user_list.php 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493
  1. <?php
  2. // $Id: user_list.php 11239 2007-02-26 15:44:23Z elixir_julian $
  3. /*
  4. ==============================================================================
  5. Dokeos - elearning and course management software
  6. Copyright (c) 2004 Dokeos S.A.
  7. Copyright (c) 2003 Ghent University (UGent)
  8. Copyright (c) 2001 Universite catholique de Louvain (UCL)
  9. Copyright (c) Olivier Brouckaert
  10. For a full list of contributors, see "credits.txt".
  11. The full license can be read in "license.txt".
  12. This program is free software; you can redistribute it and/or
  13. modify it under the terms of the GNU General Public License
  14. as published by the Free Software Foundation; either version 2
  15. of the License, or (at your option) any later version.
  16. See the GNU General Public License for more details.
  17. Contact: Dokeos, 181 rue Royale, B-1000 Brussels, Belgium, info@dokeos.com
  18. ==============================================================================
  19. */
  20. /**
  21. ==============================================================================
  22. @author Bart Mollet
  23. * @package dokeos.admin
  24. ==============================================================================
  25. */
  26. // name of the language file that needs to be included
  27. $language_file = array ('registration','admin');
  28. $cidReset = true;
  29. require ('../inc/global.inc.php');
  30. require_once (api_get_path(LIBRARY_PATH).'sortabletable.class.php');
  31. require_once (api_get_path(LIBRARY_PATH).'formvalidator/FormValidator.class.php');
  32. $this_section = SECTION_PLATFORM_ADMIN;
  33. api_protect_admin_script();
  34. /**
  35. * Make sure this function is protected
  36. * because it does NOT check password!
  37. *
  38. * This function defines globals.
  39. * @author Roan Embrechts
  40. */
  41. function login_user($user_id)
  42. {
  43. //init ---------------------------------------------------------------------
  44. global $uidReset, $loginFailed, $_configuration;
  45. $main_user_table = Database :: get_main_table(TABLE_MAIN_USER);
  46. $main_admin_table = Database :: get_main_table(TABLE_MAIN_ADMIN);
  47. $track_e_login_table = Database :: get_statistic_table(TABLE_STATISTIC_TRACK_E_LOGIN);
  48. //logic --------------------------------------------------------------------
  49. //unset($_user['user_id']); // uid not in session ? prevent any hacking
  50. if (!isset ($user_id))
  51. {
  52. $uidReset = true;
  53. return;
  54. }
  55. $sql_query = "SELECT * FROM $main_user_table WHERE user_id='$user_id'";
  56. $sql_result = api_sql_query($sql_query, __FILE__, __LINE__);
  57. $result = Database :: fetch_array($sql_result);
  58. $firstname = $result["firstname"];
  59. $lastname = $result["lastname"];
  60. $user_id = $result["user_id"];
  61. $message = "Attempting to login as ".$firstname." ".$lastname." (id ".$user_id.")";
  62. $loginFailed = false;
  63. $uidReset = false;
  64. if ($user_id) // a uid is given (log in succeeded)
  65. {
  66. if ($_configuration['tracking_enabled'])
  67. {
  68. $sql_query = "SELECT user.*, a.user_id is_admin,
  69. UNIX_TIMESTAMP(login.login_date) login_date
  70. FROM $main_user_table
  71. LEFT JOIN $main_admin_table a
  72. ON user.user_id = a.user_id
  73. LEFT JOIN $track_e_login_table login
  74. ON user.user_id = login.login_user_id
  75. WHERE user.user_id = '".$user_id."'
  76. ORDER BY login.login_date DESC LIMIT 1";
  77. }
  78. else
  79. {
  80. $sql_query = "SELECT user.*, a.user_id is_admin
  81. FROM $main_user_table
  82. LEFT JOIN $main_admin_table a
  83. ON user.user_id = a.user_id
  84. WHERE user.user_id = '".$user_id."'";
  85. }
  86. $sql_result = api_sql_query($sql_query, __FILE__, __LINE__);
  87. if (mysql_num_rows($sql_result) > 0)
  88. {
  89. // Extracting the user data
  90. $user_data = mysql_fetch_array($sql_result);
  91. // Cleaning session variables
  92. unset($_SESSION['_user']);
  93. unset($_SESSION['is_platformAdmin']);
  94. unset($_SESSION['is_allowedCreateCourse']);
  95. unset($_SESSION['_uid']);
  96. $_user['firstName'] = $user_data['firstname'];
  97. $_user['lastName'] = $user_data['lastname'];
  98. $_user['mail'] = $user_data['email'];
  99. $_user['lastLogin'] = $user_data['login_date'];
  100. $_user['official_code'] = $user_data['official_code'];
  101. $_user['picture_uri'] = $user_data['picture_uri'];
  102. $_user['user_id'] = $user_data['user_id'];
  103. $is_platformAdmin = (bool) (!is_null($user_data['is_admin']));
  104. $is_allowedCreateCourse = (bool) ($user_data['status'] == 1);
  105. LoginDelete($_SESSION["_user"]["user_id"], $_configuration['statistics_database']);
  106. // Filling session variables with new data
  107. $_SESSION['_uid'] = $user_id;
  108. $_SESSION['_user'] = $_user;
  109. $_SESSION['is_platformAdmin'] = $is_platformAdmin;
  110. $_SESSION['is_allowedCreateCourse'] = $is_allowedCreateCourse;
  111. $target_url = api_get_path(WEB_PATH)."user_portal.php";
  112. $message .= "<br/>Login successful. Go to <a href=\"$target_url\">$target_url</a>";
  113. Display :: display_header(get_lang('UserList'));
  114. Display :: display_normal_message($message);
  115. Display :: display_footer();
  116. exit;
  117. }
  118. else
  119. {
  120. exit ("<br/>WARNING UNDEFINED UID !! ");
  121. }
  122. }
  123. }
  124. /**
  125. * Get the total number of users on the platform
  126. * @see SortableTable#get_total_number_of_items()
  127. */
  128. function get_number_of_users()
  129. {
  130. $user_table = Database :: get_main_table(TABLE_MAIN_USER);
  131. $sql = "SELECT COUNT(user_id) AS total_number_of_items FROM $user_table";
  132. if (isset ($_GET['keyword']))
  133. {
  134. $keyword = mysql_real_escape_string($_GET['keyword']);
  135. $sql .= " WHERE firstname LIKE '%".$keyword."%' OR lastname LIKE '%".$keyword."%' OR email LIKE '%".$keyword."%' OR official_code LIKE '%".$keyword."%'";
  136. }
  137. elseif (isset ($_GET['keyword_firstname']))
  138. {
  139. $keyword_firstname = mysql_real_escape_string($_GET['keyword_firstname']);
  140. $keyword_lastname = mysql_real_escape_string($_GET['keyword_lastname']);
  141. $keyword_email = mysql_real_escape_string($_GET['keyword_email']);
  142. $keyword_username = mysql_real_escape_string($_GET['keyword_username']);
  143. $keyword_status = mysql_real_escape_string($_GET['keyword_status']);
  144. $keyword_active = isset($_GET['keyword_active']);
  145. $keyword_inactive = isset($_GET['keyword_inactive']);
  146. $sql .= " WHERE firstname LIKE '%".$keyword_firstname."%' AND lastname LIKE '%".$keyword_lastname."%' AND username LIKE '%".$keyword_username."%' AND email LIKE '%".$keyword_email."%' AND official_code LIKE '%".$keyword_officialcode."%' AND status LIKE '".$keyword_status."'";
  147. if($keyword_active && !$keyword_inactive)
  148. {
  149. $sql .= " AND active='1'";
  150. }
  151. elseif($keyword_inactive && !$keyword_active)
  152. {
  153. $sql .= " AND active='0'";
  154. }
  155. }
  156. $res = api_sql_query($sql, __FILE__, __LINE__);
  157. $obj = mysql_fetch_object($res);
  158. return $obj->total_number_of_items;
  159. }
  160. /**
  161. * Get the users to display on the current page.
  162. * @see SortableTable#get_table_data($from)
  163. */
  164. function get_user_data($from, $number_of_items, $column, $direction)
  165. {
  166. $user_table = Database :: get_main_table(TABLE_MAIN_USER);
  167. $sql = "SELECT
  168. user_id AS col0,
  169. official_code AS col1,
  170. firstname AS col2,
  171. lastname AS col3,
  172. username AS col4,
  173. email AS col5,
  174. IF(status=1,'".get_lang('Teacher')."','".get_lang('Student')."') AS col6,
  175. active AS col7,
  176. user_id AS col8
  177. FROM
  178. $user_table ";
  179. if (isset ($_GET['keyword']))
  180. {
  181. $keyword = mysql_real_escape_string($_GET['keyword']);
  182. $sql .= " WHERE firstname LIKE '%".$keyword."%' OR lastname LIKE '%".$keyword."%' OR username LIKE '%".$keyword."%' OR official_code LIKE '%".$keyword."%'";
  183. }
  184. elseif (isset ($_GET['keyword_firstname']))
  185. {
  186. $keyword_firstname = mysql_real_escape_string($_GET['keyword_firstname']);
  187. $keyword_lastname = mysql_real_escape_string($_GET['keyword_lastname']);
  188. $keyword_email = mysql_real_escape_string($_GET['keyword_email']);
  189. $keyword_username = mysql_real_escape_string($_GET['keyword_username']);
  190. $keyword_status = mysql_real_escape_string($_GET['keyword_status']);
  191. $keyword_active = isset($_GET['keyword_active']);
  192. $keyword_inactive = isset($_GET['keyword_inactive']);
  193. $sql .= " WHERE firstname LIKE '%".$keyword_firstname."%' AND lastname LIKE '%".$keyword_lastname."%' AND username LIKE '%".$keyword_username."%' AND email LIKE '%".$keyword_email."%' AND official_code LIKE '%".$keyword_officialcode."%' AND status LIKE '".$keyword_status."'";
  194. if($keyword_active && !$keyword_inactive)
  195. {
  196. $sql .= " AND active='1'";
  197. }
  198. elseif($keyword_inactive && !$keyword_active)
  199. {
  200. $sql .= " AND active='0'";
  201. }
  202. }
  203. $sql .= " ORDER BY col$column $direction ";
  204. $sql .= " LIMIT $from,$number_of_items";
  205. $res = api_sql_query($sql, __FILE__, __LINE__);
  206. $users = array ();
  207. while ($user = mysql_fetch_row($res))
  208. {
  209. $users[] = $user;
  210. }
  211. return $users;
  212. }
  213. /**
  214. * Returns a mailto-link
  215. * @param string $email An email-address
  216. * @return string HTML-code with a mailto-link
  217. */
  218. function email_filter($email)
  219. {
  220. return Display :: encrypted_mailto_link($email, $email);
  221. }
  222. /**
  223. * Build the modify-column of the table
  224. * @param int $user_id The user id
  225. * @param string $url_params
  226. * @return string Some HTML-code with modify-buttons
  227. */
  228. function modify_filter($user_id,$url_params)
  229. {
  230. $result .= '<a href="user_information.php?user_id='.$user_id.'"><img src="../img/synthese_view.gif" border="0" style="vertical-align: middle;" title="'.get_lang('Info').'" alt="'.get_lang('Info').'"/></a>&nbsp;';
  231. $result .= '<a href="user_list.php?action=login_as&amp;user_id='.$user_id.'"><img src="../img/login_as.gif" border="0" style="vertical-align: middle;" alt="'.get_lang('LoginAs').'" title="'.get_lang('LoginAs').'"/></a>&nbsp;';
  232. $tbl_user = Database :: get_main_table(TABLE_MAIN_USER);
  233. $sql="SELECT status FROM ".$tbl_user." WHERE user_id='".$user_id."'";
  234. $result_sql=api_sql_query($sql);
  235. if(mysql_result($result_sql,0,"status")=="1"){
  236. $result .= '<a href="../mySpace/teachers.php?teacher_id='.$user_id.'"><img src="../img/statistics.gif" border="0" style="vertical-align: middle;" title="'.get_lang('Reporting').'" alt="'.get_lang('Reporting').'"/></a>&nbsp;';
  237. }
  238. if(mysql_result($result_sql,0,"status")=="5"){
  239. $result .= '<a href="../mySpace/student.php?user_id='.$user_id.'"><img src="../img/statistics.gif" border="0" style="vertical-align: middle;" title="'.get_lang('Reporting').'" alt="'.get_lang('Reporting').'"/></a>&nbsp;';
  240. }
  241. $result .= '<a href="user_edit.php?user_id='.$user_id.'"><img src="../img/edit.gif" border="0" style="vertical-align: middle;" title="'.get_lang('Edit').'" alt="'.get_lang('Edit').'"/></a>&nbsp;';
  242. $result .= '<a href="user_list.php?action=delete_user&amp;user_id='.$user_id.'&amp;'.$url_params.'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;"><img src="../img/delete.gif" border="0" style="vertical-align: middle;" title="'.get_lang('Delete').'" alt="'.get_lang('Delete').'"/></a>';
  243. return $result;
  244. }
  245. /**
  246. * Build the active-column of the table to lock or unlock a certain user
  247. * lock = the user can no longer use this account
  248. * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
  249. * @param int $active the current state of the account
  250. * @param int $user_id The user id
  251. * @param string $url_params
  252. * @return string Some HTML-code with the lock/unlock button
  253. */
  254. function active_filter($active, $url_params, $row)
  255. {
  256. global $_user;
  257. if ($active=='1')
  258. {
  259. $action='lock';
  260. $image='right';
  261. }
  262. if ($active=='0')
  263. {
  264. $action='unlock';
  265. $image='wrong';
  266. }
  267. if ($row['0']<>$_user['user_id']) // you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
  268. {
  269. $result = '<a href="user_list.php?action='.$action.'&amp;user_id='.$row['0'].'&amp;'.$url_params.'"><img src="../img/'.$image.'.gif" border="0" style="vertical-align: middle;" alt="'.get_lang($action).'" title="'.get_lang($action).'"/></a>';
  270. }
  271. return $result;
  272. }
  273. /**
  274. * lock or unlock a user
  275. * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
  276. * @param int $status, do we want to lock the user ($status=lock) or unlock it ($status=unlock)
  277. * @param int $user_id The user id
  278. * @return language variable
  279. */
  280. function lock_unlock_user($status,$user_id)
  281. {
  282. $user_table = Database :: get_main_table(TABLE_MAIN_USER);
  283. if ($status=='lock')
  284. {
  285. $status_db='0';
  286. $return_message=get_lang('UserLocked');
  287. }
  288. if ($status=='unlock')
  289. {
  290. $status_db='1';
  291. $return_message=get_lang('UserUnlocked');
  292. }
  293. if(($status_db=='1' OR $status_db=='0') AND is_numeric($user_id))
  294. {
  295. $sql="UPDATE $user_table SET active='".mysql_real_escape_string($status_db)."' WHERE user_id='".mysql_real_escape_string($user_id)."'";
  296. $result = api_sql_query($sql, __FILE__, __LINE__);
  297. }
  298. if ($result)
  299. {
  300. return $return_message;
  301. }
  302. }
  303. /**
  304. ==============================================================================
  305. INIT SECTION
  306. ==============================================================================
  307. */
  308. require_once (api_get_path(LIBRARY_PATH).'usermanager.lib.php');
  309. $action = $_GET["action"];
  310. $login_as_user_id = $_GET["user_id"];
  311. // Login as ...
  312. if ($_GET['action'] == "login_as" && isset ($login_as_user_id))
  313. {
  314. login_user($login_as_user_id);
  315. }
  316. if (isset ($_GET['search']) && $_GET['search'] == 'advanced')
  317. {
  318. $interbreadcrumb[] = array ("url" => 'index.php', "name" => get_lang('PlatformAdmin'));
  319. $interbreadcrumb[] = array ("url" => 'user_list.php', "name" => get_lang('UserList'));
  320. $tool_name = get_lang('SearchAUser');
  321. Display :: display_header($tool_name);
  322. //api_display_tool_title($tool_name);
  323. $form = new FormValidator('advanced_search','get');
  324. $form->add_textfield('keyword_firstname',get_lang('FirstName'),false);
  325. $form->add_textfield('keyword_lastname',get_lang('LastName'),false);
  326. $form->add_textfield('keyword_username',get_lang('LoginName'),false);
  327. $form->add_textfield('keyword_email',get_lang('Email'),false);
  328. $form->add_textfield('keyword_officialcode',get_lang('OfficialCode'),false);
  329. $status_options = array();
  330. $status_options['%'] = get_lang('All');
  331. $status_options[STUDENT] = get_lang('Student');
  332. $status_options[COURSEMANAGER] = get_lang('Teacher');
  333. $form->addElement('select','keyword_status',get_lang('Status'),$status_options);
  334. $active_group = array();
  335. $active_group[] = $form->createElement('checkbox','keyword_active','',get_lang('Active'));
  336. $active_group[] = $form->createElement('checkbox','keyword_inactive','',get_lang('Inactive'));
  337. $form->addGroup($active_group,'',get_lang('ActiveAccount'),'<br/>',false);
  338. $form->addElement('submit','submit',get_lang('Ok'));
  339. $defaults['keyword_active'] = 1;
  340. $defaults['keyword_inactive'] = 1;
  341. $form->setDefaults($defaults);
  342. $form->display();
  343. }
  344. else
  345. {
  346. $interbreadcrumb[] = array ("url" => 'index.php', "name" => get_lang('PlatformAdmin'));
  347. $tool_name = get_lang('UserList');
  348. Display :: display_header($tool_name, "");
  349. //api_display_tool_title($tool_name);
  350. if (isset ($_GET['action']))
  351. {
  352. switch ($_GET['action'])
  353. {
  354. case 'show_message' :
  355. Display :: display_normal_message(stripslashes($_GET['message']));
  356. break;
  357. case 'delete_user' :
  358. if ($user_id != $_user['user_id'] && UserManager :: delete_user($_GET['user_id']))
  359. {
  360. Display :: display_normal_message(get_lang('UserDeleted'));
  361. }
  362. else
  363. {
  364. Display :: display_error_message(get_lang('CannotDeleteUser'));
  365. }
  366. break;
  367. case 'lock' :
  368. $message=lock_unlock_user('lock',$_GET['user_id']);
  369. Display :: display_normal_message($message);
  370. break;
  371. case 'unlock';
  372. $message=lock_unlock_user('unlock',$_GET['user_id']);
  373. Display :: display_normal_message($message);
  374. break;
  375. }
  376. }
  377. if (isset ($_POST['action']))
  378. {
  379. switch ($_POST['action'])
  380. {
  381. case 'delete' :
  382. $number_of_selected_users = count($_POST['id']);
  383. $number_of_deleted_users = 0;
  384. foreach ($_POST['id'] as $index => $user_id)
  385. {
  386. if($user_id != $_user['user_id'])
  387. {
  388. if(UserManager :: delete_user($user_id))
  389. {
  390. $number_of_deleted_users++;
  391. }
  392. }
  393. }
  394. if($number_of_selected_users == $number_of_deleted_users)
  395. {
  396. Display :: display_normal_message(get_lang('SelectedUsersDeleted'));
  397. }
  398. else
  399. {
  400. Display :: display_error_message(get_lang('SomeUsersNotDeleted'));
  401. }
  402. break;
  403. }
  404. }
  405. // Create a search-box
  406. $form = new FormValidator('search_simple','get','','',null,false);
  407. $renderer =& $form->defaultRenderer();
  408. $renderer->setElementTemplate('<span>{element}</span> ');
  409. $form->addElement('text','keyword',get_lang('keyword'));
  410. $form->addElement('submit','submit',get_lang('Search'));
  411. $form->addElement('static','search_advanced_link',null,'<a href="user_list.php?search=advanced">'.get_lang('AdvancedSearch').'</a>');
  412. $form->display();
  413. if (isset ($_GET['keyword']))
  414. {
  415. $parameters = array ('keyword' => $_GET['keyword']);
  416. }
  417. elseif (isset ($_GET['keyword_firstname']))
  418. {
  419. $parameters['keyword_firstname'] = $_GET['keyword_firstname'];
  420. $parameters['keyword_lastname'] = $_GET['keyword_lastname'];
  421. $parameters['keyword_email'] = $_GET['keyword_email'];
  422. $parameters['keyword_officialcode'] = $_GET['keyword_officialcode'];
  423. $parameters['keyword_status'] = $_GET['keyword_status'];
  424. $parameters['keyword_active'] = $_GET['keyword_active'];
  425. $parameters['keyword_inactive'] = $_GET['keyword_inactive'];
  426. }
  427. // Create a sortable table with user-data
  428. $table = new SortableTable('users', 'get_number_of_users', 'get_user_data',2);
  429. $table->set_additional_parameters($parameters);
  430. $table->set_header(0, '', false);
  431. $table->set_header(1, get_lang('OfficialCode'));
  432. $table->set_header(2, get_lang('FirstName'));
  433. $table->set_header(3, get_lang('LastName'));
  434. $table->set_header(4, get_lang('LoginName'));
  435. $table->set_header(5, get_lang('Email'));
  436. $table->set_header(6, get_lang('Status'));
  437. $table->set_header(7, get_lang('Active'));
  438. $table->set_header(8, get_lang('Modify'));
  439. $table->set_column_filter(5, 'email_filter');
  440. $table->set_column_filter(7, 'active_filter');
  441. $table->set_column_filter(8, 'modify_filter');
  442. $table->set_form_actions(array ('delete' => get_lang('DeleteFromPlatform')));
  443. $table->display();
  444. }
  445. /*
  446. ==============================================================================
  447. FOOTER
  448. ==============================================================================
  449. */
  450. Display :: display_footer();
  451. ?>