web/html/account.php

   1 <?php
   2
   3 set_include_path(get_include_path() . PATH_SEPARATOR . '../lib');
   4
   5 include_once('aur.inc.php');         # access AUR common functions
   6 include_once('acctfuncs.inc.php');   # access Account specific functions
   7
   8 set_lang();                 # this sets up the visitor's language
   9 check_sid();                # see if they're still logged in
  10
  11 $action = in_request("Action");
  12
  13 $need_userinfo = array(
  14         "DisplayAccount", "DeleteAccount", "AccountInfo", "UpdateAccount"
  15 );
  16
  17 if (in_array($action, $need_userinfo)) {
  18         $row = account_details(in_request("ID"), in_request("U"));
  19 }
  20
  21 if ($action == "AccountInfo") {
  22         html_header(__('Account') . ' ' . $row['Username']);
  23 } else {
  24         html_header(__('Accounts'));
  25 }
  26
  27 # Main page processing here
  28 #
  29 echo "<div class=\"box\">\n";
  30 echo "  <h2>".__("Accounts")."</h2>\n";
  31
  32 if (isset($_COOKIE["AURSID"])) {
  33         if ($action == "SearchAccounts") {
  34
  35                 # security check
  36                 #
  37                 if (has_credential(CRED_ACCOUNT_SEARCH)) {
  38                         # the user has entered search criteria, find any matching accounts
  39                         #
  40                         search_results_page(in_request("O"), in_request("SB"),
  41                                         in_request("U"), in_request("T"), in_request("S"),
  42                                         in_request("E"), in_request("R"), in_request("I"),
  43                                         in_request("K"));
  44
  45                 } else {
  46                         # a non-privileged user is trying to access the search page
  47                         #
  48                         print __("You are not allowed to access this area.")."<br />\n";
  49                 }
  50
  51         } elseif ($action == "DisplayAccount") {
  52                 # the user has clicked 'edit', display the account details in a form
  53                 #
  54                 if (empty($row)) {
  55                         print __("Could not retrieve information for the specified user.");
  56                 } else {
  57                         /* Verify user has permission to edit the account */
  58                         if (can_edit_account($row)) {
  59                                 display_account_form("UpdateAccount", $row["Username"],
  60                                         $row["AccountTypeID"], $row["Suspended"], $row["Email"],
  61                                         "", "", $row["RealName"], $row["LangPreference"],
  62                                         $row["IRCNick"], $row["PGPKey"], $row["SSHPubKey"],
  63                                         $row["InactivityTS"] ? 1 : 0, $row["ID"]);
  64                         } else {
  65                                 print __("You do not have permission to edit this account.");
  66                         }
  67                 }
  68
  69         } elseif ($action == "DeleteAccount") {
  70                 /* Details for account being deleted. */
  71                 if (can_edit_account($row)) {
  72                         $UID = $row['ID'];
  73                         if (in_request('confirm_Delete') && check_token()) {
  74                                 user_delete($UID);
  75                                 header('Location: /');
  76                         } else {
  77                                 $username = $row['Username'];
  78                                 include("account_delete.php");
  79                         }
  80                 } else {
  81                         print __("You do not have permission to edit this account.");
  82                 }
  83         } elseif ($action == "AccountInfo") {
  84                 # no editing, just looking up user info
  85                 #
  86                 if (empty($row)) {
  87                         print __("Could not retrieve information for the specified user.");
  88                 } else {
  89                         include("account_details.php");
  90                 }
  91
  92         } elseif ($action == "UpdateAccount") {
  93                 /* Details for account being updated */
  94                 /* Verify user permissions and that the request is a valid POST */
  95                 if (can_edit_account($row) && check_token()) {
  96                         /* Update the details for the existing account */
  97                         process_account_form("edit", "UpdateAccount",
  98                                         in_request("U"), in_request("T"), in_request("S"),
  99                                         in_request("E"), in_request("P"), in_request("C"),
 100                                         in_request("R"), in_request("L"), in_request("I"),
 101                                         in_request("K"), in_request("PK"), in_request("J"),
 102                                         in_request("ID"));
 103                 }
 104         } else {
 105                 if (has_credential(CRED_ACCOUNT_SEARCH)) {
 106                         # display the search page if they're a TU/dev
 107                         #
 108                         print __("Use this form to search existing accounts.")."<br />\n";
 109                         include('search_accounts_form.php');
 110
 111                 } else {
 112                         print __("You are not allowed to access this area.");
 113                 }
 114         }
 115
 116 } else {
 117         # visitor is not logged in
 118         #
 119         if ($action == "AccountInfo") {
 120                 print __("You must log in to view user information.");
 121         } elseif ($action == "NewAccount") {
 122                 # process the form input for creating a new account
 123                 #
 124                 process_account_form("new", "NewAccount",
 125                                 in_request("U"), 1, 0, in_request("E"),
 126                                 '', '', in_request("R"), in_request("L"),
 127                                 in_request("I"), in_request("K"),
 128                                 in_request("PK"));
 129
 130         } else {
 131                 # display the account request form
 132                 #
 133                 print __("Use this form to create an account.");
 134                 display_account_form("NewAccount", "", "", "", "", "", "", "", $LANG);
 135         }
 136 }
 137
 138 echo "</div>";
 139
 140 html_footer(AURWEB_VERSION);
 141
 142 ?>