浏览代码

Add "erase account" extra fields see #2555

EUGDPR: Admin report on withdrawal of consent
Julio Montoya 6 年之前
父节点
当前提交
531e450543

+ 39 - 83
main/admin/user_list_consent.php

@@ -19,6 +19,9 @@ api_protect_admin_script();
 
 $this_section = SECTION_PLATFORM_ADMIN;
 
+$extraFields = UserManager::createDataPrivacyExtraFields();
+Session::write('data_privacy_extra_fields', $extraFields);
+
 /**
  * Prepares the shared SQL query for the user table.
  * See get_user_data() and get_number_of_users().
@@ -36,11 +39,11 @@ function prepare_user_sql_query($getCount)
     if ($getCount) {
         $sql .= "SELECT COUNT(u.id) AS total_number_of_items FROM $user_table u";
     } else {
-        $sql .= "SELECT u.id AS col0, u.official_code AS col2, ";
+        $sql .= 'SELECT u.id AS col0, u.official_code AS col2, ';
         if (api_is_western_name_order()) {
-            $sql .= "u.firstname AS col3, u.lastname AS col4, ";
+            $sql .= 'u.firstname AS col3, u.lastname AS col4, ';
         } else {
-            $sql .= "u.lastname AS col3, u.firstname AS col4, ";
+            $sql .= 'u.lastname AS col3, u.firstname AS col4, ';
         }
 
         $sql .= " u.username AS col5,
@@ -50,7 +53,8 @@ function prepare_user_sql_query($getCount)
                     u.id AS col9,
                     u.registration_date AS col10,
                     u.expiration_date AS exp,
-                    u.password
+                    u.password,
+                    v.field_id
                 FROM $user_table u";
     }
 
@@ -61,16 +65,13 @@ function prepare_user_sql_query($getCount)
                   ON (u.id=url_rel_user.user_id)";
     }
 
-    $extraFieldId = UserManager::create_extra_field(
-        'request_for_legal_agreement_consent_removal',
-        1, //text
-        'Request for legal agreement consent removal',
-        ''
-    );
+    $extraFields = Session::read('data_privacy_extra_fields');
+    $extraFieldId = $extraFields['delete_legal'];
+    $extraFieldIdDeleteAccount = $extraFields['delete_account_extra_field'];
 
     $extraFieldValue = Database::get_main_table(TABLE_EXTRA_FIELD_VALUES);
     $sql .= " INNER JOIN $extraFieldValue v
-              ON (u.id = v.item_id AND field_id = $extraFieldId) ";
+              ON (u.id = v.item_id AND (field_id = $extraFieldId OR field_id = $extraFieldIdDeleteAccount)) ";
 
     $keywordList = [
         'keyword_firstname',
@@ -157,71 +158,11 @@ function prepare_user_sql_query($getCount)
         $sql .= " AND u.creator_id = ".api_get_user_id();
     }
 
-    $variables = Session::read('variables_to_show', []);
-    if (!empty($variables)) {
-        $extraField = new ExtraField('user');
-        $extraFieldResult = [];
-        $extraFieldHasData = [];
-        foreach ($variables as $variable) {
-            if (isset($_GET['extra_'.$variable])) {
-                if (is_array($_GET['extra_'.$variable])) {
-                    $values = $_GET['extra_'.$variable];
-                } else {
-                    $values = [$_GET['extra_'.$variable]];
-                }
-
-                if (empty($values)) {
-                    continue;
-                }
-
-                $info = $extraField->get_handler_field_info_by_field_variable(
-                    $variable
-                );
-
-                if (empty($info)) {
-                    continue;
-                }
-
-                foreach ($values as $value) {
-                    if (empty($value)) {
-                        continue;
-                    }
-                    if ($info['field_type'] == ExtraField::FIELD_TYPE_TAG) {
-                        $result = $extraField->getAllUserPerTag(
-                            $info['id'],
-                            $value
-                        );
-                        $result = empty($result) ? [] : array_column(
-                            $result,
-                            'user_id'
-                        );
-                    } else {
-                        $result = UserManager::get_extra_user_data_by_value(
-                            $variable,
-                            $value
-                        );
-                    }
-                    $extraFieldHasData[] = true;
-                    if (!empty($result)) {
-                        $extraFieldResult = array_merge(
-                            $extraFieldResult,
-                            $result
-                        );
-                    }
-                }
-            }
-        }
-
-        if (!empty($extraFieldHasData)) {
-            $sql .= " AND (u.id IN ('".implode("','", $extraFieldResult)."')) ";
-        }
-    }
-
     // adding the filter to see the user's only of the current access_url
     if ((api_is_platform_admin() || api_is_session_admin()) &&
         api_get_multiple_access_url()
     ) {
-        $sql .= " AND url_rel_user.access_url_id=".api_get_current_access_url_id();
+        $sql .= " AND url_rel_user.access_url_id = ".api_get_current_access_url_id();
     }
 
     return $sql;
@@ -260,8 +201,8 @@ function get_user_data($from, $number_of_items, $column, $direction)
         $direction = 'ASC';
     }
     $column = (int) $column;
-    $from = intval($from);
-    $number_of_items = intval($number_of_items);
+    $from = (int) $from;
+    $number_of_items = (int) $number_of_items;
     $sql .= " ORDER BY col$column $direction ";
     $sql .= " LIMIT $from,$number_of_items";
 
@@ -300,6 +241,7 @@ function get_user_data($from, $number_of_items, $column, $direction)
             $user[6],
             $user[7],
             api_get_local_time($user[9]),
+            $user[12],
             $user[0],
         ];
     }
@@ -333,6 +275,18 @@ function user_filter($name, $params, $row)
     return '<a href="'.api_get_path(WEB_PATH).'whoisonline.php?origin=user_list&id='.$row[0].'">'.$name.'</a>';
 }
 
+function requestTypeFilter($fieldId, $url_params, $row)
+{
+    $extraFields = Session::read('data_privacy_extra_fields');
+    $extraFieldId = $extraFields['delete_legal'];
+
+    if ($fieldId == $extraFieldId) {
+        return get_lang('DeleteLegal');
+    } else {
+        return get_lang('DeleteAccount');
+    }
+}
+
 /**
  * Build the modify-column of the table.
  *
@@ -354,7 +308,7 @@ function modify_filter($user_id, $url_params, $row)
         Display::return_icon('synthese_view.gif', get_lang('Info')).'</a>&nbsp;&nbsp;';
 
     $result .= Display::url(
-        get_lang('SendMessage'),
+        Display::return_icon('message_new.png'),
         api_get_path(WEB_CODE_PATH).'messages/new_message.php?send_to_user='.$user_id
     );
     $result .= '&nbsp;&nbsp;';
@@ -365,7 +319,7 @@ function modify_filter($user_id, $url_params, $row)
     $result .= '&nbsp;&nbsp;';
 
     $result .= ' <a href="'.api_get_self().'?action=anonymize&user_id='.$user_id.'&'.$url_params.'&sec_token='.$token.'"  onclick="javascript:if(!confirm('."'".addslashes(
-            api_htmlentities(get_lang("ConfirmYourChoice"))
+            api_htmlentities(get_lang('ConfirmYourChoice'))
         )."'".')) return false;">'.
         Display::return_icon(
             'anonymous.png',
@@ -377,7 +331,7 @@ function modify_filter($user_id, $url_params, $row)
 
     if ($user_id != api_get_user_id()) {
         $result .= ' <a href="'.api_get_self().'?action=delete_user&user_id='.$user_id.'&'.$url_params.'&sec_token='.$token.'"  onclick="javascript:if(!confirm('."'".addslashes(
-            api_htmlentities(get_lang("ConfirmYourChoice"))
+            api_htmlentities(get_lang('ConfirmYourChoice'))
         )."'".')) return false;">'.
         Display::return_icon(
             'delete.png',
@@ -485,11 +439,11 @@ function status_filter($status)
 }
 
 if (isset($_GET['keyword']) || isset($_GET['keyword_firstname'])) {
-    $interbreadcrumb[] = ["url" => 'index.php', "name" => get_lang('PlatformAdmin')];
-    $interbreadcrumb[] = ["url" => 'user_list.php', "name" => get_lang('UserList')];
+    $interbreadcrumb[] = ['url' => 'index.php', 'name' => get_lang('PlatformAdmin')];
+    $interbreadcrumb[] = ['url' => 'user_list_consent.php', 'name' => get_lang('UserList')];
     $tool_name = get_lang('SearchUsers');
 } else {
-    $interbreadcrumb[] = ["url" => 'index.php', "name" => get_lang('PlatformAdmin')];
+    $interbreadcrumb[] = ['url' => 'index.php', 'name' => get_lang('PlatformAdmin')];
     $tool_name = get_lang('UserList');
 }
 
@@ -568,7 +522,7 @@ $form->addText(
     get_lang('Search'),
     false,
     [
-        'aria-label' => get_lang("SearchUsers"),
+        'aria-label' => get_lang('SearchUsers'),
     ]
 );
 $form->addButtonSearch(get_lang('Search'));
@@ -660,14 +614,16 @@ $table->set_header(6, get_lang('Email'));
 $table->set_header(7, get_lang('Profile'));
 $table->set_header(8, get_lang('Active'), true, 'width="15px"');
 $table->set_header(9, get_lang('RegistrationDate'), true, 'width="90px"');
-$table->set_header(10, get_lang('Action'), false, 'width="220px"');
+$table->set_header(10, get_lang('RequestType'), true, 'width="15px"');
+$table->set_header(11, get_lang('Action'), false, 'width="220px"');
 
 $table->set_column_filter(3, 'user_filter');
 $table->set_column_filter(4, 'user_filter');
 $table->set_column_filter(6, 'email_filter');
 $table->set_column_filter(7, 'status_filter');
 $table->set_column_filter(8, 'active_filter');
-$table->set_column_filter(10, 'modify_filter');
+$table->set_column_filter(10, 'requestTypeFilter');
+$table->set_column_filter(11, 'modify_filter');
 
 // Only show empty actions bar if delete users has been blocked
 $actionsList = [];

+ 1 - 0
main/auth/conditional_login/conditional_login.php

@@ -55,6 +55,7 @@ function check_platform_legal_conditions($user)
         api_get_setting('load_term_conditions_section') === 'login'
     ) {
         $termAndConditionStatus = api_check_term_condition($user['user_id']);
+
         // @todo not sure why we need the login password and update_term_status
         if ($termAndConditionStatus === false) {
             Session::write('term_and_condition', ['user_id' => $user['user_id']]);

+ 6 - 4
main/inc/lib/api.lib.php

@@ -275,6 +275,8 @@ define('LOG_TERM_CONDITION_ACCEPTED', 'term_condition_accepted');
 define('LOG_USER_CONFIRMED_EMAIL', 'user_confirmed_email');
 define('LOG_USER_REMOVED_LEGAL_ACCEPT', 'user_removed_legal_accept');
 
+define('LOG_USER_DELETE_ACCOUNT_REQUEST', 'user_delete_account_request');
+
 define('USERNAME_PURIFIER', '/[^0-9A-Za-z_\.]/');
 
 //used when login_is_email setting is true
@@ -6622,7 +6624,7 @@ function api_get_tools_lists($my_tool = null)
  */
 function api_check_term_condition($userId)
 {
-    if (api_get_setting('allow_terms_conditions') == 'true') {
+    if (api_get_setting('allow_terms_conditions') === 'true') {
         // Check if exists terms and conditions
         if (LegalManager::count() == 0) {
             return true;
@@ -6638,10 +6640,10 @@ function api_check_term_condition($userId)
             $result = $data['value'];
             $user_conditions = explode(':', $result);
             $version = $user_conditions[0];
-            $lang_id = $user_conditions[1];
-            $real_version = LegalManager::get_last_version($lang_id);
+            $langId = $user_conditions[1];
+            $realVersion = LegalManager::get_last_version($langId);
 
-            return $version >= $real_version;
+            return $version >= $realVersion;
         }
 
         return false;

+ 25 - 0
main/inc/lib/usermanager.lib.php

@@ -6346,4 +6346,29 @@ SQL;
 
         return $url;
     }
+
+    /**
+     * @return array
+     */
+    public static function createDataPrivacyExtraFields()
+    {
+        $extraFieldId = self::create_extra_field(
+            'request_for_legal_agreement_consent_removal',
+            1, //text
+            'Request for legal agreement consent removal',
+            ''
+        );
+
+        $extraFieldIdDeleteAccount = self::create_extra_field(
+            'request_for_delete_account',
+            1, //text
+            'Request for delete user account',
+            ''
+        );
+
+        return [
+            'delete_account_extra_field' => $extraFieldIdDeleteAccount,
+            'delete_legal' => $extraFieldId
+        ];
+    }
 }

+ 56 - 21
main/social/personal_data.php

@@ -29,12 +29,18 @@ $action = isset($_REQUEST['action']) ? $_REQUEST['action'] : '';
 $formToString = '';
 
 if (api_get_setting('allow_terms_conditions') === 'true') {
-    $form = new FormValidator('term', 'post', api_get_self().'?action=delete_legal&user_id='.$userId);
+    $form = new FormValidator('delete_term', 'post', api_get_self().'?action=delete_legal&user_id='.$userId);
     $form->addHtml(Display::return_message(get_lang('WhyYouWantToDeleteYourLegalAgreement')));
     $form->addTextarea('explanation', get_lang('ExplanationDeleteLegal'), [], true);
-    $form->addButtonSave(get_lang('DeleteLegal'));
     $form->addHidden('action', 'delete_legal');
+    $form->addButtonSave(get_lang('DeleteLegal'));
     $formToString = $form->returnForm();
+
+    $formDelete = new FormValidator('delete_account', 'post', api_get_self().'?action=delete_account&user_id='.$userId);
+    $formDelete->addTextarea('explanation', get_lang('ExplanationDeleteAccount'), [], true);
+    $formDelete->addHidden('action', 'delete_account');
+    $formDelete->addButtonDelete(get_lang('DeleteAccount'));
+    $formToString .= $formDelete->returnForm();
 }
 
 switch ($action) {
@@ -73,7 +79,7 @@ switch ($action) {
                     $currentUserInfo['complete_name']
                 );
                 $contentEmail = sprintf(
-                    get_lang('UserXSignedTheAgreementTheY'),
+                    get_lang('UserXSignedTheAgreementTheDateY'),
                     $currentUserInfo['complete_name'],
                     api_get_local_time($time)
                 );
@@ -86,19 +92,55 @@ switch ($action) {
                 );
             }
         }
-
         Display::addFlash(Display::return_message(get_lang('Saved')));
         break;
+    case 'delete_account':
+        if ($formDelete->validate()) {
+            $explanation = $formDelete->getSubmitValue('explanation');
+            UserManager::createDataPrivacyExtraFields();
+
+            UserManager::update_extra_field_value(
+                $userId,
+                'request_for_delete_account',
+                1
+            );
+            UserManager::update_extra_field_value(
+                $userId,
+                'request_for_delete_account_justification',
+                $explanation
+            );
+
+
+            Display::addFlash(Display::return_message(get_lang('Saved')));
+            Event::addEvent(
+                LOG_USER_DELETE_ACCOUNT_REQUEST,
+                LOG_USER_OBJECT,
+                $userInfo
+            );
+
+            $url = api_get_path(WEB_CODE_PATH).'admin/';
+            $link = Display::url($url, $url);
+            $subject = get_lang('RequestForDeleteAccount');
+            $content = sprintf(
+                get_lang('TheUserXAskDeleteAccountWithJustifactionXGoHereX'),
+                $userInfo['complete_name'],
+                $explanation,
+                $link
+            );
+
+            $email = api_get_configuration_value('data_protection_officer_email');
+            if (!empty($email)) {
+                api_mail_html('', $email, $subject, $content);
+            } else {
+                MessageManager::sendMessageToAllAdminUsers(api_get_user_id(), $subject, $content);
+            }
+        }
+        break;
     case 'delete_legal':
         if ($form->validate()) {
             $explanation = $form->getSubmitValue('explanation');
 
-            UserManager::create_extra_field(
-                'request_for_legal_agreement_consent_removal',
-                1, //text
-                        'Request for legal agreement consent removal',
-                ''
-            );
+            UserManager::createDataPrivacyExtraFields();
 
             UserManager::update_extra_field_value(
                 $userId,
@@ -106,27 +148,20 @@ switch ($action) {
                 1
             );
 
-            UserManager::create_extra_field(
-                'request_for_legal_agreement_consent_removal_justification',
-                1, //text
-                'Request for legal agreement consent removal justification',
-                ''
-            );
-
             UserManager::update_extra_field_value(
                 $userId,
                 'request_for_legal_agreement_consent_removal_justification',
                 $explanation
             );
 
-            $extraFieldValue = new ExtraFieldValue('user');
+            /*$extraFieldValue = new ExtraFieldValue('user');
             $value = $extraFieldValue->get_values_by_handler_and_field_variable(
                 $userId,
                 'legal_accept'
             );
-            $result = $extraFieldValue->delete($value['id']);
+            $result = $extraFieldValue->delete($value['id']);*/
 
-            Display::addFlash(Display::return_message(get_lang('Deleted')));
+            Display::addFlash(Display::return_message(get_lang('Sent')));
 
             Event::addEvent(
                 LOG_USER_REMOVED_LEGAL_ACCEPT,
@@ -138,7 +173,7 @@ switch ($action) {
             $link = Display::url($url, $url);
             $subject = get_lang('RequestForLegalConsentRemoval');
             $content = sprintf(
-                get_lang('TheUserXAskRemovalWithJustifactionYGoHere'),
+                get_lang('TheUserXAskRemovalWithJustifactionXGoHereX'),
                 $userInfo['complete_name'],
                 $explanation,
                 $link

+ 2 - 1
main/template/default/social/personal_data.tpl

@@ -12,7 +12,6 @@
     <div class="col-md-9">
         {{ display.panel('PersonalDataIntroductionTitle' | get_lang , 'PersonalDataIntroductionText' | get_lang) }}
         {{ display.panel('PersonalDataKeptOnYou' | get_lang, personal_data.data) }}
-        {{ display.panel('PersonalDataPermissionsYouGaveUs' | get_lang, permission) }}
 
         {% if personal_data.responsible %}
             {{ display.panel('PersonalDataResponsibleOrganizationTitle' | get_lang , personal_data.responsible ) }}
@@ -49,6 +48,8 @@
         {% if term_link %}
             {{ display.panel('TermsAndConditions'|get_lang, term_link ) }}
         {% endif %}
+
+        {{ display.panel('PersonalDataPermissionsYouGaveUs' | get_lang, permission) }}
     </div>
 </div>
 {% endblock %}