includes/SpecialUserrights.php

   1 <?php
   2
   3 /**
   4  * Special page to allow managing user group membership
   5  *
   6  * @addtogroup SpecialPage
   7  * @todo This code is disgusting and needs a total rewrite
   8  */
   9
  10 /** */
  11 require_once( dirname(__FILE__) . '/HTMLForm.php');
  12
  13 /** Entry point */
  14 function wfSpecialUserrights() {
  15         global $wgRequest;
  16         $form = new UserrightsForm($wgRequest);
  17         $form->execute();
  18 }
  19
  20 /**
  21  * A class to manage user levels rights.
  22  * @addtogroup SpecialPage
  23  */
  24 class UserrightsForm extends HTMLForm {
  25         var $mPosted, $mRequest, $mSaveprefs;
  26         /** Escaped local url name*/
  27         var $action;
  28
  29         /** Constructor*/
  30         public function __construct( &$request ) {
  31                 $this->mPosted = $request->wasPosted();
  32                 $this->mRequest =& $request;
  33                 $this->mName = 'userrights';
  34
  35                 $titleObj = SpecialPage::getTitleFor( 'Userrights' );
  36                 $this->action = $titleObj->escapeLocalURL();
  37         }
  38
  39         /**
  40          * Manage forms to be shown according to posted data.
  41          * Depending on the submit button used, call a form or a save function.
  42          */
  43         function execute() {
  44                 // show the general form
  45                 $this->switchForm();
  46                 if( $this->mPosted ) {
  47                         // show some more forms
  48                         if( $this->mRequest->getCheck( 'ssearchuser' ) ) {
  49                                 $this->editUserGroupsForm( $this->mRequest->getVal( 'user-editname' ) );
  50                         }
  51
  52                         // save settings
  53                         if( $this->mRequest->getCheck( 'saveusergroups' ) ) {
  54                                 global $wgUser;
  55                                 $username = $this->mRequest->getVal( 'user-editname' );
  56                                 $reason = $this->mRequest->getVal( 'user-reason' );
  57                                 if( $wgUser->matchEditToken( $this->mRequest->getVal( 'wpEditToken' ), $username ) ) {
  58                                         $this->saveUserGroups( $username,
  59                                                 $this->mRequest->getArray( 'member' ),
  60                                                 $this->mRequest->getArray( 'available' ),
  61                                                 $reason );
  62                                 }
  63                         }
  64                 }
  65         }
  66
  67         /**
  68          * Save user groups changes in the database.
  69          * Data comes from the editUserGroupsForm() form function
  70          *
  71          * @param string $username Username to apply changes to.
  72          * @param array $removegroup id of groups to be removed.
  73          * @param array $addgroup id of groups to be added.
  74          * @param string $reason Reason for group change
  75          *
  76          */
  77         function saveUserGroups( $username, $removegroup, $addgroup, $reason = '' ) {
  78                 global $wgOut;
  79                 $u = User::newFromName($username);
  80
  81                 if(is_null($u)) {
  82                         $wgOut->addWikiText( wfMsg( 'nosuchusershort', htmlspecialchars( $username ) ) );
  83                         return;
  84                 }
  85
  86                 if($u->getID() == 0) {
  87                         $wgOut->addWikiText( wfMsg( 'nosuchusershort', htmlspecialchars( $username ) ) );
  88                         return;
  89                 }
  90
  91                 $oldGroups = $u->getGroups();
  92                 $newGroups = $oldGroups;
  93                 // remove then add groups
  94                 if(isset($removegroup)) {
  95                         $newGroups = array_diff($newGroups, $removegroup);
  96                         foreach( $removegroup as $group ) {
  97                                 if ( $this->canRemove( $group ) ) {
  98                                         $u->removeGroup( $group );
  99                                 }
 100                         }
 101                 }
 102                 if(isset($addgroup)) {
 103                         $newGroups = array_merge($newGroups, $addgroup);
 104                         foreach( $addgroup as $group ) {
 105                                 if ( $this->canAdd( $group ) ) {
 106                                         $u->addGroup( $group );
 107                                 }
 108                         }
 109                 }
 110                 $newGroups = array_unique( $newGroups );
 111
 112                 wfDebug( 'oldGroups: ' . print_r( $oldGroups, true ) );
 113                 wfDebug( 'newGroups: ' . print_r( $newGroups, true ) );
 114
 115                 wfRunHooks( 'UserRights', array( &$u, $addgroup, $removegroup ) );
 116                 $log = new LogPage( 'rights' );
 117                 $log->addEntry( 'rights', Title::makeTitle( NS_USER, $u->getName() ), $reason, array( $this->makeGroupNameList( $oldGroups ),
 118                         $this->makeGroupNameList( $newGroups ) ) );
 119         }
 120
 121         function makeGroupNameList( $ids ) {
 122                 return implode( ', ', $ids );
 123         }
 124
 125         /**
 126          * Output a form to allow searching for a user
 127          */
 128         function switchForm() {
 129                 global $wgOut, $wgRequest;
 130                 $username = $wgRequest->getText( 'user-editname' );
 131                 $form  = Xml::openElement( 'form', array( 'method' => 'post', 'action' => $this->action, 'name' => 'uluser' ) );
 132                 $form .= '<fieldset><legend>' . wfMsgHtml( 'userrights-lookup-user' ) . '</legend>';
 133                 $form .= '<p>' . Xml::inputLabel( wfMsg( 'userrights-user-editname' ), 'user-editname', 'username', 30, $username ) . '</p>';
 134                 $form .= '<p>' . Xml::submitButton( wfMsg( 'editusergroup' ), array( 'name' => 'ssearchuser' ) ) . '</p>';
 135                 $form .= '</fieldset>';
 136                 $form .= '</form>';
 137                 $wgOut->addHTML( $form );
 138         }
 139
 140         /**
 141          * Edit user groups membership
 142          * @param string $username Name of the user.
 143          */
 144         function editUserGroupsForm($username) {
 145                 global $wgOut;
 146
 147                 $user = User::newFromName($username);
 148                 if( is_null( $user ) ) {
 149                         $wgOut->addWikiText( wfMsg( 'nouserspecified' ) );
 150                         return;
 151                 } elseif( $user->getID() == 0 ) {
 152                         $wgOut->addWikiText( wfMsg( 'nosuchusershort', wfEscapeWikiText( $username ) ) );
 153                         return;
 154                 }
 155
 156                 $this->showEditUserGroupsForm( $username, $user->getGroups() );
 157         }
 158
 159         /**
 160          * Go through used and available groups and return the ones that this
 161          * form will be able to manipulate based on the current user's system
 162          * permissions.
 163          *
 164          * @param $groups Array: list of groups the given user is in
 165          * @return Array:  Tuple of addable, then removable groups
 166          */
 167         protected function splitGroups( $groups ) {
 168                 list($addable, $removable) = array_values( $this->changeableGroups() );
 169                 $removable = array_intersect($removable, $groups ); // Can't remove groups the user doesn't have
 170                 $addable   = array_diff(     $addable,   $groups ); // Can't add groups the user does have
 171
 172                 return array( $addable, $removable );
 173         }
 174
 175         /**
 176          * Show the form to edit group memberships.
 177          *
 178          * @todo make all CSS-y and semantic
 179          * @param $username  String: Name of user you're editing
 180          * @param $groups    Array:  Array of groups the user is in
 181          */
 182         protected function showEditUserGroupsForm( $username, $groups ) {
 183                 global $wgOut, $wgUser;
 184
 185                 list( $addable, $removable ) = $this->splitGroups( $groups );
 186
 187                 $wgOut->addHTML(
 188                         Xml::openElement( 'form', array( 'method' => 'post', 'action' => $this->action, 'name' => 'editGroup' ) ) .
 189                         Xml::hidden( 'user-editname', $username ) .
 190                         Xml::hidden( 'wpEditToken', $wgUser->editToken( $username ) ) .
 191                         Xml::openElement( 'fieldset' ) .
 192                         Xml::element( 'legend', array(), wfMsg( 'userrights-editusergroup' ) ) .
 193                         $wgOut->parse( wfMsg( 'editinguser', $username ) ) .
 194                         $this->explainRights() .
 195                         "<table border='0'>
 196                         <tr>
 197                                 <td></td>
 198                                 <td>
 199                                 <table width='400'>
 200                                         <tr>
 201                                                 <td width='50%'>" . $this->removeSelect( $removable ) . "</td>
 202                                                 <td width='50%'>" . $this->addSelect( $addable ) . "</td>
 203                                         </tr>
 204                                 </table>
 205                         </tr>
 206                         <tr>
 207                                 <td colspan='2'>" .
 208                                         $wgOut->parse( wfMsg('userrights-groupshelp') ) .
 209                                 "</td>
 210                         </tr>
 211                         <tr>
 212                                 <td>" .
 213                                         Xml::label( wfMsg( 'userrights-reason' ), 'wpReason' ) .
 214                                 "</td>
 215                                 <td>" .
 216                                         Xml::input( 'user-reason', 60, false, array( 'id' => 'wpReason' ) ) .
 217                                 "</td>
 218                         </tr>
 219                         <tr>
 220                                 <td></td>
 221                                 <td>" .
 222                                 Xml::submitButton( wfMsg( 'saveusergroups' ), array( 'name' => 'saveusergroups' ) ) .
 223                                 "</td>
 224                         </tr>
 225                         </table>\n" .
 226                         Xml::closeElement( 'fieldset' ) .
 227                         Xml::closeElement( 'form' ) . "\n"
 228                 );
 229         }
 230
 231         /**
 232          * Prepare a list of groups the user is able to add and remove
 233          *
 234          * @return string
 235          */
 236         private function explainRights() {
 237                 global $wgUser, $wgLang;
 238
 239                 $out = array();
 240                 list( $add, $remove ) = array_values( $this->changeableGroups() );
 241
 242                 if( count( $add ) > 0 )
 243                         $out[] = wfMsgExt( 'userrights-available-add', 'parseinline', $wgLang->listToText( $add ) );
 244                 if( count( $remove ) > 0 )
 245                         $out[] = wfMsgExt( 'userrights-available-remove', 'parseinline', $wgLang->listToText( $remove ) );
 246
 247                 return count( $out ) > 0
 248                         ? implode( ' ', $out )
 249                         : wfMsgExt( 'userrights-available-none', 'parseinline' );
 250         }
 251
 252         /**
 253          * Adds the <select> thingie where you can select what groups to remove
 254          *
 255          * @param array $groups The groups that can be removed
 256          * @return string XHTML <select> element
 257          */
 258         private function removeSelect( $groups ) {
 259                 return $this->doSelect( $groups, 'member' );
 260         }
 261
 262         /**
 263          * Adds the <select> thingie where you can select what groups to add
 264          *
 265          * @param array $groups The groups that can be added
 266          * @return string XHTML <select> element
 267          */
 268         private function addSelect( $groups ) {
 269                 return $this->doSelect( $groups, 'available' );
 270         }
 271
 272         /**
 273          * Adds the <select> thingie where you can select what groups to add/remove
 274          *
 275          * @param array  $groups The groups that can be added/removed
 276          * @param string $name   'member' or 'available'
 277          * @return string XHTML <select> element
 278          */
 279         private function doSelect( $groups, $name ) {
 280                 $ret = wfMsgHtml( "{$this->mName}-groups$name" ) .
 281                 Xml::openElement( 'select', array(
 282                                 'name' => "{$name}[]",
 283                                 'multiple' => 'multiple',
 284                                 'size' => '6',
 285                                 'style' => 'width: 100%;'
 286                         )
 287                 );
 288                 foreach ($groups as $group) {
 289                         $ret .= Xml::element( 'option', array( 'value' => $group ), User::getGroupName( $group ) );
 290                 }
 291                 $ret .= Xml::closeElement( 'select' );
 292                 return $ret;
 293         }
 294
 295         /**
 296          * @param  string $group The name of the group to check
 297          * @return bool Can we remove the group?
 298          */
 299         private function canRemove( $group ) {
 300                 // $this->changeableGroups()['remove'] doesn't work, of course. Thanks,
 301                 // PHP.
 302                 $groups = $this->changeableGroups();
 303                 return in_array( $group, $groups['remove'] );
 304         }
 305
 306         /**
 307          * @param  string $group The name of the group to check
 308          * @return bool Can we add the group?
 309          */
 310         private function canAdd( $group ) {
 311                 $groups = $this->changeableGroups();
 312                 return in_array( $group, $groups['add'] );
 313         }
 314
 315         /**
 316          * Returns an array of the groups that the user can add/remove.
 317          *
 318          * @return Array array( 'add' => array( addablegroups ), 'remove' => array( removablegroups ) )
 319          */
 320         private function changeableGroups() {
 321                 global $wgUser, $wgGroupPermissions;
 322
 323                 $groups = array( 'add' => array(), 'remove' => array() );
 324                 $addergroups = $wgUser->getEffectiveGroups();
 325
 326                 foreach ($addergroups as $addergroup) {
 327                         $groups = array_merge_recursive(
 328                                 $groups, $this->changeableByGroup($addergroup)
 329                         );
 330                         $groups['add']    = array_unique( $groups['add'] );
 331                         $groups['remove'] = array_unique( $groups['remove'] );
 332                 }
 333                 return $groups;
 334         }
 335
 336         /**
 337          * Returns an array of the groups that a particular group can add/remove.
 338          *
 339          * @param String $group The group to check for whether it can add/remove
 340          * @return Array array( 'add' => array( addablegroups ), 'remove' => array( removablegroups ) )
 341          */
 342         private function changeableByGroup( $group ) {
 343                 global $wgGroupPermissions, $wgAddGroups, $wgRemoveGroups;
 344
 345                 if( empty($wgGroupPermissions[$group]['userrights']) ) {
 346                         // This group doesn't give the right to modify anything
 347                         return array( 'add' => array(), 'remove' => array() );
 348                 }
 349                 if( empty($wgAddGroups[$group]) and empty($wgRemoveGroups[$group]) ) {
 350                         // This group gives the right to modify everything (reverse-
 351                         // compatibility with old "userrights lets you change
 352                         // everything")
 353                         return array(
 354                                 'add' => User::getAllGroups(),
 355                                 'remove' => User::getAllGroups()
 356                         );
 357                 }
 358
 359                 // Okay, it's not so simple, we have to go through the arrays
 360                 $groups = array( 'add' => array(), 'remove' => array() );
 361                 if( empty($wgAddGroups[$group]) ) {
 362                         // Don't add anything to $groups
 363                 } elseif( $wgAddGroups[$group] === true ) {
 364                         // You get everything
 365                         $groups['add'] = User::getAllGroups();
 366                 } elseif( is_array($wgAddGroups[$group]) ) {
 367                         $groups['add'] = $wgAddGroups[$group];
 368                 }
 369
 370                 // Same thing for remove
 371                 if( empty($wgRemoveGroups[$group]) ) {
 372                 } elseif($wgRemoveGroups[$group] === true ) {
 373                         $groups['remove'] = User::getAllGroups();
 374                 } elseif( is_array($wgRemoveGroups[$group]) ) {
 375                         $groups['remove'] = $wgRemoveGroups[$group];
 376                 }
 377                 return $groups;
 378         }
 379 } // end class UserrightsForm
 380