usermanager.lib.php 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319
  1. <?php
  2. /*
  3. ==============================================================================
  4. Dokeos - elearning and course management software
  5. Copyright (c) 2004 Dokeos S.A.
  6. Copyright (c) 2003 Ghent University (UGent)
  7. Copyright (c) 2001 Universite catholique de Louvain (UCL)
  8. Copyright (c) various contributors
  9. Copyright (c) Bart Mollet, Hogeschool Gent
  10. For a full list of contributors, see "credits.txt".
  11. The full license can be read in "license.txt".
  12. This program is free software; you can redistribute it and/or
  13. modify it under the terms of the GNU General Public License
  14. as published by the Free Software Foundation; either version 2
  15. of the License, or (at your option) any later version.
  16. See the GNU General Public License for more details.
  17. Contact: Dokeos, 181 rue Royale, B-1000 Brussels, Belgium, info@dokeos.com
  18. ==============================================================================
  19. */
  20. /**
  21. ==============================================================================
  22. * This library provides functions for user management.
  23. * Include/require it in your code to use its functionality.
  24. *
  25. * @package dokeos.library
  26. ==============================================================================
  27. */
  28. class UserManager
  29. {
  30. /**
  31. * Creates a new user for the platform
  32. * @author Hugues Peeters <peeters@ipm.ucl.ac.be>,
  33. * Roan Embrechts <roan_embrechts@yahoo.com>
  34. *
  35. * @param string $firstName
  36. * string $lastName
  37. * int $status
  38. * string $email
  39. * string $loginName
  40. * string $password
  41. * string $official_code (optional)
  42. * string $phone (optional)
  43. * string $picture_uri (optional)
  44. * string $auth_source (optional)
  45. *
  46. * @return int new user id - if the new user creation succeeds
  47. * boolean false otherwise
  48. *
  49. * @desc The function tries to retrieve $_user['user_id'] from the global space.
  50. * if it exists, $_user['user_id'] is the creator id If a problem arises,
  51. * it stores the error message in global $api_failureList
  52. *
  53. * @todo Add the user language to the parameters
  54. */
  55. function create_user($firstName, $lastName, $status, $email, $loginName, $password, $official_code = '', $language="english", $phone = '', $picture_uri = '', $auth_source = PLATFORM_AUTH_SOURCE, $expiration_date = '0000-00-00 00:00:00', $active = 1)
  56. {
  57. global $_user, $userPasswordCrypted;
  58. $table_user = Database::get_main_table(TABLE_MAIN_USER);
  59. if ($_user['user_id'])
  60. {
  61. $creator_id = $_user['user_id'];
  62. }
  63. else
  64. {
  65. $creator_id = '';
  66. }
  67. // First check wether the login already exists
  68. if (! UserManager::is_username_available($loginName))
  69. return api_set_failure('login-pass already taken');
  70. //$password = "PLACEHOLDER";
  71. $password = ($userPasswordCrypted ? md5($password) : $password);
  72. $sql = "INSERT INTO $table_user
  73. SET lastname = '".mysql_real_escape_string($lastName)."',
  74. firstname = '".mysql_real_escape_string($firstName)."',
  75. username = '".mysql_real_escape_string($loginName)."',
  76. status = '".mysql_real_escape_string($status)."',
  77. password = '".mysql_real_escape_string($password)."',
  78. email = '".mysql_real_escape_string($email)."',
  79. official_code = '".mysql_real_escape_string($official_code)."',
  80. picture_uri = '".mysql_real_escape_string($picture_uri)."',
  81. creator_id = '".mysql_real_escape_string($creator_id)."',
  82. auth_source = '".mysql_real_escape_string($auth_source)."',
  83. phone = '".mysql_real_escape_string($phone)."',
  84. language = '".mysql_real_escape_string($language)."',
  85. registration_date = now(),
  86. expiration_date = '".mysql_real_escape_string($expiration_date)."',
  87. active = '".mysql_real_escape_string($active)."'";
  88. $result = api_sql_query($sql);
  89. if ($result)
  90. {
  91. //echo "id returned";
  92. return mysql_insert_id();
  93. }
  94. else
  95. {
  96. //echo "false - failed" ;
  97. return false;
  98. }
  99. }
  100. /**
  101. * Can user be deleted?
  102. * This functions checks if there's a course in which the given user is the
  103. * only course administrator. If that is the case, the user can't be
  104. * deleted because the course would remain without a course admin.
  105. * @param int $user_id The user id
  106. * @return boolean true if user can be deleted
  107. */
  108. function can_delete_user($user_id)
  109. {
  110. $table_course_user = Database :: get_main_table(TABLE_MAIN_COURSE_USER);
  111. $sql = "SELECT * FROM $table_course_user WHERE status = '1' AND user_id = '".$user_id."'";
  112. $res = api_sql_query($sql,__FILE__,__LINE__);
  113. while ($course = mysql_fetch_object($res))
  114. {
  115. $sql = "SELECT user_id FROM $table_course_user WHERE status='1' AND course_code ='".$course->course_code."'";
  116. $res2 = api_sql_query($sql,__FILE__,__LINE__);
  117. if (mysql_num_rows($res2) == 1)
  118. {
  119. return false;
  120. }
  121. }
  122. return true;
  123. }
  124. /**
  125. * Delete a user from the platform
  126. * @param int $user_id The user id
  127. * @return boolean true if user is succesfully deleted, false otherwise
  128. */
  129. function delete_user($user_id)
  130. {
  131. if (!UserManager :: can_delete_user($user_id))
  132. {
  133. return false;
  134. }
  135. $table_user = Database :: get_main_table(TABLE_MAIN_USER);
  136. $table_course_user = Database :: get_main_table(TABLE_MAIN_COURSE_USER);
  137. $table_class_user = Database :: get_main_table(TABLE_MAIN_CLASS_USER);
  138. $table_course = Database :: get_main_table(TABLE_MAIN_COURSE);
  139. $table_admin = Database :: get_main_table(TABLE_MAIN_ADMIN);
  140. // Unsubscribe the user from all groups in all his courses
  141. $sql = "SELECT * FROM $table_course c, $table_course_user cu WHERE cu.user_id = '".$user_id."' AND c.code = cu.course_code";
  142. $res = api_sql_query($sql,__FILE__,__LINE__);
  143. while ($course = mysql_fetch_object($res))
  144. {
  145. $table_group = Database :: get_course_table(TABLE_GROUP_USER, $course->db_name);
  146. $sql = "DELETE FROM $table_group WHERE user_id = '".$user_id."'";
  147. api_sql_query($sql,__FILE__,__LINE__);
  148. }
  149. // Unsubscribe user from all classes
  150. $sql = "DELETE FROM $table_class_user WHERE user_id = '".$user_id."'";
  151. api_sql_query($sql,__FILE__,__LINE__);
  152. // Unsubscribe user from all courses
  153. $sql = "DELETE FROM $table_course_user WHERE user_id = '".$user_id."'";
  154. api_sql_query($sql,__FILE__,__LINE__);
  155. // Delete user picture
  156. $user_info = api_get_user_info($user_id);
  157. if(strlen($user_info['picture_uri']) > 0)
  158. {
  159. $img_path = api_get_path(SYS_CODE_PATH).'upload/users/'.$user_info['picture_uri'];
  160. unlink($img_path);
  161. }
  162. // Delete the personal course categories
  163. $course_cat_table = Database::get_user_personal_table(TABLE_USER_COURSE_CATEGORY);
  164. $sql = "DELETE FROM $course_cat_table WHERE user_id = '".$user_id."'";
  165. api_sql_query($sql,__FILE__,__LINE__);
  166. // Delete user from database
  167. $sql = "DELETE FROM $table_user WHERE user_id = '".$user_id."'";
  168. api_sql_query($sql,__FILE__,__LINE__);
  169. // Delete user from the admin table
  170. $sql = "DELETE FROM $table_admin WHERE user_id = '".$user_id."'";
  171. api_sql_query($sql,__FILE__,__LINE__);
  172. // Delete the personal agenda-items from this user
  173. $agenda_table = Database :: get_user_personal_table(TABLE_PERSONAL_AGENDA);
  174. $sql = "DELETE FROM $agenda_table WHERE user = '".$user_id."'";
  175. api_sql_query($sql,__FILE__,__LINE__);
  176. return true;
  177. }
  178. /**
  179. * Update user information
  180. * @param int $user_id
  181. * @param string $firstname
  182. * @param string $lastname
  183. * @param string $username
  184. * @param string $password
  185. * @param string $auth_source
  186. * @param string $email
  187. * @param int $status
  188. * @param string $official_code
  189. * @param string $phone
  190. * @param string $picture_uri
  191. * @param int $creator_id
  192. * @return boolean true if the user information was updated
  193. */
  194. function update_user($user_id, $firstname, $lastname, $username, $password = null, $auth_source = null, $email, $status, $official_code, $phone, $picture_uri, $expiration_date, $active, $creator_id= null )
  195. {
  196. global $userPasswordCrypted;
  197. $table_user = Database :: get_main_table(TABLE_MAIN_USER);
  198. $sql = "UPDATE $table_user SET
  199. lastname='".mysql_real_escape_string($lastname)."',
  200. firstname='".mysql_real_escape_string($firstname)."',
  201. username='".mysql_real_escape_string($username)."',";
  202. if(!is_null($password))
  203. {
  204. $password = $userPasswordCrypted ? md5($password) : $password;
  205. $sql .= " password='".mysql_real_escape_string($password)."',";
  206. }
  207. if(!is_null($auth_source))
  208. {
  209. $sql .= " auth_source='".mysql_real_escape_string($auth_source)."',";
  210. }
  211. $sql .= "
  212. email='".mysql_real_escape_string($email)."',
  213. status='".mysql_real_escape_string($status)."',
  214. official_code='".mysql_real_escape_string($official_code)."',
  215. phone='".mysql_real_escape_string($phone)."',
  216. picture_uri='".mysql_real_escape_string($picture_uri)."',
  217. expiration_date='".mysql_real_escape_string($expiration_date)."',
  218. active='".mysql_real_escape_string($active)."'";
  219. if(!is_null($creator_id))
  220. {
  221. $sql .= ", creator_id='".mysql_real_escape_string($creator_id)."'";
  222. }
  223. $sql .= " WHERE user_id='$user_id'";
  224. return api_sql_query($sql,__FILE__,__LINE__);
  225. }
  226. /**
  227. * Check if a username is available
  228. * @param string the wanted username
  229. * @return boolean true if the wanted username is available
  230. */
  231. function is_username_available($username)
  232. {
  233. $table_user = Database :: get_main_table(TABLE_MAIN_USER);
  234. $sql = "SELECT username FROM $table_user WHERE username = '".addslashes($username)."'";
  235. $res = api_sql_query($sql,__FILE__,__LINE__);
  236. return mysql_num_rows($res) == 0;
  237. }
  238. /**
  239. * @return an array with all users of the platform.
  240. * @todo optional course code parameter, optional sorting parameters...
  241. * @deprecated This function isn't used anywhere in the code.
  242. */
  243. function get_user_list()
  244. {
  245. $user_table = Database :: get_main_table(TABLE_MAIN_USER);
  246. $sql_query = "SELECT * FROM $user_table";
  247. $sql_result = api_sql_query($sql_query,__FILE__,__LINE__);
  248. while ($result = mysql_fetch_array($sql_result))
  249. {
  250. $return_array[] = $result;
  251. }
  252. return $return_array;
  253. }
  254. /**
  255. * Get user information
  256. * @param string $username The username
  257. * @return array All user information as an associative array
  258. */
  259. function get_user_info($username)
  260. {
  261. $user_table = Database :: get_main_table(TABLE_MAIN_USER);
  262. $sql = "SELECT * FROM $user_table WHERE username='".$username."'";
  263. $res = api_sql_query($sql,__FILE__,__LINE__);
  264. $user = mysql_fetch_array($res,MYSQL_ASSOC);
  265. return $user;
  266. }
  267. /**
  268. * Get user information
  269. * @param string $id The id
  270. * @return array All user information as an associative array
  271. */
  272. function get_user_info_by_id($user_id)
  273. {
  274. $user_id = intval($user_id);
  275. $user_table = Database :: get_main_table(TABLE_MAIN_USER);
  276. $sql = "SELECT * FROM $user_table WHERE user_id=".$user_id;
  277. $res = api_sql_query($sql,__FILE__,__LINE__);
  278. $user = mysql_fetch_array($res,MYSQL_ASSOC);
  279. return $user;
  280. }
  281. //for survey
  282. function get_teacher_list($course_id, $sel_teacher='')
  283. {
  284. $user_course_table = Database :: get_main_table(TABLE_MAIN_COURSE_USER);
  285. $user_table = Database :: get_main_table(TABLE_MAIN_USER);
  286. $sql_query = "SELECT * FROM $user_table a, $user_course_table b where a.user_id=b.user_id AND b.status=1 AND b.course_code='$course_id'";
  287. $sql_result = api_sql_query($sql_query,__FILE__,__LINE__);
  288. echo "<select name=\"author\">";
  289. while ($result = mysql_fetch_array($sql_result))
  290. {
  291. if($sel_teacher==$result[user_id]) $selected ="selected";
  292. echo "\n<option value=\"".$result[user_id]."\" $selected>".$result[firstname]."</option>";
  293. }
  294. echo "</select>";
  295. }
  296. }
  297. ?>