user_list.php 37 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. use ChamiloSession as Session;
  4. /**
  5. * @author Bart Mollet
  6. * @author Julio Montoya <gugli100@gmail.com> BeezNest 2011
  7. * @package chamilo.admin
  8. */
  9. $cidReset = true;
  10. require_once '../inc/global.inc.php';
  11. $current_access_url_id = api_get_current_access_url_id();
  12. $action = isset($_REQUEST["action"]) ? $_REQUEST["action"] : null;
  13. // Blocks the possibility to delete a user
  14. $deleteUserAvailable = true;
  15. if (api_get_configuration_value('deny_delete_users')) {
  16. $deleteUserAvailable = false;
  17. }
  18. $url = api_get_path(WEB_AJAX_PATH).'course.ajax.php?a=get_user_courses';
  19. $urlSession = api_get_path(WEB_AJAX_PATH).'session.ajax.php?a=get_user_sessions';
  20. $extraField = new ExtraField('user');
  21. $variables = $extraField->get_all_extra_field_by_type(ExtraField::FIELD_TYPE_TAG);
  22. $variablesSelect = $extraField->get_all_extra_field_by_type(ExtraField::FIELD_TYPE_SELECT);
  23. if (!empty($variablesSelect)) {
  24. $variables = array_merge($variables, $variablesSelect);
  25. }
  26. $variablesToShow = [];
  27. if ($variables) {
  28. foreach ($variables as $variableId) {
  29. $extraFieldInfo = $extraField->get($variableId);
  30. $variablesToShow[] = $extraFieldInfo['variable'];
  31. }
  32. }
  33. Session::write('variables_to_show', $variablesToShow);
  34. $htmlHeadXtra[] = '<script>
  35. function load_course_list (div_course,my_user_id) {
  36. $.ajax({
  37. contentType: "application/x-www-form-urlencoded",
  38. beforeSend: function(objeto) {
  39. $("div#"+div_course).html("<img src=\'../inc/lib/javascript/indicator.gif\' />"); },
  40. type: "POST",
  41. url: "'.$url.'",
  42. data: "user_id="+my_user_id,
  43. success: function(datos) {
  44. $("div#"+div_course).html(datos);
  45. $("div#div_"+my_user_id).attr("class","blackboard_show");
  46. $("div#div_"+my_user_id).attr("style","");
  47. }
  48. });
  49. }
  50. function load_session_list(div_session, my_user_id) {
  51. $.ajax({
  52. contentType: "application/x-www-form-urlencoded",
  53. beforeSend: function(objeto) {
  54. $("div#"+div_session).html("<img src=\'../inc/lib/javascript/indicator.gif\' />"); },
  55. type: "POST",
  56. url: "'.$urlSession.'",
  57. data: "user_id="+my_user_id,
  58. success: function(datos) {
  59. $("div#"+div_session).html(datos);
  60. $("div#div_s_"+my_user_id).attr("class","blackboard_show");
  61. $("div#div_s_"+my_user_id).attr("style","");
  62. }
  63. });
  64. }
  65. function active_user(element_div) {
  66. id_image=$(element_div).attr("id");
  67. image_clicked=$(element_div).attr("src");
  68. image_clicked_info = image_clicked.split("/");
  69. image_real_clicked = image_clicked_info[image_clicked_info.length-1];
  70. var status = 1;
  71. if (image_real_clicked == "accept.png") {
  72. status = 0;
  73. }
  74. user_id=id_image.split("_");
  75. ident="#img_"+user_id[1];
  76. if (confirm("'.get_lang('AreYouSureToEditTheUserStatus', '').'")) {
  77. $.ajax({
  78. contentType: "application/x-www-form-urlencoded",
  79. beforeSend: function(objeto) {
  80. $(ident).attr("src","'.Display::returnIconPath('loading1.gif').'"); }, //candy eye stuff
  81. type: "GET",
  82. url: "'.api_get_path(WEB_AJAX_PATH).'user_manager.ajax.php?a=active_user",
  83. data: "user_id="+user_id[1]+"&status="+status,
  84. success: function(data) {
  85. if (data == 1) {
  86. $(ident).attr("src", "'.Display::returnIconPath('accept.png').'");
  87. $(ident).attr("title","'.get_lang('Lock').'");
  88. }
  89. if (data == 0) {
  90. $(ident).attr("src","'.Display::returnIconPath('error.png').'");
  91. $(ident).attr("title","'.get_lang('Unlock').'");
  92. }
  93. if (data == -1) {
  94. $(ident).attr("src", "'.Display::returnIconPath('warning.png').'");
  95. $(ident).attr("title","'.get_lang('ActionNotAllowed').'");
  96. }
  97. }
  98. });
  99. }
  100. }
  101. function clear_course_list(div_course) {
  102. $("div#"+div_course).html("&nbsp;");
  103. $("div#"+div_course).hide("");
  104. }
  105. function clear_session_list(div_session) {
  106. $("div#"+div_session).html("&nbsp;");
  107. $("div#"+div_session).hide("");
  108. }
  109. function display_advanced_search_form () {
  110. if ($("#advanced_search_form").css("display") == "none") {
  111. $("#advanced_search_form").css("display","block");
  112. $("#img_plus_and_minus").html(\'&nbsp;'. Display::returnFontAwesomeIcon('arrow-down') . ' '. get_lang('AdvancedSearch').'\');
  113. } else {
  114. $("#advanced_search_form").css("display","none");
  115. $("#img_plus_and_minus").html(\'&nbsp;'. Display::returnFontAwesomeIcon('arrow-right') . ' '.get_lang('AdvancedSearch').'\');
  116. }
  117. }
  118. $(document).ready(function() {
  119. var select_val = $("#input_select_extra_data").val();
  120. if ( document.getElementById(\'extra_data_text\')) {
  121. if (select_val != 0) {
  122. document.getElementById(\'extra_data_text\').style.display="block";
  123. if (document.getElementById(\'input_extra_text\'))
  124. document.getElementById(\'input_extra_text\').value = "";
  125. } else {
  126. document.getElementById(\'extra_data_text\').style.display="none";
  127. }
  128. }
  129. });
  130. //Load user calendar
  131. function load_calendar(user_id, month, year) {
  132. var url = "'.api_get_path(WEB_AJAX_PATH).'agenda.ajax.php?a=get_user_agenda&user_id=" +user_id + "&month="+month+"&year="+year;
  133. $(".modal-body").load(url);
  134. }
  135. </script>';
  136. $this_section = SECTION_PLATFORM_ADMIN;
  137. if ($action == 'login_as') {
  138. $check = Security::check_token('get');
  139. if (isset($_GET['user_id']) && $check) {
  140. $result = loginUser($_GET['user_id']);
  141. if ($result == false) {
  142. api_not_allowed(true);
  143. }
  144. }
  145. Security::clear_token();
  146. }
  147. api_protect_admin_script(true);
  148. /**
  149. * Prepares the shared SQL query for the user table.
  150. * See get_user_data() and get_number_of_users().
  151. *
  152. * @param boolean $is_count Whether to count, or get data
  153. * @return string SQL query
  154. */
  155. function prepare_user_sql_query($is_count)
  156. {
  157. $sql = '';
  158. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  159. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  160. if ($is_count) {
  161. $sql .= "SELECT COUNT(u.id) AS total_number_of_items FROM $user_table u";
  162. } else {
  163. $sql .= "SELECT u.id AS col0, u.official_code AS col2, ";
  164. if (api_is_western_name_order()) {
  165. $sql .= "u.firstname AS col3, u.lastname AS col4, ";
  166. } else {
  167. $sql .= "u.lastname AS col3, u.firstname AS col4, ";
  168. }
  169. $sql .= " u.username AS col5,
  170. u.email AS col6,
  171. u.status AS col7,
  172. u.active AS col8,
  173. u.id AS col9,
  174. u.registration_date AS col10,
  175. u.expiration_date AS exp,
  176. u.password
  177. FROM $user_table u";
  178. }
  179. // adding the filter to see the user's only of the current access_url
  180. if ((api_is_platform_admin() || api_is_session_admin()) && api_get_multiple_access_url()) {
  181. $access_url_rel_user_table = Database :: get_main_table(TABLE_MAIN_ACCESS_URL_REL_USER);
  182. $sql.= " INNER JOIN $access_url_rel_user_table url_rel_user ON (u.id=url_rel_user.user_id)";
  183. }
  184. $keywordList = array(
  185. 'keyword_firstname',
  186. 'keyword_lastname',
  187. 'keyword_username',
  188. 'keyword_email',
  189. 'keyword_officialcode',
  190. 'keyword_status',
  191. 'keyword_active',
  192. 'keyword_inactive',
  193. 'check_easy_passwords'
  194. );
  195. $keywordListValues = array();
  196. $atLeastOne = false;
  197. foreach ($keywordList as $keyword) {
  198. $keywordListValues[$keyword] = null;
  199. if (isset($_GET[$keyword]) && !empty($_GET[$keyword])) {
  200. $keywordListValues[$keyword] = $_GET[$keyword];
  201. $atLeastOne = true;
  202. }
  203. }
  204. if ($atLeastOne == false) {
  205. $keywordListValues = array();
  206. }
  207. /*
  208. // This block is never executed because $keyword_extra_data never exists
  209. if (isset($keyword_extra_data) && !empty($keyword_extra_data)) {
  210. $extra_info = UserManager::get_extra_field_information_by_name($keyword_extra_data);
  211. $field_id = $extra_info['id'];
  212. $sql.= " INNER JOIN user_field_values ufv ON u.id=ufv.user_id AND ufv.field_id=$field_id ";
  213. }
  214. */
  215. if (isset($_GET['keyword']) && !empty($_GET['keyword'])) {
  216. $keywordFiltered = Database::escape_string("%". $_GET['keyword'] ."%");
  217. $sql .= " WHERE (
  218. u.firstname LIKE '$keywordFiltered' OR
  219. u.lastname LIKE '$keywordFiltered' OR
  220. concat(u.firstname, ' ', u.lastname) LIKE '$keywordFiltered' OR
  221. concat(u.lastname,' ',u.firstname) LIKE '$keywordFiltered' OR
  222. u.username LIKE '$keywordFiltered' OR
  223. u.official_code LIKE '$keywordFiltered' OR
  224. u.email LIKE '$keywordFiltered'
  225. )
  226. ";
  227. } elseif (isset($keywordListValues) && !empty($keywordListValues)) {
  228. $query_admin_table = '';
  229. $keyword_admin = '';
  230. if (isset($keywordListValues['keyword_status']) &&
  231. $keywordListValues['keyword_status'] == PLATFORM_ADMIN
  232. ) {
  233. $query_admin_table = " , $admin_table a ";
  234. $keyword_admin = ' AND a.user_id = u.id ';
  235. $keywordListValues['keyword_status'] = '%';
  236. }
  237. $keyword_extra_value = '';
  238. // This block is never executed because $keyword_extra_data never exists
  239. /*
  240. if (isset($keyword_extra_data) && !empty($keyword_extra_data) &&
  241. !empty($keyword_extra_data_text)) {
  242. $keyword_extra_value = " AND ufv.field_value LIKE '%".trim($keyword_extra_data_text)."%' ";
  243. }
  244. */
  245. $sql .= " $query_admin_table
  246. WHERE (
  247. u.firstname LIKE '". Database::escape_string("%".$keywordListValues['keyword_firstname']."%")."' AND
  248. u.lastname LIKE '". Database::escape_string("%".$keywordListValues['keyword_lastname']."%")."' AND
  249. u.username LIKE '". Database::escape_string("%".$keywordListValues['keyword_username']."%")."' AND
  250. u.email LIKE '". Database::escape_string("%".$keywordListValues['keyword_email']."%")."' AND
  251. u.status LIKE '".Database::escape_string($keywordListValues['keyword_status'])."' ";
  252. if (!empty($keywordListValues['keyword_officialcode'])) {
  253. $sql .= " AND u.official_code LIKE '" . Database::escape_string("%" . $keywordListValues['keyword_officialcode'] . "%") . "' ";
  254. }
  255. $sql .= "
  256. $keyword_admin
  257. $keyword_extra_value
  258. ";
  259. if (isset($keywordListValues['keyword_active']) && !isset($keywordListValues['keyword_inactive'])) {
  260. $sql .= " AND u.active = 1";
  261. } elseif (isset($keywordListValues['keyword_inactive']) && !isset($keywordListValues['keyword_active'])) {
  262. $sql .= " AND u.active = 0";
  263. }
  264. $sql .= " ) ";
  265. }
  266. $variables = Session::read('variables_to_show');
  267. $extraField = new ExtraField('user');
  268. $extraFieldResult = [];
  269. foreach ($variables as $variable) {
  270. if (isset($_GET['extra_'.$variable])) {
  271. if (is_array($_GET['extra_'.$variable])) {
  272. $values = $_GET['extra_'.$variable];
  273. } else {
  274. $values = [$_GET['extra_'.$variable]];
  275. }
  276. $info = $extraField->get_handler_field_info_by_field_variable($variable);
  277. if (empty($info)) {
  278. continue;
  279. }
  280. foreach ($values as $value) {
  281. if ($info['field_type'] == ExtraField::FIELD_TYPE_TAG) {
  282. $result = $extraField->getAllUserPerTag($info['id'], $value);
  283. $result = empty($result) ? [] : array_column($result, 'user_id');
  284. } else {
  285. $result = UserManager::get_extra_user_data_by_value(
  286. $variable,
  287. $value
  288. );
  289. }
  290. if (!empty($result)) {
  291. $extraFieldResult = array_merge($extraFieldResult, $result);
  292. }
  293. }
  294. }
  295. }
  296. if (!empty($extraFieldResult)) {
  297. $sql .= " AND (u.id IN ('".implode("','", $extraFieldResult)."')) ";
  298. }
  299. // adding the filter to see the user's only of the current access_url
  300. if ((api_is_platform_admin() || api_is_session_admin())
  301. && api_get_multiple_access_url()
  302. ) {
  303. $sql .= " AND url_rel_user.access_url_id=".api_get_current_access_url_id();
  304. }
  305. return $sql;
  306. }
  307. /**
  308. * Make sure this function is protected because it does NOT check password!
  309. *
  310. * This function defines globals.
  311. * @param int $userId
  312. *
  313. * @return false|null False on failure, redirection on success
  314. * @author Evie Embrechts
  315. * @author Yannick Warnier <yannick.warnier@dokeos.com>
  316. */
  317. function loginUser($userId)
  318. {
  319. $userId = intval($userId);
  320. $userInfo = api_get_user_info($userId);
  321. // Check if the user is allowed to 'login_as'
  322. $canLoginAs = api_can_login_as($userId);
  323. if (!$canLoginAs || empty($userInfo)) {
  324. return false;
  325. }
  326. $firstname = $userInfo['firstname'];
  327. $lastname = $userInfo['lastname'];
  328. if (api_is_western_name_order()) {
  329. $message = sprintf(get_lang('AttemptingToLoginAs'),$firstname, $lastname, $userId);
  330. } else {
  331. $message = sprintf(get_lang('AttemptingToLoginAs'), $lastname, $firstname, $userId);
  332. }
  333. if ($userId) {
  334. // Logout the current user
  335. LoginDelete(api_get_user_id());
  336. Session::erase('_user');
  337. Session::erase('is_platformAdmin');
  338. Session::erase('is_allowedCreateCourse');
  339. Session::erase('_uid');
  340. // Cleaning session variables
  341. $_user['firstName'] = $userInfo['firstname'];
  342. $_user['lastName'] = $userInfo['lastname'];
  343. $_user['mail'] = $userInfo['email'];
  344. $_user['official_code'] = $userInfo['official_code'];
  345. $_user['picture_uri'] = $userInfo['picture_uri'];
  346. $_user['user_id'] = $userId;
  347. $_user['id'] = $userId;
  348. $_user['status'] = $userInfo['status'];
  349. // Filling session variables with new data
  350. Session::write('_uid', $userId);
  351. Session::write('_user', $userInfo);
  352. Session::write('is_platformAdmin', (bool) (UserManager::is_admin($userId)));
  353. Session::write('is_allowedCreateCourse', (bool) ($userInfo['status'] == 1));
  354. // will be useful later to know if the user is actually an admin or not (example reporting)
  355. Session::write('login_as', true);
  356. $target_url = api_get_path(WEB_PATH)."user_portal.php";
  357. $message .= '<br />'.sprintf(get_lang('LoginSuccessfulGoToX'), '<a href="'.$target_url.'">'.$target_url.'</a>');
  358. Display :: display_header(get_lang('UserList'));
  359. Display :: display_normal_message($message, false);
  360. Display :: display_footer();
  361. exit;
  362. }
  363. }
  364. /**
  365. * Get the total number of users on the platform
  366. * @see SortableTable#get_total_number_of_items()
  367. */
  368. function get_number_of_users()
  369. {
  370. $sql = prepare_user_sql_query(true);
  371. $res = Database::query($sql);
  372. $obj = Database::fetch_object($res);
  373. return $obj->total_number_of_items;
  374. }
  375. /**
  376. * Get the users to display on the current page (fill the sortable-table)
  377. * @param int offset of first user to recover
  378. * @param int Number of users to get
  379. * @param int Column to sort on
  380. * @param string Order (ASC,DESC)
  381. * @see SortableTable#get_table_data($from)
  382. */
  383. function get_user_data($from, $number_of_items, $column, $direction)
  384. {
  385. $sql = prepare_user_sql_query(false);
  386. /* @todo will not work because now we use the salt field
  387. $checkPassStrength = isset($_GET['check_easy_passwords']) && $_GET['check_easy_passwords'] == 1 ? true : false;
  388. if ($checkPassStrength) {
  389. $easyPasswordList = api_get_easy_password_list();
  390. $easyPasswordList = array_map('api_get_encrypted_password', $easyPasswordList);
  391. $easyPasswordList = array_map(array('Database', 'escape_string'), $easyPasswordList);
  392. $easyPassword = implode("' OR password LIKE '", $easyPasswordList);
  393. $sql .= "AND password LIKE '$easyPassword' ";
  394. }*/
  395. if (!in_array($direction, array('ASC','DESC'))) {
  396. $direction = 'ASC';
  397. }
  398. $column = intval($column);
  399. $from = intval($from);
  400. $number_of_items = intval($number_of_items);
  401. $preventSessionAdminsToManageAllUsers = api_get_setting('prevent_session_admins_to_manage_all_users');
  402. if (api_is_session_admin() && $preventSessionAdminsToManageAllUsers === 'true') {
  403. $sql .= " WHERE u.creator_id = ".api_get_user_id();
  404. }
  405. $sql .= " ORDER BY col$column $direction ";
  406. $sql .= " LIMIT $from,$number_of_items";
  407. $res = Database::query($sql);
  408. $users = array ();
  409. $t = time();
  410. while ($user = Database::fetch_row($res)) {
  411. $userPicture = UserManager::getUserPicture($user[0], USER_IMAGE_SIZE_SMALL);
  412. $photo = '<img src="'.$userPicture.'" width="22" height="22" alt="'.api_get_person_name($user[2], $user[3]).'" title="'.api_get_person_name($user[2], $user[3]).'" />';
  413. if ($user[7] == 1 && !empty($user[10])) {
  414. // check expiration date
  415. $expiration_time = convert_sql_date($user[10]);
  416. // if expiration date is passed, store a special value for active field
  417. if ($expiration_time < $t) {
  418. $user[7] = '-1';
  419. }
  420. }
  421. // forget about the expiration date field
  422. $users[] = array(
  423. $user[0],
  424. $photo,
  425. $user[1],
  426. $user[2],
  427. $user[3],
  428. $user[4],
  429. $user[5],
  430. $user[6],
  431. $user[7],
  432. api_get_local_time($user[9]),
  433. $user[0]
  434. );
  435. }
  436. return $users;
  437. }
  438. /**
  439. * Returns a mailto-link
  440. * @param string $email An email-address
  441. * @return string HTML-code with a mailto-link
  442. */
  443. function email_filter($email)
  444. {
  445. return Display :: encrypted_mailto_link($email, $email);
  446. }
  447. /**
  448. * Returns a mailto-link
  449. * @param string $email An email-address
  450. * @return string HTML-code with a mailto-link
  451. */
  452. function user_filter($name, $params, $row)
  453. {
  454. return '<a href="'.api_get_path(WEB_PATH).'whoisonline.php?origin=user_list&id='.$row[0].'">'.$name.'</a>';
  455. }
  456. /**
  457. * Build the modify-column of the table
  458. * @param int The user id
  459. * @param string URL params to add to table links
  460. * @param array Row of elements to alter
  461. * @return string Some HTML-code with modify-buttons
  462. */
  463. function modify_filter($user_id, $url_params, $row)
  464. {
  465. global $charset, $_admins_list;
  466. $is_admin = in_array($user_id, $_admins_list);
  467. $statusname = api_get_status_langvars();
  468. $user_is_anonymous = false;
  469. $current_user_status_label = $row['7'];
  470. if ($current_user_status_label == $statusname[ANONYMOUS]) {
  471. $user_is_anonymous = true;
  472. }
  473. $result = '';
  474. if (!$user_is_anonymous) {
  475. $icon = Display::return_icon(
  476. 'course.png',
  477. get_lang('Courses'),
  478. array('onmouseout' => 'clear_course_list (\'div_'.$user_id.'\')')
  479. );
  480. $result .= '<a href="javascript:void(0)" onclick="load_course_list(\'div_'.$user_id.'\','.$user_id.')" >
  481. '.$icon.'
  482. <div class="blackboard_hide" id="div_'.$user_id.'">&nbsp;&nbsp;</div>
  483. </a>';
  484. $icon = Display::return_icon(
  485. 'session.png',
  486. get_lang('Sessions'),
  487. array('onmouseout' => 'clear_session_list (\'div_s_'.$user_id.'\')')
  488. );
  489. $result .= '<a href="javascript:void(0)" onclick="load_session_list(\'div_s_'.$user_id.'\','.$user_id.')" >
  490. '.$icon.'
  491. <div class="blackboard_hide" id="div_s_'.$user_id.'">&nbsp;&nbsp;</div>
  492. </a>';
  493. } else {
  494. $result .= Display::return_icon('course_na.png',get_lang('Courses')).'&nbsp;&nbsp;';
  495. $result .= Display::return_icon('course_na.png',get_lang('Sessions')).'&nbsp;&nbsp;';
  496. }
  497. if (api_is_platform_admin()) {
  498. if (!$user_is_anonymous) {
  499. $result .= '<a href="user_information.php?user_id='.$user_id.'">'.Display::return_icon('synthese_view.gif', get_lang('Info')).'</a>&nbsp;&nbsp;';
  500. } else {
  501. $result .= Display::return_icon('synthese_view_na.gif', get_lang('Info')).'&nbsp;&nbsp;';
  502. }
  503. }
  504. //only allow platform admins to login_as, or session admins only for students (not teachers nor other admins)
  505. if (api_is_platform_admin() || (api_is_session_admin() && $current_user_status_label == $statusname[STUDENT])) {
  506. if (!$user_is_anonymous) {
  507. if (api_global_admin_can_edit_admin($user_id)) {
  508. $result .= '<a href="user_list.php?action=login_as&user_id='.$user_id.'&sec_token='.$_SESSION['sec_token'].'">'.Display::return_icon('login_as.png', get_lang('LoginAs')).'</a>&nbsp;&nbsp;';
  509. } else {
  510. $result .= Display::return_icon('login_as_na.png', get_lang('LoginAs')).'&nbsp;&nbsp;';
  511. }
  512. } else {
  513. $result .= Display::return_icon('login_as_na.png', get_lang('LoginAs')).'&nbsp;&nbsp;';
  514. }
  515. } else {
  516. $result .= Display::return_icon('login_as_na.png', get_lang('LoginAs')).'&nbsp;&nbsp;';
  517. }
  518. if ($current_user_status_label != $statusname[STUDENT]) {
  519. $result .= Display::return_icon('statistics_na.gif', get_lang('Reporting')).'&nbsp;&nbsp;';
  520. } else {
  521. $result .= '<a href="../mySpace/myStudents.php?student='.$user_id.'">'.Display::return_icon('statistics.gif', get_lang('Reporting')).'</a>&nbsp;&nbsp;';
  522. }
  523. if (api_is_platform_admin(true)) {
  524. $editProfileUrl = Display::getProfileEditionLink($user_id, true);
  525. if (!$user_is_anonymous && api_global_admin_can_edit_admin($user_id, null, true)) {
  526. $result .= '<a href="' . $editProfileUrl . '">'.Display::return_icon('edit.png', get_lang('Edit'), array(), ICON_SIZE_SMALL).'</a>&nbsp;';
  527. } else {
  528. $result .= Display::return_icon('edit_na.png', get_lang('Edit'), array(), ICON_SIZE_SMALL).'</a>&nbsp;';
  529. }
  530. }
  531. $allowAssignSkill = api_is_platform_admin(false, true);
  532. if ($allowAssignSkill) {
  533. $result .= Display::url(
  534. Display::return_icon('skill-badges.png', get_lang('AssignSkill'), null, ICON_SIZE_SMALL),
  535. api_get_path(WEB_CODE_PATH) . 'badge/assign.php?' . http_build_query(['user' => $user_id])
  536. );
  537. }
  538. if ($is_admin) {
  539. $result .= Display::return_icon(
  540. 'admin_star.png',
  541. get_lang('IsAdministrator'),
  542. array('width' => ICON_SIZE_SMALL, 'heigth' => ICON_SIZE_SMALL)
  543. );
  544. } else {
  545. $result .= Display::return_icon('admin_star_na.png', get_lang('IsNotAdministrator'));
  546. }
  547. // actions for assigning sessions, courses or users
  548. if (!api_is_session_admin()) {
  549. if ($current_user_status_label == $statusname[SESSIONADMIN]) {
  550. $result .= Display::url(
  551. Display::return_icon('view_more_stats.gif', get_lang('AssignSessions')),
  552. "dashboard_add_sessions_to_user.php?user={$user_id}"
  553. );
  554. } else {
  555. if (
  556. $current_user_status_label == $statusname[DRH] ||
  557. UserManager::is_admin($user_id) ||
  558. $current_user_status_label == $statusname[STUDENT_BOSS]
  559. ) {
  560. $result .= Display::url(
  561. Display::return_icon('user_subscribe_course.png', get_lang('AssignUsers'), '', ICON_SIZE_SMALL),
  562. "dashboard_add_users_to_user.php?user={$user_id}"
  563. );
  564. }
  565. if ($current_user_status_label == $statusname[DRH] || UserManager::is_admin($user_id)) {
  566. $result .= Display::url(
  567. Display::return_icon('course_add.gif', get_lang('AssignCourses')),
  568. "dashboard_add_courses_to_user.php?user={$user_id}"
  569. );
  570. $result .= Display::url(
  571. Display::return_icon('view_more_stats.gif', get_lang('AssignSessions')),
  572. "dashboard_add_sessions_to_user.php?user={$user_id}"
  573. );
  574. }
  575. }
  576. }
  577. if (api_is_platform_admin()) {
  578. $result .= ' <a data-title="'.get_lang('FreeBusyCalendar').'" href="'.api_get_path(WEB_AJAX_PATH).'agenda.ajax.php?a=get_user_agenda&user_id='.$user_id.'&modal_size=lg" class="agenda_opener ajax">'.
  579. Display::return_icon('calendar.png', get_lang('FreeBusyCalendar'), array(), ICON_SIZE_SMALL).'</a>';
  580. $deleteAllowed = !api_get_configuration_value('deny_delete_users');
  581. if ($deleteAllowed) {
  582. if ($user_id != api_get_user_id() &&
  583. !$user_is_anonymous &&
  584. api_global_admin_can_edit_admin($user_id)
  585. ) {
  586. // you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
  587. $result .= ' <a href="user_list.php?action=delete_user&user_id='.$user_id.'&'.$url_params.'&sec_token='.$_SESSION['sec_token'].'" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."'".')) return false;">'.Display::return_icon('delete.png', get_lang('Delete'), array(), ICON_SIZE_SMALL).'</a>';
  588. } else {
  589. $result .= Display::return_icon('delete_na.png', get_lang('Delete'), array(), ICON_SIZE_SMALL);
  590. }
  591. }
  592. }
  593. return $result;
  594. }
  595. /**
  596. * Build the active-column of the table to lock or unlock a certain user
  597. * lock = the user can no longer use this account
  598. * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
  599. * @param int $active the current state of the account
  600. * @param string $params
  601. * @param array $row
  602. * @return string Some HTML-code with the lock/unlock button
  603. */
  604. function active_filter($active, $params, $row)
  605. {
  606. $_user = api_get_user_info();
  607. if ($active == '1') {
  608. $action = 'Lock';
  609. $image = 'accept';
  610. } elseif ($active == '-1') {
  611. $action = 'edit';
  612. $image = 'warning';
  613. } elseif ($active == '0') {
  614. $action = 'Unlock';
  615. $image = 'error';
  616. }
  617. $result = '';
  618. if ($action === 'edit') {
  619. $result = Display::return_icon($image.'.png', get_lang('AccountExpired'), array(), 16);
  620. } elseif ($row['0'] <> $_user['user_id']) {
  621. // you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
  622. $result = Display::return_icon(
  623. $image.'.png',
  624. get_lang(ucfirst($action)),
  625. array('onclick' => 'active_user(this);', 'id' => 'img_'.$row['0']),
  626. 16
  627. );
  628. }
  629. return $result;
  630. }
  631. /**
  632. * Instead of displaying the integer of the status, we give a translation for the status
  633. *
  634. * @param integer $status
  635. * @return string translation
  636. *
  637. * @version march 2008
  638. * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University, Belgium
  639. */
  640. function status_filter($status) {
  641. $statusname = api_get_status_langvars();
  642. return $statusname[$status];
  643. }
  644. if (isset($_GET['keyword']) || isset($_GET['keyword_firstname'])) {
  645. $interbreadcrumb[] = array("url" => 'index.php', "name" => get_lang('PlatformAdmin'));
  646. $interbreadcrumb[] = array("url" => 'user_list.php', "name" => get_lang('UserList'));
  647. $tool_name = get_lang('SearchUsers');
  648. } else {
  649. $interbreadcrumb[] = array("url" => 'index.php', "name" => get_lang('PlatformAdmin'));
  650. $tool_name = get_lang('UserList');
  651. }
  652. $message = '';
  653. if (!empty($action)) {
  654. $check = Security::check_token('get');
  655. if ($check) {
  656. switch ($action) {
  657. case 'add_user_to_my_url':
  658. $user_id = $_REQUEST["user_id"];
  659. $result = UrlManager::add_user_to_url($user_id, $current_access_url_id);
  660. if ($result ) {
  661. $user_info = api_get_user_info($user_id);
  662. $message = get_lang('UserAdded').' '.$user_info['firstname'].' '.$user_info['lastname'].' ('.$user_info['username'].')';
  663. $message = Display::return_message($message, 'confirmation');
  664. }
  665. break;
  666. case 'delete_user':
  667. if (api_is_platform_admin()) {
  668. $user_to_delete = $_GET['user_id'];
  669. $current_user_id = api_get_user_id();
  670. if ($deleteUserAvailable && api_global_admin_can_edit_admin($_GET['user_id'])) {
  671. if ($user_to_delete != $current_user_id && UserManager :: delete_user($_GET['user_id'])) {
  672. $message = Display :: return_message(get_lang('UserDeleted'), 'confirmation');
  673. } else {
  674. $message = Display :: return_message(get_lang('CannotDeleteUserBecauseOwnsCourse'), 'error');
  675. }
  676. } else {
  677. $message = Display :: return_message(get_lang('CannotDeleteUser'),'error');
  678. }
  679. }
  680. break;
  681. case 'delete':
  682. if (api_is_platform_admin()) {
  683. $number_of_selected_users = count($_POST['id']);
  684. $number_of_deleted_users = 0;
  685. if (is_array($_POST['id'])) {
  686. foreach ($_POST['id'] as $index => $user_id) {
  687. if ($user_id != $_user['user_id']) {
  688. if (UserManager::delete_user($user_id)) {
  689. $number_of_deleted_users++;
  690. }
  691. }
  692. }
  693. }
  694. if ($number_of_selected_users == $number_of_deleted_users) {
  695. $message = Display :: return_message(get_lang('SelectedUsersDeleted'), 'confirmation');
  696. } else {
  697. $message = Display :: return_message(get_lang('SomeUsersNotDeleted'), 'error');
  698. }
  699. }
  700. break;
  701. }
  702. Security::clear_token();
  703. }
  704. }
  705. // Create a search-box
  706. $form = new FormValidator('search_simple', 'get', null, null, null, 'inline');
  707. $form->addText('keyword', get_lang('Search'), false);
  708. $form->addButtonSearch(get_lang('Search'));
  709. $searchAdvanced = '
  710. <a id="advanced_params" href="javascript://" class = "btn btn-default advanced_options" onclick="display_advanced_search_form();">
  711. <span id="img_plus_and_minus">&nbsp;'. Display::returnFontAwesomeIcon('arrow-right') . ' '.get_lang('AdvancedSearch').'
  712. </span>
  713. </a>';
  714. $actionsLeft = '';
  715. $actionsCenter = '';
  716. $actionsRight = '';
  717. if (api_is_platform_admin()) {
  718. $actionsRight .= '<a class="pull-right" href="'.api_get_path(WEB_CODE_PATH).'admin/user_add.php">'.
  719. Display::return_icon('new_user.png',get_lang('AddUsers'),'',ICON_SIZE_MEDIUM).'</a>';
  720. }
  721. $actionsLeft .= $form->returnForm();
  722. $actionsCenter .= $searchAdvanced;
  723. if (isset($_GET['keyword'])) {
  724. $parameters = array('keyword' => Security::remove_XSS($_GET['keyword']));
  725. } elseif (isset ($_GET['keyword_firstname'])) {
  726. $parameters['keyword_firstname'] = Security::remove_XSS($_GET['keyword_firstname']);
  727. $parameters['keyword_lastname'] = Security::remove_XSS($_GET['keyword_lastname']);
  728. $parameters['keyword_username'] = Security::remove_XSS($_GET['keyword_username']);
  729. $parameters['keyword_email'] = Security::remove_XSS($_GET['keyword_email']);
  730. $parameters['keyword_officialcode'] = Security::remove_XSS($_GET['keyword_officialcode']);
  731. $parameters['keyword_status'] = Security::remove_XSS($_GET['keyword_status']);
  732. $parameters['keyword_active'] = Security::remove_XSS($_GET['keyword_active']);
  733. $parameters['keyword_inactive'] = Security::remove_XSS($_GET['keyword_inactive']);
  734. }
  735. // Create a sortable table with user-data
  736. $parameters['sec_token'] = Security::get_token();
  737. $_admins_list = array_keys(UserManager::get_all_administrators());
  738. // Display Advanced search form.
  739. $form = new FormValidator('advanced_search', 'get', '', '', array(), FormValidator::LAYOUT_HORIZONTAL);
  740. $form->addElement('html','<div id="advanced_search_form" style="display:none;">');
  741. $form->addElement('header', get_lang('AdvancedSearch'));
  742. $form->addText('keyword_firstname', get_lang('FirstName'), false);
  743. $form->addText('keyword_lastname', get_lang('LastName'), false);
  744. $form->addText('keyword_username', get_lang('LoginName'), false);
  745. $form->addText('keyword_email', get_lang('Email'), false);
  746. $form->addText('keyword_officialcode', get_lang('OfficialCode'), false);
  747. $status_options = array();
  748. $status_options['%'] = get_lang('All');
  749. $status_options[STUDENT] = get_lang('Student');
  750. $status_options[COURSEMANAGER] = get_lang('Teacher');
  751. $status_options[DRH] = get_lang('Drh');
  752. $status_options[SESSIONADMIN] = get_lang('SessionsAdmin');
  753. $status_options[PLATFORM_ADMIN] = get_lang('Administrator');
  754. $form->addElement('select', 'keyword_status', get_lang('Profile'), $status_options);
  755. $active_group = array();
  756. $active_group[] = $form->createElement('checkbox', 'keyword_active', '', get_lang('Active'));
  757. $active_group[] = $form->createElement('checkbox', 'keyword_inactive', '', get_lang('Inactive'));
  758. $form->addGroup($active_group, '', get_lang('ActiveAccount'), null, false);
  759. $form->addElement('checkbox', 'check_easy_passwords', null, get_lang('CheckEasyPasswords'));
  760. $data = $extraField->addElements($form, 0, [], true, false, $variablesToShow);
  761. $htmlHeadXtra[] = '
  762. <script>
  763. $(document).ready(function() {
  764. '.$data['jquery_ready_content'].'
  765. })
  766. </script>
  767. ';
  768. $form->addButtonSearch(get_lang('SearchUsers'));
  769. $defaults = array();
  770. $defaults['keyword_active'] = 1;
  771. $defaults['keyword_inactive'] = 1;
  772. $form->setDefaults($defaults);
  773. $form->addElement('html','</div>');
  774. $form = $form->returnForm();
  775. $table = new SortableTable(
  776. 'users',
  777. 'get_number_of_users',
  778. 'get_user_data',
  779. (api_is_western_name_order() xor api_sort_by_first_name()) ? 3 : 2
  780. );
  781. $table->set_additional_parameters($parameters);
  782. $table->set_header(0, '', false, 'width="18px"');
  783. $table->set_header(1, get_lang('Photo'), false);
  784. $table->set_header(2, get_lang('OfficialCode'));
  785. if (api_is_western_name_order()) {
  786. $table->set_header(3, get_lang('FirstName'));
  787. $table->set_header(4, get_lang('LastName'));
  788. } else {
  789. $table->set_header(3, get_lang('LastName'));
  790. $table->set_header(4, get_lang('FirstName'));
  791. }
  792. $table->set_header(5, get_lang('LoginName'));
  793. $table->set_header(6, get_lang('Email'));
  794. $table->set_header(7, get_lang('Profile'));
  795. $table->set_header(8, get_lang('Active'), true, 'width="15px"');
  796. $table->set_header(9, get_lang('RegistrationDate'), true, 'width="90px"');
  797. $table->set_header(10, get_lang('Action'), false, 'width="220px"');
  798. $table->set_column_filter(3, 'user_filter');
  799. $table->set_column_filter(4, 'user_filter');
  800. $table->set_column_filter(6, 'email_filter');
  801. $table->set_column_filter(7, 'status_filter');
  802. $table->set_column_filter(8, 'active_filter');
  803. $table->set_column_filter(10, 'modify_filter');
  804. // Only show empty actions bar if delete users has been blocked
  805. if (api_is_platform_admin() && !api_get_configuration_value('deny_delete_users')) {
  806. $table->set_form_actions(array('delete' => get_lang('DeleteFromPlatform')));
  807. } else {
  808. $table->set_form_actions(array('none' => get_lang('NoActionAvailable')));
  809. }
  810. $table_result = $table->return_table();
  811. $extra_search_options = '';
  812. //Try to search the user everywhere
  813. if ($table->get_total_number_of_items() == 0) {
  814. if (api_get_multiple_access_url() && isset($_REQUEST['keyword'])) {
  815. $keyword = Database::escape_string($_REQUEST['keyword']);
  816. $conditions = array('username' => $keyword);
  817. $user_list = UserManager::get_user_list($conditions, array(), false, ' OR ');
  818. if (!empty($user_list)) {
  819. $extra_search_options = Display::page_subheader(get_lang('UsersFoundInOtherPortals'));
  820. $table = new HTML_Table(array('class' => 'data_table'));
  821. $column = 0;
  822. $row = 0;
  823. $headers = array(get_lang('User'), 'URL', get_lang('Actions'));
  824. foreach ($headers as $header) {
  825. $table->setHeaderContents($row, $column, $header);
  826. $column++;
  827. }
  828. $row++;
  829. foreach ($user_list as $user) {
  830. $column = 0;
  831. $access_info = UrlManager::get_access_url_from_user($user['id']);
  832. $access_info_to_string = '';
  833. $add_user = true;
  834. if (!empty($access_info)) {
  835. foreach ($access_info as $url_info) {
  836. if ($current_access_url_id == $url_info['access_url_id']) {
  837. $add_user = false;
  838. }
  839. $access_info_to_string .= $url_info['url'].'<br />';
  840. }
  841. }
  842. if ($add_user) {
  843. $row_table = array();
  844. $row_table[] = api_get_person_name($user['firstname'], $user['lastname']).' ('.$user['username'].') ';
  845. $row_table[] = $access_info_to_string;
  846. $url = api_get_self().'?action=add_user_to_my_url&user_id='.$user['id'].'&sec_token='.$_SESSION['sec_token'];
  847. $row_table[] = Display::url(get_lang('AddUserToMyURL'), $url, array('class' => 'btn'));
  848. foreach ($row_table as $cell) {
  849. $table->setCellContents($row, $column, $cell);
  850. $table->updateCellAttributes($row, $column, 'align="center"');
  851. $column++;
  852. }
  853. $table->updateRowAttributes($row, $row % 2 ? 'class="row_even"' : 'class="row_odd"', true);
  854. $row++;
  855. }
  856. }
  857. $extra_search_options .= $table->toHtml();
  858. $table_result = '';
  859. }
  860. }
  861. }
  862. $toolbarActions = Display::toolbarAction(
  863. 'toolbarUser',
  864. array($actionsLeft, $actionsCenter, $actionsRight),
  865. 3
  866. );
  867. $tpl = new Template($tool_name);
  868. //$tpl->assign('actions', $toolbarActions);
  869. $tpl->assign('message', $message);
  870. $tpl->assign('content', $toolbarActions.$form.$table_result.$extra_search_options);
  871. $tpl->display_one_col_template();