3 # deluser.cgi -- support for user deletion via web
4 # Copyright (c) 2013 Kyle J. McKay. All rights reserved.
5 # Portions (c) Petr Baudis <pasky@suse.cz> and (c) Jan Krueger <jk@jk.gs>
6 # License GPLv2+: GNU GPL version 2 or later.
7 # www.gnu.org/licenses/gpl-2.0.html
8 # This is free software: you are free to change and redistribute it.
9 # There is NO WARRANTY, to the extent permitted by law.
19 binmode STDOUT
, ':utf8';
21 my $gcgi = Girocco
::CGI
->new('User Removal');
24 unless ($Girocco::Config
::manage_users
) {
25 print "<p>I don't manage users.</p>";
29 if ($cgi->param('mail')) {
30 print "<p>Go away, bot.</p>";
35 my ($name, $submit) = @_;
37 <form method="post" action="@{[url_path($Girocco::Config::webadmurl)]}/deluser.cgi">
38 <input type="hidden" name="name" value="$name" />
39 <p>Authorization code: <input name="auth" size="50" /></p>
40 <p><input type="submit" name="y0" value="$submit" /></p>
45 if ($cgi->param('name') && $cgi->param('y0') && $cgi->request_method eq 'POST') {
46 # submitted, let's see
47 # FIXME: racy, do a lock
48 my $name = $gcgi->wparam('name');
49 (Girocco
::User
::valid_name
($name)
50 and Girocco
::User
::does_exist
($name))
51 or $gcgi->err("Username is not registered.");
53 $gcgi->err_check and exit;
56 ($user = Girocco
::User
->load($name)) && valid_email
($user->{email
})
57 or $gcgi->err("Username may not be removed.");
59 $gcgi->err_check and exit;
61 if (!$cgi->param('auth')) {
62 if ($cgi->param('y0') ne 'Send authorization code') {
63 print "<p>Invalid data. Go away, sorcerer.</p>\n";
67 my $auth = $user->gen_auth('DEL');
70 open(MAIL
, '|-', '/usr/bin/mail', '-s', "[$Girocco::Config::name] Account removal authorization", $user->{email
}) or
71 die "Sorry, could not send authorization code: $!";
75 You have requested an authorization code be sent to you for removing
76 your account. If you don't want to actually remove your account, just
77 ignore this e-mail. Otherwise, use this code within 24 hours:
81 Should you run into any problems, please let us know.
87 print "<p>You should shortly receive an e-mail containing an authorization code.
88 Please enter this code below to remove your account.
89 The code will expire in 24 hours or after you have used it.</p>";
90 _auth_form
($name, "'Login'");
93 if ($cgi->param('y0') ne "'Login'" && $cgi->param('y0') ne "Remove user account") {
94 print "<p>Invalid data. Go away, sorcerer.</p>\n";
98 $user->{auth
} && $user->{authtype
} eq 'DEL' or do {
99 print "<p>There currently isn't any authorization code filed under your account. ".
100 "Please <a href=\"@{[url_path($Girocco::Config::webadmurl)]}/deluser.cgi\">generate one</a>.</p>";
104 my $auth = $gcgi->wparam('auth');
105 if ($auth ne $user->{auth
}) {
106 print "<p>Invalid authorization code, please re-enter or ".
107 "<a href=\"@{[url_path($Girocco::Config::webadmurl)]}/deluser.cgi\">generate a new one</a>.</p>";
108 _auth_form
($name, "'Login'");
112 my $y0 = $gcgi->wparam('y0') || '';
113 my $conf = $gcgi->wparam('confirm') || '';
114 if ($y0 ne 'Remove user account' || $conf ne $user->{name
}) {
116 my $projectsinfo = '';
117 my @projects = $user->get_projects;
119 $projectsinfo = projects_html_list
({target
=>"_blank", typecol
=>1, changed
=>1}, @projects);
120 $blurb1 = ' and from the following projects:' if $projectsinfo;
123 my @ownedprojects = filedb_grep
(jailed_file
('/etc/gitweb.list'),
126 my ($proj, $owner) = split / /;
127 $owner = CGI
::Util
::unescape
($owner);
128 if ($owner eq $user->{email
}) {
129 $proj = CGI
::Util
::unescape
($proj);
130 $proj =~ s/[.]git$//;
135 if (@ownedprojects) {
137 <p>The following project(s) are owned by the same email address as user account '$user->{name}'
138 and <b>will NOT be removed</b>. If desired, they can be removed from their project admin
139 page(s) (the "edit" link on the project page).</p>
141 $ownedinfo .= projects_html_list
(
142 {target
=>"_blank", typecol
=>1, changed
=>1}, @ownedprojects);
145 <p>Please confirm that you are going to remove user account '$user->{name}'
146 from the site$blurb1</p>$projectsinfo$ownedinfo
147 <form method="post" action="@{[url_path($Girocco::Config::webadmurl)]}/deluser.cgi">
148 <input type="hidden" name="name" value="$name" />
149 <input type="hidden" name="auth" value="$auth" />
150 <input type="hidden" name="confirm" value="$name" />
151 <p><input type="submit" name="y0" value="Remove user account" /></p>
158 print "<p>User account successfully removed. Have a nice day.</p>\n";
164 <p>Here you can request an authorization code to remove your user account.</p>
166 <p>Please enter your username below;
167 we will send you an email with an authorization code
168 and further instructions.</p>
170 <form method="post" action="@{[url_path($Girocco::Config::webadmurl)]}/deluser.cgi">
172 <tr><td class="formlabel">Login:</td><td><input type="text" name="name" /></td></tr>
173 <tr style="display:none"><td class="formlabel">Anti-captcha (leave empty!):</td><td><input type="text" name="mail" /></td></tr>
174 <tr><td class="formlabel"></td><td><input type="submit" name="y0" value="Send authorization code" /></td></tr>