Passed
Push — EXTRACT_CLASSES ( ae6b5c...83d77a )
by Rafael
60:14 queued 23:58
created

Users::index()   C

Complexity

Conditions 14
Paths 201

Size

Total Lines 65
Code Lines 38

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 14
eloc 38
nc 201
nop 8
dl 0
loc 65
rs 5.4208
c 0
b 0
f 0

How to fix   Long Method    Complexity    Many Parameters   

Long Method

Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.

For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.

Commonly applied refactorings include:

Many Parameters

Methods with many parameters are not only hard to understand, but their parameters also often become inconsistent when you need more, or different data.

There are several approaches to avoid long parameter lists:

1
<?php
2
3
/* Copyright (C) 2015       Jean-François Ferry         <[email protected]>
4
 * Copyright (C) 2020       Thibault FOUCART		    <[email protected]>
5
 * Copyright (C) 2024		MDW							<[email protected]>
6
 * Copyright (C) 2024       Frédéric France             <[email protected]>
7
 * Copyright (C) 2024       Rafael San José             <[email protected]>
8
 *
9
 * This program is free software; you can redistribute it and/or modify
10
 * it under the terms of the GNU General Public License as published by
11
 * the Free Software Foundation; either version 3 of the License, or
12
 * (at your option) any later version.
13
 *
14
 * This program is distributed in the hope that it will be useful,
15
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17
 * GNU General Public License for more details.
18
 *
19
 * You should have received a copy of the GNU General Public License
20
 * along with this program. If not, see <https://www.gnu.org/licenses/>.
21
 */
22
23
namespace Dolibarr\Code\User\Api;
24
25
use Dolibarr\Core\Base\DolibarrApi;
26
use Luracast\Restler\RestException;
27
28
use Dolibarr\Code\User\Classes\User;
29
30
require_once constant('DOL_DOCUMENT_ROOT') . '/user/class/usergroup.class.php';
31
32
/**
33
 * API class for users
34
 *
35
 * @access protected
36
 * @class  DolibarrApiAccess {@requires user,external}
37
 */
38
class Users extends DolibarrApi
39
{
40
    /**
41
     * @var array   $FIELDS     Mandatory fields, checked when create and update object
42
     */
43
    public static $FIELDS = array(
44
        'login',
45
    );
46
47
    /**
48
     * @var User $user {@type User}
49
     */
50
    public $useraccount;
51
52
    /**
53
     * Constructor
54
     */
55
    public function __construct()
56
    {
57
        global $db;
58
59
        $this->db = $db;
60
        $this->useraccount = new User($this->db);
61
    }
62
63
64
    /**
65
     * List Users
66
     *
67
     * Get a list of Users
68
     *
69
     * @param string    $sortfield  Sort field
70
     * @param string    $sortorder  Sort order
71
     * @param int       $limit      Limit for list
72
     * @param int       $page       Page number
73
     * @param string    $user_ids   User ids filter field. Example: '1' or '1,2,3'          {@pattern /^[0-9,]*$/i}
74
     * @param int       $category   Use this param to filter list by category
75
     * @param string    $sqlfilters Other criteria to filter answers separated by a comma. Syntax example "(t.ref:like:'SO-%') and (t.date_creation:<:'20160101')"
76
     * @param string    $properties Restrict the data returned to these properties. Ignored if empty. Comma separated list of properties names
77
     * @return  array               Array of User objects
78
     */
79
    public function index($sortfield = "t.rowid", $sortorder = 'ASC', $limit = 100, $page = 0, $user_ids = '0', $category = 0, $sqlfilters = '', $properties = '')
80
    {
81
        if (!DolibarrApiAccess::$user->hasRight('user', 'user', 'lire') && empty(DolibarrApiAccess::$user->admin)) {
82
            throw new RestException(403, "You are not allowed to read list of users");
83
        }
84
85
        $obj_ret = array();
86
87
        // case of external user, $societe param is ignored and replaced by user's socid
88
        //$socid = DolibarrApiAccess::$user->socid ? DolibarrApiAccess::$user->socid : $societe;
89
90
        $sql = "SELECT t.rowid";
91
        $sql .= " FROM " . MAIN_DB_PREFIX . "user AS t LEFT JOIN " . MAIN_DB_PREFIX . "user_extrafields AS ef ON (ef.fk_object = t.rowid)"; // Modification VMR Global Solutions to include extrafields as search parameters in the API GET call, so we will be able to filter on extrafields
92
        if ($category > 0) {
93
            $sql .= ", " . $this->db->prefix() . "categorie_user as c";
94
        }
95
        $sql .= ' WHERE t.entity IN (' . getEntity('user') . ')';
96
        if ($user_ids) {
97
            $sql .= " AND t.rowid IN (" . $this->db->sanitize($user_ids) . ")";
98
        }
99
100
        // Select products of given category
101
        if ($category > 0) {
102
            $sql .= " AND c.fk_categorie = " . ((int) $category);
103
            $sql .= " AND c.fk_user = t.rowid";
104
        }
105
106
        // Add sql filters
107
        if ($sqlfilters) {
108
            $errormessage = '';
109
            $sql .= forgeSQLFromUniversalSearchCriteria($sqlfilters, $errormessage);
110
            if ($errormessage) {
111
                throw new RestException(400, 'Error when validating parameter sqlfilters -> ' . $errormessage);
112
            }
113
        }
114
115
        $sql .= $this->db->order($sortfield, $sortorder);
116
        if ($limit) {
117
            if ($page < 0) {
118
                $page = 0;
119
            }
120
            $offset = $limit * $page;
121
122
            $sql .= $this->db->plimit($limit + 1, $offset);
123
        }
124
125
        $result = $this->db->query($sql);
126
127
        if ($result) {
128
            $i = 0;
129
            $num = $this->db->num_rows($result);
130
            $min = min($num, ($limit <= 0 ? $num : $limit));
131
            while ($i < $min) {
132
                $obj = $this->db->fetch_object($result);
133
                $user_static = new User($this->db);
134
                if ($user_static->fetch($obj->rowid)) {
135
                    $obj_ret[] = $this->_filterObjectProperties($this->_cleanObjectDatas($user_static), $properties);
136
                }
137
                $i++;
138
            }
139
        } else {
140
            throw new RestException(503, 'Error when retrieve User list : ' . $this->db->lasterror());
141
        }
142
143
        return $obj_ret;
144
    }
145
146
    /**
147
     * Get properties of an user object
148
     *
149
     * @param   int     $id                     ID of user
150
     * @param   int     $includepermissions     Set this to 1 to have the array of permissions loaded (not done by default for performance purpose)
151
     * @return  array|mixed                     data without useless information
152
     *
153
     * @throws RestException 401 Insufficient rights
154
     * @throws RestException 404 User or group not found
155
     */
156
    public function get($id, $includepermissions = 0)
157
    {
158
        if (!DolibarrApiAccess::$user->hasRight('user', 'user', 'lire') && empty(DolibarrApiAccess::$user->admin) && $id != 0 && DolibarrApiAccess::$user->id != $id) {
159
            throw new RestException(403, 'Not allowed');
160
        }
161
162
        if ($id == 0) {
163
            $result = $this->useraccount->initAsSpecimen();
164
        } else {
165
            $result = $this->useraccount->fetch($id);
166
        }
167
        if (!$result) {
168
            throw new RestException(404, 'User not found');
169
        }
170
171
        if ($id > 0 && !DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
172
            throw new RestException(403, 'Access not allowed for login ' . DolibarrApiAccess::$user->login);
173
        }
174
175
        if ($includepermissions) {
176
            $this->useraccount->getRights();
177
        }
178
179
        return $this->_cleanObjectDatas($this->useraccount);
180
    }
181
182
    /**
183
     * Get properties of an user object by login
184
     *
185
     * @param   string  $login                  Login of user
186
     * @param   int     $includepermissions     Set this to 1 to have the array of permissions loaded (not done by default for performance purpose)
187
     * @return  array|mixed                     Data without useless information
188
     *
189
     * @url GET login/{login}
190
     *
191
     * @throws RestException 400    Bad request
192
     * @throws RestException 401    Insufficient rights
193
     * @throws RestException 404    User or group not found
194
     */
195
    public function getByLogin($login, $includepermissions = 0)
196
    {
197
        if (empty($login)) {
198
            throw new RestException(400, 'Bad parameters');
199
        }
200
201
        if (!DolibarrApiAccess::$user->hasRight('user', 'user', 'lire') && empty(DolibarrApiAccess::$user->admin) && DolibarrApiAccess::$user->login != $login) {
202
            throw new RestException(403, 'Not allowed');
203
        }
204
205
        $result = $this->useraccount->fetch('', $login);
206
        if (!$result) {
207
            throw new RestException(404, 'User not found');
208
        }
209
210
        if (!DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
211
            throw new RestException(403, 'Access not allowed for login ' . DolibarrApiAccess::$user->login);
212
        }
213
214
        if ($includepermissions) {
215
            $this->useraccount->getRights();
216
        }
217
218
        return $this->_cleanObjectDatas($this->useraccount);
219
    }
220
221
    /**
222
     * Get properties of an user object by Email
223
     *
224
     * @param   string  $email                  Email of user
225
     * @param   int     $includepermissions     Set this to 1 to have the array of permissions loaded (not done by default for performance purpose)
226
     * @return  array|mixed                     Data without useless information
227
     *
228
     * @url GET email/{email}
229
     *
230
     * @throws RestException 400     Bad request
231
     * @throws RestException 401     Insufficient rights
232
     * @throws RestException 404     User or group not found
233
     */
234
    public function getByEmail($email, $includepermissions = 0)
235
    {
236
        if (empty($email)) {
237
            throw new RestException(400, 'Bad parameters');
238
        }
239
240
        if (!DolibarrApiAccess::$user->hasRight('user', 'user', 'lire') && empty(DolibarrApiAccess::$user->admin) && DolibarrApiAccess::$user->email != $email) {
241
            throw new RestException(403, 'Not allowed');
242
        }
243
244
        $result = $this->useraccount->fetch('', '', '', 0, -1, $email);
245
        if (!$result) {
246
            throw new RestException(404, 'User not found');
247
        }
248
249
        if (!DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
250
            throw new RestException(403, 'Access not allowed for login ' . DolibarrApiAccess::$user->login);
251
        }
252
253
        if ($includepermissions) {
254
            $this->useraccount->getRights();
255
        }
256
257
        return $this->_cleanObjectDatas($this->useraccount);
258
    }
259
260
    /**
261
     * Get more properties of a user
262
     *
263
     * @url GET /info
264
     *
265
     * @param   int         $includepermissions     Set this to 1 to have the array of permissions loaded (not done by default for performance purpose)
266
     * @return  array|mixed                         Data without useless information
267
     *
268
     * @throws RestException 401     Insufficient rights
269
     * @throws RestException 404     User or group not found
270
     */
271
    public function getInfo($includepermissions = 0)
272
    {
273
        if (!DolibarrApiAccess::$user->hasRight('user', 'self', 'creer') && !DolibarrApiAccess::$user->hasRight('user', 'user', 'lire') && empty(DolibarrApiAccess::$user->admin)) {
274
            throw new RestException(403, 'Not allowed');
275
        }
276
277
        $apiUser = DolibarrApiAccess::$user;
278
279
        $result = $this->useraccount->fetch($apiUser->id);
280
        if (!$result) {
281
            throw new RestException(404, 'User not found');
282
        }
283
284
        if (!DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
285
            throw new RestException(403, 'Access not allowed for login ' . DolibarrApiAccess::$user->login);
286
        }
287
288
        if ($includepermissions) {
289
            $this->useraccount->getRights();
290
        }
291
292
        $usergroup = new UserGroup($this->db);
293
        $userGroupList = $usergroup->listGroupsForUser($apiUser->id, false);
294
        if (!is_array($userGroupList)) {
295
            throw new RestException(404, 'User group not found');
296
        }
297
298
        $this->useraccount->user_group_list = $this->_cleanUserGroupListDatas($userGroupList);
299
300
        return $this->_cleanObjectDatas($this->useraccount);
301
    }
302
303
    /**
304
     * Create user account
305
     *
306
     * @param array $request_data New user data
307
     * @return int
308
     *
309
     * @throws RestException 401 Not allowed
310
     */
311
    public function post($request_data = null)
312
    {
313
        // Check user authorization
314
        if (!DolibarrApiAccess::$user->hasRight('user', 'creer') && empty(DolibarrApiAccess::$user->admin)) {
315
            throw new RestException(403, "User creation not allowed for login " . DolibarrApiAccess::$user->login);
316
        }
317
318
        // check mandatory fields
319
        /*if (!isset($request_data["login"]))
320
            throw new RestException(400, "login field missing");
321
        if (!isset($request_data["password"]))
322
            throw new RestException(400, "password field missing");
323
        if (!isset($request_data["lastname"]))
324
             throw new RestException(400, "lastname field missing");*/
325
326
        //assign field values
327
        foreach ($request_data as $field => $value) {
328
            if (in_array($field, array('pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key'))) {
329
                // This properties can't be set/modified with API
330
                throw new RestException(405, 'The property ' . $field . " can't be set/modified using the APIs");
331
            }
332
            if ($field === 'caller') {
333
                // Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
334
                $this->useraccount->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
335
                continue;
336
            }
337
            /*if ($field == 'pass') {
338
                if (!DolibarrApiAccess::$user->hasRight('user', 'user', 'password')) {
339
                    throw new RestException(403, 'You are not allowed to modify/set password of other users');
340
                    continue;
341
                }
342
            }
343
            */
344
345
            $this->useraccount->$field = $this->_checkValForAPI($field, $value, $this->useraccount);
346
        }
347
348
        if ($this->useraccount->create(DolibarrApiAccess::$user) < 0) {
349
            throw new RestException(500, 'Error creating', array_merge(array($this->useraccount->error), $this->useraccount->errors));
350
        }
351
        return $this->useraccount->id;
352
    }
353
354
355
    /**
356
     * Update user account
357
     *
358
     * @param   int         $id                 Id of account to update
359
     * @param   array       $request_data       Datas
360
     * @return  Object                          Updated object
361
     *
362
     * @throws RestException 403 Not allowed
363
     * @throws RestException 404 Not found
364
     * @throws RestException 500 System error
365
     */
366
    public function put($id, $request_data = null)
367
    {
368
        // Check user authorization
369
        if (!DolibarrApiAccess::$user->hasRight('user', 'user', 'creer') && empty(DolibarrApiAccess::$user->admin)) {
370
            throw new RestException(403, "User update not allowed");
371
        }
372
373
        $result = $this->useraccount->fetch($id);
374
        if (!$result) {
375
            throw new RestException(404, 'Account not found');
376
        }
377
378
        if (!DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
379
            throw new RestException(403, 'Access not allowed for login ' . DolibarrApiAccess::$user->login);
380
        }
381
382
        foreach ($request_data as $field => $value) {
383
            if (in_array($field, array('pass_crypted', 'pass_indatabase', 'pass_indatabase_crypted', 'pass_temp', 'api_key'))) {
384
                // This properties can't be set/modified with API
385
                throw new RestException(405, 'The property ' . $field . " can't be set/modified using the APIs");
386
            }
387
            if ($field == 'id') {
388
                continue;
389
            }
390
            if ($field == 'pass') {
391
                if ($this->useraccount->id != DolibarrApiAccess::$user->id && !DolibarrApiAccess::$user->hasRight('user', 'user', 'password')) {
392
                    throw new RestException(403, 'You are not allowed to modify password of other users');
393
                }
394
                if ($this->useraccount->id == DolibarrApiAccess::$user->id && !DolibarrApiAccess::$user->hasRight('user', 'self', 'password')) {
395
                    throw new RestException(403, 'You are not allowed to modify your own password');
396
                }
397
            }
398
            if ($field === 'caller') {
399
                // Add a mention of caller so on trigger called after action, we can filter to avoid a loop if we try to sync back again with the caller
400
                $this->useraccount->context['caller'] = sanitizeVal($request_data['caller'], 'aZ09');
401
                continue;
402
            }
403
404
            if (DolibarrApiAccess::$user->admin) {  // If user for API is admin
405
                if ($field == 'admin' && $value != $this->useraccount->admin && empty($value)) {
406
                    throw new RestException(403, 'Reseting the admin status of a user is not possible using the API');
407
                }
408
            } else {
409
                if ($field == 'admin' && $value != $this->useraccount->admin) {
410
                    throw new RestException(403, 'Only an admin user can modify the admin status of another user');
411
                }
412
            }
413
            if ($field == 'entity' && $value != $this->useraccount->entity) {
414
                throw new RestException(403, 'Changing entity of a user using the APIs is not possible');
415
            }
416
417
            // The status must be updated using setstatus() because it
418
            // is not handled by the update() method.
419
            if ($field == 'statut' || $field == 'status') {
420
                $result = $this->useraccount->setstatus($value);
421
                if ($result < 0) {
422
                    throw new RestException(500, 'Error when updating status of user: ' . $this->useraccount->error);
423
                }
424
            } else {
425
                $this->useraccount->$field = $this->_checkValForAPI($field, $value, $this->useraccount);
426
            }
427
        }
428
429
        // If there is no error, update() returns the number of affected
430
        // rows so if the update is a no op, the return value is zezo.
431
        if ($this->useraccount->update(DolibarrApiAccess::$user) >= 0) {
432
            return $this->get($id);
433
        } else {
434
            throw new RestException(500, $this->useraccount->error);
435
        }
436
    }
437
438
439
    /**
440
     * List the groups of a user
441
     *
442
     * @param int $id     Id of user
443
     * @return array      Array of group objects
444
     *
445
     * @throws RestException 403 Not allowed
446
     * @throws RestException 404 Not found
447
     *
448
     * @url GET {id}/groups
449
     */
450
    public function getGroups($id)
451
    {
452
        if (!DolibarrApiAccess::$user->hasRight('user', 'user', 'lire') && empty(DolibarrApiAccess::$user->admin)) {
453
            throw new RestException(403);
454
        }
455
456
        $user = new User($this->db);
457
        $result = $user->fetch($id);
458
        if (!$result) {
459
            throw new RestException(404, 'user not found');
460
        }
461
462
        $usergroup = new UserGroup($this->db);
463
        $groups = $usergroup->listGroupsForUser($id, false);
464
        $obj_ret = array();
465
        foreach ($groups as $group) {
466
            $obj_ret[] = $this->_cleanObjectDatas($group);
467
        }
468
        return $obj_ret;
469
    }
470
471
472
    /**
473
     * Add a user into a group
474
     *
475
     * @param   int     $id        User ID
476
     * @param   int     $group     Group ID
477
     * @param   int     $entity    Entity ID (valid only for superadmin in multicompany transverse mode)
478
     * @return  int                1 if success
479
     *
480
     * @throws RestException 403 Not allowed
481
     * @throws RestException 404 User not found
482
     * @throws RestException 500 System error
483
     *
484
     * @url GET {id}/setGroup/{group}
485
     */
486
    public function setGroup($id, $group, $entity = 1)
487
    {
488
        global $conf;
489
490
        if (!DolibarrApiAccess::$user->hasRight('user', 'user', 'creer') && empty(DolibarrApiAccess::$user->admin)) {
491
            throw new RestException(403);
492
        }
493
494
        $result = $this->useraccount->fetch($id);
495
        if (!$result) {
496
            throw new RestException(404, 'User not found');
497
        }
498
499
        if (!DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
500
            throw new RestException(403, 'Access not allowed for login ' . DolibarrApiAccess::$user->login);
501
        }
502
503
        if (isModEnabled('multicompany') && getDolGlobalString('MULTICOMPANY_TRANSVERSE_MODE') && !empty(DolibarrApiAccess::$user->admin) && empty(DolibarrApiAccess::$user->entity)) {
504
            $entity = (!empty($entity) ? $entity : $conf->entity);
505
        } else {
506
            // When using API, action is done on entity of logged user because a user of entity X with permission to create user should not be able to
507
            // hack the security by giving himself permissions on another entity.
508
            $entity = (DolibarrApiAccess::$user->entity > 0 ? DolibarrApiAccess::$user->entity : $conf->entity);
509
        }
510
511
        $result = $this->useraccount->SetInGroup($group, $entity);
512
        if (!($result > 0)) {
513
            throw new RestException(500, $this->useraccount->error);
514
        }
515
516
        return 1;
517
    }
518
519
    /**
520
     * List Groups
521
     *
522
     * Return an array with a list of Groups
523
     *
524
     * @url GET /groups
525
     *
526
     * @param string    $sortfield  Sort field
527
     * @param string    $sortorder  Sort order
528
     * @param int       $limit      Limit for list
529
     * @param int       $page       Page number
530
     * @param string    $group_ids   Groups ids filter field. Example: '1' or '1,2,3'          {@pattern /^[0-9,]*$/i}
531
     * @param string    $sqlfilters Other criteria to filter answers separated by a comma. Syntax example "(t.ref:like:'SO-%') and (t.date_creation:<:'20160101')"
532
     * @param string    $properties Restrict the data returned to these properties. Ignored if empty. Comma separated list of properties names
533
     * @return  array               Array of User objects
534
     *
535
     * @throws RestException 403 Not allowed
536
     * @throws RestException 404 User not found
537
     * @throws RestException 503 Error
538
     */
539
    public function listGroups($sortfield = "t.rowid", $sortorder = 'ASC', $limit = 100, $page = 0, $group_ids = '0', $sqlfilters = '', $properties = '')
540
    {
541
        global $conf;
542
543
        $obj_ret = array();
544
545
        if (
546
            (!getDolGlobalString('MAIN_USE_ADVANCED_PERMS') && !DolibarrApiAccess::$user->hasRight('user', 'user', 'lire') && empty(DolibarrApiAccess::$user->admin)) ||
547
            getDolGlobalString('MAIN_USE_ADVANCED_PERMS') && !DolibarrApiAccess::$user->hasRight('user', 'group_advance', 'read') && empty(DolibarrApiAccess::$user->admin)
548
        ) {
549
            throw new RestException(403, "You are not allowed to read groups");
550
        }
551
552
        // case of external user, $societe param is ignored and replaced by user's socid
553
        //$socid = DolibarrApiAccess::$user->socid ? DolibarrApiAccess::$user->socid : $societe;
554
555
        $sql = "SELECT t.rowid";
556
        $sql .= " FROM " . MAIN_DB_PREFIX . "usergroup AS t LEFT JOIN " . MAIN_DB_PREFIX . "usergroup_extrafields AS ef ON (ef.fk_object = t.rowid)"; // Modification VMR Global Solutions to include extrafields as search parameters in the API GET call, so we will be able to filter on extrafields
557
        $sql .= ' WHERE t.entity IN (' . getEntity('user') . ')';
558
        if ($group_ids) {
559
            $sql .= " AND t.rowid IN (" . $this->db->sanitize($group_ids) . ")";
560
        }
561
        // Add sql filters
562
        if ($sqlfilters) {
563
            $errormessage = '';
564
            $sql .= forgeSQLFromUniversalSearchCriteria($sqlfilters, $errormessage);
565
            if ($errormessage) {
566
                throw new RestException(400, 'Error when validating parameter sqlfilters -> ' . $errormessage);
567
            }
568
        }
569
570
        $sql .= $this->db->order($sortfield, $sortorder);
571
        if ($limit) {
572
            if ($page < 0) {
573
                $page = 0;
574
            }
575
            $offset = $limit * $page;
576
577
            $sql .= $this->db->plimit($limit + 1, $offset);
578
        }
579
580
        $result = $this->db->query($sql);
581
582
        if ($result) {
583
            $i = 0;
584
            $num = $this->db->num_rows($result);
585
            $min = min($num, ($limit <= 0 ? $num : $limit));
586
            while ($i < $min) {
587
                $obj = $this->db->fetch_object($result);
588
                $group_static = new UserGroup($this->db);
589
                if ($group_static->fetch($obj->rowid)) {
590
                    $obj_ret[] = $this->_filterObjectProperties($this->_cleanObjectDatas($group_static), $properties);
591
                }
592
                $i++;
593
            }
594
        } else {
595
            throw new RestException(503, 'Error when retrieve Group list : ' . $this->db->lasterror());
596
        }
597
598
        return $obj_ret;
599
    }
600
601
    /**
602
     * Get properties of an group object
603
     *
604
     * Return an array with group information
605
     *
606
     * @url GET /groups/{group}
607
     *
608
     * @param   int     $group ID of group
609
     * @param int       $load_members     Load members list or not {@min 0} {@max 1}
610
     * @return  object               object of User objects
611
     *
612
     * @throws RestException 403 Not allowed
613
     * @throws RestException 404 User not found
614
     */
615
    public function infoGroups($group, $load_members = 0)
616
    {
617
        global $db, $conf;
618
619
        if (
620
            (!getDolGlobalString('MAIN_USE_ADVANCED_PERMS') && !DolibarrApiAccess::$user->hasRight('user', 'user', 'lire') && empty(DolibarrApiAccess::$user->admin)) ||
621
            getDolGlobalString('MAIN_USE_ADVANCED_PERMS') && !DolibarrApiAccess::$user->hasRight('user', 'group_advance', 'read') && empty(DolibarrApiAccess::$user->admin)
622
        ) {
623
            throw new RestException(403, "You are not allowed to read groups");
624
        }
625
626
        $group_static = new UserGroup($this->db);
627
        $result = $group_static->fetch($group, '', $load_members);
628
629
        if (!$result) {
630
            throw new RestException(404, 'Group not found');
631
        }
632
633
        return $this->_cleanObjectDatas($group_static);
634
    }
635
636
    /**
637
     * Delete account/user
638
     *
639
     * @param   int     $id Account ID
640
     * @return  array
641
     *
642
     * @throws RestException 403 Not allowed
643
     * @throws RestException 404 User not found
644
     */
645
    public function delete($id)
646
    {
647
        if (!DolibarrApiAccess::$user->hasRight('user', 'user', 'supprimer') && empty(DolibarrApiAccess::$user->admin)) {
648
            throw new RestException(403, 'Not allowed');
649
        }
650
        $result = $this->useraccount->fetch($id);
651
        if (!$result) {
652
            throw new RestException(404, 'User not found');
653
        }
654
655
        if (!DolibarrApi::_checkAccessToResource('user', $this->useraccount->id, 'user')) {
656
            throw new RestException(403, 'Access not allowed for login ' . DolibarrApiAccess::$user->login);
657
        }
658
        $this->useraccount->oldcopy = clone $this->useraccount;
659
660
        if (!$this->useraccount->delete(DolibarrApiAccess::$user)) {
661
            throw new RestException(500);
662
        }
663
664
        return array(
665
            'success' => array(
666
                'code' => 200,
667
                'message' => 'Ticket deleted'
668
            )
669
        );
670
    }
671
672
	// phpcs:disable PEAR.NamingConventions.ValidFunctionName.PublicUnderscore
673
    /**
674
     * Clean sensible object datas
675
     *
676
     * @param   Object  $object     Object to clean
677
     * @return  Object              Object with cleaned properties
678
     */
679
    protected function _cleanObjectDatas($object)
680
    {
681
		// phpcs:enable
682
        global $conf;
683
684
        $object = parent::_cleanObjectDatas($object);
685
686
        unset($object->default_values);
687
        unset($object->lastsearch_values);
688
        unset($object->lastsearch_values_tmp);
689
690
        unset($object->total_ht);
691
        unset($object->total_tva);
692
        unset($object->total_localtax1);
693
        unset($object->total_localtax2);
694
        unset($object->total_ttc);
695
696
        unset($object->label_incoterms);
697
        unset($object->location_incoterms);
698
699
        unset($object->fk_delivery_address);
700
        unset($object->fk_incoterms);
701
        unset($object->all_permissions_are_loaded);
702
        unset($object->shipping_method_id);
703
        unset($object->nb_rights);
704
        unset($object->search_sid);
705
        unset($object->ldap_sid);
706
        unset($object->clicktodial_loaded);
707
708
        // List of properties never returned by API, whatever are permissions
709
        unset($object->pass);
710
        unset($object->pass_indatabase);
711
        unset($object->pass_indatabase_crypted);
712
        unset($object->pass_temp);
713
        unset($object->api_key);
714
        unset($object->clicktodial_password);
715
        unset($object->openid);
716
717
        unset($object->lines);
718
        unset($object->model_pdf);
719
720
        $canreadsalary = ((isModEnabled('salaries') && DolibarrApiAccess::$user->hasRight('salaries', 'read')) || !isModEnabled('salaries'));
721
722
        if (!$canreadsalary) {
723
            unset($object->salary);
724
            unset($object->salaryextra);
725
            unset($object->thm);
726
            unset($object->tjm);
727
        }
728
729
        return $object;
730
    }
731
732
    /**
733
     * Clean sensible user group list datas
734
     *
735
     * @param   array  $objectList   Array of object to clean
736
     * @return  array                Array of cleaned object properties
737
     */
738
    private function _cleanUserGroupListDatas($objectList)
739
    {
740
        $cleanObjectList = array();
741
742
        foreach ($objectList as $object) {
743
            $cleanObject = parent::_cleanObjectDatas($object);
744
745
            unset($cleanObject->default_values);
746
            unset($cleanObject->lastsearch_values);
747
            unset($cleanObject->lastsearch_values_tmp);
748
749
            unset($cleanObject->total_ht);
750
            unset($cleanObject->total_tva);
751
            unset($cleanObject->total_localtax1);
752
            unset($cleanObject->total_localtax2);
753
            unset($cleanObject->total_ttc);
754
755
            unset($cleanObject->libelle_incoterms);
756
            unset($cleanObject->location_incoterms);
757
758
            unset($cleanObject->fk_delivery_address);
759
            unset($cleanObject->fk_incoterms);
760
            unset($cleanObject->all_permissions_are_loaded);
761
            unset($cleanObject->shipping_method_id);
762
            unset($cleanObject->nb_rights);
763
            unset($cleanObject->search_sid);
764
            unset($cleanObject->ldap_sid);
765
            unset($cleanObject->clicktodial_loaded);
766
767
            unset($cleanObject->datec);
768
            unset($cleanObject->tms);
769
            unset($cleanObject->members);
770
            unset($cleanObject->note);
771
            unset($cleanObject->note_private);
772
773
            $cleanObjectList[] = $cleanObject;
774
        }
775
776
        return $cleanObjectList;
777
    }
778
779
    /**
780
     * Validate fields before create or update object
781
     *
782
     * @param   array|null     $data   Data to validate
783
     * @return  array
784
     * @throws RestException
785
     */
786
    private function _validate($data) // @phpstan-ignore-line
0 ignored issues
show
Unused Code introduced by
The method _validate() is not used, and could be removed.

This check looks for private methods that have been defined, but are not used inside the class.

Loading history...
787
    {
788
        $account = array();
789
        foreach (Users::$FIELDS as $field) {
790
            if (!isset($data[$field])) {
791
                throw new RestException(400, "$field field missing");
792
            }
793
            $account[$field] = $data[$field];
794
        }
795
        return $account;
796
    }
797
}
798