This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | /* |
||
4 | * This file is part of the Icybee package. |
||
5 | * |
||
6 | * (c) Olivier Laviale <[email protected]> |
||
7 | * |
||
8 | * For the full copyright and license information, please view the LICENSE |
||
9 | * file that was distributed with this source code. |
||
10 | */ |
||
11 | |||
12 | namespace Icybee\Modules\Users\Block; |
||
13 | |||
14 | use Brickrouge\Group; |
||
15 | |||
16 | |||
17 | use Brickrouge\Document; |
||
18 | use Brickrouge\Element; |
||
19 | use Brickrouge\Form; |
||
20 | use Brickrouge\Text; |
||
21 | use Brickrouge\Widget; |
||
22 | |||
23 | use Icybee\Modules\Users\Module; |
||
24 | use Icybee\Modules\Users\Roles\Binding\UserBindings; |
||
25 | use Icybee\Modules\Users\User; |
||
26 | |||
27 | /** |
||
28 | * A block to edit users. |
||
29 | * |
||
30 | * @property User|UserBindings $record |
||
31 | * @property User $user |
||
32 | */ |
||
33 | class EditBlock extends \Icybee\Block\EditBlock |
||
34 | { |
||
35 | static protected function add_assets(Document $document) |
||
36 | { |
||
37 | parent::add_assets($document); |
||
38 | |||
39 | $document->js->add(\Icybee\Modules\Users\DIR . 'public/admin.js'); |
||
40 | } |
||
41 | |||
42 | protected function get_permission() |
||
43 | { |
||
44 | $user = $this->user; |
||
45 | |||
46 | if ($user->has_permission(Module::PERMISSION_MANAGE, $this->module)) |
||
47 | { |
||
48 | return true; |
||
49 | } |
||
50 | else if ($user->uid == $this->record->uid && $user->has_permission('modify own profile')) |
||
51 | { |
||
52 | return true; |
||
53 | } |
||
54 | |||
55 | return parent::get_permission(); |
||
56 | } |
||
57 | |||
58 | protected function get_user() |
||
59 | { |
||
60 | return $this->app->user; |
||
61 | } |
||
62 | |||
63 | protected function lazy_get_attributes() |
||
64 | { |
||
65 | return \ICanBoogie\array_merge_recursive(parent::lazy_get_attributes(), [ |
||
66 | |||
67 | Element::GROUPS => [ |
||
68 | |||
69 | 'connection' => [ 'title' => 'Connection' ], |
||
70 | 'advanced' => [ 'title' => 'Advanced' ] |
||
71 | |||
72 | ] |
||
73 | |||
74 | ]); |
||
75 | } |
||
76 | |||
77 | protected function lazy_get_children() |
||
78 | { |
||
79 | $values = $this->values; |
||
80 | $user = $this->user; |
||
81 | $uid = $values[User::UID]; |
||
82 | $languages = $this->app->locale['languages']; |
||
83 | |||
84 | uasort($languages, 'ICanBoogie\unaccent_compare_ci'); |
||
85 | |||
86 | $administer = $user->has_permission(Module::PERMISSION_MANAGE, $this->module); |
||
87 | |||
88 | return array_merge(parent::lazy_get_children(), [ |
||
89 | |||
90 | # |
||
91 | # name group |
||
92 | # |
||
93 | |||
94 | User::FIRSTNAME => new Text([ |
||
95 | |||
96 | Group::LABEL => 'firstname' |
||
97 | |||
98 | ]), |
||
99 | |||
100 | User::LASTNAME => new Text([ |
||
101 | |||
102 | Group::LABEL => 'lastname' |
||
103 | |||
104 | ]), |
||
105 | |||
106 | User::NICKNAME => new Text([ |
||
107 | |||
108 | Group::LABEL => 'Nickname' |
||
109 | |||
110 | ]), |
||
111 | |||
112 | User::USERNAME => $administer ? new Text([ |
||
113 | |||
114 | Group::LABEL => 'username', |
||
115 | Element::REQUIRED => true |
||
116 | |||
117 | ]) : null, |
||
118 | |||
119 | User::NAME_AS => $this->create_control_for_name_as(), |
||
120 | |||
121 | # |
||
122 | # connection group |
||
123 | # |
||
124 | |||
125 | User::EMAIL => new Text([ |
||
126 | |||
127 | Group::LABEL => 'email', |
||
128 | Element::GROUP => 'connection', |
||
129 | Element::REQUIRED => true, |
||
130 | Element::VALIDATION => 'email', |
||
131 | |||
132 | 'autocomplete' => 'off' |
||
133 | |||
134 | ]), |
||
135 | |||
136 | User::PASSWORD => new Text([ |
||
137 | |||
138 | Element::LABEL => 'password', |
||
139 | Element::LABEL_POSITION => 'above', |
||
140 | Element::DESCRIPTION => 'password_' . ($uid ? 'update' : 'new'), |
||
141 | Element::GROUP => 'connection', |
||
142 | |||
143 | 'autocomplete' => 'off', |
||
144 | 'type' => 'password', |
||
145 | 'value' => '' |
||
146 | |||
147 | ]), |
||
148 | |||
149 | User::PASSWORD . '-verify' => new Text([ |
||
150 | |||
151 | Element::LABEL => 'password_confirm', |
||
152 | Element::LABEL_POSITION => 'above', |
||
153 | Element::DESCRIPTION => 'password_confirm', |
||
154 | Element::GROUP => 'connection', |
||
155 | |||
156 | 'autocomplete' => 'off', |
||
157 | 'type' => 'password', |
||
158 | 'value' => '' |
||
159 | |||
160 | ]), |
||
161 | |||
162 | User::IS_ACTIVATED => ($uid == 1 || !$administer) ? null : new Element(Element::TYPE_CHECKBOX, [ |
||
163 | |||
164 | Element::LABEL => 'is_activated', |
||
165 | Element::GROUP => 'connection', |
||
166 | Element::DESCRIPTION => 'is_activated' |
||
167 | |||
168 | ]), |
||
169 | |||
170 | User::ROLES => $this->create_control_for_role(), |
||
171 | |||
172 | User::LANGUAGE => new Element('select', [ |
||
173 | |||
174 | Group::LABEL => 'language', |
||
175 | Element::GROUP => 'advanced', |
||
176 | Element::DESCRIPTION => 'language', |
||
177 | Element::OPTIONS => [ null => '' ] + $languages |
||
178 | |||
179 | ]), |
||
180 | |||
181 | 'timezone' => new Widget\TimeZone([ |
||
182 | |||
183 | Group::LABEL => 'timezone', |
||
184 | Element::GROUP => 'advanced', |
||
185 | Element::DESCRIPTION =>'timezone' |
||
186 | |||
187 | ]), |
||
188 | |||
189 | User::RESTRICTED_SITES => $this->create_control_for_restricted_sites_ids() |
||
190 | |||
191 | ]); |
||
192 | } |
||
193 | |||
194 | protected function alter_actions(array $actions, array $params) |
||
195 | { |
||
196 | $actions = parent::alter_actions($actions, $params); |
||
197 | |||
198 | $user = $this->user; |
||
199 | $record = $this->record; |
||
200 | |||
201 | if ($record && $record->uid == $user->uid && !$user->has_permission(Module::PERMISSION_ADMINISTER, $this->module)) |
||
202 | { |
||
203 | unset($actions[\Icybee\OPERATION_SAVE_MODE]); |
||
204 | } |
||
205 | |||
206 | return $actions; |
||
207 | } |
||
208 | |||
209 | protected function create_control_for_role() |
||
210 | { |
||
211 | $user = $this->user; |
||
212 | $uid = $this->values[User::UID]; |
||
213 | |||
214 | if ($uid == 1 || !$user->has_permission(Module::PERMISSION_ADMINISTER, $this->module)) |
||
215 | { |
||
216 | return null; |
||
217 | } |
||
218 | |||
219 | $rid = [ 2 => true ]; |
||
220 | |||
221 | if ($uid) |
||
222 | { |
||
223 | foreach ($this->record->roles as $role) |
||
224 | { |
||
225 | $rid[$role->rid] = true; |
||
226 | } |
||
227 | } |
||
228 | |||
229 | $options = $this->app |
||
230 | ->models['users.roles'] |
||
231 | ->select('rid, name') |
||
232 | ->where('rid != 1') |
||
233 | ->order('rid') |
||
234 | ->pairs; |
||
235 | |||
236 | return new Element(Element::TYPE_CHECKBOX_GROUP, [ |
||
237 | |||
238 | Form::LABEL => 'roles', |
||
0 ignored issues
–
show
|
|||
239 | Element::GROUP => 'advanced', |
||
240 | Element::OPTIONS => $options, |
||
241 | Element::OPTIONS_DISABLED => [ 2 => true ], |
||
242 | Element::REQUIRED => true, |
||
243 | Element::DESCRIPTION => 'roles', |
||
244 | |||
245 | 'class' => 'framed inputs-list sortable', |
||
246 | 'value' => $rid |
||
247 | |||
248 | ]); |
||
249 | } |
||
250 | |||
251 | /** |
||
252 | * Returns the control element for the `name_as` param. |
||
253 | * |
||
254 | * @return Element |
||
255 | */ |
||
256 | protected function create_control_for_name_as() |
||
257 | { |
||
258 | $values = $this->values; |
||
259 | |||
260 | $options = [ '<username>' ]; |
||
261 | |||
262 | if ($values[User::USERNAME]) |
||
263 | { |
||
264 | $options[0] = $values[User::USERNAME]; |
||
265 | } |
||
266 | |||
267 | $firstname = $values[User::FIRSTNAME]; |
||
268 | |||
269 | if ($firstname) |
||
270 | { |
||
271 | $options[1] = $firstname; |
||
272 | } |
||
273 | |||
274 | $lastname = $values[User::LASTNAME]; |
||
275 | |||
276 | if ($lastname) |
||
277 | { |
||
278 | $options[2] = $lastname; |
||
279 | } |
||
280 | |||
281 | if ($firstname && $lastname) |
||
282 | { |
||
283 | $options[3] = $firstname . ' ' . $lastname; |
||
284 | $options[4] = $lastname . ' ' . $firstname; |
||
285 | } |
||
286 | |||
287 | $nickname = $values[User::NICKNAME]; |
||
288 | |||
289 | if ($nickname) |
||
290 | { |
||
291 | $options[User::NAME_AS_NICKNAME] = $nickname; |
||
292 | } |
||
293 | |||
294 | return new Element('select', [ |
||
295 | |||
296 | Group::LABEL => 'name_as', |
||
297 | Element::OPTIONS => $options |
||
298 | |||
299 | ]); |
||
300 | } |
||
301 | |||
302 | protected function create_control_for_restricted_sites_ids() |
||
303 | { |
||
304 | $user = $this->user; |
||
305 | |||
306 | if (!$user->has_permission(Module::PERMISSION_ADMINISTER, $this->module)) |
||
307 | { |
||
308 | return null; |
||
309 | } |
||
310 | |||
311 | $value = []; |
||
312 | |||
313 | if ($this->record) |
||
314 | { |
||
315 | $value = $this->record->restricted_sites_ids; |
||
316 | |||
317 | if ($value) |
||
318 | { |
||
319 | $value = array_combine($value, array_fill(0, count($value), true)); |
||
320 | } |
||
321 | } |
||
322 | |||
323 | $options = $this->app |
||
324 | ->models['sites'] |
||
325 | ->select('site_id, IF(admin_title != "", admin_title, concat(title, ":", language))') |
||
326 | ->order('admin_title, title') |
||
327 | ->pairs; |
||
328 | |||
329 | if (!$options) |
||
330 | { |
||
331 | return null; |
||
332 | } |
||
333 | |||
334 | return new Element(Element::TYPE_CHECKBOX_GROUP, [ |
||
335 | |||
336 | Form::LABEL => 'site_id', |
||
0 ignored issues
–
show
|
|||
337 | Element::OPTIONS => $options, |
||
338 | Element::GROUP => 'advanced', |
||
339 | Element::DESCRIPTION => 'site_id', |
||
340 | |||
341 | 'class' => 'inputs-list widget-bordered', |
||
342 | 'value' => $value |
||
343 | |||
344 | ]); |
||
345 | } |
||
346 | } |
||
347 |
This class constant has been deprecated.