admin/user.php

   1 <?php
   2
   3     require_once('../config.php');
   4     require_once($CFG->libdir.'/adminlib.php');
   5     require_once($CFG->libdir.'/authlib.php');
   6     require_once($CFG->dirroot.'/user/lib.php');
   7
   8     $delete       = optional_param('delete', 0, PARAM_INT);
   9     $confirm      = optional_param('confirm', '', PARAM_ALPHANUM);   //md5 confirmation hash
  10     $confirmuser  = optional_param('confirmuser', 0, PARAM_INT);
  11     $acl          = optional_param('acl', '0', PARAM_INT);           // id of user to tweak mnet ACL (requires $access)
  12     $suspend      = optional_param('suspend', 0, PARAM_INT);
  13     $unsuspend    = optional_param('unsuspend', 0, PARAM_INT);
  14     $unlock       = optional_param('unlock', 0, PARAM_INT);
  15     $resendemail  = optional_param('resendemail', 0, PARAM_INT);
  16
  17     admin_externalpage_setup('editusers');
  18
  19     $sitecontext = context_system::instance();
  20     $site = get_site();
  21
  22     if (!has_capability('moodle/user:update', $sitecontext) and !has_capability('moodle/user:delete', $sitecontext)) {
  23         throw new \moodle_exception('nopermissions', 'error', '', 'edit/delete users');
  24     }
  25
  26     $returnurl = new moodle_url('/admin/user.php');
  27
  28     $PAGE->set_primary_active_tab('siteadminnode');
  29     $PAGE->navbar->add(get_string('userlist', 'admin'), $PAGE->url);
  30
  31     // The $user variable is also used outside of these if statements.
  32     $user = null;
  33     if ($confirmuser and confirm_sesskey()) {
  34         require_capability('moodle/user:update', $sitecontext);
  35         if (!$user = $DB->get_record('user', array('id'=>$confirmuser, 'mnethostid'=>$CFG->mnet_localhost_id))) {
  36             throw new \moodle_exception('nousers');
  37         }
  38
  39         $auth = get_auth_plugin($user->auth);
  40
  41         $result = $auth->user_confirm($user->username, $user->secret);
  42
  43         if ($result == AUTH_CONFIRM_OK or $result == AUTH_CONFIRM_ALREADY) {
  44             redirect($returnurl);
  45         } else {
  46             echo $OUTPUT->header();
  47             redirect($returnurl, get_string('usernotconfirmed', '', fullname($user, true)));
  48         }
  49
  50     } else if ($resendemail && confirm_sesskey()) {
  51         if (!$user = $DB->get_record('user', ['id' => $resendemail, 'mnethostid' => $CFG->mnet_localhost_id, 'deleted' => 0])) {
  52             throw new \moodle_exception('nousers');
  53         }
  54
  55         // Prevent spamming users who are already confirmed.
  56         if ($user->confirmed) {
  57             throw new \moodle_exception('alreadyconfirmed', 'moodle');
  58         }
  59
  60         $returnmsg = get_string('emailconfirmsentsuccess');
  61         $messagetype = \core\output\notification::NOTIFY_SUCCESS;
  62         if (!send_confirmation_email($user)) {
  63             $returnmsg = get_string('emailconfirmsentfailure');
  64             $messagetype = \core\output\notification::NOTIFY_ERROR;
  65         }
  66
  67         redirect($returnurl, $returnmsg, null, $messagetype);
  68     } else if ($delete and confirm_sesskey()) {              // Delete a selected user, after confirmation
  69         require_capability('moodle/user:delete', $sitecontext);
  70
  71         $user = $DB->get_record('user', array('id'=>$delete, 'mnethostid'=>$CFG->mnet_localhost_id), '*', MUST_EXIST);
  72
  73         if ($user->deleted) {
  74             throw new \moodle_exception('usernotdeleteddeleted', 'error');
  75         }
  76         if (is_siteadmin($user->id)) {
  77             throw new \moodle_exception('useradminodelete', 'error');
  78         }
  79
  80         if ($confirm != md5($delete)) {
  81             echo $OUTPUT->header();
  82             $fullname = fullname($user, true);
  83             echo $OUTPUT->heading(get_string('deleteuser', 'admin'));
  84
  85             $optionsyes = array('delete'=>$delete, 'confirm'=>md5($delete), 'sesskey'=>sesskey());
  86             $deleteurl = new moodle_url($returnurl, $optionsyes);
  87             $deletebutton = new single_button($deleteurl, get_string('delete'), 'post');
  88
  89             echo $OUTPUT->confirm(get_string('deletecheckfull', '', "'$fullname'"), $deletebutton, $returnurl);
  90             echo $OUTPUT->footer();
  91             die;
  92         } else {
  93             if (delete_user($user)) {
  94                 \core\session\manager::gc(); // Remove stale sessions.
  95                 redirect($returnurl, get_string('deleteduserx', 'admin', fullname($user, true)));
  96             } else {
  97                 \core\session\manager::gc(); // Remove stale sessions.
  98                 echo $OUTPUT->header();
  99                 echo $OUTPUT->notification($returnurl, get_string('deletednot', '', fullname($user, true)));
 100             }
 101         }
 102     } else if ($acl and confirm_sesskey()) {
 103         if (!has_capability('moodle/user:update', $sitecontext)) {
 104             throw new \moodle_exception('nopermissions', 'error', '', 'modify the NMET access control list');
 105         }
 106         if (!$user = $DB->get_record('user', array('id'=>$acl))) {
 107             throw new \moodle_exception('nousers', 'error');
 108         }
 109         if (!is_mnet_remote_user($user)) {
 110             throw new \moodle_exception('usermustbemnet', 'error');
 111         }
 112         $accessctrl = strtolower(required_param('accessctrl', PARAM_ALPHA));
 113         if ($accessctrl != 'allow' and $accessctrl != 'deny') {
 114             throw new \moodle_exception('invalidaccessparameter', 'error');
 115         }
 116         $aclrecord = $DB->get_record('mnet_sso_access_control', array('username'=>$user->username, 'mnet_host_id'=>$user->mnethostid));
 117         if (empty($aclrecord)) {
 118             $aclrecord = new stdClass();
 119             $aclrecord->mnet_host_id = $user->mnethostid;
 120             $aclrecord->username = $user->username;
 121             $aclrecord->accessctrl = $accessctrl;
 122             $DB->insert_record('mnet_sso_access_control', $aclrecord);
 123         } else {
 124             $aclrecord->accessctrl = $accessctrl;
 125             $DB->update_record('mnet_sso_access_control', $aclrecord);
 126         }
 127         $mnethosts = $DB->get_records('mnet_host', null, 'id', 'id,wwwroot,name');
 128         redirect($returnurl);
 129
 130     } else if ($suspend and confirm_sesskey()) {
 131         require_capability('moodle/user:update', $sitecontext);
 132
 133         if ($user = $DB->get_record('user', array('id'=>$suspend, 'mnethostid'=>$CFG->mnet_localhost_id, 'deleted'=>0))) {
 134             if (!is_siteadmin($user) and $USER->id != $user->id and $user->suspended != 1) {
 135                 $user->suspended = 1;
 136                 // Force logout.
 137                 \core\session\manager::kill_user_sessions($user->id);
 138                 user_update_user($user, false);
 139             }
 140         }
 141         redirect($returnurl);
 142
 143     } else if ($unsuspend and confirm_sesskey()) {
 144         require_capability('moodle/user:update', $sitecontext);
 145
 146         if ($user = $DB->get_record('user', array('id'=>$unsuspend, 'mnethostid'=>$CFG->mnet_localhost_id, 'deleted'=>0))) {
 147             if ($user->suspended != 0) {
 148                 $user->suspended = 0;
 149                 user_update_user($user, false);
 150             }
 151         }
 152         redirect($returnurl);
 153
 154     } else if ($unlock and confirm_sesskey()) {
 155         require_capability('moodle/user:update', $sitecontext);
 156
 157         if ($user = $DB->get_record('user', array('id'=>$unlock, 'mnethostid'=>$CFG->mnet_localhost_id, 'deleted'=>0))) {
 158             login_unlock_account($user);
 159         }
 160         redirect($returnurl);
 161     }
 162
 163     echo $OUTPUT->header();
 164
 165     if (has_capability('moodle/user:create', $sitecontext)) {
 166         echo html_writer::start_div('d-flex mb-2');
 167         $url = new moodle_url('/user/editadvanced.php', ['id' => -1]);
 168         echo html_writer::link($url, get_string('addnewuser', 'moodle'), [
 169             'class' => 'btn btn-primary ml-auto',
 170             'data-action' => 'add-user',
 171         ]);
 172         echo html_writer::end_div();
 173     }
 174
 175     $report = \core_reportbuilder\system_report_factory::create(\core_admin\reportbuilder\local\systemreports\users::class,
 176         context_system::instance());
 177     echo $report->output();
 178
 179     echo $OUTPUT->footer();