includes/SpecialUserrights.php

   1 <?php
   2
   3 /**
   4  * Special page to allow managing user group membership
   5  *
   6  * @addtogroup SpecialPage
   7  * @todo This code is disgusting and needs a total rewrite
   8  */
   9
  10 /** */
  11 require_once( dirname(__FILE__) . '/HTMLForm.php');
  12
  13 /** Entry point */
  14 function wfSpecialUserrights() {
  15         global $wgRequest;
  16         $form = new UserrightsForm($wgRequest);
  17         $form->execute();
  18 }
  19
  20 /**
  21  * A class to manage user levels rights.
  22  * @addtogroup SpecialPage
  23  */
  24 class UserrightsForm extends HTMLForm {
  25         var $mPosted, $mRequest, $mSaveprefs;
  26         /** Escaped local url name*/
  27         var $action;
  28
  29         /** Constructor*/
  30         public function __construct( &$request ) {
  31                 $this->mPosted = $request->wasPosted();
  32                 $this->mRequest =& $request;
  33                 $this->mName = 'userrights';
  34
  35                 $titleObj = SpecialPage::getTitleFor( 'Userrights' );
  36                 $this->action = $titleObj->escapeLocalURL();
  37         }
  38
  39         /**
  40          * Manage forms to be shown according to posted data.
  41          * Depending on the submit button used, call a form or a save function.
  42          */
  43         function execute() {
  44                 // show the general form
  45                 $this->switchForm();
  46                 if( $this->mPosted ) {
  47                         // show some more forms
  48                         if( $this->mRequest->getCheck( 'ssearchuser' ) ) {
  49                                 $this->editUserGroupsForm( $this->mRequest->getVal( 'user-editname' ) );
  50                         }
  51
  52                         // save settings
  53                         if( $this->mRequest->getCheck( 'saveusergroups' ) ) {
  54                                 global $wgUser;
  55                                 $username = $this->mRequest->getVal( 'user-editname' );
  56                                 $reason = $this->mRequest->getVal( 'user-reason' );
  57                                 if( $wgUser->matchEditToken( $this->mRequest->getVal( 'wpEditToken' ), $username ) ) {
  58                                         $this->saveUserGroups( $username,
  59                                                 $this->mRequest->getArray( 'member' ),
  60                                                 $this->mRequest->getArray( 'available' ),
  61                                                 $reason );
  62                                 }
  63                         }
  64                 }
  65         }
  66
  67         /**
  68          * Save user groups changes in the database.
  69          * Data comes from the editUserGroupsForm() form function
  70          *
  71          * @param string $username Username to apply changes to.
  72          * @param array $removegroup id of groups to be removed.
  73          * @param array $addgroup id of groups to be added.
  74          * @param string $reason Reason for group change
  75          *
  76          */
  77         function saveUserGroups( $username, $removegroup, $addgroup, $reason = '' ) {
  78                 global $wgOut;
  79                 $u = User::newFromName($username);
  80
  81                 if(is_null($u)) {
  82                         $wgOut->addWikiText( wfMsg( 'nosuchusershort', htmlspecialchars( $username ) ) );
  83                         return;
  84                 }
  85
  86                 if($u->getID() == 0) {
  87                         $wgOut->addWikiText( wfMsg( 'nosuchusershort', htmlspecialchars( $username ) ) );
  88                         return;
  89                 }
  90
  91                 $oldGroups = $u->getGroups();
  92                 $newGroups = $oldGroups;
  93                 // remove then add groups
  94                 if(isset($removegroup)) {
  95                         $newGroups = array_diff($newGroups, $removegroup);
  96                         foreach( $removegroup as $group ) {
  97                                 if ( $this->canRemove( $group ) ) {
  98                                         $u->removeGroup( $group );
  99                                 }
 100                         }
 101                 }
 102                 if(isset($addgroup)) {
 103                         $newGroups = array_merge($newGroups, $addgroup);
 104                         foreach( $addgroup as $group ) {
 105                                 if ( $this->canAdd( $group ) ) {
 106                                         $u->addGroup( $group );
 107                                 }
 108                         }
 109                 }
 110                 $newGroups = array_unique( $newGroups );
 111
 112                 wfDebug( 'oldGroups: ' . print_r( $oldGroups, true ) );
 113                 wfDebug( 'newGroups: ' . print_r( $newGroups, true ) );
 114
 115                 wfRunHooks( 'UserRights', array( &$u, $addgroup, $removegroup ) );
 116                 $log = new LogPage( 'rights' );
 117                 $log->addEntry( 'rights', Title::makeTitle( NS_USER, $u->getName() ), $reason, array( $this->makeGroupNameList( $oldGroups ),
 118                         $this->makeGroupNameList( $newGroups ) ) );
 119         }
 120
 121         function makeGroupNameList( $ids ) {
 122                 return implode( ', ', $ids );
 123         }
 124
 125         /**
 126          * Output a form to allow searching for a user
 127          */
 128         function switchForm() {
 129                 global $wgOut, $wgRequest;
 130                 $username = $wgRequest->getText( 'user-editname' );
 131                 $form  = Xml::openElement( 'form', array( 'method' => 'post', 'action' => $this->action, 'name' => 'uluser' ) );
 132                 $form .= '<fieldset><legend>' . wfMsgHtml( 'userrights-lookup-user' ) . '</legend>';
 133                 $form .= '<p>' . Xml::inputLabel( wfMsg( 'userrights-user-editname' ), 'user-editname', 'username', 30, $username ) . '</p>';
 134                 $form .= '<p>' . Xml::submitButton( wfMsg( 'editusergroup' ), array( 'name' => 'ssearchuser' ) ) . '</p>';
 135                 $form .= '</fieldset>';
 136                 $form .= '</form>';
 137                 $wgOut->addHTML( $form );
 138         }
 139
 140         /**
 141          * Edit user groups membership
 142          * @param string $username Name of the user.
 143          */
 144         function editUserGroupsForm($username) {
 145                 global $wgOut;
 146
 147                 $user = User::newFromName($username);
 148                 if( is_null( $user ) ) {
 149                         $wgOut->addWikiText( wfMsg( 'nouserspecified' ) );
 150                         return;
 151                 } elseif( $user->getID() == 0 ) {
 152                         $wgOut->addWikiText( wfMsg( 'nosuchusershort', wfEscapeWikiText( $username ) ) );
 153                         return;
 154                 }
 155
 156                 $this->showEditUserGroupsForm( $username, $user->getGroups() );
 157         }
 158
 159         /**
 160          * Go through used and available groups and return the ones that this
 161          * form will be able to manipulate based on the current user's system
 162          * permissions.
 163          *
 164          * @param $groups Array: list of groups the given user is in
 165          * @return Array:  Tuple of addable, then removable groups
 166          */
 167         protected function splitGroups( $groups ) {
 168                 list($addable, $removable) = array_values( $this->changeableGroups() );
 169                 $removable = array_intersect($removable, $groups ); // Can't remove groups the user doesn't have
 170                 $addable   = array_diff(     $addable,   $groups ); // Can't add groups the user does have
 171
 172                 return array( $addable, $removable );
 173         }
 174
 175         /**
 176          * Show the form to edit group memberships.
 177          *
 178          * @todo make all CSS-y and semantic
 179          * @param $username  String: Name of user you're editing
 180          * @param $groups    Array:  Array of groups the user is in
 181          */
 182         protected function showEditUserGroupsForm( $username, $groups ) {
 183                 global $wgOut, $wgUser;
 184
 185                 list( $addable, $removable ) = $this->splitGroups( $groups );
 186
 187                 $wgOut->addHTML(
 188                         Xml::openElement( 'form', array( 'method' => 'post', 'action' => $this->action, 'name' => 'editGroup' ) ) .
 189                         Xml::hidden( 'user-editname', $username ) .
 190                         Xml::hidden( 'wpEditToken', $wgUser->editToken( $username ) ) .
 191                         Xml::openElement( 'fieldset' ) .
 192                         Xml::element( 'legend', array(), wfMsg( 'userrights-editusergroup' ) ) .
 193                         $wgOut->parse( wfMsg( 'editinguser', $username ) ) .
 194                         $this->explainRights() .
 195                         "<table border='0'>
 196                         <tr>
 197                                 <td></td>
 198                                 <td>
 199                                 <table width='400'>
 200                                         <tr>
 201                                                 <td width='50%'>" . $this->removeSelect( $removable ) . "</td>
 202                                                 <td width='50%'>" . $this->addSelect( $addable ) . "</td>
 203                                         </tr>
 204                                 </table>
 205                         </tr>
 206                         <tr>
 207                                 <td colspan='2'>" .
 208                                         $wgOut->parse( wfMsg('userrights-groupshelp') ) .
 209                                 "</td>
 210                         </tr>
 211                         <tr>
 212                                 <td>" .
 213                                         Xml::label( wfMsg( 'userrights-reason' ), 'wpReason' ) .
 214                                 "</td>
 215                                 <td>" .
 216                                         Xml::input( 'user-reason', 60, false, array( 'id' => 'wpReason' ) ) .
 217                                 "</td>
 218                         </tr>
 219                         <tr>
 220                                 <td></td>
 221                                 <td>" .
 222                                 Xml::submitButton( wfMsg( 'saveusergroups' ), array( 'name' => 'saveusergroups' ) ) .
 223                                 "</td>
 224                         </tr>
 225                         </table>\n" .
 226                         Xml::closeElement( 'fieldset' ) .
 227                         Xml::closeElement( 'form' ) . "\n"
 228                 );
 229         }
 230
 231         /**
 232          * Explains what groups the user can add and remove, and why.
 233          *
 234          * @return string Explanatory sanitized HTML message
 235          */
 236         private function explainRights() {
 237                 global $wgUser;
 238                 $groups = $wgUser->getEffectiveGroups();
 239                 foreach( $groups as $group ) {
 240                         if( $this->changeableByGroup( $group ) == array(
 241                                 'add' => array(),
 242                                 'remove' => array()
 243                         ) ) {
 244                                 // Can't add or remove anything, ignore this group
 245                                 $groups = array_diff( $groups, array( $group ) );
 246                         }
 247                 }
 248                 $grouplists = array( $groups );
 249                 list( $grouplists[1], $grouplists[2] ) = array_values( $this->changeableGroups() );
 250
 251                 // Now format them nicely for display (yay mutable variables? I'm sick
 252                 // of thinking up new names)
 253                 foreach( $grouplists as &$list ) {
 254                         if( $list == array() ) {
 255                                 $list = wfMsgExt( 'userrights-list-nogroups', 'parseinline' );
 256                         } else {
 257                                 $list = wfMsgExt(
 258                                         'userrights-list-groups',
 259                                         'parseinline',
 260                                         count( $list ),
 261                                         implode(
 262                                                 $list,
 263                                                 wfMsgHtml( 'userrights-list-separator' )
 264                                         )
 265                                 );
 266                         }
 267                 }
 268
 269                 return wfMsgExt(
 270                         'userrights-list',
 271                         'parse',
 272                         $grouplists[0],
 273                         $grouplists[1],
 274                         $grouplists[2]
 275                 );
 276
 277         }
 278
 279         /**
 280          * Adds the <select> thingie where you can select what groups to remove
 281          *
 282          * @param array $groups The groups that can be removed
 283          * @return string XHTML <select> element
 284          */
 285         private function removeSelect( $groups ) {
 286                 return $this->doSelect( $groups, 'member' );
 287         }
 288
 289         /**
 290          * Adds the <select> thingie where you can select what groups to add
 291          *
 292          * @param array $groups The groups that can be added
 293          * @return string XHTML <select> element
 294          */
 295         private function addSelect( $groups ) {
 296                 return $this->doSelect( $groups, 'available' );
 297         }
 298
 299         /**
 300          * Adds the <select> thingie where you can select what groups to add/remove
 301          *
 302          * @param array  $groups The groups that can be added/removed
 303          * @param string $name   'member' or 'available'
 304          * @return string XHTML <select> element
 305          */
 306         private function doSelect( $groups, $name ) {
 307                 $ret = wfMsgHtml( "{$this->mName}-groups$name" ) .
 308                 Xml::openElement( 'select', array(
 309                                 'name' => "{$name}[]",
 310                                 'multiple' => 'multiple',
 311                                 'size' => '6',
 312                                 'style' => 'width: 100%;'
 313                         )
 314                 );
 315                 foreach ($groups as $group) {
 316                         $ret .= Xml::element( 'option', array( 'value' => $group ), User::getGroupName( $group ) );
 317                 }
 318                 $ret .= Xml::closeElement( 'select' );
 319                 return $ret;
 320         }
 321
 322         /**
 323          * @param  string $group The name of the group to check
 324          * @return bool Can we remove the group?
 325          */
 326         private function canRemove( $group ) {
 327                 // $this->changeableGroups()['remove'] doesn't work, of course. Thanks,
 328                 // PHP.
 329                 $groups = $this->changeableGroups();
 330                 return in_array( $group, $groups['remove'] );
 331         }
 332
 333         /**
 334          * @param  string $group The name of the group to check
 335          * @return bool Can we add the group?
 336          */
 337         private function canAdd( $group ) {
 338                 $groups = $this->changeableGroups();
 339                 return in_array( $group, $groups['add'] );
 340         }
 341
 342         /**
 343          * Returns an array of the groups that the user can add/remove.
 344          *
 345          * @return Array array( 'add' => array( addablegroups ), 'remove' => array( removablegroups ) )
 346          */
 347         private function changeableGroups() {
 348                 global $wgUser, $wgGroupPermissions;
 349
 350                 $groups = array( 'add' => array(), 'remove' => array() );
 351                 $addergroups = $wgUser->getEffectiveGroups();
 352
 353                 foreach ($addergroups as $addergroup) {
 354                         $groups = array_merge_recursive(
 355                                 $groups, $this->changeableByGroup($addergroup)
 356                         );
 357                         $groups['add']    = array_unique( $groups['add'] );
 358                         $groups['remove'] = array_unique( $groups['remove'] );
 359                 }
 360                 return $groups;
 361         }
 362
 363         /**
 364          * Returns an array of the groups that a particular group can add/remove.
 365          *
 366          * @param String $group The group to check for whether it can add/remove
 367          * @return Array array( 'add' => array( addablegroups ), 'remove' => array( removablegroups ) )
 368          */
 369         private function changeableByGroup( $group ) {
 370                 global $wgGroupPermissions, $wgAddGroups, $wgRemoveGroups;
 371
 372                 if( empty($wgGroupPermissions[$group]['userrights']) ) {
 373                         // This group doesn't give the right to modify anything
 374                         return array( 'add' => array(), 'remove' => array() );
 375                 }
 376                 if( empty($wgAddGroups[$group]) and empty($wgRemoveGroups[$group]) ) {
 377                         // This group gives the right to modify everything (reverse-
 378                         // compatibility with old "userrights lets you change
 379                         // everything")
 380                         return array(
 381                                 'add' => User::getAllGroups(),
 382                                 'remove' => User::getAllGroups()
 383                         );
 384                 }
 385
 386                 // Okay, it's not so simple, we have to go through the arrays
 387                 $groups = array( 'add' => array(), 'remove' => array() );
 388                 if( empty($wgAddGroups[$group]) ) {
 389                         // Don't add anything to $groups
 390                 } elseif( $wgAddGroups[$group] === true ) {
 391                         // You get everything
 392                         $groups['add'] = User::getAllGroups();
 393                 } elseif( is_array($wgAddGroups[$group]) ) {
 394                         $groups['add'] = $wgAddGroups[$group];
 395                 }
 396
 397                 // Same thing for remove
 398                 if( empty($wgRemoveGroups[$group]) ) {
 399                 } elseif($wgRemoveGroups[$group] === true ) {
 400                         $groups['remove'] = User::getAllGroups();
 401                 } elseif( is_array($wgRemoveGroups[$group]) ) {
 402                         $groups['remove'] = $wgRemoveGroups[$group];
 403                 }
 404                 return $groups;
 405         }
 406 } // end class UserrightsForm
 407