src/Module/Admin/Users.php

   1 <?php
   2 /**
   3  * @copyright Copyright (C) 2020, Friendica
   4  *
   5  * @license GNU AGPL version 3 or any later version
   6  *
   7  * This program is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU Affero General Public License as
   9  * published by the Free Software Foundation, either version 3 of the
  10  * License, or (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU Affero General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU Affero General Public License
  18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19  *
  20  */
  21
  22 namespace Friendica\Module\Admin;
  23
  24 use Friendica\Content\Pager;
  25 use Friendica\Core\Renderer;
  26 use Friendica\Database\DBA;
  27 use Friendica\DI;
  28 use Friendica\Model\Register;
  29 use Friendica\Model\User;
  30 use Friendica\Module\BaseAdmin;
  31 use Friendica\Util\Temporal;
  32
  33 class Users extends BaseAdmin
  34 {
  35         public static function post(array $parameters = [])
  36         {
  37                 parent::post($parameters);
  38
  39                 $pending     = $_POST['pending']           ?? [];
  40                 $users       = $_POST['user']              ?? [];
  41                 $nu_name     = $_POST['new_user_name']     ?? '';
  42                 $nu_nickname = $_POST['new_user_nickname'] ?? '';
  43                 $nu_email    = $_POST['new_user_email']    ?? '';
  44                 $nu_language = DI::config()->get('system', 'language');
  45
  46                 parent::checkFormSecurityTokenRedirectOnError('/admin/users', 'admin_users');
  47
  48                 if ($nu_name !== '' && $nu_email !== '' && $nu_nickname !== '') {
  49                         try {
  50                                 User::createMinimal($nu_name, $nu_email, $nu_nickname, $nu_language);
  51                         } catch (\Exception $ex) {
  52                                 notice($ex->getMessage());
  53                                 return;
  54                         }
  55                 }
  56
  57                 if (!empty($_POST['page_users_block'])) {
  58                         foreach ($users as $uid) {
  59                                 User::block(Register::getPendingForUser($uid)['hash'] ?? '');
  60                         }
  61                         notice(DI::l10n()->tt('%s user blocked', '%s users blocked', count($users)));
  62                 }
  63
  64                 if (!empty($_POST['page_users_unblock'])) {
  65                         foreach ($users as $uid) {
  66                                 User::block(Register::getPendingForUser($uid)['hash'] ?? '', false);
  67                         }
  68                         notice(DI::l10n()->tt('%s user unblocked', '%s users unblocked', count($users)));
  69                 }
  70
  71                 if (!empty($_POST['page_users_delete'])) {
  72                         foreach ($users as $uid) {
  73                                 if (local_user() != $uid) {
  74                                         User::remove($uid);
  75                                 } else {
  76                                         notice(DI::l10n()->t('You can\'t remove yourself'));
  77                                 }
  78                         }
  79
  80                         notice(DI::l10n()->tt('%s user deleted', '%s users deleted', count($users)));
  81                 }
  82
  83                 if (!empty($_POST['page_users_approve'])) {
  84                         foreach ($pending as $hash) {
  85                                 if (User::allow($hash)) {
  86                                         info(DI::l10n()->t('Account approved.'));
  87                                 }
  88                         }
  89                 }
  90
  91                 if (!empty($_POST['page_users_deny'])) {
  92                         foreach ($pending as $hash) {
  93                                 if (User::deny($hash)) {
  94                                         notice(DI::l10n()->t('Registration revoked'));
  95                                 }
  96                         }
  97                 }
  98
  99                 DI::baseUrl()->redirect('admin/users');
 100         }
 101
 102         public static function content(array $parameters = [])
 103         {
 104                 parent::content($parameters);
 105
 106                 $a = DI::app();
 107
 108                 if ($a->argc > 3) {
 109                         // @TODO: Replace with parameter from router
 110                         $action = $a->argv[2];
 111                         $uid = $a->argv[3];
 112                         $user = User::getById($uid, ['username', 'blocked']);
 113                         if (!DBA::isResult($user)) {
 114                                 notice('User not found' . EOL);
 115                                 DI::baseUrl()->redirect('admin/users');
 116                                 return ''; // NOTREACHED
 117                         }
 118
 119                         switch ($action) {
 120                                 case 'delete':
 121                                         if (local_user() != $uid) {
 122                                                 parent::checkFormSecurityTokenRedirectOnError('/admin/users', 'admin_users', 't');
 123                                                 // delete user
 124                                                 User::remove($uid);
 125
 126                                                 notice(DI::l10n()->t('User "%s" deleted', $user['username']));
 127                                         } else {
 128                                                 notice(DI::l10n()->t('You can\'t remove yourself'));
 129                                         }
 130                                         break;
 131                                 case 'block':
 132                                         parent::checkFormSecurityTokenRedirectOnError('/admin/users', 'admin_users', 't');
 133                                         User::block($uid);
 134                                         notice(DI::l10n()->t('User "%s" blocked', $user['username']));
 135                                         break;
 136                                 case 'unblock':
 137                                         parent::checkFormSecurityTokenRedirectOnError('/admin/users', 'admin_users', 't');
 138                                         User::block($uid, false);
 139                                         notice(DI::l10n()->t('User "%s" unblocked', $user['username']));
 140                                         break;
 141                                 case 'allow':
 142                                         parent::checkFormSecurityTokenRedirectOnError('/admin/users', 'admin_users', 't');
 143                                         User::allow(Register::getPendingForUser($uid)['hash'] ?? '');
 144                                         notice(DI::l10n()->t('Account approved.'));
 145                                         break;
 146                                 case 'deny':
 147                                         parent::checkFormSecurityTokenRedirectOnError('/admin/users', 'admin_users', 't');
 148                                         User::deny(Register::getPendingForUser($uid)['hash'] ?? '');
 149                                         notice(DI::l10n()->t('Registration revoked'));
 150                                         break;
 151                         }
 152
 153                         DI::baseUrl()->redirect('admin/users');
 154                 }
 155
 156                 /* get pending */
 157                 $pending = Register::getPending();
 158
 159                 $pager = new Pager(DI::l10n(), DI::args()->getQueryString(), 100);
 160
 161                 // @TODO Move below block to Model\User::getUsers($start, $count, $order = 'contact.name', $order_direction = '+')
 162                 $valid_orders = [
 163                         'contact.name',
 164                         'user.email',
 165                         'user.register_date',
 166                         'user.login_date',
 167                         'lastitem_date',
 168                         'user.page-flags'
 169                 ];
 170
 171                 $order = 'contact.name';
 172                 $order_direction = '+';
 173                 if (!empty($_GET['o'])) {
 174                         $new_order = $_GET['o'];
 175                         if ($new_order[0] === '-') {
 176                                 $order_direction = '-';
 177                                 $new_order = substr($new_order, 1);
 178                         }
 179
 180                         if (in_array($new_order, $valid_orders)) {
 181                                 $order = $new_order;
 182                         }
 183                 }
 184                 $sql_order = '`' . str_replace('.', '`.`', $order) . '`';
 185                 $sql_order_direction = ($order_direction === '+') ? 'ASC' : 'DESC';
 186
 187                 $usersStmt = DBA::p("SELECT `user`.*, `contact`.`name`, `contact`.`url`, `contact`.`micro`, `user`.`account_expired`, `contact`.`last-item` AS `lastitem_date`
 188                                 FROM `user`
 189                                 INNER JOIN `contact` ON `contact`.`uid` = `user`.`uid` AND `contact`.`self`
 190                                 WHERE `user`.`verified`
 191                                 ORDER BY $sql_order $sql_order_direction LIMIT ?, ?", $pager->getStart(), $pager->getItemsPerPage()
 192                 );
 193                 $users = DBA::toArray($usersStmt);
 194
 195                 $adminlist = explode(',', str_replace(' ', '', DI::config()->get('config', 'admin_email')));
 196                 $_setup_users = function ($e) use ($adminlist) {
 197                         $page_types = [
 198                                 User::PAGE_FLAGS_NORMAL    => DI::l10n()->t('Normal Account Page'),
 199                                 User::PAGE_FLAGS_SOAPBOX   => DI::l10n()->t('Soapbox Page'),
 200                                 User::PAGE_FLAGS_COMMUNITY => DI::l10n()->t('Public Forum'),
 201                                 User::PAGE_FLAGS_FREELOVE  => DI::l10n()->t('Automatic Friend Page'),
 202                                 User::PAGE_FLAGS_PRVGROUP  => DI::l10n()->t('Private Forum')
 203                         ];
 204                         $account_types = [
 205                                 User::ACCOUNT_TYPE_PERSON       => DI::l10n()->t('Personal Page'),
 206                                 User::ACCOUNT_TYPE_ORGANISATION => DI::l10n()->t('Organisation Page'),
 207                                 User::ACCOUNT_TYPE_NEWS         => DI::l10n()->t('News Page'),
 208                                 User::ACCOUNT_TYPE_COMMUNITY    => DI::l10n()->t('Community Forum'),
 209                                 User::ACCOUNT_TYPE_RELAY        => DI::l10n()->t('Relay'),
 210                         ];
 211
 212                         $e['page_flags_raw'] = $e['page-flags'];
 213                         $e['page-flags'] = $page_types[$e['page-flags']];
 214
 215                         $e['account_type_raw'] = ($e['page_flags_raw'] == 0) ? $e['account-type'] : -1;
 216                         $e['account-type'] = ($e['page_flags_raw'] == 0) ? $account_types[$e['account-type']] : '';
 217
 218                         $e['register_date'] = Temporal::getRelativeDate($e['register_date']);
 219                         $e['login_date'] = Temporal::getRelativeDate($e['login_date']);
 220                         $e['lastitem_date'] = Temporal::getRelativeDate($e['lastitem_date']);
 221                         $e['is_admin'] = in_array($e['email'], $adminlist);
 222                         $e['is_deletable'] = (intval($e['uid']) != local_user());
 223                         $e['deleted'] = ($e['account_removed'] ? Temporal::getRelativeDate($e['account_expires_on']) : False);
 224
 225                         return $e;
 226                 };
 227
 228                 $tmp_users = array_map($_setup_users, $users);
 229
 230                 // Get rid of dashes in key names, Smarty3 can't handle them
 231                 // and extracting deleted users
 232
 233                 $deleted = [];
 234                 $users = [];
 235                 foreach ($tmp_users as $user) {
 236                         foreach ($user as $k => $v) {
 237                                 $newkey = str_replace('-', '_', $k);
 238                                 $user[$newkey] = $v;
 239                         }
 240
 241                         if ($user['deleted']) {
 242                                 $deleted[] = $user;
 243                         } else {
 244                                 $users[] = $user;
 245                         }
 246                 }
 247
 248                 $th_users = array_map(null, [DI::l10n()->t('Name'), DI::l10n()->t('Email'), DI::l10n()->t('Register date'), DI::l10n()->t('Last login'), DI::l10n()->t('Last public item'), DI::l10n()->t('Type')], $valid_orders);
 249
 250                 $t = Renderer::getMarkupTemplate('admin/users.tpl');
 251                 $o = Renderer::replaceMacros($t, [
 252                         // strings //
 253                         '$title' => DI::l10n()->t('Administration'),
 254                         '$page' => DI::l10n()->t('Users'),
 255                         '$submit' => DI::l10n()->t('Add User'),
 256                         '$select_all' => DI::l10n()->t('select all'),
 257                         '$h_pending' => DI::l10n()->t('User registrations waiting for confirm'),
 258                         '$h_deleted' => DI::l10n()->t('User waiting for permanent deletion'),
 259                         '$th_pending' => [DI::l10n()->t('Request date'), DI::l10n()->t('Name'), DI::l10n()->t('Email')],
 260                         '$no_pending' => DI::l10n()->t('No registrations.'),
 261                         '$pendingnotetext' => DI::l10n()->t('Note from the user'),
 262                         '$approve' => DI::l10n()->t('Approve'),
 263                         '$deny' => DI::l10n()->t('Deny'),
 264                         '$delete' => DI::l10n()->t('Delete'),
 265                         '$block' => DI::l10n()->t('Block'),
 266                         '$blocked' => DI::l10n()->t('User blocked'),
 267                         '$unblock' => DI::l10n()->t('Unblock'),
 268                         '$siteadmin' => DI::l10n()->t('Site admin'),
 269                         '$accountexpired' => DI::l10n()->t('Account expired'),
 270
 271                         '$h_users' => DI::l10n()->t('Users'),
 272                         '$h_newuser' => DI::l10n()->t('New User'),
 273                         '$th_deleted' => [DI::l10n()->t('Name'), DI::l10n()->t('Email'), DI::l10n()->t('Register date'), DI::l10n()->t('Last login'), DI::l10n()->t('Last public item'), DI::l10n()->t('Permanent deletion')],
 274                         '$th_users' => $th_users,
 275                         '$order_users' => $order,
 276                         '$order_direction_users' => $order_direction,
 277
 278                         '$confirm_delete_multi' => DI::l10n()->t('Selected users will be deleted!\n\nEverything these users had posted on this site will be permanently deleted!\n\nAre you sure?'),
 279                         '$confirm_delete' => DI::l10n()->t('The user {0} will be deleted!\n\nEverything this user has posted on this site will be permanently deleted!\n\nAre you sure?'),
 280
 281                         '$form_security_token' => parent::getFormSecurityToken('admin_users'),
 282
 283                         // values //
 284                         '$baseurl' => DI::baseUrl()->get(true),
 285
 286                         '$pending' => $pending,
 287                         'deleted' => $deleted,
 288                         '$users' => $users,
 289                         '$newusername' => ['new_user_name', DI::l10n()->t('Name'), '', DI::l10n()->t('Name of the new user.')],
 290                         '$newusernickname' => ['new_user_nickname', DI::l10n()->t('Nickname'), '', DI::l10n()->t('Nickname of the new user.')],
 291                         '$newuseremail' => ['new_user_email', DI::l10n()->t('Email'), '', DI::l10n()->t('Email address of the new user.'), '', '', 'email'],
 292                 ]);
 293
 294                 $o .= $pager->renderFull(DBA::count('user'));
 295
 296                 return $o;
 297         }
 298 }