Changeset 860:e6db669b069f

Timestamp:

08/02/12 23:08:21 (13 years ago)

Author:

JcDenis

Branch:

default

Children:

861:3e2e678fef61, 1022:6c73aaf901f8

Message:

Fixes a CSRF on users deletion.
Cleaned code on users manager, fixes #1200

Files:

• admin/blog_pref.php (modified) (2 diffs)
• admin/dispatcher.php (deleted)
• admin/js/_permissions.js (deleted)
• admin/js/_permissions_blog.js (deleted)
• admin/js/_users.js (modified) (3 diffs)
• admin/js/_users_actions.js (added)
• admin/permissions.php (deleted)
• admin/permissions_blog.php (deleted)
• admin/user.php (modified) (3 diffs)
• admin/users.php (modified) (7 diffs)
• admin/users_actions.php (added)
• inc/admin/lib.pager.php (modified) (1 diff)

admin/blog_pref.php

@@ -523 +523 @@
                     ' ('.html::escapeHTML(dcUtils::getUserCN(
                          $k, $v['name'], $v['firstname'], $v['displayname']
-                    )).')';
-                    
-                    if (!$v['super'] && $core->auth->isSuperAdmin()) {
-                         echo
-                         ' - <a href="permissions.php?blog_id[]='.$blog_id.'&amp;user_id[]='.$k.'">'
-                         .__('Change permissions').'</a>';
-                    }
-                    
-                    echo '</h4>';
+                    )).')</h4>';
                     
                     echo '<ul>';
@@ -542 +534 @@
                     }
                     echo '</ul>';
+                    
+                    if (!$v['super'] && $core->auth->isSuperAdmin()) {
+                         echo 
+                         '<form action="users_actions.php" method="post">'.
+                         '<p><input type="submit" value="'.__('Change permissions').'" />'.
+                         form::hidden(array('redir'),'blog_pref.php?id='.$k).
+                         form::hidden(array('action'),'perms').
+                         form::hidden(array('users[]'),$k).
+                         form::hidden(array('blogs[]'),$blog_id).
+                         $core->formNonce().
+                         '</p>'.
+                         '</form>';
+                    }
                }
           }

admin/js/_users.js

@@ -4 +4 @@
      });
      $('#form-users').submit(function() {
-          var action = $(this).find('select[name="dispatch_action"]').val();
+          var action = $(this).find('select[name="action"]').val();
           var user_ids = new Array();
           var nb_posts = new Array();
@@ -10 +10 @@
           var msg_cannot_delete = false;
           
-          $(this).find('input[name="user_id[]"]').each(function() {
+          $(this).find('input[name="users[]"]').each(function() {
                user_ids.push(this);
           });
@@ -41 +41 @@
           
           if (action == 'deleteuser') {
-               return window.confirm(dotclear.msg.confirm_delete_user.replace('%s',$('input[name="user_id[]"]:checked').size()));
+               return window.confirm(dotclear.msg.confirm_delete_user.replace('%s',$('input[name="users[]"]:checked').size()));
           }
           

admin/user.php

@@ -290 +290 @@
 if ($user_id)
 {
-     echo '<div class="clear fieldset"><h3>'.__('Permissions').'</h3>';
+     echo '<div class="clear fieldset"><h3>'.__('Permissions').'</h3>'.
+     '<form action="users_actions.php" method="post">'.
+     '<p><input type="submit" value="'.__('Add new permissions').'" />'.
+     form::hidden(array('redir'),'user.php?id='.$user_id).
+     form::hidden(array('action'),'blogs').
+     form::hidden(array('users[]'),$user_id).
+     $core->formNonce().
+     '</p>'.
+     '</form>';
      
      $permissions = $core->getUserPermissions($user_id);
@@ -305 +313 @@
                if (count($v['p']) > 0)
                {
-                    echo '<h4><a href="blog.php?id='.html::escapeHTML($k).'">'.
-                    html::escapeHTML($v['name']).'</a> ('.html::escapeHTML($k).') - '.
-                    '<a href="permissions.php?blog_id[]='.$k.'&amp;user_id[]='.$user_id.'">'
-                    .__('Change permissions').'</a></h4>';
+                    echo 
+                    '<form action="users_actions.php" method="post">'.
+                    '<h4><a href="blog.php?id='.html::escapeHTML($k).'">'.
+                    html::escapeHTML($v['name']).'</a> ('.html::escapeHTML($k).')</h4>';
                     
                     echo '<ul>';
@@ -316 +324 @@
                          }
                     }
-                    echo '</ul>';
+                    echo '</ul>'.
+                    '<p><input type="submit" value="'.__('Change permissions').'" />'.
+                    form::hidden(array('redir'),'user.php?id='.$user_id).
+                    form::hidden(array('action'),'perms').
+                    form::hidden(array('users[]'),$user_id).
+                    form::hidden(array('blogs[]'),$k).
+                    $core->formNonce().
+                    '</p>'.
+                    '</form>';
                }
           }
      }
      
-     echo
-     '<p><a href="permissions_blog.php?user_id[]='.$user_id.'">'.
-     __('Add new permissions').'</a></p>'.
-     '</div>';
+     echo '</div>';
 }
 

admin/users.php

@@ -15 +15 @@
 dcPage::checkSuper();
 
-# Delete users
-if (!empty($delete_users))
-{
-     foreach ($delete_users as $u)
-     {
-          try
-          {
-               # --BEHAVIOR-- adminBeforeUserDelete
-               $core->callBehavior('adminBeforeUserDelete',$u);
-               if ($u != $core->auth->userID()) {
-                    $core->delUser($u);
-               }
-          }
-          catch (Exception $e)
-          {
-               $core->error->add($e->getMessage());
-          }
-     }
-     if (!$core->error->flag()) {
-          http::redirect('users.php?del=1');
-     }
-}
-
-
 # Creating filter combo boxes
 $sortby_combo = array(
-__('Username') => 'U.user_id',
+__('Username') => 'user_id',
 __('Last Name') => 'user_name',
 __('First Name') => 'user_firstname',
@@ -55 +31 @@
 # Actions combo box
 $combo_action = array(
-     __('Set permissions') => 'setpermissions',
+     __('Set permissions') => 'blogs',
      __('Delete') => 'deleteuser'
 );
@@ -89 +65 @@
      if ($order !== '' && in_array($order,$order_combo)) {
           $params['order'] = $sortby.' '.$order;
+     } else {
+          $order='asc';
+     }
+     
+     if ($sortby != 'user_id' || $order != 'asc') {
           $show_filters = true;
      }
+} else {
+     $sortby = 'user_id';
+     $order = 'asc';
 }
 
+# Get users
 try {
      $rs = $core->getUsers($params);
@@ -109 +94 @@
 }
 
-dcPage::open(__('users'),$starting_script);
+dcPage::open(__('Users'),$starting_script);
 
 if (!$core->error->flag())
@@ -115 +100 @@
      if (!empty($_GET['del'])) {
           echo '<p class="message">'.__('User has been successfully removed.').'</p>';
+     }
+     if (!empty($_GET['upd'])) {
+               echo '<p class="message">'.__('The permissions have been successfully updated.').'</p>';
      }
      
@@ -153 +141 @@
      # Show users
      $user_list->display($page,$nb_per_page,
-     '<form action="dispatcher.php" method="get" id="form-users">'.
+     '<form action="users_actions.php" method="post" id="form-users">'.
      
      '%s'.
@@ -160 +148 @@
      '<p class="col checkboxes-helpers"></p>'.
      
-     '<p class="col right"><label for="dispatch_action" class="classic">'.
+     '<p class="col right"><label for="action" class="classic">'.
      __('Selected users action:').' '.
-     form::combo('dispatch_action',$combo_action).
+     form::combo('action',$combo_action).
      '</label> '.
      '<input type="submit" value="'.__('ok').'" />'.
+     form::hidden(array('q'),html::escapeHTML($q)).
+     form::hidden(array('sortby'),$sortby).
+     form::hidden(array('order'),$order).
+     form::hidden(array('page'),$page).
+     form::hidden(array('nb'),$nb_per_page).
+     $core->formNonce().
      '</p>'.
      '</div>'.

inc/admin/lib.pager.php

@@ -407 +407 @@
           '<tr class="line">'.
           '<td class="nowrap">'.form::hidden(array('nb_post[]'),(integer) $this->rs->nb_post).
-          form::checkbox(array('user_id[]'),$this->rs->user_id).'</td>'.
+          form::checkbox(array('users[]'),$this->rs->user_id).'</td>'.
           '<td class="maximal"><a href="user.php?id='.$this->rs->user_id.'">'.
           $this->rs->user_id.'</a>&nbsp;'.$img_status.'</td>'.