chamilo
/
chamilo-lms
mirror of https://github.com/chamilo/chamilo-lms/tree/1.11.x
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

"Super admins" can't be modified by "simple admins" see BT#3738

Browse Source
skala
Julio Montoya 13 years ago
parent 8d927bc7b6
commit 6093f148b0
4 changed files with 132 additions and 124 deletions
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Show Stats Download Patch File Download Diff File
  1. 5
      main/admin/user_edit.php
  2. 187
      main/admin/user_list.php
  3. 18
      main/inc/ajax/user_manager.ajax.php
  4. 46
      main/inc/lib/main_api.lib.php

5
main/admin/user_edit.php
Unescape View File

@ -15,6 +15,10 @@ $this_section = SECTION_PLATFORM_ADMIN;
api_protect_admin_script();
$user_id = isset($_GET['user_id']) ? intval($_GET['user_id']) : intval($_POST['user_id']);
api_protect_super_admin($user_id);
$htmlHeadXtra[] = '
<script type="text/javascript">
<!--
@ -55,7 +59,6 @@ require_once $libpath.'fileManage.lib.php';
require_once $libpath.'fileUpload.lib.php';
require_once $libpath.'mail.lib.inc.php';
$user_id = isset($_GET['user_id']) ? intval($_GET['user_id']) : intval($_POST['user_id']);
$noPHP_SELF = true;
$tool_name = get_lang('ModifyUserInfo');

187
main/admin/user_list.php
Unescape View File

@ -19,6 +19,8 @@ if (isset($_configuration['deny_delete_users']) && $_configuration['deny_delete
$delete_user_available = false;
}
$iam_a_global_admin = api_is_global_platform_admin();
$htmlHeadXtra[] = api_get_jquery_ui_js();
$htmlHeadXtra[] = '<script type="text/javascript">
@ -57,20 +59,24 @@ function active_user(element_div) {
type: "GET",
url: "'.api_get_path(WEB_AJAX_PATH).'user_manager.ajax.php?a=active_user",
data: "user_id="+user_id[1]+"&status="+status,
success: function(datos) {
if (status == 1) {
success: function(data) {
if (data == 1) {
$(ident).attr("src","'.api_get_path(WEB_IMG_PATH).'icons/16/accept.png'.'");
$(ident).attr("title","'.get_lang('Lock').'");
} else {
}
if (data == 0) {
$(ident).attr("src","'.api_get_path(WEB_IMG_PATH).'icons/16/error.png'.'");
$(ident).attr("title","'.get_lang('Unlock').'");
}
if (data == -1) {
$(ident).attr("src","'.api_get_path(WEB_IMG_PATH).'icons/16/warning.png'.'");
$(ident).attr("title","'.get_lang('ActionNotAllowed').'");
}
}
});
}
}
function clear_course_list (div_course) {
$("div#"+div_course).html("&nbsp;");
$("div#"+div_course).hide("");
@ -218,6 +224,7 @@ $htmlHeadXtra[] = '<style>
</style>';
$this_section = SECTION_PLATFORM_ADMIN;
api_protect_admin_script(true);
/**
@ -229,8 +236,21 @@ api_protect_admin_script(true);
* @author Evie Embrechts
* @author Yannick Warnier <yannick.warnier@dokeos.com>
*/
function login_user($user_id) {
//init
function login_user($user_id) {
$user_id = intval($user_id);
if (empty($user_id)) {
return false;
}
if ($user_id != strval(intval($user_id))) {
return false;
}
//Only superadmins can login to admin accounts
if (!api_global_admin_can_edit_admin($user_id)) {
return false;
}
//Load $_user to be sure we clean it before logging in
global $uidReset, $loginFailed, $_configuration, $_user;
@ -238,28 +258,17 @@ function login_user($user_id) {
$main_admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
$track_e_login_table = Database::get_statistic_table(TABLE_STATISTIC_TRACK_E_LOGIN);
//logic
unset($_user['user_id']); // uid not in session ? prevent any hacking
if (!isset ($user_id)) {
$uidReset = true;
return;
}
if ($user_id != strval(intval($user_id))) {
return false;
}
$sql_query = "SELECT * FROM $main_user_table WHERE user_id='$user_id'";
$sql_result = Database::query($sql_query);
$result = Database :: fetch_array($sql_result);
$user_info = api_get_user_info($user_id);
// check if the user is allowed to 'login_as'
$can_login_as = (api_is_platform_admin() OR (api_is_session_admin() && $result['status'] == 5 ));
$can_login_as = (api_is_platform_admin() OR (api_is_session_admin() && $user_info['status'] == 5 ));
if (!$can_login_as) { return false; }
$firstname = $result['firstname'];
$lastname = $result['lastname'];
$user_id = $result['user_id'];
$firstname = $user_info['firstname'];
$lastname = $user_info['lastname'];
$user_id = $user_info['user_id'];
//$message = "Attempting to login as ".api_get_person_name($firstname, $lastname)." (id ".$user_id.")";
if (api_is_western_name_order()) {
@ -315,11 +324,11 @@ function login_user($user_id) {
$is_allowedCreateCourse = (bool) ($user_data['status'] == 1);
// Filling session variables with new data
$_SESSION['_uid'] = $user_id;
$_SESSION['_user'] = $_user;
$_SESSION['is_platformAdmin'] = $is_platformAdmin;
$_SESSION['_uid'] = $user_id;
$_SESSION['_user'] = $_user;
$_SESSION['is_platformAdmin'] = $is_platformAdmin;
$_SESSION['is_allowedCreateCourse'] = $is_allowedCreateCourse;
$_SESSION['login_as'] = true; // will be usefull later to know if the user is actually an admin or not (example reporting)s
$_SESSION['login_as'] = true; // will be useful later to know if the user is actually an admin or not (example reporting)s
$target_url = api_get_path(WEB_PATH)."user_portal.php";
//$message .= "<br/>Login successful. Go to <a href=\"$target_url\">$target_url</a>";
@ -375,13 +384,13 @@ function get_number_of_users() {
$keyword_admin = ' AND a.user_id = u.user_id ';
}
$keyword_extra_value = '';
if (isset($_GET['keyword_extra_data'])) {
if (!empty($_GET['keyword_extra_data']) && !empty($_GET['keyword_extra_data_text'])) {
$keyword_extra_data_text = Database::escape_string($_GET['keyword_extra_data_text']);
$keyword_extra_value = " AND ufv.field_value LIKE '%".trim($keyword_extra_data_text)."%' ";
}
}
$keyword_extra_value = '';
if (isset($_GET['keyword_extra_data'])) {
if (!empty($_GET['keyword_extra_data']) && !empty($_GET['keyword_extra_data_text'])) {
$keyword_extra_data_text = Database::escape_string($_GET['keyword_extra_data_text']);
$keyword_extra_value = " AND ufv.field_value LIKE '%".trim($keyword_extra_data_text)."%' ";
}
}
$keyword_active = isset($_GET['keyword_active']);
$keyword_inactive = isset($_GET['keyword_inactive']);
@ -418,8 +427,7 @@ function get_number_of_users() {
* @param string Order (ASC,DESC)
* @see SortableTable#get_table_data($from)
*/
function get_user_data($from, $number_of_items, $column, $direction)
{
function get_user_data($from, $number_of_items, $column, $direction) {
global $origin;
$user_table = Database :: get_main_table(TABLE_MAIN_USER);
@ -446,14 +454,14 @@ function get_user_data($from, $number_of_items, $column, $direction)
$sql.= " INNER JOIN $access_url_rel_user_table url_rel_user ON (u.user_id=url_rel_user.user_id)";
}
if (isset($_GET['keyword_extra_data'])) {
$keyword_extra_data = Database::escape_string($_GET['keyword_extra_data']);
if (!empty($keyword_extra_data)) {
$extra_info = UserManager::get_extra_field_information_by_name($keyword_extra_data);
$field_id = $extra_info['id'];
$sql.= " INNER JOIN user_field_values ufv ON u.user_id=ufv.user_id AND ufv.field_id=$field_id ";
}
if (isset($_GET['keyword_extra_data'])) {
$keyword_extra_data = Database::escape_string($_GET['keyword_extra_data']);
if (!empty($keyword_extra_data)) {
$extra_info = UserManager::get_extra_field_information_by_name($keyword_extra_data);
$field_id = $extra_info['id'];
$sql.= " INNER JOIN user_field_values ufv ON u.user_id=ufv.user_id AND ufv.field_id=$field_id ";
}
}
if (isset ($_GET['keyword'])) {
$keyword = Database::escape_string(trim($_GET['keyword']));
@ -547,8 +555,7 @@ function get_user_data($from, $number_of_items, $column, $direction)
* @param string $email An email-address
* @return string HTML-code with a mailto-link
*/
function email_filter($email)
{
function email_filter($email) {
return Display :: encrypted_mailto_link($email, $email);
}
@ -559,7 +566,6 @@ function email_filter($email)
*/
function user_filter($name, $params, $row) {
return '<a href="'.api_get_path(WEB_PATH).'whoisonline.php?origin=user_list&id='.$row[0].'">'.$name.'</a>';
}
/**
@ -569,9 +575,10 @@ function user_filter($name, $params, $row) {
* @param array Row of elements to alter
* @return string Some HTML-code with modify-buttons
*/
function modify_filter($user_id,$url_params,$row) {
global $charset, $_user, $_admins_list, $delete_user_available;
$is_admin = in_array($user_id,$_admins_list);
function modify_filter($user_id, $url_params, $row) {
global $charset, $_user, $_admins_list, $delete_user_available, $iam_a_global_admin;
$is_admin = in_array($user_id,$_admins_list);
$statusname = api_get_status_langvars();
$user_is_anonymous = false;
if ($row['7'] == $statusname[ANONYMOUS]) {
@ -598,7 +605,12 @@ function modify_filter($user_id,$url_params,$row) {
//only allow platform admins to login_as, or session admins only for students (not teachers nor other admins)
if (api_is_platform_admin() || (api_is_session_admin() && $row['7'] == $statusname[STUDENT])) {
if (!$user_is_anonymous) {
$result .= '<a href="user_list.php?action=login_as&amp;user_id='.$user_id.'&amp;sec_token='.$_SESSION['sec_token'].'">'.Display::return_icon('login_as.gif', get_lang('LoginAs')).'</a>&nbsp;&nbsp;';
if (api_global_admin_can_edit_admin($user_id)) {
$result .= '<a href="user_list.php?action=login_as&amp;user_id='.$user_id.'&amp;sec_token='.$_SESSION['sec_token'].'">'.Display::return_icon('login_as.gif', get_lang('LoginAs')).'</a>&nbsp;&nbsp;';
} else {
$result .= Display::return_icon('login_as_na.gif', get_lang('LoginAs')).'&nbsp;&nbsp;';
}
//$result .= '<a href="user_list.php?action=login_as&amp;user_id='.$user_id.'&amp;sec_token='.$_SESSION['sec_token'].'">'.Display::return_icon('login_as.gif', get_lang('LoginAs')).'</a>&nbsp;&nbsp;';
} else {
$result .= Display::return_icon('login_as_na.gif', get_lang('LoginAs')).'&nbsp;&nbsp;';
}
@ -612,15 +624,14 @@ function modify_filter($user_id,$url_params,$row) {
}
if (api_is_platform_admin()) {
if (!$user_is_anonymous) {
$result .= '<a href="user_edit.php?user_id='.$user_id.'">'.Display::return_icon('edit.png', get_lang('Edit'), array(), 22).'</a>&nbsp;';
if (!$user_is_anonymous && api_global_admin_can_edit_admin($user_id)) {
$result .= '<a href="user_edit.php?user_id='.$user_id.'">'.Display::return_icon('edit.png', get_lang('Edit'), array(), 22).'</a>&nbsp;';
} else {
$result .= Display::return_icon('edit_na.png', get_lang('Edit'), array(), 22).'</a>&nbsp;';
$result .= Display::return_icon('edit_na.png', get_lang('Edit'), array(), 22).'</a>&nbsp;';
}
}
if ($is_admin) {
$result .= Display::return_icon('admin_star.png', get_lang('IsAdministrator'),array('width'=> 22, 'heigth'=> 22));
} else {
$result .= Display::return_icon('admin_star_na.png', get_lang('IsNotAdministrator'));
}
@ -641,12 +652,10 @@ function modify_filter($user_id,$url_params,$row) {
}
}
if (api_is_platform_admin()) {
if (api_is_platform_admin()) {
$result .= ' <a href="'.api_get_path(WEB_AJAX_PATH).'agenda.ajax.php?a=get_user_agenda&amp;user_id='.$user_id.'" class="agenda_opener">'.Display::return_icon('month.png', get_lang('FreeBusyCalendar'), array(), 22).'</a>';
if ($delete_user_available) {
if ($row[0] != $_user['user_id'] && !$user_is_anonymous) {
if ($delete_user_available) {
if ($row[0] != $_user['user_id'] && !$user_is_anonymous && api_global_admin_can_edit_admin($user_id)) {
// you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
$result .= ' <a href="user_list.php?action=delete_user&amp;user_id='.$user_id.'&amp;'.$url_params.'&amp;sec_token='.$_SESSION['sec_token'].'" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."'".')) return false;">'.Display::return_icon('delete.png', get_lang('Delete'), array(), 22).'</a>';
} else {
@ -654,8 +663,6 @@ function modify_filter($user_id,$url_params,$row) {
}
}
}
return $result;
}
@ -693,39 +700,6 @@ function active_filter($active, $url_params, $row) {
return $result;
}
/**
* Lock or unlock a user
* @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
* @param int $status, do we want to lock the user ($status=lock) or unlock it ($status=unlock)
* @param int $user_id The user id
* @return language variable
*/
function lock_unlock_user($status,$user_id)
{
$user_table = Database :: get_main_table(TABLE_MAIN_USER);
if ($status=='lock')
{
$status_db='0';
$return_message=get_lang('UserLocked');
}
if ($status=='unlock')
{
$status_db='1';
$return_message=get_lang('UserUnlocked');
}
if(($status_db=='1' OR $status_db=='0') AND is_numeric($user_id))
{
$sql="UPDATE $user_table SET active='".Database::escape_string($status_db)."' WHERE user_id='".Database::escape_string($user_id)."'";
$result = Database::query($sql);
}
if ($result)
{
return $return_message;
}
}
/**
* Instead of displaying the integer of the status, we give a translation for the status
*
@ -735,8 +709,7 @@ function lock_unlock_user($status,$user_id)
* @version march 2008
* @author Patrick Cool <patrick.cool@UGent.be>, Ghent University, Belgium
*/
function status_filter($status)
{
function status_filter($status) {
$statusname = api_get_status_langvars();
return $statusname[$status];
}
@ -761,12 +734,8 @@ if (isset($_GET['keyword']) || isset($_GET['keyword_firstname'])) {
$tool_name = get_lang('UserList');
}
//Display :: display_header($tool_name, "");
$message = '';
//api_display_tool_title($tool_name);
if (isset ($_GET['action'])) {
$check = Security::check_token('get');
if ($check) {
@ -785,8 +754,11 @@ if (isset ($_GET['action'])) {
break;
case 'delete_user' :
if (api_is_platform_admin()) {
if ($delete_user_available) {
if ($user_id != $_user['user_id'] && UserManager :: delete_user($_GET['user_id'])) {
$user_to_delete = $_GET['user_id'];
$current_user_id = api_get_user_id();
if ($delete_user_available && api_global_admin_can_edit_admin($_GET['user_id'])) {
if ($user_to_delete != $current_user_id && UserManager :: delete_user($_GET['user_id'])) {
$message = Display :: return_message(get_lang('UserDeleted'), 'confirmation');
} else {
$message = Display :: return_message(get_lang('CannotDeleteUserBecauseOwnsCourse'), 'error');
@ -796,15 +768,6 @@ if (isset ($_GET['action'])) {
}
}
break;
case 'lock' :
$message=lock_unlock_user('lock',$_GET['user_id']);
$message =Display :: return_message($message);
break;
case 'unlock';
$message=lock_unlock_user('unlock',$_GET['user_id']);
$message =Display :: return_message($message);
break;
}
Security::clear_token();
}
@ -917,8 +880,6 @@ $status_options[SESSIONADMIN] = get_lang('Administrator');
$form->addElement('select','keyword_status',get_lang('Profile'),$status_options, array('style'=>'margin-left:17px'));
$form->addElement('html', '</td></tr>');
$form->addElement('html', '<tr><td>');
$active_group = array();
$active_group[] = $form->createElement('checkbox','keyword_active','',get_lang('Active'), array('style'=>'margin-left:17px'));
@ -999,4 +960,4 @@ $tpl = new Template($tool_name);
$tpl->assign('actions', $actions);
$tpl->assign('message', $message);
$tpl->assign('content', $form.$table);
$tpl->display_one_col_template();
$tpl->display_one_col_template();

18
main/inc/ajax/user_manager.ajax.php
Unescape View File

@ -46,15 +46,18 @@ switch ($action) {
</div>
<?php
}
break;
break;
case 'active_user':
if (api_is_platform_admin()) {
if (api_is_platform_admin() && api_global_admin_can_edit_admin($_GET['user_id'])) {
$user_id = intval($_GET['user_id']);
$status = intval($_GET['status']);
if (!empty($user_id)) {
$user_table = Database :: get_main_table(TABLE_MAIN_USER);
$sql="UPDATE $user_table SET active='".$status."' WHERE user_id='".Database::escape_string($user_id)."'";
$sql="UPDATE $user_table SET active='".$status."' WHERE user_id='".$user_id."'";
$result = Database::query($sql);
//Send and email if account is active
if ($status == 1) {
$user_info = api_get_user_info($user_id);
@ -70,12 +73,13 @@ switch ($action) {
//$emailbody.=get_lang('Problem'). "\n\n". get_lang('Formula');
$emailbody.=api_get_person_name(api_get_setting('administratorName'), api_get_setting('administratorSurname'))."\n". get_lang('Manager'). " ".api_get_setting('siteName')."\nT. ".api_get_setting('administratorTelephone')."\n" .get_lang('Email') ." : ".api_get_setting('emailAdministrator');
$result = api_mail($recipient_name, $user_info['mail'], $emailsubject, $emailbody, $sender_name, $email_admin);
}
}
}
echo $status;
}
} else {
echo '';
echo '-1';
}
break;
break;
default:
echo '';
}

46
main/inc/lib/main_api.lib.php
Unescape View File

@ -1935,6 +1935,17 @@ function api_is_platform_admin($allow_sessions_admins = false) {
return $allow_sessions_admins && $_user['status'] == SESSIONADMIN;
}
function api_is_platform_admin_by_id($user_id = null) {
$user_id = intval($user_id);
if (empty($user_id)) {
$user_id = api_get_user_id();
}
$admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
$sql = "SELECT * FROM $admin_table WHERE user_id = $user_id";
$res = Database::query($sql);
return Database::num_rows($res) === 1;
}
/**
* Checks whether current user is allowed to create courses
* @return boolean True if the user has course creation rights,
@ -5170,7 +5181,7 @@ function api_is_global_platform_admin($user_id = null) {
if (empty($user_id)) {
$user_id = api_get_user_id();
}
if (api_is_platform_admin()) {
if (api_is_platform_admin_by_id($user_id)) {
$my_url_list = api_get_access_url_from_user($user_id);
// The admin is registered in the first "main" site with access_url_id = 1
if (in_array(1, $my_url_list)) {
@ -5182,6 +5193,37 @@ function api_is_global_platform_admin($user_id = null) {
return false;
}
function api_global_admin_can_edit_admin($admin_id_to_check, $my_user_id = null) {
if (empty($my_user_id)) {
$my_user_id = api_get_user_id();
}
$iam_a_global_admin = api_is_global_platform_admin($my_user_id);
$user_is_global_admin = api_is_global_platform_admin($admin_id_to_check);
if ($iam_a_global_admin) {
//global admin can edit everything
return true;
} else {
//If i'm a simple admin
if (api_is_platform_admin_by_id($my_user_id)) {
if ($user_is_global_admin) {
return false;
} else {
return true;
}
} else {
return false;
}
}
}
function api_protect_super_admin($admin_id_to_check, $my_user_id = null) {
if (api_global_admin_can_edit_admin($admin_id_to_check, $my_user_id)) {
return true;
} else {
api_not_allowed();
}
}
/**
* Function used to protect a global admin script.
@ -5563,8 +5605,6 @@ function api_get_unique_id() {
return $id;
}
function api_get_home_path() {
$home = 'home/';
if (api_get_multiple_access_url()) {

Write Preview
Loading…
Cancel
Save