user_list.php 37 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. use ChamiloSession as Session;
  4. /**
  5. * @author Bart Mollet
  6. * @author Julio Montoya <gugli100@gmail.com> BeezNest 2011
  7. * @package chamilo.admin
  8. */
  9. $cidReset = true;
  10. require_once '../inc/global.inc.php';
  11. $current_access_url_id = api_get_current_access_url_id();
  12. $action = isset($_REQUEST["action"]) ? $_REQUEST["action"] : null;
  13. // Blocks the possibility to delete a user
  14. $deleteUserAvailable = true;
  15. if (api_get_configuration_value('deny_delete_users')) {
  16. $deleteUserAvailable = false;
  17. }
  18. $url = api_get_path(WEB_AJAX_PATH).'course.ajax.php?a=get_user_courses';
  19. $urlSession = api_get_path(WEB_AJAX_PATH).'session.ajax.php?a=get_user_sessions';
  20. $extraField = new ExtraField('user');
  21. $variables = $extraField->get_all_extra_field_by_type(ExtraField::FIELD_TYPE_TAG);
  22. $variablesSelect = $extraField->get_all_extra_field_by_type(ExtraField::FIELD_TYPE_SELECT);
  23. if (!empty($variablesSelect)) {
  24. $variables = array_merge($variables, $variablesSelect);
  25. }
  26. $variablesToShow = [];
  27. if ($variables) {
  28. foreach ($variables as $variableId) {
  29. $extraFieldInfo = $extraField->get($variableId);
  30. $variablesToShow[] = $extraFieldInfo['variable'];
  31. }
  32. }
  33. Session::write('variables_to_show', $variablesToShow);
  34. $htmlHeadXtra[] = '<script>
  35. function load_course_list (div_course,my_user_id) {
  36. $.ajax({
  37. contentType: "application/x-www-form-urlencoded",
  38. beforeSend: function(objeto) {
  39. $("div#"+div_course).html("<img src=\'../inc/lib/javascript/indicator.gif\' />"); },
  40. type: "POST",
  41. url: "'.$url.'",
  42. data: "user_id="+my_user_id,
  43. success: function(datos) {
  44. $("div#"+div_course).html(datos);
  45. $("div#div_"+my_user_id).attr("class","blackboard_show");
  46. $("div#div_"+my_user_id).attr("style","");
  47. }
  48. });
  49. }
  50. function load_session_list(div_session, my_user_id) {
  51. $.ajax({
  52. contentType: "application/x-www-form-urlencoded",
  53. beforeSend: function(objeto) {
  54. $("div#"+div_session).html("<img src=\'../inc/lib/javascript/indicator.gif\' />"); },
  55. type: "POST",
  56. url: "'.$urlSession.'",
  57. data: "user_id="+my_user_id,
  58. success: function(datos) {
  59. $("div#"+div_session).html(datos);
  60. $("div#div_s_"+my_user_id).attr("class","blackboard_show");
  61. $("div#div_s_"+my_user_id).attr("style","");
  62. }
  63. });
  64. }
  65. function active_user(element_div) {
  66. id_image=$(element_div).attr("id");
  67. image_clicked=$(element_div).attr("src");
  68. image_clicked_info = image_clicked.split("/");
  69. image_real_clicked = image_clicked_info[image_clicked_info.length-1];
  70. var status = 1;
  71. if (image_real_clicked == "accept.png") {
  72. status = 0;
  73. }
  74. user_id=id_image.split("_");
  75. ident="#img_"+user_id[1];
  76. if (confirm("'.get_lang('AreYouSureToEditTheUserStatus', '').'")) {
  77. $.ajax({
  78. contentType: "application/x-www-form-urlencoded",
  79. beforeSend: function(objeto) {
  80. $(ident).attr("src","'.Display::returnIconPath('loading1.gif').'"); }, //candy eye stuff
  81. type: "GET",
  82. url: "'.api_get_path(WEB_AJAX_PATH).'user_manager.ajax.php?a=active_user",
  83. data: "user_id="+user_id[1]+"&status="+status,
  84. success: function(data) {
  85. if (data == 1) {
  86. $(ident).attr("src", "'.Display::returnIconPath('accept.png').'");
  87. $(ident).attr("title","'.get_lang('Lock').'");
  88. }
  89. if (data == 0) {
  90. $(ident).attr("src","'.Display::returnIconPath('error.png').'");
  91. $(ident).attr("title","'.get_lang('Unlock').'");
  92. }
  93. if (data == -1) {
  94. $(ident).attr("src", "'.Display::returnIconPath('warning.png').'");
  95. $(ident).attr("title","'.get_lang('ActionNotAllowed').'");
  96. }
  97. }
  98. });
  99. }
  100. }
  101. function clear_course_list(div_course) {
  102. $("div#"+div_course).html("&nbsp;");
  103. $("div#"+div_course).hide("");
  104. }
  105. function clear_session_list(div_session) {
  106. $("div#"+div_session).html("&nbsp;");
  107. $("div#"+div_session).hide("");
  108. }
  109. function display_advanced_search_form () {
  110. if ($("#advanced_search_form").css("display") == "none") {
  111. $("#advanced_search_form").css("display","block");
  112. $("#img_plus_and_minus").html(\'&nbsp;'. Display::returnFontAwesomeIcon('arrow-down') . ' '. get_lang('AdvancedSearch').'\');
  113. } else {
  114. $("#advanced_search_form").css("display","none");
  115. $("#img_plus_and_minus").html(\'&nbsp;'. Display::returnFontAwesomeIcon('arrow-right') . ' '.get_lang('AdvancedSearch').'\');
  116. }
  117. }
  118. $(document).ready(function() {
  119. var select_val = $("#input_select_extra_data").val();
  120. if ( document.getElementById(\'extra_data_text\')) {
  121. if (select_val != 0) {
  122. document.getElementById(\'extra_data_text\').style.display="block";
  123. if (document.getElementById(\'input_extra_text\'))
  124. document.getElementById(\'input_extra_text\').value = "";
  125. } else {
  126. document.getElementById(\'extra_data_text\').style.display="none";
  127. }
  128. }
  129. });
  130. //Load user calendar
  131. function load_calendar(user_id, month, year) {
  132. var url = "'.api_get_path(WEB_AJAX_PATH).'agenda.ajax.php?a=get_user_agenda&user_id=" +user_id + "&month="+month+"&year="+year;
  133. $(".modal-body").load(url);
  134. }
  135. </script>';
  136. $this_section = SECTION_PLATFORM_ADMIN;
  137. if ($action == 'login_as') {
  138. $check = Security::check_token('get');
  139. if (isset($_GET['user_id']) && $check) {
  140. $result = loginUser($_GET['user_id']);
  141. if ($result == false) {
  142. api_not_allowed(true);
  143. }
  144. }
  145. Security::clear_token();
  146. }
  147. api_protect_admin_script(true);
  148. /**
  149. * Prepares the shared SQL query for the user table.
  150. * See get_user_data() and get_number_of_users().
  151. *
  152. * @param boolean $is_count Whether to count, or get data
  153. * @return string SQL query
  154. */
  155. function prepare_user_sql_query($is_count)
  156. {
  157. $sql = '';
  158. $user_table = Database::get_main_table(TABLE_MAIN_USER);
  159. $admin_table = Database::get_main_table(TABLE_MAIN_ADMIN);
  160. if ($is_count) {
  161. $sql .= "SELECT COUNT(u.id) AS total_number_of_items FROM $user_table u";
  162. } else {
  163. $sql .= "SELECT u.id AS col0, u.official_code AS col2, ";
  164. if (api_is_western_name_order()) {
  165. $sql .= "u.firstname AS col3, u.lastname AS col4, ";
  166. } else {
  167. $sql .= "u.lastname AS col3, u.firstname AS col4, ";
  168. }
  169. $sql .= " u.username AS col5,
  170. u.email AS col6,
  171. u.status AS col7,
  172. u.active AS col8,
  173. u.id AS col9,
  174. u.registration_date AS col10,
  175. u.expiration_date AS exp,
  176. u.password
  177. FROM $user_table u";
  178. }
  179. // adding the filter to see the user's only of the current access_url
  180. if ((api_is_platform_admin() || api_is_session_admin()) && api_get_multiple_access_url()) {
  181. $access_url_rel_user_table = Database :: get_main_table(TABLE_MAIN_ACCESS_URL_REL_USER);
  182. $sql.= " INNER JOIN $access_url_rel_user_table url_rel_user ON (u.id=url_rel_user.user_id)";
  183. }
  184. $keywordList = array(
  185. 'keyword_firstname',
  186. 'keyword_lastname',
  187. 'keyword_username',
  188. 'keyword_email',
  189. 'keyword_officialcode',
  190. 'keyword_status',
  191. 'keyword_active',
  192. 'keyword_inactive',
  193. 'check_easy_passwords'
  194. );
  195. $keywordListValues = array();
  196. $atLeastOne = false;
  197. foreach ($keywordList as $keyword) {
  198. $keywordListValues[$keyword] = null;
  199. if (isset($_GET[$keyword]) && !empty($_GET[$keyword])) {
  200. $keywordListValues[$keyword] = $_GET[$keyword];
  201. $atLeastOne = true;
  202. }
  203. }
  204. if ($atLeastOne == false) {
  205. $keywordListValues = array();
  206. }
  207. /*
  208. // This block is never executed because $keyword_extra_data never exists
  209. if (isset($keyword_extra_data) && !empty($keyword_extra_data)) {
  210. $extra_info = UserManager::get_extra_field_information_by_name($keyword_extra_data);
  211. $field_id = $extra_info['id'];
  212. $sql.= " INNER JOIN user_field_values ufv ON u.id=ufv.user_id AND ufv.field_id=$field_id ";
  213. }
  214. */
  215. if (isset($_GET['keyword']) && !empty($_GET['keyword'])) {
  216. $keywordFiltered = Database::escape_string("%". $_GET['keyword'] ."%");
  217. $sql .= " WHERE (
  218. u.firstname LIKE '$keywordFiltered' OR
  219. u.lastname LIKE '$keywordFiltered' OR
  220. concat(u.firstname, ' ', u.lastname) LIKE '$keywordFiltered' OR
  221. concat(u.lastname,' ',u.firstname) LIKE '$keywordFiltered' OR
  222. u.username LIKE '$keywordFiltered' OR
  223. u.official_code LIKE '$keywordFiltered' OR
  224. u.email LIKE '$keywordFiltered'
  225. )
  226. ";
  227. } elseif (isset($keywordListValues) && !empty($keywordListValues)) {
  228. $query_admin_table = '';
  229. $keyword_admin = '';
  230. if (isset($keywordListValues['keyword_status']) &&
  231. $keywordListValues['keyword_status'] == PLATFORM_ADMIN
  232. ) {
  233. $query_admin_table = " , $admin_table a ";
  234. $keyword_admin = ' AND a.user_id = u.id ';
  235. $keywordListValues['keyword_status'] = '%';
  236. }
  237. $keyword_extra_value = '';
  238. // This block is never executed because $keyword_extra_data never exists
  239. /*
  240. if (isset($keyword_extra_data) && !empty($keyword_extra_data) &&
  241. !empty($keyword_extra_data_text)) {
  242. $keyword_extra_value = " AND ufv.field_value LIKE '%".trim($keyword_extra_data_text)."%' ";
  243. }
  244. */
  245. $sql .= " $query_admin_table
  246. WHERE (
  247. u.firstname LIKE '". Database::escape_string("%".$keywordListValues['keyword_firstname']."%")."' AND
  248. u.lastname LIKE '". Database::escape_string("%".$keywordListValues['keyword_lastname']."%")."' AND
  249. u.username LIKE '". Database::escape_string("%".$keywordListValues['keyword_username']."%")."' AND
  250. u.email LIKE '". Database::escape_string("%".$keywordListValues['keyword_email']."%")."' AND
  251. u.status LIKE '".Database::escape_string($keywordListValues['keyword_status'])."' ";
  252. if (!empty($keywordListValues['keyword_officialcode'])) {
  253. $sql .= " AND u.official_code LIKE '" . Database::escape_string("%" . $keywordListValues['keyword_officialcode'] . "%") . "' ";
  254. }
  255. $sql .= "
  256. $keyword_admin
  257. $keyword_extra_value
  258. ";
  259. if (isset($keywordListValues['keyword_active']) && !isset($keywordListValues['keyword_inactive'])) {
  260. $sql .= " AND u.active = 1";
  261. } elseif (isset($keywordListValues['keyword_inactive']) && !isset($keywordListValues['keyword_active'])) {
  262. $sql .= " AND u.active = 0";
  263. }
  264. $sql .= " ) ";
  265. }
  266. $variables = Session::read('variables_to_show');
  267. $extraField = new ExtraField('user');
  268. $extraFieldResult = [];
  269. foreach ($variables as $variable) {
  270. if (isset($_GET['extra_'.$variable])) {
  271. if (is_array($_GET['extra_'.$variable])) {
  272. $values = $_GET['extra_'.$variable];
  273. } else {
  274. $values = [$_GET['extra_'.$variable]];
  275. }
  276. $info = $extraField->get_handler_field_info_by_field_variable($variable);
  277. if (empty($info)) {
  278. continue;
  279. }
  280. foreach ($values as $value) {
  281. if ($info['field_type'] == ExtraField::FIELD_TYPE_TAG) {
  282. $result = $extraField->getAllUserPerTag($info['id'], $value);
  283. $result = empty($result) ? [] : array_column($result, 'user_id');
  284. } else {
  285. $result = UserManager::get_extra_user_data_by_value(
  286. $variable,
  287. $value
  288. );
  289. }
  290. if (!empty($result)) {
  291. $extraFieldResult = array_merge($extraFieldResult, $result);
  292. }
  293. }
  294. }
  295. }
  296. if (!empty($extraFieldResult)) {
  297. $sql .= " AND (u.id IN ('".implode("','", $extraFieldResult)."')) ";
  298. }
  299. // adding the filter to see the user's only of the current access_url
  300. if ((api_is_platform_admin() || api_is_session_admin())
  301. && api_get_multiple_access_url()
  302. ) {
  303. $sql .= " AND url_rel_user.access_url_id=".api_get_current_access_url_id();
  304. }
  305. return $sql;
  306. }
  307. /**
  308. * Make sure this function is protected because it does NOT check password!
  309. *
  310. * This function defines globals.
  311. * @param int $userId
  312. *
  313. * @return false|null False on failure, redirection on success
  314. * @author Evie Embrechts
  315. * @author Yannick Warnier <yannick.warnier@dokeos.com>
  316. */
  317. function loginUser($userId)
  318. {
  319. $userId = intval($userId);
  320. $userInfo = api_get_user_info($userId);
  321. // Check if the user is allowed to 'login_as'
  322. $canLoginAs = api_can_login_as($userId);
  323. if (!$canLoginAs || empty($userInfo)) {
  324. return false;
  325. }
  326. $firstname = $userInfo['firstname'];
  327. $lastname = $userInfo['lastname'];
  328. if (api_is_western_name_order()) {
  329. $message = sprintf(get_lang('AttemptingToLoginAs'),$firstname, $lastname, $userId);
  330. } else {
  331. $message = sprintf(get_lang('AttemptingToLoginAs'), $lastname, $firstname, $userId);
  332. }
  333. if ($userId) {
  334. // Logout the current user
  335. LoginDelete(api_get_user_id());
  336. Session::erase('_user');
  337. Session::erase('is_platformAdmin');
  338. Session::erase('is_allowedCreateCourse');
  339. Session::erase('_uid');
  340. // Cleaning session variables
  341. $_user['firstName'] = $userInfo['firstname'];
  342. $_user['lastName'] = $userInfo['lastname'];
  343. $_user['mail'] = $userInfo['email'];
  344. $_user['official_code'] = $userInfo['official_code'];
  345. $_user['picture_uri'] = $userInfo['picture_uri'];
  346. $_user['user_id'] = $userId;
  347. $_user['id'] = $userId;
  348. $_user['status'] = $userInfo['status'];
  349. // Filling session variables with new data
  350. Session::write('_uid', $userId);
  351. Session::write('_user', $userInfo);
  352. Session::write('is_platformAdmin', (bool) (UserManager::is_admin($userId)));
  353. Session::write('is_allowedCreateCourse', (bool) ($userInfo['status'] == 1));
  354. // will be useful later to know if the user is actually an admin or not (example reporting)
  355. Session::write('login_as', true);
  356. $target_url = api_get_path(WEB_PATH)."user_portal.php";
  357. $message .= '<br />'.sprintf(get_lang('LoginSuccessfulGoToX'), '<a href="'.$target_url.'">'.$target_url.'</a>');
  358. Display :: display_header(get_lang('UserList'));
  359. Display :: display_normal_message($message, false);
  360. Display :: display_footer();
  361. exit;
  362. }
  363. }
  364. /**
  365. * Get the total number of users on the platform
  366. * @see SortableTable#get_total_number_of_items()
  367. */
  368. function get_number_of_users()
  369. {
  370. $sql = prepare_user_sql_query(true);
  371. $res = Database::query($sql);
  372. $obj = Database::fetch_object($res);
  373. return $obj->total_number_of_items;
  374. }
  375. /**
  376. * Get the users to display on the current page (fill the sortable-table)
  377. * @param int offset of first user to recover
  378. * @param int Number of users to get
  379. * @param int Column to sort on
  380. * @param string Order (ASC,DESC)
  381. * @see SortableTable#get_table_data($from)
  382. */
  383. function get_user_data($from, $number_of_items, $column, $direction)
  384. {
  385. $sql = prepare_user_sql_query(false);
  386. /* @todo will not work because now we use the salt field
  387. $checkPassStrength = isset($_GET['check_easy_passwords']) && $_GET['check_easy_passwords'] == 1 ? true : false;
  388. if ($checkPassStrength) {
  389. $easyPasswordList = api_get_easy_password_list();
  390. $easyPasswordList = array_map('api_get_encrypted_password', $easyPasswordList);
  391. $easyPasswordList = array_map(array('Database', 'escape_string'), $easyPasswordList);
  392. $easyPassword = implode("' OR password LIKE '", $easyPasswordList);
  393. $sql .= "AND password LIKE '$easyPassword' ";
  394. }*/
  395. if (!in_array($direction, array('ASC','DESC'))) {
  396. $direction = 'ASC';
  397. }
  398. $column = intval($column);
  399. $from = intval($from);
  400. $number_of_items = intval($number_of_items);
  401. $preventSessionAdminsToManageAllUsers = api_get_setting('prevent_session_admins_to_manage_all_users');
  402. if (api_is_session_admin() && $preventSessionAdminsToManageAllUsers === 'true') {
  403. $sql .= " WHERE u.creator_id = ".api_get_user_id();
  404. }
  405. $sql .= " ORDER BY col$column $direction ";
  406. $sql .= " LIMIT $from,$number_of_items";
  407. $res = Database::query($sql);
  408. $users = array ();
  409. $t = time();
  410. while ($user = Database::fetch_row($res)) {
  411. $userPicture = UserManager::getUserPicture($user[0], USER_IMAGE_SIZE_SMALL);
  412. $photo = '<img src="'.$userPicture.'" width="22" height="22" alt="'.api_get_person_name($user[2], $user[3]).'" title="'.api_get_person_name($user[2], $user[3]).'" />';
  413. if ($user[7] == 1 && !empty($user[10])) {
  414. // check expiration date
  415. $expiration_time = convert_sql_date($user[10]);
  416. // if expiration date is passed, store a special value for active field
  417. if ($expiration_time < $t) {
  418. $user[7] = '-1';
  419. }
  420. }
  421. // forget about the expiration date field
  422. $users[] = array(
  423. $user[0],
  424. $photo,
  425. $user[1],
  426. $user[2],
  427. $user[3],
  428. $user[4],
  429. $user[5],
  430. $user[6],
  431. $user[7],
  432. api_get_local_time($user[9]),
  433. $user[0]
  434. );
  435. }
  436. return $users;
  437. }
  438. /**
  439. * Returns a mailto-link
  440. * @param string $email An email-address
  441. * @return string HTML-code with a mailto-link
  442. */
  443. function email_filter($email)
  444. {
  445. return Display :: encrypted_mailto_link($email, $email);
  446. }
  447. /**
  448. * Returns a mailto-link
  449. * @param string $email An email-address
  450. * @return string HTML-code with a mailto-link
  451. */
  452. function user_filter($name, $params, $row)
  453. {
  454. return '<a href="'.api_get_path(WEB_PATH).'whoisonline.php?origin=user_list&id='.$row[0].'">'.$name.'</a>';
  455. }
  456. /**
  457. * Build the modify-column of the table
  458. * @param int The user id
  459. * @param string URL params to add to table links
  460. * @param array Row of elements to alter
  461. * @return string Some HTML-code with modify-buttons
  462. */
  463. function modify_filter($user_id, $url_params, $row)
  464. {
  465. global $charset, $_admins_list;
  466. $is_admin = in_array($user_id, $_admins_list);
  467. $statusname = api_get_status_langvars();
  468. $user_is_anonymous = false;
  469. $current_user_status_label = $row['7'];
  470. if ($current_user_status_label == $statusname[ANONYMOUS]) {
  471. $user_is_anonymous =true;
  472. }
  473. $result = '';
  474. if (!$user_is_anonymous) {
  475. $icon = Display::return_icon('course.png', get_lang('Courses'), array('onmouseout' => 'clear_course_list (\'div_'.$user_id.'\')'));
  476. $result .= '<a href="javascript:void(0)" onclick="load_course_list(\'div_'.$user_id.'\','.$user_id.')" >
  477. '.$icon.'
  478. <div class="blackboard_hide" id="div_'.$user_id.'">&nbsp;&nbsp;</div>
  479. </a>';
  480. $icon = Display::return_icon('session.png', get_lang('Sessions'), array('onmouseout' => 'clear_session_list (\'div_s_'.$user_id.'\')'));
  481. $result .= '<a href="javascript:void(0)" onclick="load_session_list(\'div_s_'.$user_id.'\','.$user_id.')" >
  482. '.$icon.'
  483. <div class="blackboard_hide" id="div_s_'.$user_id.'">&nbsp;&nbsp;</div>
  484. </a>';
  485. } else {
  486. $result .= Display::return_icon('course_na.png',get_lang('Courses')).'&nbsp;&nbsp;';
  487. $result .= Display::return_icon('course_na.png',get_lang('Sessions')).'&nbsp;&nbsp;';
  488. }
  489. if (api_is_platform_admin()) {
  490. if (!$user_is_anonymous) {
  491. $result .= '<a href="user_information.php?user_id='.$user_id.'">'.Display::return_icon('synthese_view.gif', get_lang('Info')).'</a>&nbsp;&nbsp;';
  492. } else {
  493. $result .= Display::return_icon('synthese_view_na.gif', get_lang('Info')).'&nbsp;&nbsp;';
  494. }
  495. }
  496. //only allow platform admins to login_as, or session admins only for students (not teachers nor other admins)
  497. if (api_is_platform_admin() || (api_is_session_admin() && $current_user_status_label == $statusname[STUDENT])) {
  498. if (!$user_is_anonymous) {
  499. if (api_global_admin_can_edit_admin($user_id)) {
  500. $result .= '<a href="user_list.php?action=login_as&user_id='.$user_id.'&sec_token='.$_SESSION['sec_token'].'">'.Display::return_icon('login_as.png', get_lang('LoginAs')).'</a>&nbsp;&nbsp;';
  501. } else {
  502. $result .= Display::return_icon('login_as_na.png', get_lang('LoginAs')).'&nbsp;&nbsp;';
  503. }
  504. } else {
  505. $result .= Display::return_icon('login_as_na.png', get_lang('LoginAs')).'&nbsp;&nbsp;';
  506. }
  507. } else {
  508. $result .= Display::return_icon('login_as_na.png', get_lang('LoginAs')).'&nbsp;&nbsp;';
  509. }
  510. if ($current_user_status_label != $statusname[STUDENT]) {
  511. $result .= Display::return_icon('statistics_na.gif', get_lang('Reporting')).'&nbsp;&nbsp;';
  512. } else {
  513. $result .= '<a href="../mySpace/myStudents.php?student='.$user_id.'">'.Display::return_icon('statistics.gif', get_lang('Reporting')).'</a>&nbsp;&nbsp;';
  514. }
  515. if (api_is_platform_admin(true)) {
  516. $editProfileUrl = Display::getProfileEditionLink($user_id, true);
  517. if (!$user_is_anonymous && api_global_admin_can_edit_admin($user_id, null, true)) {
  518. $result .= '<a href="' . $editProfileUrl . '">'.Display::return_icon('edit.png', get_lang('Edit'), array(), ICON_SIZE_SMALL).'</a>&nbsp;';
  519. } else {
  520. $result .= Display::return_icon('edit_na.png', get_lang('Edit'), array(), ICON_SIZE_SMALL).'</a>&nbsp;';
  521. }
  522. }
  523. $allowAssignSkill = api_is_platform_admin(false, true);
  524. if ($allowAssignSkill) {
  525. $result .= Display::url(
  526. Display::return_icon('skill-badges.png', get_lang('AssignSkill'), null, ICON_SIZE_SMALL),
  527. api_get_path(WEB_CODE_PATH) . 'badge/assign.php?' . http_build_query(['user' => $user_id])
  528. );
  529. }
  530. if ($is_admin) {
  531. $result .= Display::return_icon('admin_star.png', get_lang('IsAdministrator'),array('width'=> ICON_SIZE_SMALL, 'heigth'=> ICON_SIZE_SMALL));
  532. } else {
  533. $result .= Display::return_icon('admin_star_na.png', get_lang('IsNotAdministrator'));
  534. }
  535. // actions for assigning sessions, courses or users
  536. if (!api_is_session_admin()) {
  537. if ($current_user_status_label == $statusname[SESSIONADMIN]) {
  538. $result .= Display::url(
  539. Display::return_icon('view_more_stats.gif', get_lang('AssignSessions')),
  540. "dashboard_add_sessions_to_user.php?user={$user_id}"
  541. );
  542. } else {
  543. if (
  544. $current_user_status_label == $statusname[DRH] ||
  545. UserManager::is_admin($user_id) ||
  546. $current_user_status_label == $statusname[STUDENT_BOSS]
  547. ) {
  548. $result .= Display::url(
  549. Display::return_icon('user_subscribe_course.png', get_lang('AssignUsers'), '', ICON_SIZE_SMALL),
  550. "dashboard_add_users_to_user.php?user={$user_id}"
  551. );
  552. }
  553. if ($current_user_status_label == $statusname[DRH] || UserManager::is_admin($user_id)) {
  554. $result .= Display::url(
  555. Display::return_icon('course_add.gif', get_lang('AssignCourses')),
  556. "dashboard_add_courses_to_user.php?user={$user_id}"
  557. );
  558. $result .= Display::url(
  559. Display::return_icon('view_more_stats.gif', get_lang('AssignSessions')),
  560. "dashboard_add_sessions_to_user.php?user={$user_id}"
  561. );
  562. }
  563. }
  564. }
  565. if (api_is_platform_admin()) {
  566. $result .= ' <a data-title="'.get_lang('FreeBusyCalendar').'" href="'.api_get_path(WEB_AJAX_PATH).'agenda.ajax.php?a=get_user_agenda&user_id='.$user_id.'&modal_size=lg" class="agenda_opener ajax">'.
  567. Display::return_icon('calendar.png', get_lang('FreeBusyCalendar'), array(), ICON_SIZE_SMALL).'</a>';
  568. $deleteAllowed = !api_get_configuration_value('deny_delete_users');
  569. if ($deleteAllowed) {
  570. if ($user_id != api_get_user_id() &&
  571. !$user_is_anonymous &&
  572. api_global_admin_can_edit_admin($user_id)
  573. ) {
  574. // you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
  575. $result .= ' <a href="user_list.php?action=delete_user&user_id='.$user_id.'&'.$url_params.'&sec_token='.$_SESSION['sec_token'].'" onclick="javascript:if(!confirm('."'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES,$charset))."'".')) return false;">'.Display::return_icon('delete.png', get_lang('Delete'), array(), ICON_SIZE_SMALL).'</a>';
  576. } else {
  577. $result .= Display::return_icon('delete_na.png', get_lang('Delete'), array(), ICON_SIZE_SMALL);
  578. }
  579. }
  580. }
  581. return $result;
  582. }
  583. /**
  584. * Build the active-column of the table to lock or unlock a certain user
  585. * lock = the user can no longer use this account
  586. * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University
  587. * @param int $active the current state of the account
  588. * @param string $params
  589. * @param array $row
  590. * @return string Some HTML-code with the lock/unlock button
  591. */
  592. function active_filter($active, $params, $row)
  593. {
  594. $_user = api_get_user_info();
  595. if ($active == '1') {
  596. $action = 'Lock';
  597. $image = 'accept';
  598. } elseif ($active == '-1') {
  599. $action = 'edit';
  600. $image = 'warning';
  601. } elseif ($active == '0') {
  602. $action = 'Unlock';
  603. $image = 'error';
  604. }
  605. $result = '';
  606. if ($action === 'edit') {
  607. $result = Display::return_icon($image.'.png', get_lang('AccountExpired'), array(), 16);
  608. } elseif ($row['0'] <> $_user['user_id']) {
  609. // you cannot lock yourself out otherwise you could disable all the accounts including your own => everybody is locked out and nobody can change it anymore.
  610. $result = Display::return_icon($image.'.png', get_lang(ucfirst($action)), array('onclick'=>'active_user(this);', 'id'=>'img_'.$row['0']), 16).'</a>';
  611. }
  612. return $result;
  613. }
  614. /**
  615. * Instead of displaying the integer of the status, we give a translation for the status
  616. *
  617. * @param integer $status
  618. * @return string translation
  619. *
  620. * @version march 2008
  621. * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University, Belgium
  622. */
  623. function status_filter($status) {
  624. $statusname = api_get_status_langvars();
  625. return $statusname[$status];
  626. }
  627. if (isset($_GET['keyword']) || isset($_GET['keyword_firstname'])) {
  628. $interbreadcrumb[] = array("url" => 'index.php', "name" => get_lang('PlatformAdmin'));
  629. $interbreadcrumb[] = array("url" => 'user_list.php', "name" => get_lang('UserList'));
  630. $tool_name = get_lang('SearchUsers');
  631. } else {
  632. $interbreadcrumb[] = array("url" => 'index.php', "name" => get_lang('PlatformAdmin'));
  633. $tool_name = get_lang('UserList');
  634. }
  635. $message = '';
  636. if (!empty($action)) {
  637. $check = Security::check_token('get');
  638. if ($check) {
  639. switch ($action) {
  640. case 'add_user_to_my_url':
  641. $user_id = $_REQUEST["user_id"];
  642. $result = UrlManager::add_user_to_url($user_id, $current_access_url_id);
  643. if ($result ) {
  644. $user_info = api_get_user_info($user_id);
  645. $message = get_lang('UserAdded').' '.$user_info['firstname'].' '.$user_info['lastname'].' ('.$user_info['username'].')';
  646. $message = Display::return_message($message, 'confirmation');
  647. }
  648. break;
  649. case 'delete_user':
  650. if (api_is_platform_admin()) {
  651. $user_to_delete = $_GET['user_id'];
  652. $current_user_id = api_get_user_id();
  653. if ($deleteUserAvailable && api_global_admin_can_edit_admin($_GET['user_id'])) {
  654. if ($user_to_delete != $current_user_id && UserManager :: delete_user($_GET['user_id'])) {
  655. $message = Display :: return_message(get_lang('UserDeleted'), 'confirmation');
  656. } else {
  657. $message = Display :: return_message(get_lang('CannotDeleteUserBecauseOwnsCourse'), 'error');
  658. }
  659. } else {
  660. $message = Display :: return_message(get_lang('CannotDeleteUser'),'error');
  661. }
  662. }
  663. break;
  664. case 'delete':
  665. if (api_is_platform_admin()) {
  666. $number_of_selected_users = count($_POST['id']);
  667. $number_of_deleted_users = 0;
  668. if (is_array($_POST['id'])) {
  669. foreach ($_POST['id'] as $index => $user_id) {
  670. if ($user_id != $_user['user_id']) {
  671. if (UserManager::delete_user($user_id)) {
  672. $number_of_deleted_users++;
  673. }
  674. }
  675. }
  676. }
  677. if ($number_of_selected_users == $number_of_deleted_users) {
  678. $message = Display :: return_message(get_lang('SelectedUsersDeleted'), 'confirmation');
  679. } else {
  680. $message = Display :: return_message(get_lang('SomeUsersNotDeleted'), 'error');
  681. }
  682. }
  683. break;
  684. }
  685. Security::clear_token();
  686. }
  687. }
  688. // Create a search-box
  689. $form = new FormValidator('search_simple', 'get', null, null, null, 'inline');
  690. $form->addText('keyword', get_lang('Search'), false);
  691. $form->addButtonSearch(get_lang('Search'));
  692. $searchAdvanced = '
  693. <a id="advanced_params" href="javascript://" class = "btn btn-default advanced_options" onclick="display_advanced_search_form();">
  694. <span id="img_plus_and_minus">&nbsp;'. Display::returnFontAwesomeIcon('arrow-right') . ' '.get_lang('AdvancedSearch').'
  695. </span>
  696. </a>';
  697. $actionsLeft = '';
  698. $actionsCenter = '';
  699. $actionsRight = '';
  700. if (api_is_platform_admin()) {
  701. $actionsRight .= '<a class="pull-right" href="'.api_get_path(WEB_CODE_PATH).'admin/user_add.php">'.
  702. Display::return_icon('new_user.png',get_lang('AddUsers'),'',ICON_SIZE_MEDIUM).'</a>';
  703. }
  704. $actionsLeft .= $form->returnForm();
  705. $actionsCenter .= $searchAdvanced;
  706. if (isset($_GET['keyword'])) {
  707. $parameters = array('keyword' => Security::remove_XSS($_GET['keyword']));
  708. } elseif (isset ($_GET['keyword_firstname'])) {
  709. $parameters['keyword_firstname'] = Security::remove_XSS($_GET['keyword_firstname']);
  710. $parameters['keyword_lastname'] = Security::remove_XSS($_GET['keyword_lastname']);
  711. $parameters['keyword_username'] = Security::remove_XSS($_GET['keyword_username']);
  712. $parameters['keyword_email'] = Security::remove_XSS($_GET['keyword_email']);
  713. $parameters['keyword_officialcode'] = Security::remove_XSS($_GET['keyword_officialcode']);
  714. $parameters['keyword_status'] = Security::remove_XSS($_GET['keyword_status']);
  715. $parameters['keyword_active'] = Security::remove_XSS($_GET['keyword_active']);
  716. $parameters['keyword_inactive'] = Security::remove_XSS($_GET['keyword_inactive']);
  717. }
  718. // Create a sortable table with user-data
  719. $parameters['sec_token'] = Security::get_token();
  720. $_admins_list = array_keys(UserManager::get_all_administrators());
  721. // Display Advanced search form.
  722. $form = new FormValidator('advanced_search', 'get', '', '', array(), FormValidator::LAYOUT_HORIZONTAL);
  723. $form->addElement('html','<div id="advanced_search_form" style="display:none;">');
  724. $form->addElement('header', get_lang('AdvancedSearch'));
  725. $form->addText('keyword_firstname', get_lang('FirstName'), false);
  726. $form->addText('keyword_lastname', get_lang('LastName'), false);
  727. $form->addText('keyword_username', get_lang('LoginName'), false);
  728. $form->addText('keyword_email', get_lang('Email'), false);
  729. $form->addText('keyword_officialcode', get_lang('OfficialCode'), false);
  730. $status_options = array();
  731. $status_options['%'] = get_lang('All');
  732. $status_options[STUDENT] = get_lang('Student');
  733. $status_options[COURSEMANAGER] = get_lang('Teacher');
  734. $status_options[DRH] = get_lang('Drh');
  735. $status_options[SESSIONADMIN] = get_lang('SessionsAdmin');
  736. $status_options[PLATFORM_ADMIN] = get_lang('Administrator');
  737. $form->addElement('select', 'keyword_status', get_lang('Profile'), $status_options);
  738. $active_group = array();
  739. $active_group[] = $form->createElement('checkbox', 'keyword_active', '', get_lang('Active'));
  740. $active_group[] = $form->createElement('checkbox', 'keyword_inactive', '', get_lang('Inactive'));
  741. $form->addGroup($active_group, '', get_lang('ActiveAccount'), null, false);
  742. $form->addElement('checkbox', 'check_easy_passwords', null, get_lang('CheckEasyPasswords'));
  743. $data = $extraField->addElements($form, 0, [], true, false, $variablesToShow);
  744. $htmlHeadXtra[] = '
  745. <script>
  746. $(document).ready(function() {
  747. '.$data['jquery_ready_content'].'
  748. })
  749. </script>
  750. ';
  751. $form->addButtonSearch(get_lang('SearchUsers'));
  752. $defaults = array();
  753. $defaults['keyword_active'] = 1;
  754. $defaults['keyword_inactive'] = 1;
  755. $form->setDefaults($defaults);
  756. $form->addElement('html','</div>');
  757. $form = $form->returnForm();
  758. $table = new SortableTable(
  759. 'users',
  760. 'get_number_of_users',
  761. 'get_user_data',
  762. (api_is_western_name_order() xor api_sort_by_first_name()) ? 3 : 2
  763. );
  764. $table->set_additional_parameters($parameters);
  765. $table->set_header(0, '', false, 'width="18px"');
  766. $table->set_header(1, get_lang('Photo'), false);
  767. $table->set_header(2, get_lang('OfficialCode'));
  768. if (api_is_western_name_order()) {
  769. $table->set_header(3, get_lang('FirstName'));
  770. $table->set_header(4, get_lang('LastName'));
  771. } else {
  772. $table->set_header(3, get_lang('LastName'));
  773. $table->set_header(4, get_lang('FirstName'));
  774. }
  775. $table->set_header(5, get_lang('LoginName'));
  776. $table->set_header(6, get_lang('Email'));
  777. $table->set_header(7, get_lang('Profile'));
  778. $table->set_header(8, get_lang('Active'), true, 'width="15px"');
  779. $table->set_header(9, get_lang('RegistrationDate'), true, 'width="90px"');
  780. $table->set_header(10, get_lang('Action'), false, 'width="220px"');
  781. $table->set_column_filter(3, 'user_filter');
  782. $table->set_column_filter(4, 'user_filter');
  783. $table->set_column_filter(6, 'email_filter');
  784. $table->set_column_filter(7, 'status_filter');
  785. $table->set_column_filter(8, 'active_filter');
  786. $table->set_column_filter(10, 'modify_filter');
  787. // Only show empty actions bar if delete users has been blocked
  788. if (api_is_platform_admin() && !(api_get_configuration_value('deny_delete_users'))) {
  789. $table->set_form_actions(array('delete' => get_lang('DeleteFromPlatform')));
  790. } else {
  791. $table->set_form_actions(array('none' => get_lang('NoActionAvailable')));
  792. }
  793. $table_result = $table->return_table();
  794. $extra_search_options = '';
  795. //Try to search the user everywhere
  796. if ($table->get_total_number_of_items() == 0) {
  797. if (api_get_multiple_access_url() && isset($_REQUEST['keyword'])) {
  798. $keyword = Database::escape_string($_REQUEST['keyword']);
  799. $conditions = array('username' => $keyword);
  800. $user_list = UserManager::get_user_list($conditions, array(), false, ' OR ');
  801. if (!empty($user_list)) {
  802. $extra_search_options = Display::page_subheader(get_lang('UsersFoundInOtherPortals'));
  803. $table = new HTML_Table(array('class' => 'data_table'));
  804. $column = 0;
  805. $row = 0;
  806. $headers = array(get_lang('User'), 'URL', get_lang('Actions'));
  807. foreach ($headers as $header) {
  808. $table->setHeaderContents($row, $column, $header);
  809. $column++;
  810. }
  811. $row++;
  812. foreach ($user_list as $user) {
  813. $column = 0;
  814. $access_info = UrlManager::get_access_url_from_user($user['id']);
  815. $access_info_to_string = '';
  816. $add_user = true;
  817. if (!empty($access_info)) {
  818. foreach ($access_info as $url_info) {
  819. if ($current_access_url_id == $url_info['access_url_id']) {
  820. $add_user = false;
  821. }
  822. $access_info_to_string .= $url_info['url'].'<br />';
  823. }
  824. }
  825. if ($add_user) {
  826. $row_table = array();
  827. $row_table[] = api_get_person_name($user['firstname'], $user['lastname']).' ('.$user['username'].') ';
  828. $row_table[] = $access_info_to_string;
  829. $url = api_get_self().'?action=add_user_to_my_url&user_id='.$user['id'].'&sec_token='.$_SESSION['sec_token'];
  830. $row_table[] = Display::url(get_lang('AddUserToMyURL'), $url, array('class' => 'btn'));
  831. foreach ($row_table as $cell) {
  832. $table->setCellContents($row, $column, $cell);
  833. $table->updateCellAttributes($row, $column, 'align="center"');
  834. $column++;
  835. }
  836. $table->updateRowAttributes($row, $row % 2 ? 'class="row_even"' : 'class="row_odd"', true);
  837. $row++;
  838. }
  839. }
  840. $extra_search_options .= $table->toHtml();
  841. $table_result = '';
  842. }
  843. }
  844. }
  845. $toolbarActions = Display::toolbarAction(
  846. 'toolbarUser',
  847. array($actionsLeft, $actionsCenter, $actionsRight),
  848. 3
  849. );
  850. $tpl = new Template($tool_name);
  851. $tpl->assign('actions', $toolbarActions);
  852. $tpl->assign('message', $message);
  853. $tpl->assign('content', $form.$table_result.$extra_search_options);
  854. $tpl->display_one_col_template();