330 lines
9.6 KiB
Go
330 lines
9.6 KiB
Go
package panel
|
|
|
|
import (
|
|
"database/sql"
|
|
"html/template"
|
|
"net/http"
|
|
"net/url"
|
|
"strconv"
|
|
|
|
c "github.com/Azareal/Gosora/common"
|
|
)
|
|
|
|
func Users(w http.ResponseWriter, r *http.Request, u *c.User) c.RouteError {
|
|
basePage, ferr := buildBasePage(w, r, u, "users", "users")
|
|
if ferr != nil {
|
|
return ferr
|
|
}
|
|
|
|
name := r.FormValue("s-name")
|
|
email := r.FormValue("s-email")
|
|
if !u.Perms.EditUserEmail && email != "" {
|
|
return c.LocalError("Only users with the EditUserEmail permission can search by email.", w, r, u)
|
|
}
|
|
group := r.FormValue("s-group")
|
|
f := func(l ...string) bool {
|
|
for _, ll := range l {
|
|
if ll != "" {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
hasParam := f(name, email, group)
|
|
gid, _ := strconv.Atoi(group)
|
|
/*if group == "" {
|
|
gid = -1
|
|
}*/
|
|
hasParam = hasParam || gid > 0
|
|
|
|
page, _ := strconv.Atoi(r.FormValue("page"))
|
|
perPage := 15
|
|
userCount := basePage.Stats.Users
|
|
if hasParam {
|
|
userCount = c.Users.CountSearch(name, email, gid)
|
|
}
|
|
offset, page, lastPage := c.PageOffset(userCount, page, perPage)
|
|
|
|
allGroups, e := c.Groups.GetAll()
|
|
if e != nil {
|
|
return c.InternalError(e, w, r)
|
|
}
|
|
|
|
var users []*c.User
|
|
if hasParam {
|
|
users, e = c.Users.SearchOffset(name, email, gid, offset, perPage)
|
|
} else {
|
|
users, e = c.Users.GetOffset(offset, perPage)
|
|
}
|
|
if e != nil {
|
|
return c.InternalError(e, w, r)
|
|
}
|
|
|
|
name = url.QueryEscape(name)
|
|
email = url.QueryEscape(email)
|
|
search := c.PanelUserPageSearch{name, email, gid, hasParam}
|
|
|
|
var params string
|
|
if hasParam {
|
|
if name != "" {
|
|
params += "s-name=" + name + "&"
|
|
}
|
|
if email != "" {
|
|
params += "s-email=" + email + "&"
|
|
}
|
|
if gid > 0 {
|
|
params += "s-group=" + strconv.Itoa(gid) + "&"
|
|
}
|
|
}
|
|
pageList := c.Paginate(page, lastPage, 5)
|
|
pi := c.PanelUserPage{basePage, users, allGroups, search, c.PaginatorMod{template.URL(params), pageList, page, lastPage}}
|
|
return renderTemplate("panel", w, r, basePage.Header, c.Panel{basePage, "", "", "panel_users", &pi})
|
|
}
|
|
|
|
func UsersEdit(w http.ResponseWriter, r *http.Request, u *c.User, suid string) c.RouteError {
|
|
basePage, ferr := buildBasePage(w, r, u, "edit_user", "users")
|
|
if ferr != nil {
|
|
return ferr
|
|
}
|
|
if !u.Perms.EditUser {
|
|
return c.NoPermissions(w, r, u)
|
|
}
|
|
|
|
uid, err := strconv.Atoi(suid)
|
|
if err != nil {
|
|
return c.LocalError("The provided UserID is not a valid number.", w, r, u)
|
|
}
|
|
targetUser, err := c.Users.Get(uid)
|
|
if err == sql.ErrNoRows {
|
|
return c.LocalError("The user you're trying to edit doesn't exist.", w, r, u)
|
|
} else if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
if targetUser.IsAdmin && !u.IsAdmin {
|
|
return c.LocalError("Only administrators can edit the account of an administrator.", w, r, u)
|
|
}
|
|
|
|
// ? - Should we stop admins from deleting all the groups? Maybe, protect the group they're currently using?
|
|
groups, err := c.Groups.GetRange(1, 0) // ? - 0 = Go to the end
|
|
if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
|
|
var groupList []*c.Group
|
|
for _, group := range groups {
|
|
if !u.Perms.EditUserGroupAdmin && group.IsAdmin {
|
|
continue
|
|
}
|
|
if !u.Perms.EditUserGroupSuperMod && group.IsMod {
|
|
continue
|
|
}
|
|
groupList = append(groupList, group)
|
|
}
|
|
|
|
if r.FormValue("updated") == "1" {
|
|
basePage.AddNotice("panel_user_updated")
|
|
}
|
|
showEmail := r.FormValue("show-email") == "1"
|
|
|
|
pi := c.PanelUserEditPage{basePage, groupList, targetUser, showEmail}
|
|
return renderTemplate("panel", w, r, basePage.Header, c.Panel{basePage, "", "", "panel_user_edit", &pi})
|
|
}
|
|
|
|
func UsersEditSubmit(w http.ResponseWriter, r *http.Request, user *c.User, suid string) c.RouteError {
|
|
_, ferr := c.SimplePanelUserCheck(w, r, user)
|
|
if ferr != nil {
|
|
return ferr
|
|
}
|
|
if !user.Perms.EditUser {
|
|
return c.NoPermissions(w, r, user)
|
|
}
|
|
|
|
uid, err := strconv.Atoi(suid)
|
|
if err != nil {
|
|
return c.LocalError("The provided UserID is not a valid number.", w, r, user)
|
|
}
|
|
targetUser, err := c.Users.Get(uid)
|
|
if err == sql.ErrNoRows {
|
|
return c.LocalError("The user you're trying to edit doesn't exist.", w, r, user)
|
|
} else if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
if targetUser.IsAdmin && !user.IsAdmin {
|
|
return c.LocalError("Only administrators can edit the account of other administrators.", w, r, user)
|
|
}
|
|
|
|
newName := c.SanitiseSingleLine(r.PostFormValue("name"))
|
|
if newName == "" {
|
|
return c.LocalError("You didn't put in a name.", w, r, user)
|
|
}
|
|
|
|
// TODO: How should activation factor into admin set emails?
|
|
// TODO: How should we handle secondary emails? Do we even have secondary emails implemented?
|
|
newEmail := c.SanitiseSingleLine(r.PostFormValue("email"))
|
|
if newEmail == "" && targetUser.Email != "" {
|
|
return c.LocalError("You didn't put in an email address.", w, r, user)
|
|
}
|
|
if newEmail == "-1" {
|
|
newEmail = targetUser.Email
|
|
}
|
|
if (newEmail != targetUser.Email) && !user.Perms.EditUserEmail {
|
|
return c.LocalError("You need the EditUserEmail permission to edit the email address of a user.", w, r, user)
|
|
}
|
|
|
|
newPassword := r.PostFormValue("password")
|
|
if newPassword != "" && !user.Perms.EditUserPassword {
|
|
return c.LocalError("You need the EditUserPassword permission to edit the password of a user.", w, r, user)
|
|
}
|
|
|
|
newGroup, err := strconv.Atoi(r.PostFormValue("group"))
|
|
if err != nil {
|
|
return c.LocalError("You need to provide a whole number for the group ID", w, r, user)
|
|
}
|
|
group, err := c.Groups.Get(newGroup)
|
|
if err == sql.ErrNoRows {
|
|
return c.LocalError("The group you're trying to place this user in doesn't exist.", w, r, user)
|
|
} else if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
if !user.Perms.EditUserGroupAdmin && group.IsAdmin {
|
|
return c.LocalError("You need the EditUserGroupAdmin permission to assign someone to an administrator group.", w, r, user)
|
|
}
|
|
if !user.Perms.EditUserGroupSuperMod && group.IsMod {
|
|
return c.LocalError("You need the EditUserGroupSuperMod permission to assign someone to a super mod group.", w, r, user)
|
|
}
|
|
|
|
err = targetUser.Update(newName, c.CanonEmail(newEmail), newGroup)
|
|
if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
|
|
red := false
|
|
if newPassword != "" {
|
|
c.SetPassword(targetUser.ID, newPassword)
|
|
// Log the user out as a safety precaution
|
|
c.Auth.ForceLogout(targetUser.ID)
|
|
red = true
|
|
}
|
|
targetUser.CacheRemove()
|
|
|
|
targetUser, err = c.Users.Get(uid)
|
|
if err == sql.ErrNoRows {
|
|
return c.LocalError("The user you're trying to edit doesn't exist.", w, r, user)
|
|
} else if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
err = c.GroupPromotions.PromoteIfEligible(targetUser, targetUser.Level, targetUser.Posts, targetUser.CreatedAt)
|
|
if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
targetUser.CacheRemove()
|
|
|
|
err = c.AdminLogs.Create("edit", targetUser.ID, "user", user.GetIP(), user.ID)
|
|
if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
|
|
// If we're changing our own password, redirect to the index rather than to a noperms error due to the force logout
|
|
if targetUser.ID == user.ID && red {
|
|
http.Redirect(w, r, "/", http.StatusSeeOther)
|
|
} else {
|
|
var se string
|
|
if r.PostFormValue("show-email") == "1" {
|
|
se = "&show-email=1"
|
|
}
|
|
http.Redirect(w, r, "/panel/users/edit/"+strconv.Itoa(targetUser.ID)+"?updated=1"+se, http.StatusSeeOther)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func UsersAvatarSubmit(w http.ResponseWriter, r *http.Request, u *c.User, suid string) c.RouteError {
|
|
_, ferr := c.SimplePanelUserCheck(w, r, u)
|
|
if ferr != nil {
|
|
return ferr
|
|
}
|
|
// TODO: Check the UploadAvatars permission too?
|
|
if !u.Perms.EditUser {
|
|
return c.NoPermissions(w, r, u)
|
|
}
|
|
|
|
uid, err := strconv.Atoi(suid)
|
|
if err != nil {
|
|
return c.LocalError("The provided UserID is not a valid number.", w, r, u)
|
|
}
|
|
targetUser, err := c.Users.Get(uid)
|
|
if err == sql.ErrNoRows {
|
|
return c.LocalError("The user you're trying to edit doesn't exist.", w, r, u)
|
|
} else if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
if targetUser.IsAdmin && !u.IsAdmin {
|
|
return c.LocalError("Only administrators can edit the account of other administrators.", w, r, u)
|
|
}
|
|
|
|
ext, ferr := c.UploadAvatar(w, r, u, targetUser.ID)
|
|
if ferr != nil {
|
|
return ferr
|
|
}
|
|
ferr = c.ChangeAvatar("."+ext, w, r, targetUser)
|
|
if ferr != nil {
|
|
return ferr
|
|
}
|
|
// TODO: Only schedule a resize if the avatar isn't tiny
|
|
err = targetUser.ScheduleAvatarResize()
|
|
if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
|
|
err = c.AdminLogs.Create("edit", targetUser.ID, "user", u.GetIP(), u.ID)
|
|
if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
|
|
var se string
|
|
if r.PostFormValue("show-email") == "1" {
|
|
se = "&show-email=1"
|
|
}
|
|
http.Redirect(w, r, "/panel/users/edit/"+strconv.Itoa(targetUser.ID)+"?updated=1"+se, http.StatusSeeOther)
|
|
return nil
|
|
}
|
|
|
|
func UsersAvatarRemoveSubmit(w http.ResponseWriter, r *http.Request, u *c.User, suid string) c.RouteError {
|
|
_, ferr := c.SimplePanelUserCheck(w, r, u)
|
|
if ferr != nil {
|
|
return ferr
|
|
}
|
|
if !u.Perms.EditUser {
|
|
return c.NoPermissions(w, r, u)
|
|
}
|
|
|
|
uid, err := strconv.Atoi(suid)
|
|
if err != nil {
|
|
return c.LocalError("The provided UserID is not a valid number.", w, r, u)
|
|
}
|
|
targetUser, err := c.Users.Get(uid)
|
|
if err == sql.ErrNoRows {
|
|
return c.LocalError("The user you're trying to edit doesn't exist.", w, r, u)
|
|
} else if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
if targetUser.IsAdmin && !u.IsAdmin {
|
|
return c.LocalError("Only administrators can edit the account of other administrators.", w, r, u)
|
|
}
|
|
ferr = c.ChangeAvatar("", w, r, targetUser)
|
|
if ferr != nil {
|
|
return ferr
|
|
}
|
|
|
|
err = c.AdminLogs.Create("edit", targetUser.ID, "user", u.GetIP(), u.ID)
|
|
if err != nil {
|
|
return c.InternalError(err, w, r)
|
|
}
|
|
|
|
var se string
|
|
if r.PostFormValue("show-email") == "1" {
|
|
se = "&show-email=1"
|
|
}
|
|
http.Redirect(w, r, "/panel/users/edit/"+strconv.Itoa(targetUser.ID)+"?updated=1"+se, http.StatusSeeOther)
|
|
return nil
|
|
}
|