From f67bfd099296602f60d48914ae4b09d65b0ad8d3 Mon Sep 17 00:00:00 2001 From: Tim Almdal Date: Wed, 7 Oct 2009 20:26:26 -0700 Subject: Change the users.php controller so its no longer restful. The problem with our approach to restfulness is that it assumes that the resource will be found in the gallery database. It may well be there, but in the case of using plugable drivers for users management, there are no guarantees that it is in our database or it could be in a ldap directory. So it was just easier to remove the restfulness and just call user::lookup instead. (cherry picked from commit b3211cb2a8282556d410c91771baeb764d47ed10) --- modules/user/controllers/users.php | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'modules/user/controllers/users.php') diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php index 4ad704f0..07c5a457 100644 --- a/modules/user/controllers/users.php +++ b/modules/user/controllers/users.php @@ -17,10 +17,10 @@ * along with this program; if not, write to the Free Software * Foundation, Inc., 51 Franklin Street - Fifth Floor, Boston, MA 02110-1301, USA. */ -class Users_Controller extends REST_Controller { - protected $resource_type = "user"; +class Users_Controller extends Controller { + public function update($id) { + $user = user::lookup($id); - public function _update($user) { if ($user->guest || $user->id != user::active()->id) { access::forbidden(); } @@ -57,7 +57,8 @@ class Users_Controller extends REST_Controller { } } - public function _form_edit($user) { + public function form_edit($id) { + $user = user::lookup($id); if ($user->guest || $user->id != user::active()->id) { access::forbidden(); } -- cgit v1.2.3 From 2af48060117bdf30fb48929dd8c9d22800a70843 Mon Sep 17 00:00:00 2001 From: Tim Almdal Date: Tue, 13 Oct 2009 13:19:17 -0700 Subject: Refactor the ui component of the user module into the gallery core module. --- modules/gallery/controllers/admin_users.php | 290 +++++++++++++++++++++ modules/gallery/controllers/login.php | 81 ++++++ modules/gallery/controllers/logout.php | 38 +++ modules/gallery/controllers/password.php | 133 ++++++++++ modules/gallery/controllers/users.php | 68 +++++ modules/gallery/helpers/gallery_event.php | 4 + modules/gallery/views/admin_users.html.php | 128 +++++++++ modules/gallery/views/admin_users_group.html.php | 38 +++ modules/gallery/views/login.html.php | 22 ++ modules/gallery/views/login_ajax.html.php | 43 +++ modules/gallery/views/reset_password.html.php | 17 ++ .../gallery/views/user_languages_block.html.php | 19 ++ modules/user/controllers/admin_users.php | 290 --------------------- modules/user/controllers/login.php | 81 ------ modules/user/controllers/logout.php | 38 --- modules/user/controllers/password.php | 133 ---------- modules/user/controllers/users.php | 68 ----- modules/user/helpers/user_event.php | 28 -- modules/user/views/admin_users.html.php | 128 --------- modules/user/views/admin_users_group.html.php | 38 --- modules/user/views/login.html.php | 22 -- modules/user/views/login_ajax.html.php | 43 --- modules/user/views/reset_password.html.php | 17 -- modules/user/views/user_languages_block.html.php | 19 -- 24 files changed, 881 insertions(+), 905 deletions(-) create mode 100644 modules/gallery/controllers/admin_users.php create mode 100644 modules/gallery/controllers/login.php create mode 100644 modules/gallery/controllers/logout.php create mode 100644 modules/gallery/controllers/password.php create mode 100644 modules/gallery/controllers/users.php create mode 100644 modules/gallery/views/admin_users.html.php create mode 100644 modules/gallery/views/admin_users_group.html.php create mode 100644 modules/gallery/views/login.html.php create mode 100644 modules/gallery/views/login_ajax.html.php create mode 100644 modules/gallery/views/reset_password.html.php create mode 100644 modules/gallery/views/user_languages_block.html.php delete mode 100644 modules/user/controllers/admin_users.php delete mode 100644 modules/user/controllers/login.php delete mode 100644 modules/user/controllers/logout.php delete mode 100644 modules/user/controllers/password.php delete mode 100644 modules/user/controllers/users.php delete mode 100644 modules/user/helpers/user_event.php delete mode 100644 modules/user/views/admin_users.html.php delete mode 100644 modules/user/views/admin_users_group.html.php delete mode 100644 modules/user/views/login.html.php delete mode 100644 modules/user/views/login_ajax.html.php delete mode 100644 modules/user/views/reset_password.html.php delete mode 100644 modules/user/views/user_languages_block.html.php (limited to 'modules/user/controllers/users.php') diff --git a/modules/gallery/controllers/admin_users.php b/modules/gallery/controllers/admin_users.php new file mode 100644 index 00000000..a8a8cd95 --- /dev/null +++ b/modules/gallery/controllers/admin_users.php @@ -0,0 +1,290 @@ +content = new View("admin_users.html"); + $view->content->users = user::get_user_list(array("orderby" => array("name" => "ASC"))); + $view->content->groups = group::get_group_list(array("orderby" => array("name" => "ASC"))); + print $view; + } + + public function add_user() { + access::verify_csrf(); + + $form = user::get_add_form_admin(); + $valid = $form->validate(); + $name = $form->add_user->inputs["name"]->value; + if ($user = user::lookup_by_name($name)) { + $form->add_user->inputs["name"]->add_error("in_use", 1); + $valid = false; + } + + if ($valid) { + $user = user::create( + $name, $form->add_user->full_name->value, $form->add_user->password->value); + $user->email = $form->add_user->email->value; + $user->admin = $form->add_user->admin->checked; + + if ($form->add_user->locale) { + $desired_locale = $form->add_user->locale->value; + $user->locale = $desired_locale == "none" ? null : $desired_locale; + } + $user->save(); + module::event("user_add_form_admin_completed", $user, $form); + + message::success(t("Created user %user_name", array("user_name" => $user->name))); + print json_encode(array("result" => "success")); + } else { + print json_encode(array("result" => "error", + "form" => $form->__toString())); + } + } + + public function add_user_form() { + print user::get_add_form_admin(); + } + + public function delete_user($id) { + access::verify_csrf(); + + if ($id == user::active()->id || $id == user::guest()->id) { + access::forbidden(); + } + + $user = user::lookup($id); + if (empty($user)) { + kohana::show_404(); + } + + $form = user::get_delete_form_admin($user); + if($form->validate()) { + $name = $user->name; + $user->delete(); + } else { + print json_encode(array("result" => "error", + "form" => $form->__toString())); + } + + $message = t("Deleted user %user_name", array("user_name" => $name)); + log::success("user", $message); + message::success($message); + print json_encode(array("result" => "success")); + } + + public function delete_user_form($id) { + $user = user::lookup($id); + if (empty($user)) { + kohana::show_404(); + } + print user::get_delete_form_admin($user); + } + + public function edit_user($id) { + access::verify_csrf(); + + $user = user::lookup($id); + if (empty($user)) { + kohana::show_404(); + } + + $form = user::get_edit_form_admin($user); + $valid = $form->validate(); + if ($valid) { + $new_name = $form->edit_user->inputs["name"]->value; + $temp_user = user::lookup_by_name($new_name); + if ($new_name != $user->name && + ($temp_user && $temp_user->id != $user->id)) { + $form->edit_user->inputs["name"]->add_error("in_use", 1); + $valid = false; + } else { + $user->name = $new_name; + } + } + + if ($valid) { + $user->full_name = $form->edit_user->full_name->value; + if ($form->edit_user->password->value) { + $user->password = $form->edit_user->password->value; + } + $user->email = $form->edit_user->email->value; + $user->url = $form->edit_user->url->value; + if ($form->edit_user->locale) { + $desired_locale = $form->edit_user->locale->value; + $user->locale = $desired_locale == "none" ? null : $desired_locale; + } + + // An admin can change the admin status for any user but themselves + if ($user->id != user::active()->id) { + $user->admin = $form->edit_user->admin->checked; + } + $user->save(); + module::event("user_edit_form_admin_completed", $user, $form); + + message::success(t("Changed user %user_name", array("user_name" => $user->name))); + print json_encode(array("result" => "success")); + } else { + print json_encode(array("result" => "error", + "form" => $form->__toString())); + } + } + + public function edit_user_form($id) { + $user = user::lookup($id); + if (empty($user)) { + kohana::show_404(); + } + + $form = user::get_edit_form_admin($user); + // Don't allow the user to control their own admin bit, else you can lock yourself out + if ($user->id == user::active()->id) { + $form->edit_user->admin->disabled(1); + } + print $form; + } + + public function add_user_to_group($user_id, $group_id) { + access::verify_csrf(); + $group = group::lookup($group_id); + $user = user::lookup($user_id); + $group->add($user); + $group->save(); + } + + public function remove_user_from_group($user_id, $group_id) { + access::verify_csrf(); + $group = group::lookup($group_id); + $user = user::lookup($user_id); + $group->remove($user); + $group->save(); + } + + public function group($group_id) { + $view = new View("admin_users_group.html"); + $view->group = group::lookup($group_id); + print $view; + } + + public function add_group() { + access::verify_csrf(); + + $form = group::get_add_form_admin(); + $valid = $form->validate(); + if ($valid) { + $new_name = $form->add_group->inputs["name"]->value; + $group = group::lookup_by_name($new_name); + if (!empty($group)) { + $form->add_group->inputs["name"]->add_error("in_use", 1); + $valid = false; + } + } + + if ($valid) { + $group = group::create($new_name); + $group->save(); + message::success( + t("Created group %group_name", array("group_name" => $group->name))); + print json_encode(array("result" => "success")); + } else { + print json_encode(array("result" => "error", + "form" => $form->__toString())); + } + } + + public function add_group_form() { + print group::get_add_form_admin(); + } + + public function delete_group($id) { + access::verify_csrf(); + + $group = group::lookup($id); + if (empty($group)) { + kohana::show_404(); + } + + $form = group::get_delete_form_admin($group); + if ($form->validate()) { + $name = $group->name; + $group->delete(); + } else { + print json_encode(array("result" => "error", + "form" => $form->__toString())); + } + + $message = t("Deleted group %group_name", array("group_name" => $name)); + log::success("group", $message); + message::success($message); + print json_encode(array("result" => "success")); + } + + public function delete_group_form($id) { + $group = group::lookup($id); + if (empty($group)) { + kohana::show_404(); + } + + print group::get_delete_form_admin($group); + } + + public function edit_group($id) { + access::verify_csrf(); + + $group = group::lookup($id); + if (empty($group)) { + kohana::show_404(); + } + + $form = group::get_edit_form_admin($group); + $valid = $form->validate(); + + if ($valid) { + $new_name = $form->edit_group->inputs["name"]->value; + $group = group::lookup_by_name($name); + if ($group->loaded) { + $form->edit_group->inputs["name"]->add_error("in_use", 1); + $valid = false; + } + } + + if ($valid) { + $group->name = $form->edit_group->inputs["name"]->value; + $group->save(); + message::success( + t("Changed group %group_name", array("group_name" => $group->name))); + print json_encode(array("result" => "success")); + } else { + message::error( + t("Failed to change group %group_name", array("group_name" => $group->name))); + print json_encode(array("result" => "error", + "form" => $form->__toString())); + } + } + + public function edit_group_form($id) { + $group = group::lookup($id); + if (empty($group)) { + kohana::show_404(); + } + + print group::get_edit_form_admin($group); + } + +} diff --git a/modules/gallery/controllers/login.php b/modules/gallery/controllers/login.php new file mode 100644 index 00000000..2c4bd557 --- /dev/null +++ b/modules/gallery/controllers/login.php @@ -0,0 +1,81 @@ +form = user::get_login_form("login/auth_ajax"); + print $view; + } + + public function auth_ajax() { + access::verify_csrf(); + + list ($valid, $form) = $this->_auth("login/auth_ajax"); + if ($valid) { + print json_encode( + array("result" => "success")); + } else { + print json_encode( + array("result" => "error", + "form" => $form->__toString())); + } + } + + public function html() { + print user::get_login_form("login/auth_html"); + } + + public function auth_html() { + access::verify_csrf(); + + list ($valid, $form) = $this->_auth("login/auth_html"); + if ($valid) { + url::redirect(item::root()->abs_url()); + } else { + print $form; + } + } + private function _auth($url) { + $form = user::get_login_form($url); + $valid = $form->validate(); + if ($valid) { + $user = user::lookup_by_name($form->login->inputs["name"]->value); + if (empty($user) || !user::is_correct_password($user, $form->login->password->value)) { + log::warning( + "user", + t("Failed login for %name", + array("name" => $form->login->inputs["name"]->value))); + $form->login->inputs["name"]->add_error("invalid_login", 1); + $valid = false; + } + } + + if ($valid) { + user::login($user); + log::info("user", t("User %name logged in", array("name" => $user->name))); + } + + // Either way, regenerate the session id to avoid session trapping + Session::instance()->regenerate(); + + return array($valid, $form); + } +} \ No newline at end of file diff --git a/modules/gallery/controllers/logout.php b/modules/gallery/controllers/logout.php new file mode 100644 index 00000000..45d397ad --- /dev/null +++ b/modules/gallery/controllers/logout.php @@ -0,0 +1,38 @@ + $user->name)), + html::anchor("user/$user->id", html::clean($user->name))); + if ($continue_url = $this->input->get("continue")) { + $item = url::get_item_from_uri($continue_url); + if (access::can("view", $item)) { + // Don't use url::redirect() because it'll call url::site() and munge the continue url. + header("Location: $continue_url"); + } else { + url::redirect(item::root()->abs_url()); + } + } + } +} \ No newline at end of file diff --git a/modules/gallery/controllers/password.php b/modules/gallery/controllers/password.php new file mode 100644 index 00000000..e8b08960 --- /dev/null +++ b/modules/gallery/controllers/password.php @@ -0,0 +1,133 @@ +_send_reset(); + } else { + print $this->_reset_form(); + } + } + + public function do_reset() { + if (request::method() == "post") { + $this->_change_password(); + } else { + $user = user::lookup_by_hash(Input::instance()->get("key")); + if (!empty($user)) { + print $this->_new_password_form($user->hash); + } else { + throw new Exception("@todo FORBIDDEN", 503); + } + } + } + + private function _send_reset() { + $form = $this->_reset_form(); + + $valid = $form->validate(); + if ($valid) { + $user = user::lockup_by_name($form->reset->inputs["name"]->value); + if (!$user->loaded || empty($user->email)) { + $form->reset->inputs["name"]->add_error("no_email", 1); + $valid = false; + } + } + + if ($valid) { + $user->hash = md5(rand()); + $user->save(); + $message = new View("reset_password.html"); + $message->confirm_url = url::abs_site("password/do_reset?key=$user->hash"); + $message->user = $user; + + Sendmail::factory() + ->to($user->email) + ->subject(t("Password Reset Request")) + ->header("Mime-Version", "1.0") + ->header("Content-type", "text/html; charset=iso-8859-1") + ->message($message->render()) + ->send(); + + log::success( + "user", + t("Password reset email sent for user %name", array("name" => $user->name))); + } else { + // Don't include the username here until you're sure that it's XSS safe + log::warning( + "user", "Password reset email requested for bogus user"); + } + + message::success(t("Password reset email sent")); + print json_encode( + array("result" => "success")); + } + + private function _reset_form() { + $form = new Forge(url::current(true), "", "post", array("id" => "g-reset-form")); + $group = $form->group("reset")->label(t("Reset Password")); + $group->input("name")->label(t("Username"))->id("g-name")->class(null)->rules("required"); + $group->inputs["name"]->error_messages("no_email", t("No email, unable to reset password")); + $group->submit("")->value(t("Reset")); + + return $form; + } + + private function _new_password_form($hash=null) { + $template = new Theme_View("page.html", "reset"); + + $form = new Forge("password/do_reset", "", "post", array("id" => "g-change-password-form")); + $group = $form->group("reset")->label(t("Change Password")); + $hidden = $group->hidden("hash"); + if (!empty($hash)) { + $hidden->value($hash); + } + $group->password("password")->label(t("Password"))->id("g-password") + ->rules("required|length[1,40]"); + $group->password("password2")->label(t("Confirm Password"))->id("g-password2") + ->matches($group->password); + $group->inputs["password2"]->error_messages( + "mistyped", t("The password and the confirm password must match")); + $group->submit("")->value(t("Update")); + + $template->content = $form; + return $template; + } + + private function _change_password() { + $view = $this->_new_password_form(); + if ($view->content->validate()) { + $user = user::lookup_by_hash(Input::instance()->get("key")); + if (empty($user)) { + throw new Exception("@todo FORBIDDEN", 503); + } + + $user->password = $view->content->reset->password->value; + $user->hash = null; + $user->save(); + message::success(t("Password reset successfully")); + url::redirect(item::root()->abs_url()); + } else { + print $view; + } + } +} \ No newline at end of file diff --git a/modules/gallery/controllers/users.php b/modules/gallery/controllers/users.php new file mode 100644 index 00000000..07c5a457 --- /dev/null +++ b/modules/gallery/controllers/users.php @@ -0,0 +1,68 @@ +guest || $user->id != user::active()->id) { + access::forbidden(); + } + + $form = user::get_edit_form($user); + $valid = $form->validate(); + if ($valid) { + $user->full_name = $form->edit_user->full_name->value; + if ($form->edit_user->password->value) { + $user->password = $form->edit_user->password->value; + } + $user->email = $form->edit_user->email->value; + $user->url = $form->edit_user->url->value; + if ($form->edit_user->locale) { + $desired_locale = $form->edit_user->locale->value; + $new_locale = $desired_locale == "none" ? null : $desired_locale; + if ($new_locale != $user->locale) { + // Delete the session based locale preference + setcookie("g_locale", "", time() - 24 * 3600, "/"); + } + $user->locale = $new_locale; + } + $user->save(); + module::event("user_edit_form_completed", $user, $form); + + message::success(t("User information updated.")); + print json_encode( + array("result" => "success", + "resource" => url::site("users/{$user->id}"))); + } else { + print json_encode( + array("result" => "error", + "form" => $form->__toString())); + } + } + + public function form_edit($id) { + $user = user::lookup($id); + if ($user->guest || $user->id != user::active()->id) { + access::forbidden(); + } + + print user::get_edit_form($user); + } +} diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php index 106aa202..e0de2152 100644 --- a/modules/gallery/helpers/gallery_event.php +++ b/modules/gallery/helpers/gallery_event.php @@ -187,6 +187,10 @@ class gallery_event_Core { ->id("sidebar") ->label(t("Manage Sidebar")) ->url(url::site("admin/sidebar")))) + ->append(Menu::factory("link") + ->id("users_groups") + ->label(t("Users/Groups")) + ->url(url::site("admin/users"))) ->append(Menu::factory("submenu") ->id("statistics_menu") ->label(t("Statistics"))) diff --git a/modules/gallery/views/admin_users.html.php b/modules/gallery/views/admin_users.html.php new file mode 100644 index 00000000..a127bc15 --- /dev/null +++ b/modules/gallery/views/admin_users.html.php @@ -0,0 +1,128 @@ + + +
+ " + class="g-dialog-link g-button g-right ui-icon-left ui-state-default ui-corner-all" + title="for_html_attr() ?>"> + + + + +

+ +

+ +
+ + + + + + + + + + $user): ?> + user admin ? "admin" : "" ?>"> + + + + + + + +
+ " + title="for_html_attr() ?>" + alt="name) ?>" + width="20" + height="20" /> + name) ?> + + full_name) ?> + + email) ?> + + last_login == 0) ? "" : gallery::date($user->last_login) ?> + + id") ?>" + open_text="" + class="g-panel-link g-button ui-state-default ui-corner-all ui-icon-left"> + + id != $user->id && !$user->guest): ?> + id") ?>" + class="g-dialog-link g-button ui-state-default ui-corner-all ui-icon-left"> + + + for_html_attr() ?>" + class="g-button ui-state-disabled ui-corner-all ui-icon-left"> + + +
+
+
+ + diff --git a/modules/gallery/views/admin_users_group.html.php b/modules/gallery/views/admin_users_group.html.php new file mode 100644 index 00000000..db3645a0 --- /dev/null +++ b/modules/gallery/views/admin_users_group.html.php @@ -0,0 +1,38 @@ + +

+ name) ?> + special): ?> + id") ?>" + title=" $group->name))->for_html_attr() ?>" + class="g-dialog-link g-button ui-state-default ui-corner-all"> + + + for_html_attr() ?>" + class="g-dialog-link g-button ui-state-disabled ui-corner-all ui-icon-left"> + + +

+ +users->count() > 0): ?> + + +
+

+ +

+
+ diff --git a/modules/gallery/views/login.html.php b/modules/gallery/views/login.html.php new file mode 100644 index 00000000..049ba043 --- /dev/null +++ b/modules/gallery/views/login.html.php @@ -0,0 +1,22 @@ + + diff --git a/modules/gallery/views/login_ajax.html.php b/modules/gallery/views/login_ajax.html.php new file mode 100644 index 00000000..d3364b46 --- /dev/null +++ b/modules/gallery/views/login_ajax.html.php @@ -0,0 +1,43 @@ + + +
+
    +
  • + +
    • +
  • + +
    • +
+
diff --git a/modules/gallery/views/reset_password.html.php b/modules/gallery/views/reset_password.html.php new file mode 100644 index 00000000..92ca4917 --- /dev/null +++ b/modules/gallery/views/reset_password.html.php @@ -0,0 +1,17 @@ + + + + <?= t("Password Reset Request") ?> + + +

+

+ $user->full_name ? $user->full_name : $user->name)) ?> +

+

+ %site_url. If you made this request, you can confirm it by clicking this link. If you didn't request this password reset, it's ok to ignore this mail.", + array("site_url" => html::mark_clean(url::base(false, "http")), + "confirm_url" => $confirm_url)) ?> +

+ + diff --git a/modules/gallery/views/user_languages_block.html.php b/modules/gallery/views/user_languages_block.html.php new file mode 100644 index 00000000..89185967 --- /dev/null +++ b/modules/gallery/views/user_languages_block.html.php @@ -0,0 +1,19 @@ + + + + diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php deleted file mode 100644 index a8a8cd95..00000000 --- a/modules/user/controllers/admin_users.php +++ /dev/null @@ -1,290 +0,0 @@ -content = new View("admin_users.html"); - $view->content->users = user::get_user_list(array("orderby" => array("name" => "ASC"))); - $view->content->groups = group::get_group_list(array("orderby" => array("name" => "ASC"))); - print $view; - } - - public function add_user() { - access::verify_csrf(); - - $form = user::get_add_form_admin(); - $valid = $form->validate(); - $name = $form->add_user->inputs["name"]->value; - if ($user = user::lookup_by_name($name)) { - $form->add_user->inputs["name"]->add_error("in_use", 1); - $valid = false; - } - - if ($valid) { - $user = user::create( - $name, $form->add_user->full_name->value, $form->add_user->password->value); - $user->email = $form->add_user->email->value; - $user->admin = $form->add_user->admin->checked; - - if ($form->add_user->locale) { - $desired_locale = $form->add_user->locale->value; - $user->locale = $desired_locale == "none" ? null : $desired_locale; - } - $user->save(); - module::event("user_add_form_admin_completed", $user, $form); - - message::success(t("Created user %user_name", array("user_name" => $user->name))); - print json_encode(array("result" => "success")); - } else { - print json_encode(array("result" => "error", - "form" => $form->__toString())); - } - } - - public function add_user_form() { - print user::get_add_form_admin(); - } - - public function delete_user($id) { - access::verify_csrf(); - - if ($id == user::active()->id || $id == user::guest()->id) { - access::forbidden(); - } - - $user = user::lookup($id); - if (empty($user)) { - kohana::show_404(); - } - - $form = user::get_delete_form_admin($user); - if($form->validate()) { - $name = $user->name; - $user->delete(); - } else { - print json_encode(array("result" => "error", - "form" => $form->__toString())); - } - - $message = t("Deleted user %user_name", array("user_name" => $name)); - log::success("user", $message); - message::success($message); - print json_encode(array("result" => "success")); - } - - public function delete_user_form($id) { - $user = user::lookup($id); - if (empty($user)) { - kohana::show_404(); - } - print user::get_delete_form_admin($user); - } - - public function edit_user($id) { - access::verify_csrf(); - - $user = user::lookup($id); - if (empty($user)) { - kohana::show_404(); - } - - $form = user::get_edit_form_admin($user); - $valid = $form->validate(); - if ($valid) { - $new_name = $form->edit_user->inputs["name"]->value; - $temp_user = user::lookup_by_name($new_name); - if ($new_name != $user->name && - ($temp_user && $temp_user->id != $user->id)) { - $form->edit_user->inputs["name"]->add_error("in_use", 1); - $valid = false; - } else { - $user->name = $new_name; - } - } - - if ($valid) { - $user->full_name = $form->edit_user->full_name->value; - if ($form->edit_user->password->value) { - $user->password = $form->edit_user->password->value; - } - $user->email = $form->edit_user->email->value; - $user->url = $form->edit_user->url->value; - if ($form->edit_user->locale) { - $desired_locale = $form->edit_user->locale->value; - $user->locale = $desired_locale == "none" ? null : $desired_locale; - } - - // An admin can change the admin status for any user but themselves - if ($user->id != user::active()->id) { - $user->admin = $form->edit_user->admin->checked; - } - $user->save(); - module::event("user_edit_form_admin_completed", $user, $form); - - message::success(t("Changed user %user_name", array("user_name" => $user->name))); - print json_encode(array("result" => "success")); - } else { - print json_encode(array("result" => "error", - "form" => $form->__toString())); - } - } - - public function edit_user_form($id) { - $user = user::lookup($id); - if (empty($user)) { - kohana::show_404(); - } - - $form = user::get_edit_form_admin($user); - // Don't allow the user to control their own admin bit, else you can lock yourself out - if ($user->id == user::active()->id) { - $form->edit_user->admin->disabled(1); - } - print $form; - } - - public function add_user_to_group($user_id, $group_id) { - access::verify_csrf(); - $group = group::lookup($group_id); - $user = user::lookup($user_id); - $group->add($user); - $group->save(); - } - - public function remove_user_from_group($user_id, $group_id) { - access::verify_csrf(); - $group = group::lookup($group_id); - $user = user::lookup($user_id); - $group->remove($user); - $group->save(); - } - - public function group($group_id) { - $view = new View("admin_users_group.html"); - $view->group = group::lookup($group_id); - print $view; - } - - public function add_group() { - access::verify_csrf(); - - $form = group::get_add_form_admin(); - $valid = $form->validate(); - if ($valid) { - $new_name = $form->add_group->inputs["name"]->value; - $group = group::lookup_by_name($new_name); - if (!empty($group)) { - $form->add_group->inputs["name"]->add_error("in_use", 1); - $valid = false; - } - } - - if ($valid) { - $group = group::create($new_name); - $group->save(); - message::success( - t("Created group %group_name", array("group_name" => $group->name))); - print json_encode(array("result" => "success")); - } else { - print json_encode(array("result" => "error", - "form" => $form->__toString())); - } - } - - public function add_group_form() { - print group::get_add_form_admin(); - } - - public function delete_group($id) { - access::verify_csrf(); - - $group = group::lookup($id); - if (empty($group)) { - kohana::show_404(); - } - - $form = group::get_delete_form_admin($group); - if ($form->validate()) { - $name = $group->name; - $group->delete(); - } else { - print json_encode(array("result" => "error", - "form" => $form->__toString())); - } - - $message = t("Deleted group %group_name", array("group_name" => $name)); - log::success("group", $message); - message::success($message); - print json_encode(array("result" => "success")); - } - - public function delete_group_form($id) { - $group = group::lookup($id); - if (empty($group)) { - kohana::show_404(); - } - - print group::get_delete_form_admin($group); - } - - public function edit_group($id) { - access::verify_csrf(); - - $group = group::lookup($id); - if (empty($group)) { - kohana::show_404(); - } - - $form = group::get_edit_form_admin($group); - $valid = $form->validate(); - - if ($valid) { - $new_name = $form->edit_group->inputs["name"]->value; - $group = group::lookup_by_name($name); - if ($group->loaded) { - $form->edit_group->inputs["name"]->add_error("in_use", 1); - $valid = false; - } - } - - if ($valid) { - $group->name = $form->edit_group->inputs["name"]->value; - $group->save(); - message::success( - t("Changed group %group_name", array("group_name" => $group->name))); - print json_encode(array("result" => "success")); - } else { - message::error( - t("Failed to change group %group_name", array("group_name" => $group->name))); - print json_encode(array("result" => "error", - "form" => $form->__toString())); - } - } - - public function edit_group_form($id) { - $group = group::lookup($id); - if (empty($group)) { - kohana::show_404(); - } - - print group::get_edit_form_admin($group); - } - -} diff --git a/modules/user/controllers/login.php b/modules/user/controllers/login.php deleted file mode 100644 index 2c4bd557..00000000 --- a/modules/user/controllers/login.php +++ /dev/null @@ -1,81 +0,0 @@ -form = user::get_login_form("login/auth_ajax"); - print $view; - } - - public function auth_ajax() { - access::verify_csrf(); - - list ($valid, $form) = $this->_auth("login/auth_ajax"); - if ($valid) { - print json_encode( - array("result" => "success")); - } else { - print json_encode( - array("result" => "error", - "form" => $form->__toString())); - } - } - - public function html() { - print user::get_login_form("login/auth_html"); - } - - public function auth_html() { - access::verify_csrf(); - - list ($valid, $form) = $this->_auth("login/auth_html"); - if ($valid) { - url::redirect(item::root()->abs_url()); - } else { - print $form; - } - } - private function _auth($url) { - $form = user::get_login_form($url); - $valid = $form->validate(); - if ($valid) { - $user = user::lookup_by_name($form->login->inputs["name"]->value); - if (empty($user) || !user::is_correct_password($user, $form->login->password->value)) { - log::warning( - "user", - t("Failed login for %name", - array("name" => $form->login->inputs["name"]->value))); - $form->login->inputs["name"]->add_error("invalid_login", 1); - $valid = false; - } - } - - if ($valid) { - user::login($user); - log::info("user", t("User %name logged in", array("name" => $user->name))); - } - - // Either way, regenerate the session id to avoid session trapping - Session::instance()->regenerate(); - - return array($valid, $form); - } -} \ No newline at end of file diff --git a/modules/user/controllers/logout.php b/modules/user/controllers/logout.php deleted file mode 100644 index 45d397ad..00000000 --- a/modules/user/controllers/logout.php +++ /dev/null @@ -1,38 +0,0 @@ - $user->name)), - html::anchor("user/$user->id", html::clean($user->name))); - if ($continue_url = $this->input->get("continue")) { - $item = url::get_item_from_uri($continue_url); - if (access::can("view", $item)) { - // Don't use url::redirect() because it'll call url::site() and munge the continue url. - header("Location: $continue_url"); - } else { - url::redirect(item::root()->abs_url()); - } - } - } -} \ No newline at end of file diff --git a/modules/user/controllers/password.php b/modules/user/controllers/password.php deleted file mode 100644 index e8b08960..00000000 --- a/modules/user/controllers/password.php +++ /dev/null @@ -1,133 +0,0 @@ -_send_reset(); - } else { - print $this->_reset_form(); - } - } - - public function do_reset() { - if (request::method() == "post") { - $this->_change_password(); - } else { - $user = user::lookup_by_hash(Input::instance()->get("key")); - if (!empty($user)) { - print $this->_new_password_form($user->hash); - } else { - throw new Exception("@todo FORBIDDEN", 503); - } - } - } - - private function _send_reset() { - $form = $this->_reset_form(); - - $valid = $form->validate(); - if ($valid) { - $user = user::lockup_by_name($form->reset->inputs["name"]->value); - if (!$user->loaded || empty($user->email)) { - $form->reset->inputs["name"]->add_error("no_email", 1); - $valid = false; - } - } - - if ($valid) { - $user->hash = md5(rand()); - $user->save(); - $message = new View("reset_password.html"); - $message->confirm_url = url::abs_site("password/do_reset?key=$user->hash"); - $message->user = $user; - - Sendmail::factory() - ->to($user->email) - ->subject(t("Password Reset Request")) - ->header("Mime-Version", "1.0") - ->header("Content-type", "text/html; charset=iso-8859-1") - ->message($message->render()) - ->send(); - - log::success( - "user", - t("Password reset email sent for user %name", array("name" => $user->name))); - } else { - // Don't include the username here until you're sure that it's XSS safe - log::warning( - "user", "Password reset email requested for bogus user"); - } - - message::success(t("Password reset email sent")); - print json_encode( - array("result" => "success")); - } - - private function _reset_form() { - $form = new Forge(url::current(true), "", "post", array("id" => "g-reset-form")); - $group = $form->group("reset")->label(t("Reset Password")); - $group->input("name")->label(t("Username"))->id("g-name")->class(null)->rules("required"); - $group->inputs["name"]->error_messages("no_email", t("No email, unable to reset password")); - $group->submit("")->value(t("Reset")); - - return $form; - } - - private function _new_password_form($hash=null) { - $template = new Theme_View("page.html", "reset"); - - $form = new Forge("password/do_reset", "", "post", array("id" => "g-change-password-form")); - $group = $form->group("reset")->label(t("Change Password")); - $hidden = $group->hidden("hash"); - if (!empty($hash)) { - $hidden->value($hash); - } - $group->password("password")->label(t("Password"))->id("g-password") - ->rules("required|length[1,40]"); - $group->password("password2")->label(t("Confirm Password"))->id("g-password2") - ->matches($group->password); - $group->inputs["password2"]->error_messages( - "mistyped", t("The password and the confirm password must match")); - $group->submit("")->value(t("Update")); - - $template->content = $form; - return $template; - } - - private function _change_password() { - $view = $this->_new_password_form(); - if ($view->content->validate()) { - $user = user::lookup_by_hash(Input::instance()->get("key")); - if (empty($user)) { - throw new Exception("@todo FORBIDDEN", 503); - } - - $user->password = $view->content->reset->password->value; - $user->hash = null; - $user->save(); - message::success(t("Password reset successfully")); - url::redirect(item::root()->abs_url()); - } else { - print $view; - } - } -} \ No newline at end of file diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php deleted file mode 100644 index 07c5a457..00000000 --- a/modules/user/controllers/users.php +++ /dev/null @@ -1,68 +0,0 @@ -guest || $user->id != user::active()->id) { - access::forbidden(); - } - - $form = user::get_edit_form($user); - $valid = $form->validate(); - if ($valid) { - $user->full_name = $form->edit_user->full_name->value; - if ($form->edit_user->password->value) { - $user->password = $form->edit_user->password->value; - } - $user->email = $form->edit_user->email->value; - $user->url = $form->edit_user->url->value; - if ($form->edit_user->locale) { - $desired_locale = $form->edit_user->locale->value; - $new_locale = $desired_locale == "none" ? null : $desired_locale; - if ($new_locale != $user->locale) { - // Delete the session based locale preference - setcookie("g_locale", "", time() - 24 * 3600, "/"); - } - $user->locale = $new_locale; - } - $user->save(); - module::event("user_edit_form_completed", $user, $form); - - message::success(t("User information updated.")); - print json_encode( - array("result" => "success", - "resource" => url::site("users/{$user->id}"))); - } else { - print json_encode( - array("result" => "error", - "form" => $form->__toString())); - } - } - - public function form_edit($id) { - $user = user::lookup($id); - if ($user->guest || $user->id != user::active()->id) { - access::forbidden(); - } - - print user::get_edit_form($user); - } -} diff --git a/modules/user/helpers/user_event.php b/modules/user/helpers/user_event.php deleted file mode 100644 index 93a92589..00000000 --- a/modules/user/helpers/user_event.php +++ /dev/null @@ -1,28 +0,0 @@ -add_after("appearance_menu", - Menu::factory("link") - ->id("users_groups") - ->label(t("Users/Groups")) - ->url(url::site("admin/users"))); - } -} diff --git a/modules/user/views/admin_users.html.php b/modules/user/views/admin_users.html.php deleted file mode 100644 index a127bc15..00000000 --- a/modules/user/views/admin_users.html.php +++ /dev/null @@ -1,128 +0,0 @@ - - -
- " - class="g-dialog-link g-button g-right ui-icon-left ui-state-default ui-corner-all" - title="for_html_attr() ?>"> - - - - -

- -

- -
- - - - - - - - - - $user): ?> - user admin ? "admin" : "" ?>"> - - - - - - - -
- " - title="for_html_attr() ?>" - alt="name) ?>" - width="20" - height="20" /> - name) ?> - - full_name) ?> - - email) ?> - - last_login == 0) ? "" : gallery::date($user->last_login) ?> - - id") ?>" - open_text="" - class="g-panel-link g-button ui-state-default ui-corner-all ui-icon-left"> - - id != $user->id && !$user->guest): ?> - id") ?>" - class="g-dialog-link g-button ui-state-default ui-corner-all ui-icon-left"> - - - for_html_attr() ?>" - class="g-button ui-state-disabled ui-corner-all ui-icon-left"> - - -
-
-
- - diff --git a/modules/user/views/admin_users_group.html.php b/modules/user/views/admin_users_group.html.php deleted file mode 100644 index db3645a0..00000000 --- a/modules/user/views/admin_users_group.html.php +++ /dev/null @@ -1,38 +0,0 @@ - -

- name) ?> - special): ?> - id") ?>" - title=" $group->name))->for_html_attr() ?>" - class="g-dialog-link g-button ui-state-default ui-corner-all"> - - - for_html_attr() ?>" - class="g-dialog-link g-button ui-state-disabled ui-corner-all ui-icon-left"> - - -

- -users->count() > 0): ?> - - -
-

- -

-
- diff --git a/modules/user/views/login.html.php b/modules/user/views/login.html.php deleted file mode 100644 index 049ba043..00000000 --- a/modules/user/views/login.html.php +++ /dev/null @@ -1,22 +0,0 @@ - - diff --git a/modules/user/views/login_ajax.html.php b/modules/user/views/login_ajax.html.php deleted file mode 100644 index d3364b46..00000000 --- a/modules/user/views/login_ajax.html.php +++ /dev/null @@ -1,43 +0,0 @@ - - -
-
    -
  • - -
    • -
  • - -
    • -
-
diff --git a/modules/user/views/reset_password.html.php b/modules/user/views/reset_password.html.php deleted file mode 100644 index 92ca4917..00000000 --- a/modules/user/views/reset_password.html.php +++ /dev/null @@ -1,17 +0,0 @@ - - - - <?= t("Password Reset Request") ?> - - -

-

- $user->full_name ? $user->full_name : $user->name)) ?> -

-

- %site_url. If you made this request, you can confirm it by clicking this link. If you didn't request this password reset, it's ok to ignore this mail.", - array("site_url" => html::mark_clean(url::base(false, "http")), - "confirm_url" => $confirm_url)) ?> -

- - diff --git a/modules/user/views/user_languages_block.html.php b/modules/user/views/user_languages_block.html.php deleted file mode 100644 index 89185967..00000000 --- a/modules/user/views/user_languages_block.html.php +++ /dev/null @@ -1,19 +0,0 @@ - - - - -- cgit v1.2.3 From f5dd8d487eefe9aa0b4e1f38db79d3ee952b783a Mon Sep 17 00:00:00 2001 From: Tim Almdal Date: Thu, 15 Oct 2009 08:56:31 -0700 Subject: Move all the edit/update forms for users and groups back to the user module. --- modules/gallery/controllers/users.php | 68 ---------------- modules/gallery/helpers/group.php | 33 -------- modules/gallery/helpers/user.php | 88 --------------------- modules/user/controllers/admin_users.php | 128 ++++++++++++++++++++++++++++--- modules/user/controllers/users.php | 103 +++++++++++++++++++++++++ 5 files changed, 219 insertions(+), 201 deletions(-) delete mode 100644 modules/gallery/controllers/users.php create mode 100644 modules/user/controllers/users.php (limited to 'modules/user/controllers/users.php') diff --git a/modules/gallery/controllers/users.php b/modules/gallery/controllers/users.php deleted file mode 100644 index 07c5a457..00000000 --- a/modules/gallery/controllers/users.php +++ /dev/null @@ -1,68 +0,0 @@ -guest || $user->id != user::active()->id) { - access::forbidden(); - } - - $form = user::get_edit_form($user); - $valid = $form->validate(); - if ($valid) { - $user->full_name = $form->edit_user->full_name->value; - if ($form->edit_user->password->value) { - $user->password = $form->edit_user->password->value; - } - $user->email = $form->edit_user->email->value; - $user->url = $form->edit_user->url->value; - if ($form->edit_user->locale) { - $desired_locale = $form->edit_user->locale->value; - $new_locale = $desired_locale == "none" ? null : $desired_locale; - if ($new_locale != $user->locale) { - // Delete the session based locale preference - setcookie("g_locale", "", time() - 24 * 3600, "/"); - } - $user->locale = $new_locale; - } - $user->save(); - module::event("user_edit_form_completed", $user, $form); - - message::success(t("User information updated.")); - print json_encode( - array("result" => "success", - "resource" => url::site("users/{$user->id}"))); - } else { - print json_encode( - array("result" => "error", - "form" => $form->__toString())); - } - } - - public function form_edit($id) { - $user = user::lookup($id); - if ($user->guest || $user->id != user::active()->id) { - access::forbidden(); - } - - print user::get_edit_form($user); - } -} diff --git a/modules/gallery/helpers/group.php b/modules/gallery/helpers/group.php index dbfa03fe..1702fb87 100644 --- a/modules/gallery/helpers/group.php +++ b/modules/gallery/helpers/group.php @@ -117,37 +117,4 @@ class group_Core { } return $group->find_all(); } - - static function get_edit_form_admin($group) { - $form = new Forge("admin/users/edit_group/$group->id", "", "post", array("id" => "g-edit-group-form")); - $form_group = $form->group("edit_group")->label(t("Edit Group")); - $form_group->input("name")->label(t("Name"))->id("g-name")->value($group->name); - $form_group->inputs["name"]->error_messages( - "in_use", t("There is already a group with that name")); - $form_group->submit("")->value(t("Save")); - $form->add_rules_from($group); - return $form; - } - - static function get_add_form_admin() { - $form = new Forge("admin/users/add_group", "", "post", array("id" => "g-add-group-form")); - $form->set_attr('class', "g-narrow"); - $form_group = $form->group("add_group")->label(t("Add Group")); - $form_group->input("name")->label(t("Name"))->id("g-name"); - $form_group->inputs["name"]->error_messages( - "in_use", t("There is already a group with that name")); - $form_group->submit("")->value(t("Add Group")); - $group = ORM::factory("group"); - $form->add_rules_from($group); - return $form; - } - - static function get_delete_form_admin($group) { - $form = new Forge("admin/users/delete_group/$group->id", "", "post", - array("id" => "g-delete-group-form")); - $form_group = $form->group("delete_group")->label( - t("Are you sure you want to delete group %group_name?", array("group_name" => $group->name))); - $form_group->submit("")->value(t("Delete")); - return $form; - } } diff --git a/modules/gallery/helpers/user.php b/modules/gallery/helpers/user.php index cb205170..e7e75d64 100644 --- a/modules/gallery/helpers/user.php +++ b/modules/gallery/helpers/user.php @@ -24,94 +24,6 @@ * Note: by design, this class does not do any permission checking. */ class user_Core { - static function get_edit_form($user) { - $form = new Forge("users/update/$user->id", "", "post", array("id" => "g-edit-user-form")); - $form->set_attr("class", "g-narrow"); - $group = $form->group("edit_user")->label(t("Edit User: %name", array("name" => $user->name))); - $group->input("full_name")->label(t("Full Name"))->id("g-fullname")->value($user->full_name); - self::_add_locale_dropdown($group, $user); - $group->password("password")->label(t("Password"))->id("g-password"); - $group->password("password2")->label(t("Confirm Password"))->id("g-password2") - ->matches($group->password); - $group->input("email")->label(t("Email"))->id("g-email")->value($user->email); - $group->input("url")->label(t("URL"))->id("g-url")->value($user->url); - $form->add_rules_from($user); - - module::event("user_edit_form", $user, $form); - $group->submit("")->value(t("Save")); - return $form; - } - - static function get_edit_form_admin($user) { - $form = new Forge( - "admin/users/edit_user/$user->id", "", "post", array("id" => "g-edit-user-form")); - $group = $form->group("edit_user")->label(t("Edit User")); - $group->input("name")->label(t("Username"))->id("g-username")->value($user->name); - $group->inputs["name"]->error_messages( - "in_use", t("There is already a user with that username")); - $group->input("full_name")->label(t("Full Name"))->id("g-fullname")->value($user->full_name); - self::_add_locale_dropdown($group, $user); - $group->password("password")->label(t("Password"))->id("g-password"); - $group->password("password2")->label(t("Confirm Password"))->id("g-password2") - ->matches($group->password); - $group->input("email")->label(t("Email"))->id("g-email")->value($user->email); - $group->input("url")->label(t("URL"))->id("g-url")->value($user->url); - $group->checkbox("admin")->label(t("Admin"))->id("g-admin")->checked($user->admin); - $form->add_rules_from($user); - $form->edit_user->password->rules("-required"); - - module::event("user_edit_form_admin", $user, $form); - $group->submit("")->value(t("Modify User")); - return $form; - } - - static function get_add_form_admin() { - $form = new Forge("admin/users/add_user", "", "post", array("id" => "g-add-user-form")); - $form->set_attr('class', "g-narrow"); - $group = $form->group("add_user")->label(t("Add User")); - $group->input("name")->label(t("Username"))->id("g-username") - ->error_messages("in_use", t("There is already a user with that username")); - $group->input("full_name")->label(t("Full Name"))->id("g-fullname"); - $group->password("password")->label(t("Password"))->id("g-password"); - $group->password("password2")->label(t("Confirm Password"))->id("g-password2") - ->matches($group->password); - $group->input("email")->label(t("Email"))->id("g-email"); - $group->input("url")->label(t("URL"))->id("g-url"); - self::_add_locale_dropdown($group); - $group->checkbox("admin")->label(t("Admin"))->id("g-admin"); - $user = ORM::factory("user"); - $form->add_rules_from($user); - - module::event("user_add_form_admin", $user, $form); - $group->submit("")->value(t("Add User")); - return $form; - } - - private static function _add_locale_dropdown(&$form, $user=null) { - $locales = locales::installed(); - foreach ($locales as $locale => $display_name) { - $locales[$locale] = SafeString::of_safe_html($display_name); - } - if (count($locales) > 1) { - // Put "none" at the first position in the array - $locales = array_merge(array("" => t("« none »")), $locales); - $selected_locale = ($user && $user->locale) ? $user->locale : ""; - $form->dropdown("locale") - ->label(t("Language Preference")) - ->options($locales) - ->selected($selected_locale); - } - } - - static function get_delete_form_admin($user) { - $form = new Forge("admin/users/delete_user/$user->id", "", "post", - array("id" => "g-delete-user-form")); - $group = $form->group("delete_user")->label( - t("Are you sure you want to delete user %name?", array("name" => $user->name))); - $group->submit("")->value(t("Delete user %name", array("name" => $user->name))); - return $form; - } - static function get_login_form($url) { $form = new Forge($url, "", "post", array("id" => "g-login-form")); $form->set_attr('class', "g-narrow"); diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php index a8a8cd95..5950c358 100644 --- a/modules/user/controllers/admin_users.php +++ b/modules/user/controllers/admin_users.php @@ -29,7 +29,7 @@ class Admin_Users_Controller extends Admin_Controller { public function add_user() { access::verify_csrf(); - $form = user::get_add_form_admin(); + $form = $this->_get_user_add_form_admin(); $valid = $form->validate(); $name = $form->add_user->inputs["name"]->value; if ($user = user::lookup_by_name($name)) { @@ -59,7 +59,7 @@ class Admin_Users_Controller extends Admin_Controller { } public function add_user_form() { - print user::get_add_form_admin(); + print $this->_get_user_add_form_admin(); } public function delete_user($id) { @@ -74,7 +74,7 @@ class Admin_Users_Controller extends Admin_Controller { kohana::show_404(); } - $form = user::get_delete_form_admin($user); + $form = $this->_get_user_delete_form_admin($user); if($form->validate()) { $name = $user->name; $user->delete(); @@ -94,7 +94,7 @@ class Admin_Users_Controller extends Admin_Controller { if (empty($user)) { kohana::show_404(); } - print user::get_delete_form_admin($user); + print $this->_get_user_delete_form_admin($user); } public function edit_user($id) { @@ -105,7 +105,7 @@ class Admin_Users_Controller extends Admin_Controller { kohana::show_404(); } - $form = user::get_edit_form_admin($user); + $form = $this->_get_user_edit_form_admin($user); $valid = $form->validate(); if ($valid) { $new_name = $form->edit_user->inputs["name"]->value; @@ -152,7 +152,7 @@ class Admin_Users_Controller extends Admin_Controller { kohana::show_404(); } - $form = user::get_edit_form_admin($user); + $form = $this->_get_user_edit_form_admin($user); // Don't allow the user to control their own admin bit, else you can lock yourself out if ($user->id == user::active()->id) { $form->edit_user->admin->disabled(1); @@ -185,7 +185,7 @@ class Admin_Users_Controller extends Admin_Controller { public function add_group() { access::verify_csrf(); - $form = group::get_add_form_admin(); + $form = $this->_get_group_add_form_admin(); $valid = $form->validate(); if ($valid) { $new_name = $form->add_group->inputs["name"]->value; @@ -209,7 +209,7 @@ class Admin_Users_Controller extends Admin_Controller { } public function add_group_form() { - print group::get_add_form_admin(); + print $this->_get_group_add_form_admin(); } public function delete_group($id) { @@ -220,7 +220,7 @@ class Admin_Users_Controller extends Admin_Controller { kohana::show_404(); } - $form = group::get_delete_form_admin($group); + $form = $this->_get_group_delete_form_admin($group); if ($form->validate()) { $name = $group->name; $group->delete(); @@ -241,7 +241,7 @@ class Admin_Users_Controller extends Admin_Controller { kohana::show_404(); } - print group::get_delete_form_admin($group); + print $this->_get_group_delete_form_admin($group); } public function edit_group($id) { @@ -252,7 +252,7 @@ class Admin_Users_Controller extends Admin_Controller { kohana::show_404(); } - $form = group::get_edit_form_admin($group); + $form = $this->_get_group_edit_form_admin($group); $valid = $form->validate(); if ($valid) { @@ -284,7 +284,111 @@ class Admin_Users_Controller extends Admin_Controller { kohana::show_404(); } - print group::get_edit_form_admin($group); + print $this->_get_group_edit_form_admin($group); } + /* User Form Definitions */ + static function _get_user_edit_form_admin($user) { + $form = new Forge( + "admin/users/edit_user/$user->id", "", "post", array("id" => "g-edit-user-form")); + $group = $form->group("edit_user")->label(t("Edit User")); + $group->input("name")->label(t("Username"))->id("g-username")->value($user->name); + $group->inputs["name"]->error_messages( + "in_use", t("There is already a user with that username")); + $group->input("full_name")->label(t("Full Name"))->id("g-fullname")->value($user->full_name); + self::_add_locale_dropdown($group, $user); + $group->password("password")->label(t("Password"))->id("g-password"); + $group->password("password2")->label(t("Confirm Password"))->id("g-password2") + ->matches($group->password); + $group->input("email")->label(t("Email"))->id("g-email")->value($user->email); + $group->input("url")->label(t("URL"))->id("g-url")->value($user->url); + $group->checkbox("admin")->label(t("Admin"))->id("g-admin")->checked($user->admin); + $form->add_rules_from($user); + $form->edit_user->password->rules("-required"); + + module::event("user_edit_form_admin", $user, $form); + $group->submit("")->value(t("Modify User")); + return $form; + } + + static function _get_user_add_form_admin() { + $form = new Forge("admin/users/add_user", "", "post", array("id" => "g-add-user-form")); + $form->set_attr('class', "g-narrow"); + $group = $form->group("add_user")->label(t("Add User")); + $group->input("name")->label(t("Username"))->id("g-username") + ->error_messages("in_use", t("There is already a user with that username")); + $group->input("full_name")->label(t("Full Name"))->id("g-fullname"); + $group->password("password")->label(t("Password"))->id("g-password"); + $group->password("password2")->label(t("Confirm Password"))->id("g-password2") + ->matches($group->password); + $group->input("email")->label(t("Email"))->id("g-email"); + $group->input("url")->label(t("URL"))->id("g-url"); + self::_add_locale_dropdown($group); + $group->checkbox("admin")->label(t("Admin"))->id("g-admin"); + $user = ORM::factory("user"); + $form->add_rules_from($user); + + module::event("user_add_form_admin", $user, $form); + $group->submit("")->value(t("Add User")); + return $form; + } + + private function _add_locale_dropdown(&$form, $user=null) { + $locales = locales::installed(); + foreach ($locales as $locale => $display_name) { + $locales[$locale] = SafeString::of_safe_html($display_name); + } + if (count($locales) > 1) { + // Put "none" at the first position in the array + $locales = array_merge(array("" => t("« none »")), $locales); + $selected_locale = ($user && $user->locale) ? $user->locale : ""; + $form->dropdown("locale") + ->label(t("Language Preference")) + ->options($locales) + ->selected($selected_locale); + } + } + + private function _get_user_delete_form_admin($user) { + $form = new Forge("admin/users/delete_user/$user->id", "", "post", + array("id" => "g-delete-user-form")); + $group = $form->group("delete_user")->label( + t("Are you sure you want to delete user %name?", array("name" => $user->name))); + $group->submit("")->value(t("Delete user %name", array("name" => $user->name))); + return $form; + } + + /* Group Form Definitions */ + private function _get_group_edit_form_admin($group) { + $form = new Forge("admin/users/edit_group/$group->id", "", "post", array("id" => "g-edit-group-form")); + $form_group = $form->group("edit_group")->label(t("Edit Group")); + $form_group->input("name")->label(t("Name"))->id("g-name")->value($group->name); + $form_group->inputs["name"]->error_messages( + "in_use", t("There is already a group with that name")); + $form_group->submit("")->value(t("Save")); + $form->add_rules_from($group); + return $form; + } + + private function _get_group_add_form_admin() { + $form = new Forge("admin/users/add_group", "", "post", array("id" => "g-add-group-form")); + $form->set_attr('class', "g-narrow"); + $form_group = $form->group("add_group")->label(t("Add Group")); + $form_group->input("name")->label(t("Name"))->id("g-name"); + $form_group->inputs["name"]->error_messages( + "in_use", t("There is already a group with that name")); + $form_group->submit("")->value(t("Add Group")); + $group = ORM::factory("group"); + $form->add_rules_from($group); + return $form; + } + + private function _get_group_delete_form_admin($group) { + $form = new Forge("admin/users/delete_group/$group->id", "", "post", + array("id" => "g-delete-group-form")); + $form_group = $form->group("delete_group")->label( + t("Are you sure you want to delete group %group_name?", array("group_name" => $group->name))); + $form_group->submit("")->value(t("Delete")); + return $form; + } } diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php new file mode 100644 index 00000000..b03a47cc --- /dev/null +++ b/modules/user/controllers/users.php @@ -0,0 +1,103 @@ +guest || $user->id != user::active()->id) { + access::forbidden(); + } + + $form = $this->_get_edit_form($user); + $valid = $form->validate(); + if ($valid) { + $user->full_name = $form->edit_user->full_name->value; + if ($form->edit_user->password->value) { + $user->password = $form->edit_user->password->value; + } + $user->email = $form->edit_user->email->value; + $user->url = $form->edit_user->url->value; + if ($form->edit_user->locale) { + $desired_locale = $form->edit_user->locale->value; + $new_locale = $desired_locale == "none" ? null : $desired_locale; + if ($new_locale != $user->locale) { + // Delete the session based locale preference + setcookie("g_locale", "", time() - 24 * 3600, "/"); + } + $user->locale = $new_locale; + } + $user->save(); + module::event("user_edit_form_completed", $user, $form); + + message::success(t("User information updated.")); + print json_encode( + array("result" => "success", + "resource" => url::site("users/{$user->id}"))); + } else { + print json_encode( + array("result" => "error", + "form" => $form->__toString())); + } + } + + public function form_edit($id) { + $user = user::lookup($id); + if ($user->guest || $user->id != user::active()->id) { + access::forbidden(); + } + + print $this->_get_edit_form($user); + } + + private function _get_edit_form($user) { + $form = new Forge("users/update/$user->id", "", "post", array("id" => "g-edit-user-form")); + $form->set_attr("class", "g-narrow"); + $group = $form->group("edit_user")->label(t("Edit User: %name", array("name" => $user->name))); + $group->input("full_name")->label(t("Full Name"))->id("g-fullname")->value($user->full_name); + self::_add_locale_dropdown($group, $user); + $group->password("password")->label(t("Password"))->id("g-password"); + $group->password("password2")->label(t("Confirm Password"))->id("g-password2") + ->matches($group->password); + $group->input("email")->label(t("Email"))->id("g-email")->value($user->email); + $group->input("url")->label(t("URL"))->id("g-url")->value($user->url); + $form->add_rules_from($user); + + module::event("user_edit_form", $user, $form); + $group->submit("")->value(t("Save")); + return $form; + } + + /** @todo combine with Admin_Users_Controller::_add_locale_dropdown */ + private function _add_locale_dropdown(&$form, $user=null) { + $locales = locales::installed(); + foreach ($locales as $locale => $display_name) { + $locales[$locale] = SafeString::of_safe_html($display_name); + } + if (count($locales) > 1) { + // Put "none" at the first position in the array + $locales = array_merge(array("" => t("« none »")), $locales); + $selected_locale = ($user && $user->locale) ? $user->locale : ""; + $form->dropdown("locale") + ->label(t("Language Preference")) + ->options($locales) + ->selected($selected_locale); + } + } +} -- cgit v1.2.3 From be6765336eb894535d62055fab577dfc951b6b6a Mon Sep 17 00:00:00 2001 From: Tim Almdal Date: Thu, 15 Oct 2009 10:44:25 -0700 Subject: Finish integrating the move of the user edit/update functions into the user module. The premise is that the plugable user module will provide the update screens if the user backend supports updates. --- modules/gallery/controllers/albums.php | 1 - modules/gallery/controllers/login.php | 1 - modules/gallery/helpers/gallery_event.php | 4 ++++ modules/gallery/helpers/gallery_theme.php | 1 - modules/gallery/helpers/user.php | 1 - modules/gallery/libraries/Identity.php | 1 - modules/gallery/views/login.html.php | 6 +++++- modules/gallery/views/login_ajax.html.php | 2 +- modules/user/controllers/admin_users.php | 9 ++++---- modules/user/controllers/users.php | 2 +- modules/user/views/admin_users.html.php | 31 +++++++++++---------------- modules/user/views/admin_users_group.html.php | 4 ++-- 12 files changed, 29 insertions(+), 34 deletions(-) (limited to 'modules/user/controllers/users.php') diff --git a/modules/gallery/controllers/albums.php b/modules/gallery/controllers/albums.php index 95d63308..9733d1cd 100644 --- a/modules/gallery/controllers/albums.php +++ b/modules/gallery/controllers/albums.php @@ -29,7 +29,6 @@ class Albums_Controller extends Items_Controller { $view = new Theme_View("page.html", "login"); $view->page_title = t("Log in to Gallery"); $view->content = new View("login_ajax.html"); - $view->content->writable = user::is_writable(); $view->content->form = user::get_login_form("login/auth_html"); print $view; return; diff --git a/modules/gallery/controllers/login.php b/modules/gallery/controllers/login.php index 85f6db5d..2c4bd557 100644 --- a/modules/gallery/controllers/login.php +++ b/modules/gallery/controllers/login.php @@ -21,7 +21,6 @@ class Login_Controller extends Controller { public function ajax() { $view = new View("login_ajax.html"); - $view->writable = user::is_writable(); $view->form = user::get_login_form("login/auth_ajax"); print $view; } diff --git a/modules/gallery/helpers/gallery_event.php b/modules/gallery/helpers/gallery_event.php index e0de2152..4a6b14b6 100644 --- a/modules/gallery/helpers/gallery_event.php +++ b/modules/gallery/helpers/gallery_event.php @@ -23,6 +23,10 @@ class gallery_event_Core { * Initialization. */ static function gallery_ready() { + // Call Identity::instance() now to force the load of the user interface classes. + // user::load_user will attempt to load the active user from the session and needs + // the user definition class, which can't be reached by Kohana's heiracrchical lookup. + Identity::instance(); user::load_user(); locales::set_request_locale(); } diff --git a/modules/gallery/helpers/gallery_theme.php b/modules/gallery/helpers/gallery_theme.php index 54b35fb7..a342b4bd 100644 --- a/modules/gallery/helpers/gallery_theme.php +++ b/modules/gallery/helpers/gallery_theme.php @@ -55,7 +55,6 @@ class gallery_theme_Core { if ($theme->page_type != "login") { $view = new View("login.html"); $view->user = user::active(); - $view->writable = user::is_writable(); return $view->render(); } } diff --git a/modules/gallery/helpers/user.php b/modules/gallery/helpers/user.php index efe08830..c51a4a9c 100644 --- a/modules/gallery/helpers/user.php +++ b/modules/gallery/helpers/user.php @@ -78,7 +78,6 @@ class user_Core { * driver classes. */ static function load_user() { - Identity::instance(); $session = Session::instance(); if (!($user = $session->get("user"))) { $session->set("user", $user = self::guest()); diff --git a/modules/gallery/libraries/Identity.php b/modules/gallery/libraries/Identity.php index 88865913..86b15935 100644 --- a/modules/gallery/libraries/Identity.php +++ b/modules/gallery/libraries/Identity.php @@ -102,7 +102,6 @@ class Identity_Core { return !empty($this->config["allow_updates"]); } - /** * @see Identity_Driver::guest. */ diff --git a/modules/gallery/views/login.html.php b/modules/gallery/views/login.html.php index 5256f1ac..2d8119d0 100644 --- a/modules/gallery/views/login.html.php +++ b/modules/gallery/views/login.html.php @@ -8,11 +8,15 @@
  • + html::mark_clean( 'id}") . - '" title="' . ($writable ? t("Edit Your Profile")->for_html_attr() : t("Display Your Profile")->for_html_attr()) . + '" title="' . t("Edit Your Profile")->for_html_attr() . '" id="g-user-profile-link" class="g-dialog-link">' . html::clean($user->display_name()) . ''))) ?> + + html::clean($user->display_name()))) ?> +
  • " diff --git a/modules/gallery/views/login_ajax.html.php b/modules/gallery/views/login_ajax.html.php index 332a5365..d71ca719 100644 --- a/modules/gallery/views/login_ajax.html.php +++ b/modules/gallery/views/login_ajax.html.php @@ -36,7 +36,7 @@
    • - +
    • diff --git a/modules/user/controllers/admin_users.php b/modules/user/controllers/admin_users.php index 70348a69..64f19ecd 100644 --- a/modules/user/controllers/admin_users.php +++ b/modules/user/controllers/admin_users.php @@ -21,7 +21,6 @@ class Admin_Users_Controller extends Admin_Controller { public function index() { $view = new Admin_View("admin.html"); $view->content = new View("admin_users.html"); - $view->content->writable = user::is_writable(); $view->content->users = user::get_user_list(array("orderby" => array("name" => "ASC"))); $view->content->groups = group::get_group_list(array("orderby" => array("name" => "ASC"))); print $view; @@ -304,7 +303,7 @@ class Admin_Users_Controller extends Admin_Controller { $group->input("email")->label(t("Email"))->id("g-email")->value($user->email); $group->input("url")->label(t("URL"))->id("g-url")->value($user->url); $group->checkbox("admin")->label(t("Admin"))->id("g-admin")->checked($user->admin); - $form->add_rules_from($user); + $form->add_rules_from(user::get_edit_rules()); $form->edit_user->password->rules("-required"); module::event("user_edit_form_admin", $user, $form); @@ -327,7 +326,7 @@ class Admin_Users_Controller extends Admin_Controller { self::_add_locale_dropdown($group); $group->checkbox("admin")->label(t("Admin"))->id("g-admin"); $user = ORM::factory("user"); - $form->add_rules_from($user); + $form->add_rules_from(user::get_edit_rules()); module::event("user_add_form_admin", $user, $form); $group->submit("")->value(t("Add User")); @@ -367,7 +366,7 @@ class Admin_Users_Controller extends Admin_Controller { $form_group->inputs["name"]->error_messages( "in_use", t("There is already a group with that name")); $form_group->submit("")->value(t("Save")); - $form->add_rules_from($group); + $form->add_rules_from(group::get_edit_rules()); return $form; } @@ -380,7 +379,7 @@ class Admin_Users_Controller extends Admin_Controller { "in_use", t("There is already a group with that name")); $form_group->submit("")->value(t("Add Group")); $group = ORM::factory("group"); - $form->add_rules_from($group); + $form->add_rules_from(group::get_edit_rules()); return $form; } diff --git a/modules/user/controllers/users.php b/modules/user/controllers/users.php index b03a47cc..7c2e7833 100644 --- a/modules/user/controllers/users.php +++ b/modules/user/controllers/users.php @@ -77,7 +77,7 @@ class Users_Controller extends Controller { ->matches($group->password); $group->input("email")->label(t("Email"))->id("g-email")->value($user->email); $group->input("url")->label(t("URL"))->id("g-url")->value($user->url); - $form->add_rules_from($user); + $form->add_rules_from(user::get_edit_rules()); module::event("user_edit_form", $user, $form); $group->submit("")->value(t("Save")); diff --git a/modules/user/views/admin_users.html.php b/modules/user/views/admin_users.html.php index 82d0926c..a29f24b1 100644 --- a/modules/user/views/admin_users.html.php +++ b/modules/user/views/admin_users.html.php @@ -43,14 +43,12 @@ }
    - " class="g-dialog-link g-button g-right ui-icon-left ui-state-default ui-corner-all" title="for_html_attr() ?>"> -

    @@ -68,7 +66,7 @@ $user): ?> user admin ? "admin" : "" ?>"> - "> + " title="for_html_attr() ?>" alt="name) ?>" @@ -90,18 +88,16 @@ open_text="" class="g-panel-link g-button ui-state-default ui-corner-all ui-icon-left"> - + - - id != $user->id && !$user->guest): ?> - id") ?>" - class="g-dialog-link g-button ui-state-default ui-corner-all ui-icon-left"> - - - for_html_attr() ?>" - class="g-button ui-state-disabled ui-corner-all ui-icon-left"> - - + id != $user->id && !$user->guest): ?> + id") ?>" + class="g-dialog-link g-button ui-state-default ui-corner-all ui-icon-left"> + + + for_html_attr() ?>" + class="g-button ui-state-disabled ui-corner-all ui-icon-left"> + @@ -111,14 +107,12 @@

    - " class="g-dialog-link g-button g-right ui-icon-left ui-state-default ui-corner-all" title="for_html_attr() ?>"> -

    @@ -127,9 +121,8 @@