misuzu/public-legacy/manage/users/user.php

227 lines
8.2 KiB
PHP
Raw Normal View History

2022-09-13 13:14:49 +00:00
<?php
namespace Misuzu;
use RuntimeException;
use Index\Colour\Colour;
2022-09-13 13:14:49 +00:00
use Misuzu\Users\User;
if(!$msz->isLoggedIn()) {
2022-09-13 13:14:49 +00:00
echo render_error(403);
return;
}
2023-07-27 23:26:05 +00:00
$users = $msz->getUsers();
$roles = $msz->getRoles();
$currentUser = $msz->getActiveUser();
2022-09-13 13:14:49 +00:00
$canManageUsers = perms_check_user(MSZ_PERMS_USER, $currentUser->getId(), MSZ_PERM_USER_MANAGE_USERS);
$canManagePerms = perms_check_user(MSZ_PERMS_USER, $currentUser->getId(), MSZ_PERM_USER_MANAGE_PERMS);
$canManageNotes = perms_check_user(MSZ_PERMS_USER, $currentUser->getId(), MSZ_PERM_USER_MANAGE_NOTES);
$canManageWarnings = perms_check_user(MSZ_PERMS_USER, $currentUser->getId(), MSZ_PERM_USER_MANAGE_WARNINGS);
$canManageBans = perms_check_user(MSZ_PERMS_USER, $currentUser->getId(), MSZ_PERM_USER_MANAGE_BANS);
$canImpersonate = perms_check_user(MSZ_PERMS_USER, $currentUser->getId(), MSZ_PERM_USER_IMPERSONATE);
$canSendTestMail = $currentUser->isSuperUser();
$hasAccess = $canManageUsers || $canManageNotes || $canManageWarnings || $canManageBans;
if(!$hasAccess) {
echo render_error(403);
return;
}
$notices = [];
$userId = (int)filter_input(INPUT_GET, 'u', FILTER_SANITIZE_NUMBER_INT);
2022-09-13 13:14:49 +00:00
try {
$userInfo = $users->getUser($userId, 'id');
} catch(RuntimeException $ex) {
2022-09-13 13:14:49 +00:00
echo render_error(404);
return;
}
$currentUserRank = $users->getUserRank($currentUser);
$userRank = $users->getUserRank($userInfo);
$canEdit = $canManageUsers && ($currentUser->isSuperUser() || (string)$currentUser->getId() === $userInfo->getId() || $currentUserRank > $userRank);
$canEditPerms = $canEdit && $canManagePerms;
$permissions = $canEditPerms ? manage_perms_list(perms_get_user_raw($userId)) : [];
2022-09-13 13:14:49 +00:00
if(CSRF::validateRequest() && $canEdit) {
2023-05-21 18:15:04 +00:00
if(!empty($_POST['impersonate_user'])) {
if(!$canImpersonate) {
2023-05-21 18:15:04 +00:00
$notices[] = 'You must be a super user to do this.';
} elseif(!is_string($_POST['impersonate_user']) || $_POST['impersonate_user'] !== 'meow') {
$notices[] = 'You didn\'t say the magic word.';
} else {
$allowToImpersonate = $currentUser->isSuperUser();
if(!$allowToImpersonate) {
$allowImpersonateUsers = $msz->getConfig()->getArray(sprintf('impersonate.allow.u%s', $currentUser->getId()));
$allowToImpersonate = in_array($userInfo->getId(), $allowImpersonateUsers, true);
}
if($allowToImpersonate) {
$msz->createAuditLog('USER_IMPERSONATE', [$userInfo->getId(), $userInfo->getName()]);
$authToken->setImpersonatedUserId($userInfo->getId());
$authToken->applyCookie();
url_redirect('index');
return;
} else $notices[] = 'You aren\'t allowed to impersonate this user.';
2023-05-21 18:15:04 +00:00
}
}
2022-09-13 13:14:49 +00:00
if(!empty($_POST['send_test_email'])) {
if(!$canSendTestMail) {
2022-09-13 13:14:49 +00:00
$notices[] = 'You must be a super user to do this.';
} elseif(!is_string($_POST['send_test_email']) || $_POST['send_test_email'] !== 'yes_send_it') {
$notices[] = 'Invalid request thing shut the fuck up.';
} else {
$testMail = Mailer::sendMessage(
[$userInfo->getEMailAddress() => $userInfo->getName()],
2022-09-13 13:14:49 +00:00
'Flashii Test E-mail',
'You were sent this e-mail to validate if you can receive e-mails from Flashii. You may discard it.'
);
if(!$testMail)
$notices[] = 'Failed to send test e-mail.';
}
}
2023-07-05 01:33:12 +00:00
if(!empty($_POST['roles']) && is_array($_POST['roles'])) {
// Read user input array and throw intval on em
$applyRoles = [];
foreach($_POST['roles'] as $item) {
if(!ctype_digit($item))
die('Invalid item encountered in roles list.');
2023-07-27 23:26:05 +00:00
$applyRoles[] = (string)$item;
2023-07-05 01:33:12 +00:00
}
2023-07-27 23:26:05 +00:00
$existingRoles = [];
foreach($roles->getRoles(userInfo: $userInfo) as $roleInfo)
$existingRoles[$roleInfo->getId()] = $roleInfo;
2022-09-13 13:14:49 +00:00
$removeRoles = [];
2023-07-27 23:26:05 +00:00
foreach($existingRoles as $roleInfo) {
if($roleInfo->isDefault() || !($currentUser->isSuperUser() || $userRank > $roleInfo->getRank()))
2022-09-13 13:14:49 +00:00
continue;
2023-07-27 23:26:05 +00:00
if(!in_array($roleInfo->getId(), $applyRoles))
$removeRoles[] = $roleInfo;
2022-09-13 13:14:49 +00:00
}
2023-07-27 23:26:05 +00:00
if(!empty($removeRoles))
$users->removeRoles($userInfo, $removeRoles);
$addRoles = [];
2022-09-13 13:14:49 +00:00
foreach($applyRoles as $roleId) {
try {
2023-07-27 23:26:05 +00:00
$roleInfo = $existingRoles[$roleId] ?? $roles->getRole($roleId);
} catch(RuntimeException $ex) {
2022-09-13 13:14:49 +00:00
continue;
}
2023-07-27 23:26:05 +00:00
if(!$currentUser->isSuperUser() && $userRank <= $roleInfo->getRank())
2022-09-13 13:14:49 +00:00
continue;
2023-07-27 23:26:05 +00:00
if(!in_array($roleInfo, $existingRoles))
$addRoles[] = $roleInfo;
}
2022-09-13 13:14:49 +00:00
2023-07-27 23:26:05 +00:00
if(!empty($addRoles))
$users->addRoles($userInfo, $addRoles);
2022-09-13 13:14:49 +00:00
}
if(!empty($_POST['user']) && is_array($_POST['user'])) {
$setCountry = (string)($_POST['user']['country'] ?? '');
$setTitle = (string)($_POST['user']['title'] ?? '');
2023-07-27 23:26:05 +00:00
$displayRole = (string)($_POST['user']['display_role'] ?? 0);
if(!$users->hasRole($userInfo, $displayRole))
$notices[] = 'User does not have the role you\'re trying to assign as primary.';
2022-09-13 13:14:49 +00:00
$countryValidation = strlen($setCountry) === 2
&& ctype_alpha($setCountry)
&& ctype_upper($setCountry);
if(!$countryValidation)
$notices[] = 'Country code was invalid.';
if(strlen($setTitle) > 64)
$notices[] = 'User title was invalid.';
2023-07-27 23:26:05 +00:00
if(empty($notices)) {
$users->updateUser(
userInfo: $userInfo,
displayRoleInfo: $displayRole,
countryCode: (string)($_POST['user']['country'] ?? 'XX'),
title: (string)($_POST['user']['title'] ?? '')
2023-07-27 23:26:05 +00:00
);
}
2022-09-13 13:14:49 +00:00
}
if(!empty($_POST['colour']) && is_array($_POST['colour'])) {
$setColour = null;
if(!empty($_POST['colour']['enable'])) {
$setColour = \Index\Colour\Colour::parse((string)($_POST['colour']['hex'] ?? ''));
if($setColour->shouldInherit())
$notices[] = 'Invalid colour specified.';
}
2022-09-13 13:14:49 +00:00
if(empty($notices))
$users->updateUser(userInfo: $userInfo, colour: $setColour);
2022-09-13 13:14:49 +00:00
}
if(!empty($_POST['password']) && is_array($_POST['password'])) {
$passwordNewValue = (string)($_POST['password']['new'] ?? '');
$passwordConfirmValue = (string)($_POST['password']['confirm'] ?? '');
if(!empty($passwordNewValue)) {
if($passwordNewValue !== $passwordConfirmValue)
$notices[] = 'Confirm password does not match.';
elseif(!empty(User::validatePassword($passwordNewValue)))
$notices[] = 'New password is too weak.';
else
$users->updateUser(userInfo: $userInfo, password: $passwordNewValue);
2022-09-13 13:14:49 +00:00
}
}
if($canEditPerms && !empty($_POST['perms']) && is_array($_POST['perms'])) {
$perms = manage_perms_apply($permissions, $_POST['perms']);
if($perms !== null) {
if(!perms_set_user_raw($userId, $perms))
$notices[] = 'Failed to update permissions.';
} else {
if(!perms_delete_user($userId))
$notices[] = 'Failed to remove permissions.';
}
// this smells, make it refresh/apply in a non-retarded way
$permissions = manage_perms_list(perms_get_user_raw($userId));
}
url_redirect('manage-user', ['user' => $userInfo->getId()]);
return;
2022-09-13 13:14:49 +00:00
}
2023-07-27 23:26:05 +00:00
$rolesAll = $roles->getRoles();
$userRoleIds = $users->hasRoles($userInfo, $rolesAll);
2022-09-13 13:14:49 +00:00
Template::render('manage.users.user', [
'user_info' => $userInfo,
'manage_notices' => $notices,
2023-07-27 23:26:05 +00:00
'manage_roles' => $rolesAll,
'manage_user_has_roles' => $userRoleIds,
2022-09-13 13:14:49 +00:00
'can_edit_user' => $canEdit,
'can_edit_perms' => $canEdit && $canEditPerms,
2023-07-25 14:40:31 +00:00
'can_manage_notes' => $canManageNotes,
'can_manage_warnings' => $canManageWarnings,
'can_manage_bans' => $canManageBans,
'can_impersonate' => $canImpersonate,
'can_send_test_mail' => $canSendTestMail,
2022-09-13 13:14:49 +00:00
'permissions' => $permissions ?? [],
]);