user_list.php 38 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. use ChamiloSession as Session;
  4. /**
  5. * @author Bart Mollet
  6. * @author Julio Montoya <gugli100@gmail.com> BeezNest 2011
  7. * @package chamilo.admin
  8. */
  9. $cidReset = true;
  10. require_once __DIR__.'/../inc/global.inc.php';
  11. $current_access_url_id = api_get_current_access_url_id();
  12. $action = isset($_REQUEST["action"]) ? $_REQUEST["action"] : null;
  13. // Blocks the possibility to delete a user
  14. $deleteUserAvailable = true;
  15. if (api_get_configuration_value('deny_delete_users')) {
  16. $deleteUserAvailable = false;
  17. }
  18. $url = api_get_path(WEB_AJAX_PATH).'course.ajax.php?a=get_user_courses';
  19. $urlSession = api_get_path(WEB_AJAX_PATH).'session.ajax.php?a=get_user_sessions';
  20. $extraField = new ExtraField('user');
  21. $variables = $extraField->get_all_extra_field_by_type(ExtraField::FIELD_TYPE_TAG);
  22. $variablesSelect = $extraField->get_all_extra_field_by_type(ExtraField::FIELD_TYPE_SELECT);
  23. if (!empty($variablesSelect)) {
  24. $variables = array_merge($variables, $variablesSelect);
  25. }
  26. $variablesToShow = [];
  27. if ($variables) {
  28. foreach ($variables as $variableId) {
  29. $extraFieldInfo = $extraField->get($variableId);
  30. $variablesToShow[] = $extraFieldInfo['variable'];
  31. }
  32. }
  33. Session::write('variables_to_show', $variablesToShow);
  34. $htmlHeadXtra[] = '<script>
  35. function load_course_list (div_course,my_user_id) {
  36. $.ajax({
  37. contentType: "application/x-www-form-urlencoded",
  38. beforeSend: function(objeto) {
  39. $("div#"+div_course).html("<img src=\'../inc/lib/javascript/indicator.gif\' />"); },
  40. type: "POST",
  41. url: "'.$url.'",
  42. data: "user_id="+my_user_id,
  43. success: function(datos) {
  44. $("div#"+div_course).html(datos);
  45. $("div#div_"+my_user_id).attr("class","blackboard_show");
  46. $("div#div_"+my_user_id).attr("style","");
  47. }
  48. });
  49. }
  50. function load_session_list(div_session, my_user_id) {
  51. $.ajax({
  52. contentType: "application/x-www-form-urlencoded",
  53. beforeSend: function(objeto) {
  54. $("div#"+div_session).html("<img src=\'../inc/lib/javascript/indicator.gif\' />"); },
  55. type: "POST",
  56. url: "'.$urlSession.'",
  57. data: "user_id="+my_user_id,
  58. success: function(datos) {
  59. $("div#"+div_session).html(datos);
  60. $("div#div_s_"+my_user_id).attr("class","blackboard_show");
  61. $("div#div_s_"+my_user_id).attr("style","");
  62. }
  63. });
  64. }
  65. function active_user(element_div) {
  66. id_image=$(element_div).attr("id");
  67. image_clicked=$(element_div).attr("src");
  68. image_clicked_info = image_clicked.split("/");
  69. image_real_clicked = image_clicked_info[image_clicked_info.length-1];
  70. var status = 1;
  71. if (image_real_clicked == "accept.png") {
  72. status = 0;
  73. }
  74. user_id=id_image.split("_");
  75. ident="#img_"+user_id[1];
  76. if (confirm("'.get_lang('AreYouSureToEditTheUserStatus', '').'")) {
  77. $.ajax({
  78. contentType: "application/x-www-form-urlencoded",
  79. beforeSend: function(objeto) {
  80. $(ident).attr("src","'.Display::returnIconPath('loading1.gif').'"); }, //candy eye stuff
  81. type: "GET",
  82. url: "'.api_get_path(WEB_AJAX_PATH).'user_manager.ajax.php?a=active_user",
  83. data: "user_id="+user_id[1]+"&status="+status,
  84. success: function(data) {
  85. if (data == 1) {
  86. $(ident).attr("src", "'.Display::returnIconPath('accept.png').'");
  87. $(ident).attr("title","'.get_lang('Lock').'");
  88. }
  89. if (data == 0) {
  90. $(ident).attr("src","'.Display::returnIconPath('error.png').'");
  91. $(ident).attr("title","'.get_lang('Unlock').'");
  92. }
  93. if (data == -1) {
  94. $(ident).attr("src", "'.Display::returnIconPath('warning.png').'");
  95. $(ident).attr("title","'.get_lang('ActionNotAllowed').'");
  96. }
  97. }
  98. });
  99. }
  100. }
  101. function clear_course_list(div_course) {
  102. $("div#"+div_course).html("&nbsp;");
  103. $("div#"+div_course).hide("");
  104. }
  105. function clear_session_list(div_session) {
  106. $("div#"+div_session).html("&nbsp;");
  107. $("div#"+div_session).hide("");
  108. }
  109. function display_advanced_search_form () {
  110. if ($("#advanced_search_form").css("display") == "none") {
  111. $("#advanced_search_form").css("display","block");
  112. $("#img_plus_and_minus").html(\'&nbsp;'. Display::returnFontAwesomeIcon('arrow-down').' '.get_lang('AdvancedSearch').'\');
  113. } else {
  114. $("#advanced_search_form").css("display","none");
  115. $("#img_plus_and_minus").html(\'&nbsp;'. Display::returnFontAwesomeIcon('arrow-right').' '.get_lang('AdvancedSearch').'\');
  116. }
  117. }
  118. $(document).ready(function() {
  119. var select_val = $("#input_select_extra_data").val();
  120. if ( document.getElementById(\'extra_data_text\')) {
  121. if (select_val != 0) {
  122. document.getElementById(\'extra_data_text\').style.display="block";
  123. if (document.getElementById(\'input_extra_text\'))
  124. document.getElementById(\'input_extra_text\').value = "";
  125. } else {
  126. document.getElementById(\'extra_data_text\').style.display="none";
  127. }
  128. }
  129. });
  130. //Load user calendar
  131. function load_calendar(user_id, month, year) {
  132. var url = "'.api_get_path(WEB_AJAX_PATH).'agenda.ajax.php?a=get_user_agenda&user_id=" +user_id + "&month="+month+"&year="+year;
  133. $(".modal-body").load(url);
  134. }
  135. </script>';
  136. $this_section = SECTION_PLATFORM_ADMIN;
  137. if ($action == 'login_as') {
  138. $check = Security::check_token('get');
  139. if (isset($_GET['user_id']) && $check) {
  140. $result = loginUser($_GET['user_id']);
  141. if ($result == false) {
  142. api_not_allowed(true);
  143. }
  144. }
  145. Security::clear_token();
  146. }
  147. api_protect_admin_script(true);
  148. /**
  149. * Prepares the shared SQL query for the user table.
  150. * See get_user_data() and get_number_of_users().
  151. *
  152. * @param boolean $is_count Whether to count, or get data
  153. * @return string SQL query
  154. */
  155. function prepare_user_sql_query($is_count)
  156. {
  157. $sql = '';
  158. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  159. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  160. if ($is_count) {
  161. $sql .= "SELECT COUNT(u.id) AS total_number_of_items FROM $user_table u";
  162. } else {
  163. $sql .= "SELECT u.id AS col0, u.official_code AS col2, ";
  164. if (api_is_western_name_order()) {
  165. $sql .= "u.firstname AS col3, u.lastname AS col4, ";
  166. } else {
  167. $sql .= "u.lastname AS col3, u.firstname AS col4, ";
  168. }
  169. $sql .= " u.username AS col5,
  170. u.email AS col6,
  171. u.status AS col7,
  172. u.active AS col8,
  173. u.id AS col9,
  174. u.registration_date AS col10,
  175. u.expiration_date AS exp,
  176. u.password
  177. FROM $user_table u";
  178. }
  179. // adding the filter to see the user's only of the current access_url
  180. if ((api_is_platform_admin() || api_is_session_admin()) && api_get_multiple_access_url()) {
  181. $access_url_rel_user_table = Database::get_main_table(TABLE_MAIN_ACCESS_URL_REL_USER);
  182. $sql .= " INNER JOIN $access_url_rel_user_table url_rel_user ON (u.id=url_rel_user.user_id)";
  183. }
  184. $keywordList = array(
  185. 'keyword_firstname',
  186. 'keyword_lastname',
  187. 'keyword_username',
  188. 'keyword_email',
  189. 'keyword_officialcode',
  190. 'keyword_status',
  191. 'keyword_active',
  192. 'keyword_inactive',
  193. 'check_easy_passwords'
  194. );
  195. $keywordListValues = array();
  196. $atLeastOne = false;
  197. foreach ($keywordList as $keyword) {
  198. $keywordListValues[$keyword] = null;
  199. if (isset($_GET[$keyword]) && !empty($_GET[$keyword])) {
  200. $keywordListValues[$keyword] = $_GET[$keyword];
  201. $atLeastOne = true;
  202. }
  203. }
  204. if ($atLeastOne == false) {
  205. $keywordListValues = array();
  206. }
  207. /*
  208. // This block is never executed because $keyword_extra_data never exists
  209. if (isset($keyword_extra_data) && !empty($keyword_extra_data)) {
  210. $extra_info = UserManager::get_extra_field_information_by_name($keyword_extra_data);
  211. $field_id = $extra_info['id'];
  212. $sql.= " INNER JOIN user_field_values ufv ON u.id=ufv.user_id AND ufv.field_id=$field_id ";
  213. }
  214. */
  215. if (isset($_GET['keyword']) && !empty($_GET['keyword'])) {
  216. $keywordFiltered = Database::escape_string("%".$_GET['keyword']."%");
  217. $sql .= " WHERE (
  218. u.firstname LIKE '$keywordFiltered' OR
  219. u.lastname LIKE '$keywordFiltered' OR
  220. concat(u.firstname, ' ', u.lastname) LIKE '$keywordFiltered' OR
  221. concat(u.lastname,' ',u.firstname) LIKE '$keywordFiltered' OR
  222. u.username LIKE '$keywordFiltered' OR
  223. u.official_code LIKE '$keywordFiltered' OR
  224. u.email LIKE '$keywordFiltered'
  225. )
  226. ";
  227. } elseif (isset($keywordListValues) && !empty($keywordListValues)) {
  228. $query_admin_table = '';
  229. $keyword_admin = '';
  230. if (isset($keywordListValues['keyword_status']) &&
  231. $keywordListValues['keyword_status'] == PLATFORM_ADMIN
  232. ) {
  233. $query_admin_table = " , $admin_table a ";
  234. $keyword_admin = ' AND a.user_id = u.id ';
  235. $keywordListValues['keyword_status'] = '%';
  236. }
  237. $keyword_extra_value = '';
  238. // This block is never executed because $keyword_extra_data never exists
  239. /*
  240. if (isset($keyword_extra_data) && !empty($keyword_extra_data) &&
  241. !empty($keyword_extra_data_text)) {
  242. $keyword_extra_value = " AND ufv.field_value LIKE '%".trim($keyword_extra_data_text)."%' ";
  243. }
  244. */
  245. $sql .= " $query_admin_table
  246. WHERE (
  247. u.firstname LIKE '".Database::escape_string("%".$keywordListValues['keyword_firstname']."%")."' AND
  248. u.lastname LIKE '". Database::escape_string("%".$keywordListValues['keyword_lastname']."%")."' AND
  249. u.username LIKE '". Database::escape_string("%".$keywordListValues['keyword_username']."%")."' AND
  250. u.email LIKE '". Database::escape_string("%".$keywordListValues['keyword_email']."%")."' AND
  251. u.status LIKE '".Database::escape_string($keywordListValues['keyword_status'])."' ";
  252. if (!empty($keywordListValues['keyword_officialcode'])) {
  253. $sql .= " AND u.official_code LIKE '".Database::escape_string("%".$keywordListValues['keyword_officialcode']."%")."' ";
  254. }
  255. $sql .= "
  256. $keyword_admin
  257. $keyword_extra_value
  258. ";
  259. if (isset($keywordListValues['keyword_active']) && !isset($keywordListValues['keyword_inactive'])) {
  260. $sql .= " AND u.active = 1";
  261. } elseif (isset($keywordListValues['keyword_inactive']) && !isset($keywordListValues['keyword_active'])) {
  262. $sql .= " AND u.active = 0";
  263. }
  264. $sql .= " ) ";
  265. }
  266. $variables = Session::read('variables_to_show', []);
  267. if (!empty($variables)) {
  268. $extraField = new ExtraField('user');
  269. $extraFieldResult = [];
  270. $extraFieldHasData = [];
  271. foreach ($variables as $variable) {
  272. if (isset($_GET['extra_'.$variable])) {
  273. if (is_array($_GET['extra_'.$variable])) {
  274. $values = $_GET['extra_'.$variable];
  275. } else {
  276. $values = [$_GET['extra_'.$variable]];
  277. }
  278. if (empty($values)) {
  279. continue;
  280. }
  281. $info = $extraField->get_handler_field_info_by_field_variable(
  282. $variable
  283. );
  284. if (empty($info)) {
  285. continue;
  286. }
  287. foreach ($values as $value) {
  288. if (empty($value)) {
  289. continue;
  290. }
  291. if ($info['field_type'] == ExtraField::FIELD_TYPE_TAG) {
  292. $result = $extraField->getAllUserPerTag(
  293. $info['id'],
  294. $value
  295. );
  296. $result = empty($result) ? [] : array_column(
  297. $result,
  298. 'user_id'
  299. );
  300. } else {
  301. $result = UserManager::get_extra_user_data_by_value(
  302. $variable,
  303. $value
  304. );
  305. }
  306. $extraFieldHasData[] = true;
  307. if (!empty($result)) {
  308. $extraFieldResult = array_merge(
  309. $extraFieldResult,
  310. $result
  311. );
  312. }
  313. }
  314. }
  315. }
  316. if (!empty($extraFieldHasData)) {
  317. $sql .= " AND (u.id IN ('".implode("','", $extraFieldResult)."')) ";
  318. }
  319. }
  320. // adding the filter to see the user's only of the current access_url
  321. if ((api_is_platform_admin() || api_is_session_admin())
  322. && api_get_multiple_access_url()
  323. ) {
  324. $sql .= " AND url_rel_user.access_url_id=".api_get_current_access_url_id();
  325. }
  326. return $sql;
  327. }
  328. /**
  329. * Make sure this function is protected because it does NOT check password!
  330. *
  331. * This function defines globals.
  332. * @param int $userId
  333. *
  334. * @return false|null False on failure, redirection on success
  335. * @author Evie Embrechts
  336. * @author Yannick Warnier <yannick.warnier@dokeos.com>
  337. */
  338. function loginUser($userId)
  339. {
  340. $userId = intval($userId);
  341. $userInfo = api_get_user_info($userId);
  342. // Check if the user is allowed to 'login_as'
  343. $canLoginAs = api_can_login_as($userId);
  344. if (!$canLoginAs || empty($userInfo)) {
  345. return false;
  346. }
  347. $firstname = $userInfo['firstname'];
  348. $lastname = $userInfo['lastname'];
  349. if (api_is_western_name_order()) {
  350. $message = sprintf(
  351. get_lang('AttemptingToLoginAs'),
  352. $firstname,
  353. $lastname,
  354. $userId
  355. );
  356. } else {
  357. $message = sprintf(
  358. get_lang('AttemptingToLoginAs'),
  359. $lastname,
  360. $firstname,
  361. $userId
  362. );
  363. }
  364. if ($userId) {
  365. // Logout the current user
  366. LoginDelete(api_get_user_id());
  367. Session::erase('_user');
  368. Session::erase('is_platformAdmin');
  369. Session::erase('is_allowedCreateCourse');
  370. Session::erase('_uid');
  371. // Cleaning session variables
  372. $_user['firstName'] = $userInfo['firstname'];
  373. $_user['lastName'] = $userInfo['lastname'];
  374. $_user['mail'] = $userInfo['email'];
  375. $_user['official_code'] = $userInfo['official_code'];
  376. $_user['picture_uri'] = $userInfo['picture_uri'];
  377. $_user['user_id'] = $userId;
  378. $_user['id'] = $userId;
  379. $_user['status'] = $userInfo['status'];
  380. // Filling session variables with new data
  381. Session::write('_uid', $userId);
  382. Session::write('_user', $userInfo);
  383. Session::write('is_platformAdmin', (bool) (UserManager::is_admin($userId)));
  384. Session::write('is_allowedCreateCourse', (bool) ($userInfo['status'] == 1));
  385. // will be useful later to know if the user is actually an admin or not (example reporting)
  386. Session::write('login_as', true);
  387. $target_url = api_get_path(WEB_PATH)."user_portal.php";
  388. $message .= '<br />'.sprintf(get_lang('LoginSuccessfulGoToX'), '<a href="'.$target_url.'">'.$target_url.'</a>');
  389. Display :: display_header(get_lang('UserList'));
  390. echo Display::return_message($message, 'normal', false);
  391. Display :: display_footer();
  392. exit;
  393. }
  394. }
  395. /**
  396. * Get the total number of users on the platform
  397. * @see SortableTable#get_total_number_of_items()
  398. */
  399. function get_number_of_users()
  400. {
  401. $sql = prepare_user_sql_query(true);
  402. $res = Database::query($sql);
  403. $obj = Database::fetch_object($res);
  404. return $obj->total_number_of_items;
  405. }
  406. /**
  407. * Get the users to display on the current page (fill the sortable-table)
  408. * @param int offset of first user to recover
  409. * @param int Number of users to get
  410. * @param int Column to sort on
  411. * @param string Order (ASC,DESC)
  412. * @see SortableTable#get_table_data($from)
  413. */
  414. function get_user_data($from, $number_of_items, $column, $direction)
  415. {
  416. $sql = prepare_user_sql_query(false);
  417. if (!in_array($direction, array('ASC', 'DESC'))) {
  418. $direction = 'ASC';
  419. }
  420. $column = intval($column);
  421. $from = intval($from);
  422. $number_of_items = intval($number_of_items);
  423. $preventSessionAdminsToManageAllUsers = api_get_setting('prevent_session_admins_to_manage_all_users');
  424. if (api_is_session_admin() && $preventSessionAdminsToManageAllUsers === 'true') {
  425. $sql .= " WHERE u.creator_id = ".api_get_user_id();
  426. }
  427. $sql .= " ORDER BY col$column $direction ";
  428. $sql .= " LIMIT $from,$number_of_items";
  429. $res = Database::query($sql);
  430. $users = array();
  431. $t = time();
  432. while ($user = Database::fetch_row($res)) {
  433. $userPicture = UserManager::getUserPicture($user[0], USER_IMAGE_SIZE_SMALL);
  434. $photo = '<img src="'.$userPicture.'" width="22" height="22" alt="'.api_get_person_name($user[2], $user[3]).'" title="'.api_get_person_name($user[2], $user[3]).'" />';
  435. if ($user[7] == 1 && !empty($user[10])) {
  436. // check expiration date
  437. $expiration_time = convert_sql_date($user[10]);
  438. // if expiration date is passed, store a special value for active field
  439. if ($expiration_time < $t) {
  440. $user[7] = '-1';
  441. }
  442. }
  443. // forget about the expiration date field
  444. $users[] = array(
  445. $user[0],
  446. $photo,
  447. $user[1],
  448. $user[2],
  449. $user[3],
  450. $user[4],
  451. $user[5],
  452. $user[6],
  453. $user[7],
  454. api_get_local_time($user[9]),
  455. $user[0]
  456. );
  457. }
  458. return $users;
  459. }
  460. /**
  461. * Returns a mailto-link
  462. * @param string $email An email-address
  463. * @return string HTML-code with a mailto-link
  464. */
  465. function email_filter($email)
  466. {
  467. return Display :: encrypted_mailto_link($email, $email);
  468. }
  469. /**
  470. * Returns a mailto-link
  471. * @param string $email An email-address
  472. * @return string HTML-code with a mailto-link
  473. */
  474. function user_filter($name, $params, $row)
  475. {
  476. return '<a href="'.api_get_path(WEB_PATH).'whoisonline.php?origin=user_list&id='.$row[0].'">'.$name.'</a>';
  477. }
  478. /**
  479. * Build the modify-column of the table
  480. * @param int The user id
  481. * @param string URL params to add to table links
  482. * @param array Row of elements to alter
  483. * @return string Some HTML-code with modify-buttons
  484. */
  485. function modify_filter($user_id, $url_params, $row)
  486. {
  487. $_admins_list = Session::read('admin_list', []);
  488. $is_admin = in_array($user_id, $_admins_list);
  489. $statusname = api_get_status_langvars();
  490. $user_is_anonymous = false;
  491. $current_user_status_label = $row['7'];
  492. if ($current_user_status_label == $statusname[ANONYMOUS]) {
  493. $user_is_anonymous = true;
  494. }
  495. $result = '';
  496. if (!$user_is_anonymous) {
  497. $icon = Display::return_icon(
  498. 'course.png',
  499. get_lang('Courses'),
  500. array('onmouseout' => 'clear_course_list (\'div_'.$user_id.'\')')
  501. );
  502. $result .= '<a href="javascript:void(0)" onclick="load_course_list(\'div_'.$user_id.'\','.$user_id.')" >
  503. '.$icon.'
  504. <div class="blackboard_hide" id="div_'.$user_id.'">&nbsp;&nbsp;</div>
  505. </a>';
  506. $icon = Display::return_icon(
  507. 'session.png',
  508. get_lang('Sessions'),
  509. array('onmouseout' => 'clear_session_list (\'div_s_'.$user_id.'\')')
  510. );
  511. $result .= '<a href="javascript:void(0)" onclick="load_session_list(\'div_s_'.$user_id.'\','.$user_id.')" >
  512. '.$icon.'
  513. <div class="blackboard_hide" id="div_s_'.$user_id.'">&nbsp;&nbsp;</div>
  514. </a>';
  515. } else {
  516. $result .= Display::return_icon('course_na.png', get_lang('Courses')).'&nbsp;&nbsp;';
  517. $result .= Display::return_icon('course_na.png', get_lang('Sessions')).'&nbsp;&nbsp;';
  518. }
  519. if (api_is_platform_admin()) {
  520. if (!$user_is_anonymous) {
  521. $result .= '<a href="user_information.php?user_id='.$user_id.'">'.Display::return_icon('synthese_view.gif', get_lang('Info')).'</a>&nbsp;&nbsp;';
  522. } else {
  523. $result .= Display::return_icon('synthese_view_na.gif', get_lang('Info')).'&nbsp;&nbsp;';
  524. }
  525. }
  526. //only allow platform admins to login_as, or session admins only for students (not teachers nor other admins)
  527. if (api_is_platform_admin() || (api_is_session_admin() && $current_user_status_label == $statusname[STUDENT])) {
  528. if (!$user_is_anonymous) {
  529. if (api_global_admin_can_edit_admin($user_id)) {
  530. $result .= '<a href="user_list.php?action=login_as&user_id='.$user_id.'&sec_token='.$_SESSION['sec_token'].'">'.Display::return_icon('login_as.png', get_lang('LoginAs')).'</a>&nbsp;';
  531. } else {
  532. $result .= Display::return_icon('login_as_na.png', get_lang('LoginAs')).'&nbsp;';
  533. }
  534. } else {
  535. $result .= Display::return_icon('login_as_na.png', get_lang('LoginAs')).'&nbsp;';
  536. }
  537. } else {
  538. $result .= Display::return_icon('login_as_na.png', get_lang('LoginAs')).'&nbsp;';
  539. }
  540. if ($current_user_status_label != $statusname[STUDENT]) {
  541. $result .= Display::return_icon('statistics_na.gif', get_lang('Reporting')).'&nbsp;';
  542. } else {
  543. $result .= '<a href="../mySpace/myStudents.php?student='.$user_id.'">'.Display::return_icon('statistics.gif', get_lang('Reporting')).'</a>&nbsp;';
  544. }
  545. if (api_is_platform_admin(true)) {
  546. $editProfileUrl = Display::getProfileEditionLink($user_id, true);
  547. if (!$user_is_anonymous && api_global_admin_can_edit_admin($user_id, null, true)) {
  548. $result .= '<a href="'.$editProfileUrl.'">'.Display::return_icon('edit.png', get_lang('Edit'), array(), ICON_SIZE_SMALL).'</a>&nbsp;';
  549. } else {
  550. $result .= Display::return_icon('edit_na.png', get_lang('Edit'), array(), ICON_SIZE_SMALL).'</a>&nbsp;';
  551. }
  552. }
  553. $allowAssignSkill = api_is_platform_admin(false, true);
  554. if ($allowAssignSkill) {
  555. $result .= Display::url(
  556. Display::return_icon('skill-badges.png', get_lang('AssignSkill'), null, ICON_SIZE_SMALL),
  557. api_get_path(WEB_CODE_PATH).'badge/assign.php?'.http_build_query(['user' => $user_id])
  558. );
  559. }
  560. if ($is_admin) {
  561. $result .= Display::return_icon(
  562. 'admin_star.png',
  563. get_lang('IsAdministrator'),
  564. array('width' => ICON_SIZE_SMALL, 'heigth' => ICON_SIZE_SMALL)
  565. );
  566. } else {
  567. $result .= Display::return_icon('admin_star_na.png', get_lang('IsNotAdministrator'));
  568. }
  569. // actions for assigning sessions, courses or users
  570. if (!api_is_session_admin()) {
  571. if ($current_user_status_label == $statusname[SESSIONADMIN]) {
  572. $result .= Display::url(
  573. Display::return_icon('view_more_stats.gif', get_lang('AssignSessions')),
  574. "dashboard_add_sessions_to_user.php?user={$user_id}"
  575. );
  576. } else {
  577. if (
  578. $current_user_status_label == $statusname[DRH] ||
  579. UserManager::is_admin($user_id) ||
  580. $current_user_status_label == $statusname[STUDENT_BOSS]
  581. ) {
  582. $result .= Display::url(
  583. Display::return_icon('user_subscribe_course.png', get_lang('AssignUsers'), '', ICON_SIZE_SMALL),
  584. "dashboard_add_users_to_user.php?user={$user_id}"
  585. );
  586. }
  587. if ($current_user_status_label == $statusname[DRH] || UserManager::is_admin($user_id)) {
  588. $result .= Display::url(
  589. Display::return_icon('course_add.gif', get_lang('AssignCourses')),
  590. "dashboard_add_courses_to_user.php?user={$user_id}"
  591. );
  592. $result .= Display::url(
  593. Display::return_icon('view_more_stats.gif', get_lang('AssignSessions')),
  594. "dashboard_add_sessions_to_user.php?user={$user_id}"
  595. );
  596. }
  597. }
  598. }
  599. if (api_is_platform_admin()) {
  600. $result .= ' <a data-title="'.get_lang('FreeBusyCalendar').'" href="'.api_get_path(WEB_AJAX_PATH).'agenda.ajax.php?a=get_user_agenda&user_id='.$user_id.'&modal_size=lg" class="agenda_opener ajax">'.
  601. Display::return_icon('calendar.png', get_lang('FreeBusyCalendar'), array(), ICON_SIZE_SMALL).'</a>';
  602. $deleteAllowed = !api_get_configuration_value('deny_delete_users');
  603. if ($deleteAllowed) {
  604. if ($user_id != api_get_user_id() &&
  605. !$user_is_anonymous &&
  606. api_global_admin_can_edit_admin($user_id)
  607. ) {
  608. // you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
  609. $result .= ' <a href="user_list.php?action=delete_user&user_id='.$user_id.'&'.$url_params.'&sec_token='.$_SESSION['sec_token'].'" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice")))."'".')) return false;">'.Display::return_icon('delete.png', get_lang('Delete'), array(), ICON_SIZE_SMALL).'</a>';
  610. } else {
  611. $result .= Display::return_icon('delete_na.png', get_lang('Delete'), array(), ICON_SIZE_SMALL);
  612. }
  613. }
  614. }
  615. return $result;
  616. }
  617. /**
  618. * Build the active-column of the table to lock or unlock a certain user
  619. * lock = the user can no longer use this account
  620. * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
  621. * @param int $active the current state of the account
  622. * @param string $params
  623. * @param array $row
  624. * @return string Some HTML-code with the lock/unlock button
  625. */
  626. function active_filter($active, $params, $row)
  627. {
  628. $_user = api_get_user_info();
  629. if ($active == '1') {
  630. $action = 'Lock';
  631. $image = 'accept';
  632. } elseif ($active == '-1') {
  633. $action = 'edit';
  634. $image = 'warning';
  635. } elseif ($active == '0') {
  636. $action = 'Unlock';
  637. $image = 'error';
  638. }
  639. $result = '';
  640. if ($action === 'edit') {
  641. $result = Display::return_icon($image.'.png', get_lang('AccountExpired'), array(), 16);
  642. } elseif ($row['0'] <> $_user['user_id']) {
  643. // you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
  644. $result = Display::return_icon(
  645. $image.'.png',
  646. get_lang(ucfirst($action)),
  647. array('onclick' => 'active_user(this);', 'id' => 'img_'.$row['0']),
  648. 16
  649. );
  650. }
  651. return $result;
  652. }
  653. /**
  654. * Instead of displaying the integer of the status, we give a translation for the status
  655. *
  656. * @param integer $status
  657. * @return string translation
  658. *
  659. * @version march 2008
  660. * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University, Belgium
  661. */
  662. function status_filter($status) {
  663. $statusname = api_get_status_langvars();
  664. return $statusname[$status];
  665. }
  666. if (isset($_GET['keyword']) || isset($_GET['keyword_firstname'])) {
  667. $interbreadcrumb[] = array("url" => 'index.php', "name" => get_lang('PlatformAdmin'));
  668. $interbreadcrumb[] = array("url" => 'user_list.php', "name" => get_lang('UserList'));
  669. $tool_name = get_lang('SearchUsers');
  670. } else {
  671. $interbreadcrumb[] = array("url" => 'index.php', "name" => get_lang('PlatformAdmin'));
  672. $tool_name = get_lang('UserList');
  673. }
  674. $message = '';
  675. if (!empty($action)) {
  676. $check = Security::check_token('get');
  677. if ($check) {
  678. switch ($action) {
  679. case 'add_user_to_my_url':
  680. $user_id = $_REQUEST["user_id"];
  681. $result = UrlManager::add_user_to_url($user_id, $current_access_url_id);
  682. if ($result) {
  683. $user_info = api_get_user_info($user_id);
  684. $message = get_lang('UserAdded').' '.$user_info['firstname'].' '.$user_info['lastname'].' ('.$user_info['username'].')';
  685. $message = Display::return_message($message, 'confirmation');
  686. }
  687. break;
  688. case 'delete_user':
  689. if (api_is_platform_admin()) {
  690. $user_to_delete = $_GET['user_id'];
  691. $userToDeleteInfo = api_get_user_info($user_to_delete);
  692. $current_user_id = api_get_user_id();
  693. if ($userToDeleteInfo && $deleteUserAvailable && api_global_admin_can_edit_admin($_GET['user_id'])) {
  694. if ($user_to_delete != $current_user_id && UserManager :: delete_user($_GET['user_id'])) {
  695. $message = Display :: return_message(
  696. get_lang('UserDeleted').': '.$userToDeleteInfo['complete_name_with_username'],
  697. 'confirmation'
  698. );
  699. } else {
  700. $message = Display :: return_message(get_lang('CannotDeleteUserBecauseOwnsCourse'), 'error');
  701. }
  702. } else {
  703. $message = Display :: return_message(get_lang('CannotDeleteUser'), 'error');
  704. }
  705. Display::addFlash($message);
  706. header('Location: '.api_get_self());
  707. exit;
  708. }
  709. break;
  710. case 'delete':
  711. if (api_is_platform_admin()) {
  712. $number_of_selected_users = count($_POST['id']);
  713. $number_of_deleted_users = 0;
  714. if (is_array($_POST['id'])) {
  715. foreach ($_POST['id'] as $index => $user_id) {
  716. if ($user_id != $_user['user_id']) {
  717. if (UserManager::delete_user($user_id)) {
  718. $number_of_deleted_users++;
  719. }
  720. }
  721. }
  722. }
  723. if ($number_of_selected_users == $number_of_deleted_users) {
  724. $message = Display :: return_message(get_lang('SelectedUsersDeleted'), 'confirmation');
  725. } else {
  726. $message = Display :: return_message(get_lang('SomeUsersNotDeleted'), 'error');
  727. }
  728. }
  729. break;
  730. }
  731. Security::clear_token();
  732. }
  733. }
  734. // Create a search-box
  735. $form = new FormValidator('search_simple', 'get', null, null, null, 'inline');
  736. $form->addText('keyword', get_lang('Search'), false);
  737. $form->addButtonSearch(get_lang('Search'));
  738. $searchAdvanced = '
  739. <a id="advanced_params" href="javascript://" class = "btn btn-default advanced_options" onclick="display_advanced_search_form();">
  740. <span id="img_plus_and_minus">&nbsp;
  741. '. Display::returnFontAwesomeIcon('arrow-right').' '.get_lang('AdvancedSearch').'
  742. </span>
  743. </a>';
  744. $actionsLeft = '';
  745. $actionsCenter = '';
  746. $actionsRight = '';
  747. if (api_is_platform_admin()) {
  748. $actionsRight .= '<a class="pull-right" href="'.api_get_path(WEB_CODE_PATH).'admin/user_add.php">'.
  749. Display::return_icon('new_user.png', get_lang('AddUsers'), '', ICON_SIZE_MEDIUM).'</a>';
  750. }
  751. $actionsLeft .= $form->returnForm();
  752. $actionsCenter .= $searchAdvanced;
  753. if (isset($_GET['keyword'])) {
  754. $parameters = array('keyword' => Security::remove_XSS($_GET['keyword']));
  755. } elseif (isset ($_GET['keyword_firstname'])) {
  756. $parameters['keyword_firstname'] = Security::remove_XSS($_GET['keyword_firstname']);
  757. $parameters['keyword_lastname'] = Security::remove_XSS($_GET['keyword_lastname']);
  758. $parameters['keyword_username'] = Security::remove_XSS($_GET['keyword_username']);
  759. $parameters['keyword_email'] = Security::remove_XSS($_GET['keyword_email']);
  760. $parameters['keyword_officialcode'] = Security::remove_XSS($_GET['keyword_officialcode']);
  761. $parameters['keyword_status'] = Security::remove_XSS($_GET['keyword_status']);
  762. $parameters['keyword_active'] = Security::remove_XSS($_GET['keyword_active']);
  763. $parameters['keyword_inactive'] = Security::remove_XSS($_GET['keyword_inactive']);
  764. }
  765. // Create a sortable table with user-data
  766. $parameters['sec_token'] = Security::get_token();
  767. $_admins_list = array_keys(UserManager::get_all_administrators());
  768. Session::write('admin_list', $_admins_list);
  769. // Display Advanced search form.
  770. $form = new FormValidator('advanced_search', 'get', '', '', array(), FormValidator::LAYOUT_HORIZONTAL);
  771. $form->addElement('html', '<div id="advanced_search_form" style="display:none;">');
  772. $form->addElement('header', get_lang('AdvancedSearch'));
  773. $form->addText('keyword_firstname', get_lang('FirstName'), false);
  774. $form->addText('keyword_lastname', get_lang('LastName'), false);
  775. $form->addText('keyword_username', get_lang('LoginName'), false);
  776. $form->addText('keyword_email', get_lang('Email'), false);
  777. $form->addText('keyword_officialcode', get_lang('OfficialCode'), false);
  778. $status_options = array();
  779. $status_options['%'] = get_lang('All');
  780. $status_options[STUDENT] = get_lang('Student');
  781. $status_options[COURSEMANAGER] = get_lang('Teacher');
  782. $status_options[DRH] = get_lang('Drh');
  783. $status_options[SESSIONADMIN] = get_lang('SessionsAdmin');
  784. $status_options[PLATFORM_ADMIN] = get_lang('Administrator');
  785. $form->addElement('select', 'keyword_status', get_lang('Profile'), $status_options);
  786. $active_group = array();
  787. $active_group[] = $form->createElement('checkbox', 'keyword_active', '', get_lang('Active'));
  788. $active_group[] = $form->createElement('checkbox', 'keyword_inactive', '', get_lang('Inactive'));
  789. $form->addGroup($active_group, '', get_lang('ActiveAccount'), null, false);
  790. $form->addElement('checkbox', 'check_easy_passwords', null, get_lang('CheckEasyPasswords'));
  791. $data = $extraField->addElements($form, 0, [], true, false, $variablesToShow);
  792. $htmlHeadXtra[] = '
  793. <script>
  794. $(document).ready(function() {
  795. '.$data['jquery_ready_content'].'
  796. })
  797. </script>
  798. ';
  799. $form->addButtonSearch(get_lang('SearchUsers'));
  800. $defaults = array();
  801. $defaults['keyword_active'] = 1;
  802. $defaults['keyword_inactive'] = 1;
  803. $form->setDefaults($defaults);
  804. $form->addElement('html', '</div>');
  805. $form = $form->returnForm();
  806. $table = new SortableTable(
  807. 'users',
  808. 'get_number_of_users',
  809. 'get_user_data',
  810. (api_is_western_name_order() xor api_sort_by_first_name()) ? 3 : 2
  811. );
  812. $table->set_additional_parameters($parameters);
  813. $table->set_header(0, '', false, 'width="18px"');
  814. $table->set_header(1, get_lang('Photo'), false);
  815. $table->set_header(2, get_lang('OfficialCode'));
  816. if (api_is_western_name_order()) {
  817. $table->set_header(3, get_lang('FirstName'));
  818. $table->set_header(4, get_lang('LastName'));
  819. } else {
  820. $table->set_header(3, get_lang('LastName'));
  821. $table->set_header(4, get_lang('FirstName'));
  822. }
  823. $table->set_header(5, get_lang('LoginName'));
  824. $table->set_header(6, get_lang('Email'));
  825. $table->set_header(7, get_lang('Profile'));
  826. $table->set_header(8, get_lang('Active'), true, 'width="15px"');
  827. $table->set_header(9, get_lang('RegistrationDate'), true, 'width="90px"');
  828. $table->set_header(10, get_lang('Action'), false, 'width="220px"');
  829. $table->set_column_filter(3, 'user_filter');
  830. $table->set_column_filter(4, 'user_filter');
  831. $table->set_column_filter(6, 'email_filter');
  832. $table->set_column_filter(7, 'status_filter');
  833. $table->set_column_filter(8, 'active_filter');
  834. $table->set_column_filter(10, 'modify_filter');
  835. // Only show empty actions bar if delete users has been blocked
  836. if (api_is_platform_admin() && !api_get_configuration_value('deny_delete_users')) {
  837. $table->set_form_actions(array('delete' => get_lang('DeleteFromPlatform')));
  838. } else {
  839. $table->set_form_actions(array('none' => get_lang('NoActionAvailable')));
  840. }
  841. $table_result = $table->return_table();
  842. $extra_search_options = '';
  843. //Try to search the user everywhere
  844. if ($table->get_total_number_of_items() == 0) {
  845. if (api_get_multiple_access_url() && isset($_REQUEST['keyword'])) {
  846. $keyword = Database::escape_string($_REQUEST['keyword']);
  847. $conditions = array('username' => $keyword);
  848. $user_list = UserManager::get_user_list($conditions, array(), false, ' OR ');
  849. if (!empty($user_list)) {
  850. $extra_search_options = Display::page_subheader(get_lang('UsersFoundInOtherPortals'));
  851. $table = new HTML_Table(array('class' => 'data_table'));
  852. $column = 0;
  853. $row = 0;
  854. $headers = array(get_lang('User'), 'URL', get_lang('Actions'));
  855. foreach ($headers as $header) {
  856. $table->setHeaderContents($row, $column, $header);
  857. $column++;
  858. }
  859. $row++;
  860. foreach ($user_list as $user) {
  861. $column = 0;
  862. $access_info = UrlManager::get_access_url_from_user($user['id']);
  863. $access_info_to_string = '';
  864. $add_user = true;
  865. if (!empty($access_info)) {
  866. foreach ($access_info as $url_info) {
  867. if ($current_access_url_id == $url_info['access_url_id']) {
  868. $add_user = false;
  869. }
  870. $access_info_to_string .= $url_info['url'].'<br />';
  871. }
  872. }
  873. if ($add_user) {
  874. $row_table = array();
  875. $row_table[] = api_get_person_name($user['firstname'], $user['lastname']).' ('.$user['username'].') ';
  876. $row_table[] = $access_info_to_string;
  877. $url = api_get_self().'?action=add_user_to_my_url&user_id='.$user['id'].'&sec_token='.$_SESSION['sec_token'];
  878. $row_table[] = Display::url(get_lang('AddUserToMyURL'), $url, array('class' => 'btn'));
  879. foreach ($row_table as $cell) {
  880. $table->setCellContents($row, $column, $cell);
  881. $table->updateCellAttributes($row, $column, 'align="center"');
  882. $column++;
  883. }
  884. $table->updateRowAttributes($row, $row % 2 ? 'class="row_even"' : 'class="row_odd"', true);
  885. $row++;
  886. }
  887. }
  888. $extra_search_options .= $table->toHtml();
  889. $table_result = '';
  890. }
  891. }
  892. }
  893. $toolbarActions = Display::toolbarAction('toolbarUser', [$actionsLeft, $actionsCenter, $actionsRight], [4, 4, 4]);
  894. $tpl = new Template($tool_name);
  895. $tpl->assign('actions', $toolbarActions);
  896. $tpl->assign('message', $message);
  897. $tpl->assign('content', $form.$table_result.$extra_search_options);
  898. $tpl->display_one_col_template();