352 lines
No EOL
13 KiB
PHP
352 lines
No EOL
13 KiB
PHP
<?php
|
|
/*
|
|
* This file is part of NOALYSS.
|
|
*
|
|
* NOALYSS is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* NOALYSS is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with NOALYSS; if not, write to the Free Software
|
|
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
|
*/
|
|
|
|
// Copyright Author Dany De Bontridder danydb@aevalys.eu
|
|
if ( !defined ('ALLOWED')) die('Forbidden');
|
|
/*!\file
|
|
*
|
|
*
|
|
* \brief user managemnt, included from admin-noalyss,
|
|
* action=user_mgt
|
|
*
|
|
*/
|
|
$http=new HttpInput();
|
|
echo '<div class="content" >';
|
|
\Noalyss\Dbg::echo_file(__FILE__);
|
|
/******************************************************/
|
|
// Add user
|
|
/******************************************************/
|
|
if ( isset ($_POST["ADD"]) )
|
|
{
|
|
$cn=new Database();
|
|
$a_result =check_password_strength($_POST['PASS']);
|
|
$pass5=md5($_POST['PASS']);
|
|
$new_user=new Noalyss_user($cn,0);
|
|
$new_user->first_name=$http->post('FNAME');
|
|
$new_user->last_name=$http->post('LNAME');
|
|
$new_user->setAdmin(0);
|
|
$login=$http->post('LOGIN');
|
|
$login=str_replace("'","",$login);
|
|
$login=str_replace('"',"",$login);
|
|
$login=str_replace(" ","",$login);
|
|
$login=strtolower($login);
|
|
$new_user->login=$login;
|
|
//$new_user->auth_method=
|
|
$new_user->email=$http->post('EMAIL',"string",'');
|
|
if ( trim($login)=="" || strlen($login)<5)
|
|
{
|
|
alert(_("Le login ne peut pas être vide et avoir au moins 5 lettres"));
|
|
}elseif (count($a_result['msg']) > 0){
|
|
// password too weak
|
|
$msg='<span class="warning">'._("Mot de passe inchangé").'</span>';
|
|
foreach ($a_result['msg'] as $result ) {
|
|
$msg.="$result <br/>";
|
|
}
|
|
alert($msg);
|
|
}
|
|
else
|
|
{
|
|
$exist_user=$cn->get_value("select count(*) from ac_users where use_login=lower($1)",[$login]);
|
|
if ( $exist_user == 0 ) {
|
|
$new_user->setPassword($pass5);
|
|
$new_user->insert();
|
|
$new_user->load();
|
|
put_global(array(['key'=>'use_id',"value"=>$new_user->id]));
|
|
Noalyss_user::audit_admin(sprintf('ADD USER %s %s',$new_user->id,$login));
|
|
} else {
|
|
echo_warning(_("Utilisateur existant"));
|
|
$uid=$cn->get_value("select use_id from ac_users where use_login=lower($1)",[$login]);
|
|
$new_user->setId($uid);
|
|
put_global(array(['key'=>'use_id',"value"=>$new_user->id]));
|
|
$new_user->load();
|
|
}
|
|
|
|
require_once NOALYSS_INCLUDE.'/user_detail.inc.php';
|
|
return;
|
|
|
|
}
|
|
} //SET login
|
|
/******************************************************/
|
|
// Update user
|
|
/******************************************************/
|
|
$sbaction=$http->post('sbaction',"string", "");
|
|
if ($sbaction == "save")
|
|
{
|
|
$uid = $http->post("UID");
|
|
|
|
// Update User
|
|
$cn = new Database();
|
|
$UserChange = new Noalyss_user($cn, $uid);
|
|
|
|
if ($UserChange->load() == -1)
|
|
{
|
|
alert(_("Cet utilisateur n'existe pas"));
|
|
}
|
|
else
|
|
{
|
|
$UserChange->first_name =$http->post('fname');
|
|
$UserChange->last_name = $http->post('lname');
|
|
$UserChange->active = $http->post('Actif');
|
|
$UserChange->admin = $http->post('Admin');
|
|
$UserChange->email = $http->post('email');
|
|
$UserChange->authent_method = $http->post('auth_method',"number");
|
|
if ($UserChange->active ==-1 || $UserChange->admin ==-1)
|
|
{
|
|
die ('Missing data');
|
|
}
|
|
if ( trim($_POST['password'])<>'')
|
|
{
|
|
$a_result =check_password_strength($_POST['password']);
|
|
if (count($a_result['msg']) > 0){
|
|
// password too weak
|
|
$msg='<span class="warning">'._("Mot de passe inchangé").'</span>';
|
|
foreach ($a_result['msg'] as $result ) {
|
|
$msg.="$result <br/>";
|
|
}
|
|
alert($msg);
|
|
require_once NOALYSS_INCLUDE.'/user_detail.inc.php';
|
|
return;
|
|
} else {
|
|
$UserChange->setPassword(md5($_POST['password']));
|
|
|
|
}
|
|
}
|
|
// if request new secret for OTP
|
|
if ( $http->post("generate_otp","number",0)==1){
|
|
|
|
$UserChange->generate_otp();
|
|
}
|
|
|
|
// save user change
|
|
$UserChange->save();
|
|
if ( $UserChange->authent_method !=0 && filter_var($UserChange->email, FILTER_VALIDATE_EMAIL) === false ) {
|
|
echo_warning(_("Email invalide"));
|
|
require_once NOALYSS_INCLUDE.'/user_detail.inc.php';
|
|
return;
|
|
}
|
|
// send a email with link if authen_method !=0 (freeOTP)
|
|
if ( $UserChange->authent_method !=0
|
|
&& filter_var($UserChange->email, FILTER_VALIDATE_EMAIL) == true
|
|
&& $http->post('email_otp','number',0) == 1
|
|
) {
|
|
// delete previous send for this user
|
|
$cn->exec_sql('delete from otp_send_secret where use_id=$1',[$UserChange->getId()]);
|
|
// send a email with a link to the qcode
|
|
$UserChange->send_link_otp();
|
|
}
|
|
|
|
}
|
|
}
|
|
else if ($sbaction == "delete")
|
|
{
|
|
/******************************************************/
|
|
// Delete the user
|
|
/******************************************************/
|
|
// check that the control is correct
|
|
try {
|
|
$code=$http->post("userdel");
|
|
$ctl_code=$http->post('ctlcode');
|
|
$uid = $http->request('use_id');
|
|
} catch (Exception $ex) {
|
|
echo_error($ex->getMessage());
|
|
throw $ex;
|
|
}
|
|
if ( DEBUGNOALYSS > 1) {
|
|
echo "code [$code] code control [$ctl_code]";
|
|
}
|
|
if ( $code != $ctl_code) {
|
|
echo_warning (_("Code invalide, effacement refusé"));
|
|
require_once NOALYSS_INCLUDE.'/user_detail.inc.php';
|
|
return;
|
|
}
|
|
if ($uid == 1) {
|
|
echo_warning(_("Administrateur ne peut pas être effacé"));
|
|
require_once NOALYSS_INCLUDE.'/user_detail.inc.php';
|
|
return;
|
|
}
|
|
$cn = new Database();
|
|
$auser=$cn->get_row('select use_login from ac_users where use_id = $1',[$uid]);
|
|
if ( $auser == null) return;
|
|
$Res = $cn->exec_sql("delete from jnt_use_dos where use_id=$1", array($uid));
|
|
$Res = $cn->exec_sql("delete from ac_users where use_id=$1", array($uid));
|
|
//------------------------------------
|
|
// Remove user from all the dossiers
|
|
//------------------------------------
|
|
$a_dossier=$cn->get_array('select dos_id from ac_dossier');
|
|
if ( is_array($a_dossier) ) {
|
|
$nb=count($a_dossier);
|
|
for ( $i=0;$i<$nb;$i++)
|
|
Noalyss_user::remove_inexistant_user($a_dossier[$i]['dos_id']);
|
|
}
|
|
Noalyss_user::audit_admin(sprintf('DELETE USER %s %s',$uid,$auser['use_login']));
|
|
echo "<H2 class=\"notice\">";
|
|
printf (_("Utilisateur %s %s est effacé"),$http->post('fname'),$http->post('lname')) ;
|
|
echo " </H2>";
|
|
}
|
|
// View user detail
|
|
if ( isset($_REQUEST['det']) && $sbaction=="")
|
|
{
|
|
require_once NOALYSS_INCLUDE.'/user_detail.inc.php';
|
|
|
|
return;
|
|
}
|
|
?>
|
|
<span id="info_passid"></span>
|
|
<div id="create_user" style="display:none;margin-right: 20%;position:float;" class="inner_box2">
|
|
<?php echo HtmlInput::title_box(_('Ajout Utilisateur'),"create_user","hide");?>
|
|
<form action="admin-noalyss.php?action=user_mgt" method="POST" onsubmit="return check_form()">
|
|
<div style="text-align: center">
|
|
|
|
<TABLE class="result" >
|
|
<TR><TD style="text-align: right"> <?php echo _('login')?></TD><TD><INPUT id="input_login" class="input_text" TYPE="TEXT" NAME="LOGIN" autocomplete=“off” required></TD></tr>
|
|
<TR><TD style="text-align: right"> <?php echo _('Prénom')?></TD><TD><INPUT class="input_text" TYPE="TEXT" NAME="FNAME" autocomplete=“off”></TD></tr>
|
|
<TR><TD style="text-align: right"> <?php echo _('Nom')?></TD><TD><INPUT class="input_text" TYPE="TEXT" NAME="LNAME" autocomplete=“off” required></TD></TR>
|
|
<TR>
|
|
<TD style="text-align: right"> <?php echo _('Mot de passe')?>
|
|
<?=\Icon_Action::tips("Mot de passe : longueur minimale = 8 dont au moins 1 majuscule, 1 minuscule,1 chiffre et 1 car.spécial")?>
|
|
|
|
</TD>
|
|
<TD> <INPUT id="input_password" class="input_text" TYPE="TEXT" NAME="PASS"
|
|
onkeyup="check_password_strength('input_password','info_passid',true)"
|
|
autocomplete=“off”
|
|
required
|
|
>
|
|
|
|
</TD></TR>
|
|
<TR><TD style="text-align: right"> <?php echo _('Email')?></TD><TD> <INPUT class="input_text" TYPE="TEXT" NAME="EMAIL"></TD></TR>
|
|
<tr>
|
|
<td></td>
|
|
<td></td>
|
|
<tr>
|
|
</TABLE>
|
|
|
|
<?php
|
|
echo HtmlInput::submit("ADD",_('Créer Utilisateur'),"",'button');
|
|
echo HtmlInput::button_action(_("Fermer"), "$('create_user').style.display='none';");
|
|
|
|
?>
|
|
</div>
|
|
</FORM>
|
|
<script>
|
|
function check_form() {
|
|
if ($F('input_login') == "") {
|
|
smoke.alert('<?php echo _('Le login ne peut être vide') ?>');
|
|
$('input_login').setStyle({border:"red solid 2px"});
|
|
return false;
|
|
}
|
|
if ($F('input_password') == "") {
|
|
smoke.alert('<?php echo _('Le mot de passe ne peut être vide') ?>');
|
|
$('input_password').setStyle({border:"red solid 2px"});
|
|
return false;
|
|
}
|
|
if ($F('input_login').length < 5) {
|
|
smoke.alert('<?php echo _('Le login doit avoir au moins 5 lettres') ?>');
|
|
$('input_password').setStyle({border:"red solid 2px"});
|
|
return false;
|
|
}
|
|
return true;
|
|
}
|
|
|
|
</script>
|
|
</div>
|
|
<div>
|
|
<?php
|
|
echo '<p>';
|
|
echo HtmlInput::button_action(_("Ajout utilisateur"), "$('create_user').show();","cu");
|
|
echo '</p>';
|
|
// Show all the existing user on 7 columns
|
|
$repo=new Dossier(0);
|
|
/******************************************************/
|
|
// Detail of a user
|
|
/******************************************************/
|
|
|
|
|
|
|
|
$compteur=0;
|
|
$header=new Sort_Table();
|
|
$url=basename($_SERVER['PHP_SELF'])."?action=".$_REQUEST['action'];
|
|
$header->add(_("Login"), $url," order by use_login asc", "order by use_login desc","la", "ld"); // 0
|
|
$header->add(_("Nom"), $url," order by use_name asc,use_first_name asc", "order by use_name desc,use_first_name desc","na", "nd"); // 1
|
|
$header->add(_("Authentification"), $url," order by use_auth_method asc,use_login asc", "order by use_auth_method desc ,use_login asc","auth", "nauth"); // 2
|
|
$header->add(_('Dossier'),$url,' order by ag_dossier asc','order by ag_dossier desc', //3
|
|
'da','dd');
|
|
$header->add(_("Actif"), $url," order by use_active asc", "order by use_active desc","aa", "ad"); // 4
|
|
$header->add(_("Email"), $url," order by use_email asc,use_name asc,use_first_name asc", "order by use_email desc,use_name desc,use_first_name desc","na", "nd"); //5
|
|
$ord=$http->request("ord","string","la");
|
|
$sql=$header->get_sql_order($ord);
|
|
$a_user=$repo->get_user_folder($sql);
|
|
|
|
if ( !empty ($a_user) )
|
|
{
|
|
echo '<span style="display:block">';
|
|
echo _('Cherche').Icon_Action::infobulle(22);
|
|
echo HtmlInput::filter_table("user", "0,1,2,3,5,6","1");
|
|
echo '</span>';
|
|
echo '<table id="user" class="result">';
|
|
echo '<tr>';
|
|
echo '<th>'.$header->get_header(0).'</th>';
|
|
echo '<th>'.$header->get_header(1).'</th>';
|
|
echo th(_("Prénom"));
|
|
echo '<th>'.$header->get_header(5).'</th>';
|
|
echo '<th>'.$header->get_header(2).'</th>';
|
|
echo '<th>'.$header->get_header(4).'</th>';
|
|
echo "<th>"._('Type')."</th>";
|
|
echo '<th>'.$header->get_header(3).'</th>';
|
|
echo '</tr>';
|
|
$a_auth=[0=>_("Mot de passe"),1=>'Email et OTP',2=>'OTP'];
|
|
|
|
foreach ( $a_user as $r_user)
|
|
{
|
|
$compteur++;
|
|
$class=($compteur%2==0)?"odd":"even";
|
|
|
|
echo "<tr class=\"$class\">";
|
|
if ( $r_user['use_active'] == 0 )
|
|
{
|
|
$Active=$g_failed;
|
|
}
|
|
else
|
|
{
|
|
$Active=$g_succeed;
|
|
}
|
|
$det_url=$url."&det&use_id=".$r_user['use_id'];
|
|
echo "<td>";
|
|
echo HtmlInput::anchor($r_user['use_login'],$det_url);
|
|
echo "</td>";
|
|
|
|
echo td($r_user['use_name']);
|
|
echo td($r_user['use_first_name']);
|
|
echo td($r_user['use_email']);
|
|
|
|
echo td($a_auth[$r_user['use_auth_method']]);
|
|
echo td($Active);
|
|
$type=($r_user['use_admin']==1)?_("Administrateur"):_("Utilisateur");
|
|
echo "<td>".$type."</td>";
|
|
if ( $r_user['use_admin'] == 0)
|
|
echo td($r_user['ag_dossier']);
|
|
else {
|
|
echo td(_('Tous'));
|
|
}
|
|
echo '</tr>';
|
|
}// foreach
|
|
echo '</table>';
|
|
} // $cn != null
|
|
?>
|
|
|
|
</div>
|