/
manage_user_update.php
128 lines (104 loc) · 4.5 KB
/
manage_user_update.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
<?php
# Mantis - a php based bugtracking system
# Copyright (C) 2000 - 2002 Kenzaburo Ito - kenito@300baud.org
# Copyright (C) 2002 - 2007 Mantis Team - mantisbt-dev@lists.sourceforge.net
# Mantis is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 2 of the License, or
# (at your option) any later version.
#
# Mantis is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with Mantis. If not, see <http://www.gnu.org/licenses/>.
# --------------------------------------------------------
# $Id: manage_user_update.php,v 1.42 2007-10-24 22:30:50 giallu Exp $
# --------------------------------------------------------
require_once( 'core.php' );
$t_core_path = config_get( 'core_path' );
require_once( $t_core_path.'email_api.php' );
auth_reauthenticate();
access_ensure_global_level( config_get( 'manage_user_threshold' ) );
$f_protected = gpc_get_bool( 'protected' );
$f_enabled = gpc_get_bool( 'enabled' );
$f_email = gpc_get_string( 'email', '' );
$f_username = gpc_get_string( 'username', '' );
$f_realname = gpc_get_string( 'realname', '' );
$f_access_level = gpc_get_int( 'access_level' );
$f_user_id = gpc_get_int( 'user_id' );
$f_email = trim( $f_email );
$f_username = trim( $f_username );
$t_old_username = user_get_field( $f_user_id, 'username' );
# check that the username is unique
if ( 0 != strcasecmp( $t_old_username, $f_username )
&& false == user_is_name_unique( $f_username ) ) {
trigger_error( ERROR_USER_NAME_NOT_UNIQUE, ERROR );
}
user_ensure_name_valid( $f_username );
user_ensure_realname_valid( $f_realname );
user_ensure_realname_unique( $f_username, $f_realname );
$f_email = email_append_domain( $f_email );
email_ensure_valid( $f_email );
email_ensure_not_disposable( $f_email );
$c_email = db_prepare_string( $f_email );
$c_username = db_prepare_string( $f_username );
$c_realname = db_prepare_string( $f_realname );
$c_protected = db_prepare_bool( $f_protected );
$c_enabled = db_prepare_bool( $f_enabled );
$c_user_id = db_prepare_int( $f_user_id );
$c_access_level = db_prepare_int( $f_access_level );
$t_user_table = config_get( 'mantis_user_table' );
$t_old_protected = user_get_field( $f_user_id, 'protected' );
# check that we are not downgrading the last administrator
$t_old_access = user_get_field( $f_user_id, 'access_level' );
if ( ( ADMINISTRATOR == $t_old_access ) && ( $t_old_access <> $f_access_level ) && ( 1 >= user_count_level( ADMINISTRATOR ) ) ) {
trigger_error( ERROR_USER_CHANGE_LAST_ADMIN, ERROR );
}
# Project specific access rights override global levels, hence, for users who are changed
# to be administrators, we have to remove project specific rights.
if ( ( $c_access_level >= ADMINISTRATOR ) && ( !user_is_administrator( $c_user_id ) ) ) {
user_delete_project_specific_access_levels( $c_user_id );
}
# if the user is already protected and the admin is not removing the
# protected flag then don't update the access level and enabled flag.
# If the user was unprotected or the protected flag is being turned off
# then proceed with a full update.
if ( $f_protected && $t_old_protected ) {
$query = "UPDATE $t_user_table
SET username='$c_username', email='$c_email',
protected='$c_protected', realname='$c_realname'
WHERE id='$c_user_id'";
} else {
$query = "UPDATE $t_user_table
SET username='$c_username', email='$c_email',
access_level='$c_access_level', enabled='$c_enabled',
protected='$c_protected', realname='$c_realname'
WHERE id='$c_user_id'";
}
$result = db_query( $query );
$t_redirect_url = 'manage_user_edit_page.php?user_id=' . $c_user_id;
?>
<?php html_page_top1() ?>
<?php
if ( $result ) {
html_meta_redirect( $t_redirect_url );
}
?>
<?php html_page_top2() ?>
<br />
<div align="center">
<?php
if ( $f_protected && $t_old_protected ) { # PROTECTED
echo lang_get( 'manage_user_protected_msg' ) . '<br />';
} else if ( $result ) { # SUCCESS
echo lang_get( 'operation_successful' ) . '<br />';
} else { # FAILURE
print_sql_error( $query );
}
print_bracket_link( $t_redirect_url, lang_get( 'proceed' ) );
?>
</div>
<?php html_page_bottom1( __FILE__ ) ?>