user_list.php 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478
  1. <?php
  2. // $Id: user_list.php 9555 2006-10-18 10:05:15Z elixir_inter $
  3. /*
  4. ==============================================================================
  5. Dokeos - elearning and course management software
  6. Copyright (c) 2004 Dokeos S.A.
  7. Copyright (c) 2003 Ghent University (UGent)
  8. Copyright (c) 2001 Universite catholique de Louvain (UCL)
  9. Copyright (c) Olivier Brouckaert
  10. For a full list of contributors, see "credits.txt".
  11. The full license can be read in "license.txt".
  12. This program is free software; you can redistribute it and/or
  13. modify it under the terms of the GNU General Public License
  14. as published by the Free Software Foundation; either version 2
  15. of the License, or (at your option) any later version.
  16. See the GNU General Public License for more details.
  17. Contact: Dokeos, 181 rue Royale, B-1000 Brussels, Belgium, info@dokeos.com
  18. ==============================================================================
  19. */
  20. /**
  21. ==============================================================================
  22. @author Bart Mollet
  23. * @package dokeos.admin
  24. ==============================================================================
  25. */
  26. $langFile = 'admin';
  27. $cidReset = true;
  28. require ('../inc/global.inc.php');
  29. require_once (api_get_path(LIBRARY_PATH).'sortabletable.class.php');
  30. require_once (api_get_path(LIBRARY_PATH).'formvalidator/FormValidator.class.php');
  31. $this_section = SECTION_PLATFORM_ADMIN;
  32. api_protect_admin_script();
  33. /**
  34. * Make sure this function is protected
  35. * because it does NOT check password!
  36. *
  37. * This function defines globals.
  38. * @author Roan Embrechts
  39. */
  40. function login_user($user_id)
  41. {
  42. //init ---------------------------------------------------------------------
  43. global $_uid, $uidReset, $loginFailed, $uidReset, $is_trackingEnabled, $_user;
  44. global $is_platformAdmin, $is_allowedCreateCourse;
  45. $main_user_table = Database :: get_main_table(MAIN_USER_TABLE);
  46. $main_admin_table = Database :: get_main_table(MAIN_ADMIN_TABLE);
  47. $track_e_login_table = Database :: get_statistic_table(STATISTIC_TRACK_E_LOGIN_TABLE);
  48. //logic --------------------------------------------------------------------
  49. //unset($_uid); // uid not in session ? prevent any hacking
  50. if (!isset ($user_id))
  51. {
  52. $uidReset = true;
  53. return;
  54. }
  55. $sql_query = "SELECT * FROM $main_user_table WHERE user_id='$user_id'";
  56. $sql_result = api_sql_query($sql_query, __FILE__, __LINE__);
  57. $result = Database :: fetch_array($sql_result);
  58. $firstname = $result["firstname"];
  59. $lastname = $result["lastname"];
  60. $user_id = $result["user_id"];
  61. $message = "Attempting to login as ".$firstname." ".$lastname." (id ".$user_id.")";
  62. $_uid = $user_id;
  63. //bug: this only works if $_uid is global
  64. api_session_register('_uid');
  65. $loginFailed = false;
  66. $uidReset = false;
  67. if ($user_id) // a uid is given (log in succeeded)
  68. {
  69. if ($is_trackingEnabled)
  70. {
  71. $sql_query = "SELECT user.*, a.user_id is_admin,
  72. UNIX_TIMESTAMP(login.login_date) login_date
  73. FROM $main_user_table
  74. LEFT JOIN $main_admin_table a
  75. ON user.user_id = a.user_id
  76. LEFT JOIN $track_e_login_table login
  77. ON user.user_id = login.login_user_id
  78. WHERE user.user_id = '$_uid'
  79. ORDER BY login.login_date DESC LIMIT 1";
  80. }
  81. else
  82. {
  83. $sql_query = "SELECT user.*, a.user_id is_admin
  84. FROM $main_user_table
  85. LEFT JOIN $main_admin_table a
  86. ON user.user_id = a.user_id
  87. WHERE user.user_id = '$_uid'";
  88. }
  89. $sql_result = api_sql_query($sql_query, __FILE__, __LINE__);
  90. if (mysql_num_rows($sql_result) > 0)
  91. {
  92. // Extracting the user data
  93. $user_data = mysql_fetch_array($sql_result);
  94. $_user['firstName'] = $user_data['firstname'];
  95. $_user['lastName'] = $user_data['lastname'];
  96. $_user['mail'] = $user_data['email'];
  97. $_user['lastLogin'] = $user_data['login_date'];
  98. $_user['official_code'] = $user_data['official_code'];
  99. $_user['picture_uri'] = $user_data['picture_uri'];
  100. $is_platformAdmin = (bool) (!is_null($user_data['is_admin']));
  101. $is_allowedCreateCourse = (bool) ($user_data['status'] == 1);
  102. LoginDelete($_SESSION["_user"]["user_id"], $statsDbName);
  103. //bug: this only works if $_user is global
  104. api_session_register('_user');
  105. api_session_register('is_platformAdmin');
  106. api_session_register('is_allowedCreateCourse');
  107. $target_url = api_get_path(WEB_PATH)."user_portal.php";
  108. $message .= "<br/>Login successful. Go to <a href=\"$target_url\">$target_url</a>";
  109. Display :: display_header(get_lang('UserList'));
  110. Display :: display_normal_message($message);
  111. Display :: display_footer();
  112. exit;
  113. }
  114. else
  115. {
  116. exit ("<br/>WARNING UNDEFINED UID !! ");
  117. }
  118. }
  119. }
  120. /**
  121. * Get the total number of users on the platform
  122. * @see SortableTable#get_total_number_of_items()
  123. */
  124. function get_number_of_users()
  125. {
  126. $user_table = Database :: get_main_table(MAIN_USER_TABLE);
  127. $sql = "SELECT COUNT(user_id) AS total_number_of_items FROM $user_table";
  128. if (isset ($_GET['keyword']))
  129. {
  130. $keyword = mysql_real_escape_string($_GET['keyword']);
  131. $sql .= " WHERE firstname LIKE '%".$keyword."%' OR lastname LIKE '%".$keyword."%' OR email LIKE '%".$keyword."%' OR official_code LIKE '%".$keyword."%'";
  132. }
  133. elseif (isset ($_GET['keyword_firstname']))
  134. {
  135. $keyword_firstname = mysql_real_escape_string($_GET['keyword_firstname']);
  136. $keyword_lastname = mysql_real_escape_string($_GET['keyword_lastname']);
  137. $keyword_email = mysql_real_escape_string($_GET['keyword_email']);
  138. $keyword_username = mysql_real_escape_string($_GET['keyword_username']);
  139. $keyword_status = mysql_real_escape_string($_GET['keyword_status']);
  140. $keyword_active = isset($_GET['keyword_active']);
  141. $keyword_inactive = isset($_GET['keyword_inactive']);
  142. $sql .= " WHERE firstname LIKE '%".$keyword_firstname."%' AND lastname LIKE '%".$keyword_lastname."%' AND username LIKE '%".$keyword_username."%' AND email LIKE '%".$keyword_email."%' AND official_code LIKE '%".$keyword_officialcode."%' AND status LIKE '".$keyword_status."'";
  143. if($keyword_active && !$keyword_inactive)
  144. {
  145. $sql .= " AND active='1'";
  146. }
  147. elseif($keyword_inactive && !$keyword_active)
  148. {
  149. $sql .= " AND active='0'";
  150. }
  151. }
  152. $res = api_sql_query($sql, __FILE__, __LINE__);
  153. $obj = mysql_fetch_object($res);
  154. return $obj->total_number_of_items;
  155. }
  156. /**
  157. * Get the users to display on the current page.
  158. * @see SortableTable#get_table_data($from)
  159. */
  160. function get_user_data($from, $number_of_items, $column, $direction)
  161. {
  162. $user_table = Database :: get_main_table(MAIN_USER_TABLE);
  163. $sql = "SELECT
  164. user_id AS col0,
  165. official_code AS col1,
  166. lastname AS col2,
  167. firstname AS col3,
  168. username AS col4,
  169. email AS col5,
  170. IF(status=1,'".get_lang('Teacher')."','".get_lang('Student')."') AS col6,
  171. active AS col7,
  172. user_id AS col8
  173. FROM
  174. $user_table ";
  175. if (isset ($_GET['keyword']))
  176. {
  177. $keyword = mysql_real_escape_string($_GET['keyword']);
  178. $sql .= " WHERE firstname LIKE '%".$keyword."%' OR lastname LIKE '%".$keyword."%' OR username LIKE '%".$keyword."%' OR official_code LIKE '%".$keyword."%'";
  179. }
  180. elseif (isset ($_GET['keyword_firstname']))
  181. {
  182. $keyword_firstname = mysql_real_escape_string($_GET['keyword_firstname']);
  183. $keyword_lastname = mysql_real_escape_string($_GET['keyword_lastname']);
  184. $keyword_email = mysql_real_escape_string($_GET['keyword_email']);
  185. $keyword_username = mysql_real_escape_string($_GET['keyword_username']);
  186. $keyword_status = mysql_real_escape_string($_GET['keyword_status']);
  187. $keyword_active = isset($_GET['keyword_active']);
  188. $keyword_inactive = isset($_GET['keyword_inactive']);
  189. $sql .= " WHERE firstname LIKE '%".$keyword_firstname."%' AND lastname LIKE '%".$keyword_lastname."%' AND username LIKE '%".$keyword_username."%' AND email LIKE '%".$keyword_email."%' AND official_code LIKE '%".$keyword_officialcode."%' AND status LIKE '".$keyword_status."'";
  190. if($keyword_active && !$keyword_inactive)
  191. {
  192. $sql .= " AND active='1'";
  193. }
  194. elseif($keyword_inactive && !$keyword_active)
  195. {
  196. $sql .= " AND active='0'";
  197. }
  198. }
  199. $sql .= " ORDER BY col$column $direction ";
  200. $sql .= " LIMIT $from,$number_of_items";
  201. $res = api_sql_query($sql, __FILE__, __LINE__);
  202. $users = array ();
  203. while ($user = mysql_fetch_row($res))
  204. {
  205. $users[] = $user;
  206. }
  207. return $users;
  208. }
  209. /**
  210. * Returns a mailto-link
  211. * @param string $email An email-address
  212. * @return string HTML-code with a mailto-link
  213. */
  214. function email_filter($email)
  215. {
  216. return Display :: encrypted_mailto_link($email, $email);
  217. }
  218. /**
  219. * Build the modify-column of the table
  220. * @param int $user_id The user id
  221. * @param string $url_params
  222. * @return string Some HTML-code with modify-buttons
  223. */
  224. function modify_filter($user_id,$url_params)
  225. {
  226. $result .= '<a href="user_information.php?user_id='.$user_id.'"><img src="../img/info_small.gif" border="0" style="vertical-align: middle;" title="'.get_lang('Info').'" alt="'.get_lang('Info').'"/></a>';
  227. $result .= '<a href="user_list.php?action=login_as&amp;user_id='.$user_id.'"><img src="../img/loginas.gif" border="0" style="vertical-align: middle;" alt="'.get_lang('LoginAs').'" title="'.get_lang('LoginAs').'"/></a>';
  228. $result .= '<a href="user_edit.php?user_id='.$user_id.'"><img src="../img/edit.gif" border="0" style="vertical-align: middle;" title="'.get_lang('Edit').'" alt="'.get_lang('Edit').'"/></a>';
  229. $result .= '<a href="user_list.php?action=delete_user&amp;user_id='.$user_id.'&amp;'.$url_params.'" onclick="javascript:if(!confirm('."'".addslashes(htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;"><img src="../img/delete.gif" border="0" style="vertical-align: middle;" title="'.get_lang('Delete').'" alt="'.get_lang('Delete').'"/></a>';
  230. return $result;
  231. }
  232. /**
  233. * Build the active-column of the table to lock or unlock a certain user
  234. * lock = the user can no longer use this account
  235. * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
  236. * @param int $active the current state of the account
  237. * @param int $user_id The user id
  238. * @param string $url_params
  239. * @return string Some HTML-code with the lock/unlock button
  240. */
  241. function active_filter($active, $url_params, $row)
  242. {
  243. global $_uid;
  244. if ($active=='1')
  245. {
  246. $action='lock';
  247. $image='right';
  248. }
  249. if ($active=='0')
  250. {
  251. $action='unlock';
  252. $image='wrong';
  253. }
  254. if ($row['0']<>$_uid) // you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
  255. {
  256. $result = '<a href="user_list.php?action='.$action.'&amp;user_id='.$row['0'].'&amp;'.$url_params.'"><img src="../img/'.$image.'.gif" border="0" style="vertical-align: middle;" alt="'.get_lang($action).'" title="'.get_lang($action).'"/></a>';
  257. }
  258. return $result;
  259. }
  260. /**
  261. * lock or unlock a user
  262. * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
  263. * @param int $status, do we want to lock the user ($status=lock) or unlock it ($status=unlock)
  264. * @param int $user_id The user id
  265. * @return language variable
  266. */
  267. function lock_unlock_user($status,$user_id)
  268. {
  269. $user_table = Database :: get_main_table(MAIN_USER_TABLE);
  270. if ($status=='lock')
  271. {
  272. $status_db='0';
  273. $return_message=get_lang('UserLocked');
  274. }
  275. if ($status=='unlock')
  276. {
  277. $status_db='1';
  278. $return_message=get_lang('UserUnlocked');
  279. }
  280. if(($status_db=='1' OR $status_db=='0') AND is_numeric($user_id))
  281. {
  282. $sql="UPDATE $user_table SET active='".mysql_real_escape_string($status_db)."' WHERE user_id='".mysql_real_escape_string($user_id)."'";
  283. $result = api_sql_query($sql, __FILE__, __LINE__);
  284. }
  285. if ($result)
  286. {
  287. return $return_message;
  288. }
  289. }
  290. /**
  291. ==============================================================================
  292. INIT SECTION
  293. ==============================================================================
  294. */
  295. require_once (api_get_path(LIBRARY_PATH).'usermanager.lib.php');
  296. $action = $_GET["action"];
  297. $login_as_user_id = $_GET["user_id"];
  298. // Login as ...
  299. if ($_GET['action'] == "login_as" && isset ($login_as_user_id))
  300. {
  301. login_user($login_as_user_id);
  302. }
  303. if (isset ($_GET['search']) && $_GET['search'] == 'advanced')
  304. {
  305. //$interbreadcrumb[] = array ("url" => "index.php", "name" => get_lang('PlatformAdmin'));
  306. $interbreadcrumb[] = array ("url" => 'user_list.php', "name" => get_lang('UserList'));
  307. $tool_name = get_lang('SearchAUser');
  308. Display :: display_header($tool_name);
  309. //api_display_tool_title($tool_name);
  310. $form = new FormValidator('advanced_search','get');
  311. $form->add_textfield('keyword_firstname',get_lang('FirstName'),false);
  312. $form->add_textfield('keyword_lastname',get_lang('LastName'),false);
  313. $form->add_textfield('keyword_username',get_lang('LoginName'),false);
  314. $form->add_textfield('keyword_email',get_lang('Email'),false);
  315. $form->add_textfield('keyword_officialcode',get_lang('OfficialCode'),false);
  316. $status_options = array();
  317. $status_options['%'] = get_lang('All');
  318. $status_options[STUDENT] = get_lang('Student');
  319. $status_options[COURSEMANAGER] = get_lang('Teacher');
  320. $form->addElement('select','keyword_status',get_lang('Status'),$status_options);
  321. $active_group = array();
  322. $active_group[] = $form->createElement('checkbox','keyword_active','',get_lang('Active'));
  323. $active_group[] = $form->createElement('checkbox','keyword_inactive','',get_lang('Inactive'));
  324. $form->addGroup($active_group,'',get_lang('ActiveAccount'),'<br/>',false);
  325. $form->addElement('submit','submit',get_lang('Ok'));
  326. $defaults['keyword_active'] = 1;
  327. $defaults['keyword_inactive'] = 1;
  328. $form->setDefaults($defaults);
  329. $form->display();
  330. }
  331. else
  332. {
  333. //$interbreadcrumb[] = array ("url" => "index.php", "name" => get_lang('PlatformAdmin'));
  334. $tool_name = get_lang('UserList');
  335. Display :: display_header($tool_name, "");
  336. //api_display_tool_title($tool_name);
  337. if (isset ($_GET['action']))
  338. {
  339. switch ($_GET['action'])
  340. {
  341. case 'show_message' :
  342. Display :: display_normal_message(stripslashes($_GET['message']));
  343. break;
  344. case 'delete_user' :
  345. if ($user_id != $_uid && UserManager :: delete_user($_GET['user_id']))
  346. {
  347. Display :: display_normal_message(get_lang('UserDeleted'));
  348. }
  349. else
  350. {
  351. Display :: display_error_message(get_lang('CannotDeleteUser'));
  352. }
  353. break;
  354. case 'lock' :
  355. $message=lock_unlock_user('lock',$_GET['user_id']);
  356. Display :: display_normal_message($message);
  357. break;
  358. case 'unlock';
  359. $message=lock_unlock_user('unlock',$_GET['user_id']);
  360. Display :: display_normal_message($message);
  361. break;
  362. }
  363. }
  364. if (isset ($_POST['action']))
  365. {
  366. switch ($_POST['action'])
  367. {
  368. case 'delete' :
  369. $number_of_selected_users = count($_POST['id']);
  370. $number_of_deleted_users = 0;
  371. foreach ($_POST['id'] as $index => $user_id)
  372. {
  373. if($user_id != $_uid)
  374. {
  375. if(UserManager :: delete_user($user_id))
  376. {
  377. $number_of_deleted_users++;
  378. }
  379. }
  380. }
  381. if($number_of_selected_users == $number_of_deleted_users)
  382. {
  383. Display :: display_normal_message(get_lang('SelectedUsersDeleted'));
  384. }
  385. else
  386. {
  387. Display :: display_error_message(get_lang('SomeUsersNotDeleted'));
  388. }
  389. break;
  390. }
  391. }
  392. // Create a search-box
  393. $form = new FormValidator('search_simple','get','','',null,false);
  394. $renderer =& $form->defaultRenderer();
  395. $renderer->setElementTemplate('<span>{element}</span> ');
  396. $form->addElement('text','keyword',get_lang('keyword'));
  397. $form->addElement('submit','submit',get_lang('Search'));
  398. $form->addElement('static','search_advanced_link',null,'<a href="user_list.php?search=advanced">'.get_lang('AdvancedSearch').'</a>');
  399. $form->display();
  400. if (isset ($_GET['keyword']))
  401. {
  402. $parameters = array ('keyword' => $_GET['keyword']);
  403. }
  404. elseif (isset ($_GET['keyword_firstname']))
  405. {
  406. $parameters['keyword_firstname'] = $_GET['keyword_firstname'];
  407. $parameters['keyword_lastname'] = $_GET['keyword_lastname'];
  408. $parameters['keyword_email'] = $_GET['keyword_email'];
  409. $parameters['keyword_officialcode'] = $_GET['keyword_officialcode'];
  410. $parameters['keyword_status'] = $_GET['keyword_status'];
  411. $parameters['keyword_active'] = $_GET['keyword_active'];
  412. $parameters['keyword_inactive'] = $_GET['keyword_inactive'];
  413. }
  414. // Create a sortable table with user-data
  415. $table = new SortableTable('users', 'get_number_of_users', 'get_user_data',2);
  416. $table->set_additional_parameters($parameters);
  417. $table->set_header(0, '', false);
  418. $table->set_header(1, get_lang('OfficialCode'));
  419. $table->set_header(2, get_lang('LastName'));
  420. $table->set_header(3, get_lang('FirstName'));
  421. $table->set_header(4, get_lang('LoginName'));
  422. $table->set_header(5, get_lang('Email'));
  423. $table->set_header(6, get_lang('Status'));
  424. $table->set_header(7, get_lang('Active'));
  425. $table->set_header(8, get_lang('Modify'));
  426. $table->set_column_filter(5, 'email_filter');
  427. $table->set_column_filter(7, 'active_filter');
  428. $table->set_column_filter(8, 'modify_filter');
  429. $table->set_form_actions(array ('delete' => get_lang('DeleteFromPlatform')));
  430. $table->display();
  431. }
  432. /*
  433. ==============================================================================
  434. FOOTER
  435. ==============================================================================
  436. */
  437. Display :: display_footer();
  438. ?>