430 lines
13 KiB
Perl
Executable File
430 lines
13 KiB
Perl
Executable File
#!/usr/bin/perl
|
|
|
|
use strict;
|
|
use warnings;
|
|
no warnings 'redefine';
|
|
|
|
use Data::Dumper;
|
|
|
|
use config();
|
|
use entry();
|
|
use log();
|
|
use template();
|
|
use auth();
|
|
use uac();
|
|
use studios();
|
|
use params();
|
|
use localization();
|
|
use password_requests();
|
|
|
|
binmode STDOUT, ":utf8";
|
|
|
|
my $r = shift;
|
|
( my $cgi, my $params, my $error ) = params::get($r);
|
|
my $config = config::get('../config/config.cgi');
|
|
my ( $user, $expires ) = auth::get_user( $config, $params, $cgi );
|
|
return if ( ( !defined $user ) || ( $user eq '' ) );
|
|
my $user_presets = uac::get_user_presets(
|
|
$config,
|
|
{
|
|
user => $user,
|
|
project_id => $params->{project_id},
|
|
studio_id => $params->{studio_id}
|
|
}
|
|
);
|
|
$params->{default_studio_id} = $user_presets->{studio_id};
|
|
$params = uac::setDefaultStudio( $params, $user_presets );
|
|
$params = uac::setDefaultProject( $params, $user_presets );
|
|
|
|
my $request = {
|
|
url => $ENV{QUERY_STRING} || '',
|
|
params => {
|
|
original => $params,
|
|
checked => check_params( $config, $params ),
|
|
},
|
|
};
|
|
$request = uac::prepare_request( $request, $user_presets );
|
|
$params = $request->{params}->{checked};
|
|
|
|
#process header
|
|
my $headerParams = uac::set_template_permissions( $request->{permissions}, $params );
|
|
$headerParams->{loc} = localization::get( $config, { user => $user, file => 'menu' } );
|
|
template::process( $config, 'print', template::check( $config, 'default.html' ), $headerParams );
|
|
return unless uac::check( $config, $params, $user_presets ) == 1;
|
|
|
|
our $errors = [];
|
|
|
|
if ( defined $params->{action} ) {
|
|
update_user_roles( $config, $request ) if ( $params->{action} eq 'assign' );
|
|
update_user( $config, $request ) if ( $params->{action} eq 'save' );
|
|
delete_user( $config, $request ) if ( $params->{action} eq 'delete' );
|
|
if ( $params->{action} eq 'change_password' ) {
|
|
change_password( $config, $request, $user );
|
|
$config->{access}->{write} = 0;
|
|
return;
|
|
}
|
|
}
|
|
$config->{access}->{write} = 0;
|
|
show_users( $config, $request );
|
|
|
|
sub show_users {
|
|
my ($config, $request) = @_;
|
|
|
|
my $params = $request->{params}->{checked};
|
|
|
|
my $permissions = $request->{permissions};
|
|
|
|
unless ( ( defined $permissions->{read_user} ) && ( $permissions->{read_user} == 1 ) ) {
|
|
uac::permissions_denied('read_user');
|
|
return;
|
|
}
|
|
|
|
my $max_level = $permissions->{level};
|
|
my $project_id = $params->{project_id};
|
|
my $studio_id = $params->{studio_id};
|
|
|
|
#TODO: get from presets
|
|
my $studios = studios::get( $config, { project_id => $project_id } );
|
|
my $users = uac::get_users($config);
|
|
my $roles = uac::get_roles(
|
|
$config,
|
|
{
|
|
project_id => $project_id,
|
|
studio_id => $studio_id
|
|
}
|
|
);
|
|
|
|
# print "max level:$max_level<br>";
|
|
|
|
#user roles
|
|
for my $user (@$users) {
|
|
$user->{disabled_checked} = 'selected="selected"' if ( $user->{disabled} eq '1' );
|
|
|
|
my $user_roles = uac::get_user_roles(
|
|
$config,
|
|
{
|
|
user => $user->{name},
|
|
project_id => $project_id,
|
|
studio_id => $studio_id
|
|
}
|
|
);
|
|
my @user_roles = ( map { { role => $_->{role} } } @$user_roles );
|
|
|
|
$user->{user_roles} = \@user_roles;
|
|
|
|
#mark all roles assigned to user
|
|
my $has_roles = 0;
|
|
my @assignable_roles = ();
|
|
for my $role ( reverse sort { $a->{level} <=> $b->{level} } @$roles ) {
|
|
|
|
#next if ($role->{level}>$max_level);
|
|
$role->{assigned} = 0;
|
|
my %role = %$role;
|
|
for my $user_role (@user_roles) {
|
|
if ( $role->{role} eq $user_role->{role} ) {
|
|
$role{assigned} = 1;
|
|
|
|
# print "if ($role->{role} eq $user_role->{role}<br>";
|
|
$has_roles = 1;
|
|
last;
|
|
}
|
|
}
|
|
push @assignable_roles, \%role;
|
|
}
|
|
$user->{has_roles} = $has_roles;
|
|
$user->{roles} = \@assignable_roles;
|
|
$user->{studio_id} = $studio_id;
|
|
$user->{project_id} = $project_id;
|
|
uac::set_template_permissions( $permissions, $user );
|
|
}
|
|
|
|
my $sort_by = 'name';
|
|
my @users = sort { lc( $a->{$sort_by} ) cmp lc( $b->{$sort_by} ) } @$users;
|
|
|
|
my @users_with_roles = ();
|
|
my @users_without_roles = ();
|
|
for my $user (@users) {
|
|
if ( $user->{has_roles} == 1 ) {
|
|
push @users_with_roles, $user;
|
|
} else {
|
|
push @users_without_roles, $user;
|
|
}
|
|
}
|
|
|
|
if ( $permissions->{update_user_role} == 1 ) {
|
|
@users = ( @users_with_roles, @users_without_roles );
|
|
} else {
|
|
@users = (@users_with_roles);
|
|
}
|
|
|
|
$params->{users} = \@users;
|
|
$params->{studios} = $studios;
|
|
$params->{permissions} = $permissions;
|
|
$params->{errors} = $errors;
|
|
$params->{loc} = localization::get( $config, { user => $params->{presets}->{user}, file => 'users' } );
|
|
uac::set_template_permissions( $permissions, $params );
|
|
|
|
template::process( $config, 'print', $params->{template}, $params );
|
|
|
|
}
|
|
|
|
sub update_user {
|
|
my ($config, $request) = @_;
|
|
|
|
my $params = $request->{params}->{checked};
|
|
my $permissions = $request->{permissions};
|
|
|
|
my $user = {
|
|
full_name => $params->{user_full_name},
|
|
email => $params->{user_email},
|
|
id => $params->{user_id}
|
|
};
|
|
$user->{name} = $params->{user_name} if ( ( defined $params->{user_name} ) && ( $params->{user_name} ne '' ) );
|
|
|
|
if ( $permissions->{disable_user} == 1 ) {
|
|
$user->{disabled} = $params->{disabled} || 0;
|
|
}
|
|
|
|
if ( ( !defined $user->{id} ) || ( $user->{id} eq '' ) ) {
|
|
unless ( $permissions->{create_user} == 1 ) {
|
|
uac::permissions_denied('create_user');
|
|
return;
|
|
}
|
|
|
|
my $users = uac::get_users( $config, { email => $params->{user_email} } );
|
|
if ( scalar(@$users) > 0 ) {
|
|
|
|
error('There is already a user registered for the given email address');
|
|
return;
|
|
}
|
|
|
|
my $error = password_requests::isPasswordInvalid( $params->{user_password} );
|
|
error($error) if $error;
|
|
return if $error;
|
|
|
|
if ( $params->{user_password} ne $params->{user_password2} ) {
|
|
error('password mismatch');
|
|
return;
|
|
}
|
|
my $crypt = auth::crypt_password( $params->{user_password} );
|
|
$user->{salt} = $crypt->{salt};
|
|
$user->{pass} = $crypt->{crypt};
|
|
|
|
$user->{created_at} = time::time_to_datetime( time() );
|
|
$user->{modified_at} = time::time_to_datetime( time() );
|
|
$user->{created_by} = $params->{presets}->{user};
|
|
|
|
$config->{access}->{write} = 1;
|
|
uac::insert_user( $config, $user );
|
|
} else {
|
|
unless ( $permissions->{update_user} == 1 ) {
|
|
uac::permissions_denied('update_user');
|
|
return;
|
|
}
|
|
$user->{modified_at} = time::time_to_datetime( time() );
|
|
$config->{access}->{write} = 1;
|
|
uac::update_user( $config, $user );
|
|
}
|
|
}
|
|
|
|
sub change_password {
|
|
my $config = shift;
|
|
my $request = shift;
|
|
my $userName = shift;
|
|
|
|
my $params = $request->{params}->{checked};
|
|
my $permissions = $request->{permissions};
|
|
|
|
my $result = password_requests::changePassword( $config, $request, $userName );
|
|
|
|
$params->{errors} = $result->{error} if defined $result->{error};
|
|
$params->{info} = $result->{success} if defined $result->{success};
|
|
$params->{loc} = localization::get( $config, { user => $params->{presets}->{user}, file => 'users' } );
|
|
uac::set_template_permissions( $permissions, $params );
|
|
|
|
template::process( $config, 'print', template::check( $config, 'change-password' ), $params );
|
|
}
|
|
|
|
sub delete_user {
|
|
my ($config, $request) = @_;
|
|
|
|
my $permissions = $request->{permissions};
|
|
unless ( $permissions->{delete_user} == 1 ) {
|
|
uac::permissions_denied('delete_user');
|
|
return;
|
|
}
|
|
|
|
$config->{access}->{write} = 1;
|
|
my $params = $request->{params}->{checked};
|
|
uac::delete_user( $config, $params->{user_id} );
|
|
}
|
|
|
|
# add or remove user from role for given studio_id
|
|
# todo: assign/unassign role oly if max(change user rank) is < max(users rank)
|
|
sub update_user_roles {
|
|
my ($config, $request) = @_;
|
|
|
|
my $permissions = $request->{permissions};
|
|
unless ( $permissions->{update_user_role} == 1 ) {
|
|
uac::permissions_denied('update_user_role');
|
|
return;
|
|
}
|
|
my $params = $request->{params}->{checked};
|
|
my $project_id = $params->{project_id};
|
|
my $studio_id = $params->{studio_id};
|
|
my $user_id = $params->{user_id} || '';
|
|
|
|
# return undef if ($user_id eq '');
|
|
|
|
#get all roles
|
|
my $roles = uac::get_roles(
|
|
$config,
|
|
{
|
|
project_id => $project_id,
|
|
studio_id => $studio_id
|
|
}
|
|
);
|
|
|
|
#get roles for the selected user
|
|
my $user_roles = uac::get_user_roles(
|
|
$config,
|
|
{
|
|
project_id => $project_id,
|
|
studio_id => $studio_id,
|
|
user_id => $user_id
|
|
}
|
|
);
|
|
|
|
#maximum level of the user who wants to perform the update (given by $permissions)
|
|
my $max_level = $permissions->{level};
|
|
|
|
#maximum level of the user to be changed (given by $user_id)
|
|
my $max_user_level = 0;
|
|
|
|
#get all roles by id
|
|
my $role_by_id = {};
|
|
for my $role (@$roles) {
|
|
$role_by_id->{ $role->{id} } = $role;
|
|
}
|
|
|
|
#get user role by id
|
|
my $user_role_by_id = {};
|
|
for my $role (@$user_roles) {
|
|
$user_role_by_id->{ $role->{id} } = $role;
|
|
$max_user_level = $role->{level} if $max_user_level < $role->{level};
|
|
}
|
|
|
|
$config->{access}->{write} = 1;
|
|
|
|
#remove unchecked user roles
|
|
for my $user_role_id ( keys %$user_role_by_id ) {
|
|
my $user_role = $user_role_by_id->{$user_role_id};
|
|
my $role = $role_by_id->{$user_role_id};
|
|
|
|
# print "$user_role_id - $params->{role_ids}->{$user_role_id} ($studio_id)<br>";
|
|
unless ( defined $params->{role_ids}->{$user_role_id} ) {
|
|
my $message =
|
|
"remove role '$role->{role}' (level $role->{level}) from user $user_id (level $max_user_level) for studio_id=$studio_id, project_id=$project_id. Your level is $max_level";
|
|
my $update = 0;
|
|
$update = 1 if defined $permissions->{is_admin};
|
|
$update = 1
|
|
if ( ( $role_by_id->{ $user_role->{role_id} }->{level} < $max_level )
|
|
&& ( $max_user_level < $max_level ) );
|
|
if ( $update == 0 ) {
|
|
uac::permissions_denied($message);
|
|
next;
|
|
}
|
|
my $result = uac::remove_user_role(
|
|
$config,
|
|
{
|
|
project_id => $project_id,
|
|
studio_id => $studio_id,
|
|
user_id => $user_id,
|
|
role_id => $user_role_id
|
|
}
|
|
);
|
|
unless ( defined $result ) {
|
|
uac::print_error("missing parameter on remove user role");
|
|
return;
|
|
}
|
|
if ( $result == 0 ) {
|
|
uac::print_error("no changes");
|
|
return;
|
|
}
|
|
uac::print_info($message);
|
|
}
|
|
}
|
|
|
|
#insert/update user roles
|
|
for my $role_id ( keys %{ $params->{role_ids} } ) {
|
|
my $role = $role_by_id->{$role_id};
|
|
unless ( defined $user_role_by_id->{$role_id} ) {
|
|
my $message =
|
|
"assign role $role->{role} (level $role->{level}) to user (level $max_user_level). Your level is $max_level";
|
|
|
|
# print "user role id: $role->{id}<br>\n";
|
|
my $update = 0;
|
|
$update = 1 if defined $permissions->{is_admin};
|
|
$update = 1
|
|
if ( ( $role_by_id->{ $role->{id} }->{level} < $max_level )
|
|
&& ( $max_user_level < $max_level ) );
|
|
if ( $update == 0 ) {
|
|
uac::permissions_denied($message);
|
|
next;
|
|
}
|
|
uac::assign_user_role(
|
|
$config,
|
|
{
|
|
project_id => $project_id,
|
|
studio_id => $studio_id,
|
|
user_id => $user_id,
|
|
role_id => $role_id
|
|
}
|
|
);
|
|
uac::print_info($message);
|
|
}
|
|
}
|
|
$config->{access}->{write} = 0;
|
|
}
|
|
|
|
sub check_params {
|
|
my $config = shift;
|
|
my $params = shift;
|
|
|
|
my $checked = {};
|
|
|
|
my $template = '';
|
|
$template = template::check( $config, $params->{template}, 'users' );
|
|
$checked->{template} = $template;
|
|
|
|
entry::set_numbers( $checked, $params, [
|
|
'project_id', 'user_id', 'default_studio_id', 'studio_id', 'disabled']);
|
|
|
|
if ( defined $checked->{studio_id} ) {
|
|
$checked->{default_studio_id} = $checked->{studio_id};
|
|
} else {
|
|
$checked->{studio_id} = -1;
|
|
}
|
|
|
|
entry::set_strings( $checked, $params,
|
|
[ 'user_name', 'user_full_name', 'user_email', 'user_password', 'user_password2' ]
|
|
);
|
|
|
|
$checked->{action} = entry::element_of( $params->{action},
|
|
['save', 'assign', 'delete', 'change_password']);
|
|
|
|
if ( $params->{action} eq 'assign' ) {
|
|
$checked->{action} = $params->{action};
|
|
for my $param ( keys %$params ) {
|
|
$checked->{role_ids}->{$1} = 1 if ( $param =~ /^role_(\d+)$/ );
|
|
}
|
|
}
|
|
|
|
return $checked;
|
|
}
|
|
|
|
sub error {
|
|
push @$errors, { error => $_[0] };
|
|
}
|
|
|