Fully implement the user administration backend with drag/drop to add

users to groups.

9 files changed, 128 insertions, 179 deletions

diff --git a/core/helpers/core_menu.php b/core/helpers/core_menu.php
index cbd417fa..0e4c9854 100644
--- a/core/helpers/core_menu.php
+++ b/core/helpers/core_menu.php
@@ -130,9 +130,6 @@ class core_menu_Core {
                         ->id("theme_details")
                         ->label(t("Theme Details"))
                         ->url(url::site("admin/theme_details"))))
-      ->append(Menu::factory("submenu")
-               ->id("users_groups_menu")
-               ->label(t("Users/Groups")))
       ->append(Menu::factory("link")
                ->id("maintenance")
                ->label(t("Maintenance"))
diff --git a/modules/user/controllers/admin_groups.php b/modules/user/controllers/admin_groups.php
deleted file mode 100644
index bba104f0..00000000
--- a/modules/user/controllers/admin_groups.php
+++ /dev/null
@@ -1,124 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.");
-/**
- * Gallery - a web based photo album viewer and editor
- * Copyright (C) 2000-2008 Bharat Mediratta
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or (at
- * your option) any later version.
- *
- * This program is distributed in the hope that it will be useful, but
- * WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA  02110-1301, USA.
- */
-class Admin_Groups_Controller extends Controller {
-  public function index() {
-    $view = new Admin_View("admin.html");
-    $view->content = new View("admin_groups.html");
-    $view->content->groups = ORM::factory("group")->orderby("name")->find_all();
-    print $view;
-  }
-
-  public function add() {
-    $form = group::get_add_form_admin();
-    $valid = $form->validate();
-    if ($valid) {
-      $new_name = $form->add_group->inputs["name"]->value;
-      $group = ORM::factory("group")->where("name", $new_name)->find();
-      if ($group->loaded) {
-        $form->add_group->inputs["name"]->add_error("in_use", 1);
-        $valid = false;
-      }
-    }
-
-    if ($valid) {
-      $group = group::create($new_name);
-      $group->save();
-      message::success(t("Created group %group_name", array("group_name" => $group->name)));
-      print json_encode(array("result" => "success"));
-    } else {
-      message::error(t("Failed to create group"));
-      print json_encode(array("result" => "error",
-                              "form" => $form->__toString()));
-    }
-  }
-
-  public function add_form() {
-    print group::get_add_form_admin();
-  }
-
-  public function delete($id) {
-    $group = ORM::factory("group", $id);
-    if (!$group->loaded) {
-      kohana::show_404();
-    }
-
-    $form = group::get_delete_form_admin($group);
-    if($form->validate()) {
-      $name = $group->name;
-      $group->delete();
-    } else {
-      message::error(t("Failed to delete group"));
-      print json_encode(array("result" => "error",
-                              "form" => $form->__toString()));
-    }
-
-    $message = t("Deleted group %group_name", array("group_name" => $name));
-    log::success("group", $message);
-    message::success($message);
-    print json_encode(array("result" => "success"));
-  }
-
-  public function delete_form($id) {
-    $group = ORM::factory("group", $id);
-    if (!$group->loaded) {
-      kohana::show_404();
-    }
-    print group::get_delete_form_admin($group);
-  }
-
-  public function edit($id) {
-    $group = ORM::factory("group", $id);
-    if (!$group->loaded) {
-      kohana::show_404();
-    }
-
-    $form = group::get_edit_form_admin($group);
-    $valid = $form->validate();
-
-    if ($valid) {
-      $new_name = $form->edit_group->inputs["name"]->value;
-      $group = ORM::factory("group")->where("name", $new_name)->find();
-      if ($group->loaded) {
-        $form->edit_group->inputs["name"]->add_error("in_use", 1);
-        $valid = false;
-      }
-    }
-
-    if ($valid) {
-      $group->name = $form->edit_group->inputs["name"]->value;
-      $group->save();
-      message::success(t("Changed group %group_name", array("group_name" => $group->name)));
-      print json_encode(array("result" => "success"));
-    } else {
-      message::error(t("Failed to change group %group_name", array("group_name" => $group->name)));
-      print json_encode(array("result" => "error",
-                              "form" => $form->__toString()));
-    }
-  }
-
-  public function edit_form($id) {
-    $group = ORM::factory("group", $id);
-    if (!$group->loaded) {
-      kohana::show_404();
-    }
-
-    print group::get_edit_form_admin($group);
-  }
-}
diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php
index 85d59b8d..f6136cd0 100644
--- a/modules/user/controllers/admin_users.php
+++ b/modules/user/controllers/admin_users.php
@@ -27,8 +27,8 @@ class Admin_Users_Controller extends Controller {
   }
 
   public function add_user() {
+    access::verify_csrf();
     $form = user::get_add_form_admin();
-
     $valid = $form->validate();
     $name = $form->add_user->inputs["name"]->value;
     $user = ORM::factory("user")->where("name", $name)->find();
@@ -45,7 +45,6 @@ class Admin_Users_Controller extends Controller {
       message::success(t("Created user %user_name", array("user_name" => $user->name)));
       print json_encode(array("result" => "success"));
     } else {
-      message::error(t("Failed to create user"));
       print json_encode(array("result" => "error",
                               "form" => $form->__toString()));
     }
@@ -56,6 +55,7 @@ class Admin_Users_Controller extends Controller {
   }
 
   public function delete_user($id) {
+    access::verify_csrf();
     $user = ORM::factory("user", $id);
     if (!$user->loaded) {
       kohana::show_404();
@@ -66,7 +66,6 @@ class Admin_Users_Controller extends Controller {
       $name = $user->name;
       $user->delete();
     } else {
-      message::error(t("Failed to delete user"));
       print json_encode(array("result" => "error",
                               "form" => $form->__toString()));
     }
@@ -86,6 +85,7 @@ class Admin_Users_Controller extends Controller {
   }
 
   public function edit_user($id) {
+    access::verify_csrf();
     $user = ORM::factory("user", $id);
     if (!$user->loaded) {
       kohana::show_404();
@@ -96,8 +96,11 @@ class Admin_Users_Controller extends Controller {
     $valid = $form->validate();
     if ($valid) {
       $new_name = $form->edit_user->inputs["name"]->value;
-      $user = ORM::factory("user")->where("name", $new_name)->find();
-      if ($user->loaded) {
+      if (ORM::factory("user")
+          ->where("name", $new_name)
+          ->where("id !=", $id)
+          ->find()
+          ->loaded) {
         $form->edit_user->inputs["name"]->add_error("in_use", 1);
         $valid = false;
       }
@@ -112,7 +115,6 @@ class Admin_Users_Controller extends Controller {
       message::success(t("Changed user %user_name", array("user_name" => $user->name)));
       print json_encode(array("result" => "success"));
     } else {
-      message::error(t("Failed to change user %user_name", array("user_name" => $user->name)));
       print json_encode(array("result" => "error",
                               "form" => $form->__toString()));
     }
@@ -148,4 +150,103 @@ class Admin_Users_Controller extends Controller {
     $view->group = ORM::factory("group", $group_id);
     print $view;
   }
+
+  public function add_group() {
+    access::verify_csrf();
+    $form = group::get_add_form_admin();
+    $valid = $form->validate();
+    if ($valid) {
+      $new_name = $form->add_group->inputs["name"]->value;
+      $group = ORM::factory("group")->where("name", $new_name)->find();
+      if ($group->loaded) {
+        $form->add_group->inputs["name"]->add_error("in_use", 1);
+        $valid = false;
+      }
+    }
+
+    if ($valid) {
+      $group = group::create($new_name);
+      $group->save();
+      message::success(t("Created group %group_name", array("group_name" => $group->name)));
+      print json_encode(array("result" => "success"));
+    } else {
+      print json_encode(array("result" => "error",
+                              "form" => $form->__toString()));
+    }
+  }
+
+  public function add_group_form() {
+    print group::get_add_form_admin();
+  }
+
+  public function delete_group($id) {
+    access::verify_csrf();
+    $group = ORM::factory("group", $id);
+    if (!$group->loaded) {
+      kohana::show_404();
+    }
+
+    $form = group::get_delete_form_admin($group);
+    if($form->validate()) {
+      $name = $group->name;
+      $group->delete();
+    } else {
+      print json_encode(array("result" => "error",
+                              "form" => $form->__toString()));
+    }
+
+    $message = t("Deleted group %group_name", array("group_name" => $name));
+    log::success("group", $message);
+    message::success($message);
+    print json_encode(array("result" => "success"));
+  }
+
+  public function delete_group_form($id) {
+    $group = ORM::factory("group", $id);
+    if (!$group->loaded) {
+      kohana::show_404();
+    }
+    print group::get_delete_form_admin($group);
+  }
+
+  public function edit_group($id) {
+    access::verify_csrf();
+    $group = ORM::factory("group", $id);
+    if (!$group->loaded) {
+      kohana::show_404();
+    }
+
+    $form = group::get_edit_form_admin($group);
+    $valid = $form->validate();
+
+    if ($valid) {
+      $new_name = $form->edit_group->inputs["name"]->value;
+      $group = ORM::factory("group")->where("name", $new_name)->find();
+      if ($group->loaded) {
+        $form->edit_group->inputs["name"]->add_error("in_use", 1);
+        $valid = false;
+      }
+    }
+
+    if ($valid) {
+      $group->name = $form->edit_group->inputs["name"]->value;
+      $group->save();
+      message::success(t("Changed group %group_name", array("group_name" => $group->name)));
+      print json_encode(array("result" => "success"));
+    } else {
+      message::error(t("Failed to change group %group_name", array("group_name" => $group->name)));
+      print json_encode(array("result" => "error",
+                              "form" => $form->__toString()));
+    }
+  }
+
+  public function edit_group_form($id) {
+    $group = ORM::factory("group", $id);
+    if (!$group->loaded) {
+      kohana::show_404();
+    }
+
+    print group::get_edit_form_admin($group);
+  }
+
 }
diff --git a/modules/user/helpers/group.php b/modules/user/helpers/group.php
index 45c8d1e8..56e8b52d 100644
--- a/modules/user/helpers/group.php
+++ b/modules/user/helpers/group.php
@@ -62,7 +62,7 @@ class group_Core {
   }
 
   static function get_edit_form_admin($group) {
-    $form = new Forge("admin/groups/edit/$group->id", "", "post", array("id" => "gEditGroupForm"));
+    $form = new Forge("admin/users/edit_group/$group->id", "", "post", array("id" => "gEditGroupForm"));
     $form_group = $form->group("edit_group")->label(t("Edit Group"));
     $form_group->input("name")->label(t("Name"))->id("gName")->value($group->name);
     $form_group->inputs["name"]->error_messages(
@@ -73,7 +73,7 @@ class group_Core {
   }
 
   static function get_add_form_admin() {
-    $form = new Forge("admin/groups/add", "", "post", array("id" => "gAddGroupForm"));
+    $form = new Forge("admin/users/add_group", "", "post", array("id" => "gAddGroupForm"));
     $form_group = $form->group("add_group")->label(t("Add Group"));
     $form_group->input("name")->label(t("Name"))->id("gName");
     $form_group->inputs["name"]->error_messages(
@@ -85,7 +85,7 @@ class group_Core {
   }
 
   static function get_delete_form_admin($group) {
-    $form = new Forge("admin/groups/delete/$group->id", "", "post",
+    $form = new Forge("admin/users/delete_group/$group->id", "", "post",
                       array("id" => "gDeleteGroupForm"));
     $form_group = $form->group("delete_group")->label(
       t("Are you sure you want to delete group %group_name?", array("group_name" => $group->name)));
diff --git a/modules/user/helpers/user.php b/modules/user/helpers/user.php
index b67986e3..14e3f09c 100644
--- a/modules/user/helpers/user.php
+++ b/modules/user/helpers/user.php
@@ -38,7 +38,8 @@ class user_Core {
   }
 
   static function get_edit_form_admin($user) {
-    $form = new Forge("admin/users/edit/$user->id", "", "post", array("id" => "gEditUserForm"));
+    $form = new Forge(
+      "admin/users/edit_user/$user->id", "", "post", array("id" => "gEditUserForm"));
     $group = $form->group("edit_user")->label(t("Edit User"));
     $group->input("name")->label(t("Name"))->id("gName")->value($user->name);
     $group->inputs["name"]->error_messages(
@@ -69,7 +70,7 @@ class user_Core {
   }
 
   static function get_delete_form_admin($user) {
-    $form = new Forge("admin/users/delete/$user->id", "", "post", array("id" => "gDeleteUserForm"));
+    $form = new Forge("admin/users/delete_user/$user->id", "", "post", array("id" => "gDeleteUserForm"));
     $group = $form->group("delete_user")->label(
       t("Are you sure you want to delete user %name?", array("name" => $user->name)));
     $group->submit("")->value(t("Delete user %name", array("name" => $user->name)));
diff --git a/modules/user/helpers/user_menu.php b/modules/user/helpers/user_menu.php
index 5f845804..7a0a4505 100644
--- a/modules/user/helpers/user_menu.php
+++ b/modules/user/helpers/user_menu.php
@@ -19,18 +19,10 @@
  */
 class user_menu_Core {
   static function admin($menu, $theme) {
-    $menu->get("users_groups_menu")
-      ->append(Menu::factory("link")
-               ->id("list_users")
-               ->label(t("Users"))
-               ->url(url::site("admin/users")))
-      ->append(Menu::factory("link")
-               ->id("list_groups")
-               ->label(t("Groups"))
-               ->url(url::site("admin/groups")))
-      ->append(Menu::factory("link")
-               ->id("users_groups")
-               ->label(t("Users <-> Groups"))
-               ->url("#"));
+    $menu->add_after("presentation_menu",
+                     Menu::factory("link")
+                     ->id("users_groups")
+                     ->label(t("Users/Groups"))
+                     ->url(url::site("admin/users")));
   }
 }
diff --git a/modules/user/views/admin_groups.html.php b/modules/user/views/admin_groups.html.php
deleted file mode 100644
index c1b7dbde..00000000
--- a/modules/user/views/admin_groups.html.php
+++ /dev/null
@@ -1,25 +0,0 @@
-<?php defined("SYSPATH") or die("No direct script access.") ?>
-<div class="gBlock">
-  <h2><?= t("Group Administration") ?></h2>
-  <div class="gBlockContent">
-    <p><?= t("These are the groups in your system") ?></p>
-  </div>
-  <ul>
-    <? foreach ($groups as $i => $group): ?>
-    <li class="<?= ($i % 2 == 0) ? "gEvenRow" : "gOddRow" ?>">
-      <?= $group->name ?>
-      <a href="groups/edit_form/<?= $group->id ?>" class="gDialogLink"
-        title="<?= t("Edit group") ?>"><?= t("edit") ?></a>
-      <? if (!$group->special): ?>
-        <a href="groups/delete_form/<?= $group->id ?>" class="gDialogLink"
-          title="<?= t("Do you really want to delete %group_name", array("group_name" => $group->name)) ?>">
-        <?= t("delete") ?></a>
-      <? endif ?>
-    </li>
-    <? endforeach ?>
-    <li><a href="groups/add_form" class="gDialogLink"
-      title="<?= t("Add group") ?>"><?= t("Add group") ?></a></li>
-  </ul>
-</div>
-
-
diff --git a/modules/user/views/admin_users.html.php b/modules/user/views/admin_users.html.php
index 57e0864f..72ad0fcd 100644
--- a/modules/user/views/admin_users.html.php
+++ b/modules/user/views/admin_users.html.php
@@ -73,9 +73,9 @@
           <?= ($user->last_login == 0) ? "" : date("m j, y", $user->last_login) ?>
         </span>
         <span class="gActions">
-          <a href="users/edit_form/<?= $user->id ?>" class="gPanelLink"><?= t("edit") ?></a>
+          <a href="<?= url::site("admin/users/edit_user_form/$user->id") ?>" class="gPanelLink"><?= t("edit") ?></a>
           <? if (user::active()->id != $user->id && !$user->guest): ?>
-          <a href="users/delete_form/<?= $user->id ?>" class="gDialogLink"><?= t("delete") ?></a>
+          <a href="<?= url::site("admin/users/delete_user_form/$user->id") ?>" class="gDialogLink"><?= t("delete") ?></a>
           <? else: ?>
           <span class="inactive" title="<?= t("This user cannot be deleted") ?>">
             <?= t("delete") ?>
@@ -96,7 +96,7 @@
 </div>
 
 <div id="gGroupAdmin" class="gBlock">
-  <a href="groups/add_form"
+  <a href="<?= url::site("admin/users/add_group_form") ?>"
      class="gDialogLink gButtonLink right"
      title="<?= t("Create a new group") ?>">
     + <?= t("Add a new group") ?>
diff --git a/modules/user/views/admin_users_group.html.php b/modules/user/views/admin_users_group.html.php
index 1d6c127d..66ad9a78 100644
--- a/modules/user/views/admin_users_group.html.php
+++ b/modules/user/views/admin_users_group.html.php
@@ -1,4 +1,11 @@
 <strong><?= $group->name?></strong>
+<? if (!$group->special): ?>
+<a href="<?= url::site("users/delete_group_form/$group->id") ?>" class="gDialogLink"><?= t("delete") ?></a>
+<? else: ?>
+<span class="inactive" title="<?= t("This group cannot be deleted") ?>">
+  <?= t("delete") ?>
+</span>
+<? endif ?>
 <ul>
   <? foreach ($group->users as $i => $user): ?>
   <li class="gUser">