admin/user.php

   1 <?php
   2
   3     require_once('../config.php');
   4     require_once($CFG->libdir.'/adminlib.php');
   5     require_once($CFG->libdir.'/authlib.php');
   6     require_once($CFG->dirroot.'/user/lib.php');
   7     require_once($CFG->dirroot.'/'.$CFG->admin.'/user/user_bulk_forms.php');
   8
   9     $delete       = optional_param('delete', 0, PARAM_INT);
  10     $confirm      = optional_param('confirm', '', PARAM_ALPHANUM);   //md5 confirmation hash
  11     $confirmuser  = optional_param('confirmuser', 0, PARAM_INT);
  12     $acl          = optional_param('acl', '0', PARAM_INT);           // id of user to tweak mnet ACL (requires $access)
  13     $suspend      = optional_param('suspend', 0, PARAM_INT);
  14     $unsuspend    = optional_param('unsuspend', 0, PARAM_INT);
  15     $unlock       = optional_param('unlock', 0, PARAM_INT);
  16     $resendemail  = optional_param('resendemail', 0, PARAM_INT);
  17
  18     admin_externalpage_setup('editusers');
  19
  20     $sitecontext = context_system::instance();
  21     $site = get_site();
  22
  23     if (!has_capability('moodle/user:update', $sitecontext) and !has_capability('moodle/user:delete', $sitecontext)) {
  24         throw new \moodle_exception('nopermissions', 'error', '', 'edit/delete users');
  25     }
  26
  27     $returnurl = new moodle_url('/admin/user.php');
  28
  29     $PAGE->set_primary_active_tab('siteadminnode');
  30     $PAGE->navbar->add(get_string('userlist', 'admin'), $PAGE->url);
  31
  32     // The $user variable is also used outside of these if statements.
  33     $user = null;
  34     if ($confirmuser and confirm_sesskey()) {
  35         require_capability('moodle/user:update', $sitecontext);
  36         if (!$user = $DB->get_record('user', array('id'=>$confirmuser, 'mnethostid'=>$CFG->mnet_localhost_id))) {
  37             throw new \moodle_exception('nousers');
  38         }
  39
  40         $auth = get_auth_plugin($user->auth);
  41
  42         $result = $auth->user_confirm($user->username, $user->secret);
  43
  44         if ($result == AUTH_CONFIRM_OK or $result == AUTH_CONFIRM_ALREADY) {
  45             redirect($returnurl);
  46         } else {
  47             echo $OUTPUT->header();
  48             redirect($returnurl, get_string('usernotconfirmed', '', fullname($user, true)));
  49         }
  50
  51     } else if ($resendemail && confirm_sesskey()) {
  52         if (!$user = $DB->get_record('user', ['id' => $resendemail, 'mnethostid' => $CFG->mnet_localhost_id, 'deleted' => 0])) {
  53             throw new \moodle_exception('nousers');
  54         }
  55
  56         // Prevent spamming users who are already confirmed.
  57         if ($user->confirmed) {
  58             throw new \moodle_exception('alreadyconfirmed', 'moodle');
  59         }
  60
  61         $returnmsg = get_string('emailconfirmsentsuccess');
  62         $messagetype = \core\output\notification::NOTIFY_SUCCESS;
  63         if (!send_confirmation_email($user)) {
  64             $returnmsg = get_string('emailconfirmsentfailure');
  65             $messagetype = \core\output\notification::NOTIFY_ERROR;
  66         }
  67
  68         redirect($returnurl, $returnmsg, null, $messagetype);
  69     } else if ($delete and confirm_sesskey()) {              // Delete a selected user, after confirmation
  70         require_capability('moodle/user:delete', $sitecontext);
  71
  72         $user = $DB->get_record('user', array('id'=>$delete, 'mnethostid'=>$CFG->mnet_localhost_id), '*', MUST_EXIST);
  73
  74         if ($user->deleted) {
  75             throw new \moodle_exception('usernotdeleteddeleted', 'error');
  76         }
  77         if (is_siteadmin($user->id)) {
  78             throw new \moodle_exception('useradminodelete', 'error');
  79         }
  80
  81         if ($confirm != md5($delete)) {
  82             echo $OUTPUT->header();
  83             $fullname = fullname($user, true);
  84             echo $OUTPUT->heading(get_string('deleteuser', 'admin'));
  85
  86             $optionsyes = array('delete'=>$delete, 'confirm'=>md5($delete), 'sesskey'=>sesskey());
  87             $deleteurl = new moodle_url($returnurl, $optionsyes);
  88             $deletebutton = new single_button($deleteurl, get_string('delete'), 'post');
  89
  90             echo $OUTPUT->confirm(get_string('deletecheckfull', '', "'$fullname'"), $deletebutton, $returnurl);
  91             echo $OUTPUT->footer();
  92             die;
  93         } else {
  94             if (delete_user($user)) {
  95                 \core\session\manager::gc(); // Remove stale sessions.
  96                 redirect($returnurl, get_string('deleteduserx', 'admin', fullname($user, true)));
  97             } else {
  98                 \core\session\manager::gc(); // Remove stale sessions.
  99                 echo $OUTPUT->header();
 100                 echo $OUTPUT->notification($returnurl, get_string('deletednot', '', fullname($user, true)));
 101             }
 102         }
 103     } else if ($acl and confirm_sesskey()) {
 104         if (!has_capability('moodle/user:update', $sitecontext)) {
 105             throw new \moodle_exception('nopermissions', 'error', '', 'modify the NMET access control list');
 106         }
 107         if (!$user = $DB->get_record('user', array('id'=>$acl))) {
 108             throw new \moodle_exception('nousers', 'error');
 109         }
 110         if (!is_mnet_remote_user($user)) {
 111             throw new \moodle_exception('usermustbemnet', 'error');
 112         }
 113         $accessctrl = strtolower(required_param('accessctrl', PARAM_ALPHA));
 114         if ($accessctrl != 'allow' and $accessctrl != 'deny') {
 115             throw new \moodle_exception('invalidaccessparameter', 'error');
 116         }
 117         $aclrecord = $DB->get_record('mnet_sso_access_control', array('username'=>$user->username, 'mnet_host_id'=>$user->mnethostid));
 118         if (empty($aclrecord)) {
 119             $aclrecord = new stdClass();
 120             $aclrecord->mnet_host_id = $user->mnethostid;
 121             $aclrecord->username = $user->username;
 122             $aclrecord->accessctrl = $accessctrl;
 123             $DB->insert_record('mnet_sso_access_control', $aclrecord);
 124         } else {
 125             $aclrecord->accessctrl = $accessctrl;
 126             $DB->update_record('mnet_sso_access_control', $aclrecord);
 127         }
 128         $mnethosts = $DB->get_records('mnet_host', null, 'id', 'id,wwwroot,name');
 129         redirect($returnurl);
 130
 131     } else if ($suspend and confirm_sesskey()) {
 132         require_capability('moodle/user:update', $sitecontext);
 133
 134         if ($user = $DB->get_record('user', array('id'=>$suspend, 'mnethostid'=>$CFG->mnet_localhost_id, 'deleted'=>0))) {
 135             if (!is_siteadmin($user) and $USER->id != $user->id and $user->suspended != 1) {
 136                 $user->suspended = 1;
 137                 // Force logout.
 138                 \core\session\manager::kill_user_sessions($user->id);
 139                 user_update_user($user, false);
 140             }
 141         }
 142         redirect($returnurl);
 143
 144     } else if ($unsuspend and confirm_sesskey()) {
 145         require_capability('moodle/user:update', $sitecontext);
 146
 147         if ($user = $DB->get_record('user', array('id'=>$unsuspend, 'mnethostid'=>$CFG->mnet_localhost_id, 'deleted'=>0))) {
 148             if ($user->suspended != 0) {
 149                 $user->suspended = 0;
 150                 user_update_user($user, false);
 151             }
 152         }
 153         redirect($returnurl);
 154
 155     } else if ($unlock and confirm_sesskey()) {
 156         require_capability('moodle/user:update', $sitecontext);
 157
 158         if ($user = $DB->get_record('user', array('id'=>$unlock, 'mnethostid'=>$CFG->mnet_localhost_id, 'deleted'=>0))) {
 159             login_unlock_account($user);
 160         }
 161         redirect($returnurl);
 162     }
 163
 164     echo $OUTPUT->header();
 165
 166     if (has_capability('moodle/user:create', $sitecontext)) {
 167         echo html_writer::start_div('d-flex mb-2');
 168         $url = new moodle_url('/user/editadvanced.php', ['id' => -1]);
 169         echo html_writer::link($url, get_string('addnewuser', 'moodle'), [
 170             'class' => 'btn btn-primary ml-auto',
 171             'data-action' => 'add-user',
 172         ]);
 173         echo html_writer::end_div();
 174     }
 175
 176     echo html_writer::start_div('', ['data-region' => 'report-user-list-wrapper']);
 177
 178     $bulkactions = new user_bulk_action_form(new moodle_url('/admin/user/user_bulk.php'),
 179         ['excludeactions' => ['displayonpage', 'download'], 'passuserids' => true, 'hidesubmit' => true],
 180         'post', '',
 181         ['id' => 'user-bulk-action-form']);
 182     $bulkactions->set_data(['returnurl' => $PAGE->url->out_as_local_url(false)]);
 183
 184     $report = \core_reportbuilder\system_report_factory::create(\core_admin\reportbuilder\local\systemreports\users::class,
 185         context_system::instance(), parameters: ['withcheckboxes' => $bulkactions->has_bulk_actions()]);
 186     echo $report->output();
 187
 188     if ($bulkactions->has_bulk_actions()) {
 189         $PAGE->requires->js_call_amd('core_admin/bulk_user_actions', 'init');
 190         $bulkactions->display();
 191     }
 192
 193     echo html_writer::end_div();
 194
 195     echo $OUTPUT->footer();