19 * along with this program. If not, see <http://www.gnu.org/licenses/>. |
19 * along with this program. If not, see <http://www.gnu.org/licenses/>. |
20 */ |
20 */ |
21 |
21 |
22 require_once("inc/toolkit.inc.php"); |
22 require_once("inc/toolkit.inc.php"); |
23 |
23 |
|
24 |
|
25 /* |
|
26 * Function to see if user has right to do something. It will check if |
|
27 * user has "ueberuser" bit set. If it isn't, it will check if the user has |
|
28 * the specific permission. It returns "false" if the user doesn't have the |
|
29 * right, and "true" if the user has. |
|
30 */ |
|
31 |
|
32 function verify_permission($permission) { |
|
33 |
|
34 global $db; |
|
35 |
|
36 if ((!isset($_SESSION['userid'])) || (!is_object($db))) { |
|
37 return 0; |
|
38 } |
|
39 |
|
40 // Set current user ID. |
|
41 $userid=$_SESSION['userid']; |
|
42 |
|
43 // Find the template ID that this user has been assigned. |
|
44 $query = "SELECT perm_templ |
|
45 FROM users |
|
46 WHERE id = " . $db->quote($userid) ; |
|
47 $templ_id = $db->queryOne($query); |
|
48 |
|
49 // Does this user have ueberuser rights? |
|
50 $query = "SELECT id |
|
51 FROM perm_templ_items |
|
52 WHERE templ_id = " . $db->quote($templ_id) . " |
|
53 AND perm_id = '53'"; |
|
54 $result = $db->query($query); |
|
55 if ( $result->numRows() > 0 ) { |
|
56 return 1; |
|
57 } |
|
58 |
|
59 // Find the permission ID for the requested permission. |
|
60 $query = "SELECT id |
|
61 FROM perm_items |
|
62 WHERE name = " . $db->quote($permission) ; |
|
63 $perm_id = $db->queryOne($query); |
|
64 |
|
65 // Check if the permission ID is assigned to the template ID. |
|
66 $query = "SELECT id |
|
67 FROM perm_templ_items |
|
68 WHERE templ_id = " . $db->quote($templ_id) . " |
|
69 AND perm_id = " . $db->quote($perm_id) ; |
|
70 $result = $db->query($query); |
|
71 if ( $result->numRows() > 0 ) { |
|
72 return 1; |
|
73 } else { |
|
74 return 0; |
|
75 } |
|
76 } |
|
77 |
|
78 function list_permission_templates() { |
|
79 global $db; |
|
80 $query = "SELECT * FROM perm_templ"; |
|
81 $result = $db->query($query); |
|
82 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
83 |
|
84 $template_list = array(); |
|
85 while ($template= $result->fetchRow()) { |
|
86 $tempate_list[] = array( |
|
87 "id" => $template['id'], |
|
88 "name" => $template['name'], |
|
89 "descr" => $template['descr'] |
|
90 ); |
|
91 } |
|
92 return $tempate_list; |
|
93 } |
|
94 |
24 /* |
95 /* |
25 * Retrieve all users. |
96 * Retrieve all users. |
26 * Its to show_users therefore the odd name. Has to be changed. |
97 * Its to show_users therefore the odd name. Has to be changed. |
27 * return values: an array with all users in it. |
98 * return values: an array with all users in it. |
28 */ |
99 */ |
149 error(ERR_UNKNOWN); |
193 error(ERR_UNKNOWN); |
150 } |
194 } |
151 } |
195 } |
152 |
196 |
153 |
197 |
154 /* |
|
155 * Get all user info for the given user in an array. |
|
156 * return values: the database style array with the information about the user. |
|
157 */ |
|
158 function get_user_info($id) |
|
159 { |
|
160 global $db; |
|
161 if (is_numeric($id)) |
|
162 { |
|
163 $result = $db->query("SELECT id, username, fullname, email, description, level, active from users where id=".$db->quote($id)); |
|
164 $r = $result->fetchRow(); |
|
165 return $r; |
|
166 } |
|
167 else |
|
168 { |
|
169 error(sprintf(ERR_INV_ARGC,"get_user_info", "you gave illegal arguments: $id")); |
|
170 } |
|
171 } |
|
172 |
|
173 |
198 |
174 /* |
199 /* |
175 * Delete a user from the system |
200 * Delete a user from the system |
176 * return values: true if user doesnt exist. |
201 * return values: true if user doesnt exist. |
177 */ |
202 */ |
178 function delete_user($id) |
203 function delete_user($uid,$zones) |
179 { |
204 { |
180 global $db; |
205 global $db; |
181 if (!level(10)) |
206 |
182 { |
207 if (($uid != $_SESSION['userid'] && !verify_permission(user_edit_others)) || ($uid == $_SESSION['userid'] && !verify_permission(user_edit_own))) { |
183 error(ERR_LEVEL_10); |
208 error(ERR_PERM_DEL_USER); |
184 } |
209 return false; |
185 if (is_numeric($id)) |
210 } else { |
186 { |
211 |
187 $db->query("DELETE FROM users WHERE id=".$db->quote($id)); |
212 if (is_array($zones)) { |
188 $db->query("DELETE FROM zones WHERE owner=".$db->quote($id)); |
213 foreach ($zones as $zone) { |
189 return true; |
214 if ($zone['target'] == "delete") { |
190 // No need to check the affected rows. If the affected rows would be 0, |
215 delete_domain($zone['zid']); |
191 // the user isnt in the dbase, just as we want. |
216 } elseif ($zone['target'] == "new_owner") { |
192 } |
217 add_owner_to_zone($zone['zid'], $zone['newowner']); |
193 else |
218 } |
194 { |
219 } |
195 error(ERR_INV_ARG); |
220 } |
196 } |
221 |
197 } |
222 $query = "DELETE FROM zones WHERE owner = " . $db->quote($uid) ; |
198 |
223 $result = $db->query($query); |
199 |
224 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
200 /* |
225 |
201 * Adds a user to the system. |
226 $query = "DELETE FROM users WHERE id = " . $db->quote($uid) ; |
202 * return values: true if succesfully added. |
227 $result = $db->query($query); |
203 */ |
228 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
204 function add_user($user, $password, $fullname, $email, $level, $description, $active) |
229 } |
205 { |
230 return true; |
206 global $db; |
|
207 if (!level(10)) |
|
208 { |
|
209 error(ERR_LEVEL_10); |
|
210 } |
|
211 if (!user_exists($user)) |
|
212 { |
|
213 if (!is_valid_email($email)) |
|
214 { |
|
215 error(ERR_INV_EMAIL); |
|
216 } |
|
217 if ($active != 1) { |
|
218 $active = 0; |
|
219 } |
|
220 $db->query("INSERT INTO users (username, password, fullname, email, description, level, active) VALUES (".$db->quote($user).", '" . md5($password) . "', ".$db->quote($fullname).", ".$db->quote($email).", ".$db->quote($description).", ".$db->quote($level).", ".$db->quote($active).")"); |
|
221 return true; |
|
222 } |
|
223 else |
|
224 { |
|
225 error(ERR_USER_EXISTS); |
|
226 } |
|
227 } |
231 } |
228 |
232 |
229 |
233 |
230 /* |
234 /* |
231 * Edit the information of an user.. sloppy implementation with too many queries.. (2) :) |
235 * Edit the information of an user.. sloppy implementation with too many queries.. (2) :) |
232 * return values: true if succesful |
236 * return values: true if succesful |
233 */ |
237 */ |
234 function edit_user($id, $user, $fullname, $email, $level, $description, $active, $password) |
238 function edit_user($id, $user, $fullname, $email, $perm_templ, $description, $active, $password) |
235 { |
239 { |
236 global $db; |
240 global $db; |
237 if(!level(10)) { |
241 |
238 error(ERR_LEVEL_10); |
242 verify_permission(user_edit_own) ? $perm_edit_own = "1" : $perm_edit_own = "0" ; |
239 } |
243 verify_permission(user_edit_others) ? $perm_edit_others = "1" : $perm_edit_others = "0" ; |
240 |
244 |
241 if (!is_valid_email($email)) |
245 if (($id == $_SESSION["userid"] && $perm_edit_own == "1") || ($id != $_SESSION["userid"] && $perm_edit_others == "1" )) { |
242 { |
246 |
243 error(ERR_INV_EMAIL); |
247 if (!is_valid_email($email)) { |
244 } |
248 error(ERR_INV_EMAIL); |
245 if ($active != 1) { |
249 return false; |
246 $active = 0; |
250 } |
247 } |
251 |
248 $sqlquery = "UPDATE users set username=".$db->quote($user).", fullname=".$db->quote($fullname).", email=".$db->quote($email).", level=".$db->quote($level).", description=".$db->quote($description).", active=".$db->quote($active); |
252 if ($active != 1) { |
249 |
253 $active = 0; |
250 if($password != "") |
254 } |
251 { |
255 |
252 $sqlquery .= ", password= '" . md5($password) . "' "; |
256 // Before updating the database we need to check whether the user wants to |
253 } |
257 // change the username. If the user wants to change the username, we need |
254 |
258 // to make sure it doesn't already exists. |
255 $sqlquery .= " WHERE id=".$db->quote($id) ; |
259 // |
256 |
260 // First find the current username of the user ID we want to change. If the |
257 // Search the username that right now goes with this ID. |
261 // current username is not the same as the username that was given by the |
258 $result = $db->query("SELECT username from users where id=".$db->quote($id)); |
262 // user, the username should apparantly changed. If so, check if the "new" |
259 $r = array(); |
263 // username already exists. |
260 $r = $result->fetchRow(); |
264 |
261 |
265 $query = "SELECT username FROM users WHERE id = " . $db->quote($id); |
262 // If the found username with this ID is the given username with the command.. execute. |
266 $result = $db->query($query); |
263 |
267 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
264 if($r["username"] == $user) |
268 |
265 { |
269 $usercheck = array(); |
266 $db->query($sqlquery); |
270 $usercheck = $result->fetchRow(); |
267 return true; |
271 |
268 } |
272 if ($usercheck['username'] != $user) { |
269 |
273 |
270 // Its not.. so the user wants to change. |
274 // Username of user ID in the database is different from the name |
271 // Find if there is an id that has the wished username. |
275 // we have been given. User wants a change of username. Now, make |
272 $otheruser = $db->query("SELECT id from users where username=".$db->query($user)); |
276 // sure it doesn't already exist. |
273 if($otheruser->numRows() > 0) |
277 |
274 { |
278 $query = "SELECT id FROM users WHERE username = " . $db->query($user); |
275 error(ERR_USER_EXIST); |
279 $result = $db->query($query); |
276 } |
280 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
277 |
281 |
278 // Its fine it seems.. :) |
282 if($result->numRows() > 0) { |
279 // Lets execute it. |
283 error(ERR_USER_EXIST); |
280 else |
284 return false; |
281 { |
285 } |
282 $db->query($sqlquery); |
286 } |
283 return true; |
287 |
284 } |
288 // So, user doesn't want to change username or, if he wants, there is not |
|
289 // another user that goes by the wanted username. So, go ahead! |
|
290 |
|
291 $query = "UPDATE users SET |
|
292 username = " . $db->quote($user) . ", |
|
293 fullname = " . $db->quote($fullname) . ", |
|
294 email = " . $db->quote($email) . ", |
|
295 perm_templ = " . $db->quote($perm_templ) . ", |
|
296 description = " . $db->quote($description) . ", |
|
297 active = " . $db->quote($active) ; |
|
298 |
|
299 if($password != "") { |
|
300 $query .= ", password = " . $db->quote(md5($password)) ; |
|
301 } |
|
302 |
|
303 $query .= " WHERE id = " . $db->quote($id) ; |
|
304 |
|
305 $result = $db->query($query); |
|
306 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
307 |
|
308 } else { |
|
309 error(ERR_PERM_EDIT_USER); |
|
310 return false; |
|
311 } |
|
312 return true; |
285 } |
313 } |
286 |
314 |
287 /* |
315 /* |
288 * Change the pass of the user. |
316 * Change the pass of the user. |
289 * The user is automatically logged out after the pass change. |
317 * The user is automatically logged out after the pass change. |
290 * return values: none. |
318 * return values: none. |
291 */ |
319 */ |
292 function change_user_pass($currentpass, $newpass, $newpass2) |
320 function change_user_pass($details) { |
293 { |
321 global $db; |
294 global $db; |
322 |
295 |
323 if ($details['newpass'] != $details['newpass2']) { |
296 // Check if the passwords are equal. |
|
297 if($newpass != $newpass2) |
|
298 { |
|
299 error(ERR_USER_MATCH_NEW_PASS); |
324 error(ERR_USER_MATCH_NEW_PASS); |
300 } |
325 return false; |
301 |
326 } |
302 // Retrieve the users password. |
327 |
303 $result = $db->query("SELECT password, id FROM users WHERE username=".$db->quote($_SESSION["userlogin"])); |
328 $query = "SELECT id, password FROM users WHERE username = " . $db->quote($_SESSION["userlogin"]); |
|
329 $result = $db->query($query); |
|
330 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
331 |
304 $rinfo = $result->fetchRow(); |
332 $rinfo = $result->fetchRow(); |
305 |
333 |
306 // Check the current password versus the database password and execute the update. |
334 if(md5($details['currentpass']) == $rinfo['password']) { |
307 if(md5($currentpass) == $rinfo["password"]) |
335 $query = "UPDATE users SET password = " . $db->quote(md5($details['newpass'])) . " WHERE id = " . $db->quote($rinfo['id']) ; |
308 { |
336 $result = $db->query($query); |
309 $sqlquery = "update users set password='" . md5($newpass) . "' where id='" . $rinfo["id"] . "'"; |
337 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
310 $db->query($sqlquery); |
338 |
311 |
339 logout( _('Password has been changed, please login.')); |
312 // Logout the user. |
340 } else { |
313 logout("Pass changed please re-login"); |
|
314 } |
|
315 else |
|
316 { |
|
317 error(ERR_USER_WRONG_CURRENT_PASS); |
341 error(ERR_USER_WRONG_CURRENT_PASS); |
|
342 return false; |
318 } |
343 } |
319 } |
344 } |
320 |
345 |
321 |
346 |
322 /* |
347 /* |
323 * Get a fullname when you have a userid. |
348 * Get a fullname when you have a userid. |
324 * return values: gives the fullname from a userid. |
349 * return values: gives the fullname from a userid. |
325 */ |
350 */ |
326 function get_fullname_from_userid($id) |
351 function get_fullname_from_userid($id) { |
327 { |
352 global $db; |
328 global $db; |
353 if (is_numeric($id)) { |
329 if (is_numeric($id)) |
|
330 { |
|
331 $result = $db->query("SELECT fullname FROM users WHERE id=".$db->quote($id)); |
354 $result = $db->query("SELECT fullname FROM users WHERE id=".$db->quote($id)); |
332 $r = $result->fetchRow(); |
355 $r = $result->fetchRow(); |
333 return $r["fullname"]; |
356 return $r["fullname"]; |
334 } |
357 } else { |
335 else |
|
336 { |
|
337 error(ERR_INV_ARG); |
358 error(ERR_INV_ARG); |
|
359 return false; |
338 } |
360 } |
339 } |
361 } |
340 |
362 |
341 |
363 |
342 /* |
364 /* |
390 } |
412 } |
391 } |
413 } |
392 error(ERR_INV_ARG); |
414 error(ERR_INV_ARG); |
393 } |
415 } |
394 |
416 |
|
417 |
|
418 |
|
419 function verify_user_is_owner_zoneid($zoneid) { |
|
420 global $db; |
|
421 |
|
422 $userid=$_SESSION["userid"]; |
|
423 |
|
424 if (is_numeric($zoneid)) { |
|
425 $result = $db->query("SELECT zones.id |
|
426 FROM zones |
|
427 WHERE zones.owner = " . $db->quote($userid) . " |
|
428 AND zones.domain_id = ". $db->quote($zoneid)) ; |
|
429 if ($result->numRows() == 0) { |
|
430 return "0"; |
|
431 } else { |
|
432 return "1"; |
|
433 } |
|
434 } |
|
435 error(ERR_INV_ARG); |
|
436 } |
|
437 |
|
438 |
|
439 function get_user_detail_list($specific) { |
|
440 |
|
441 global $db; |
|
442 $userid=$_SESSION['userid']; |
|
443 |
|
444 |
|
445 if (v_num($specific)) { |
|
446 $sql_add = "AND users.id = " . $db->quote($specific) ; |
|
447 } else { |
|
448 if (verify_permission(user_view_others)) { |
|
449 $sql_add = ""; |
|
450 } else { |
|
451 $sql_add = "AND users.id = " . $db->quote($userid) ; |
|
452 } |
|
453 } |
|
454 |
|
455 $query = "SELECT users.id AS uid, |
|
456 username, |
|
457 fullname, |
|
458 email, |
|
459 description AS descr, |
|
460 active, |
|
461 perm_templ.id AS tpl_id, |
|
462 perm_templ.name AS tpl_name, |
|
463 perm_templ.descr AS tpl_descr |
|
464 FROM users, perm_templ |
|
465 WHERE users.perm_templ = perm_templ.id " |
|
466 . $sql_add . " |
|
467 ORDER BY username"; |
|
468 |
|
469 $result = $db->query($query); |
|
470 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
471 |
|
472 while ($user = $result->fetchRow()) { |
|
473 $userlist[] = array( |
|
474 "uid" => $user['uid'], |
|
475 "username" => $user['username'], |
|
476 "fullname" => $user['fullname'], |
|
477 "email" => $user['email'], |
|
478 "descr" => $user['descr'], |
|
479 "active" => $user['active'], |
|
480 "tpl_id" => $user['tpl_id'], |
|
481 "tpl_name" => $user['tpl_name'], |
|
482 "tpl_descr" => $user['tpl_descr'] |
|
483 ); |
|
484 } |
|
485 return $userlist; |
|
486 } |
|
487 |
|
488 |
|
489 // Get a list of permissions that are available. If first argument is "0", it |
|
490 // should return all available permissions. If the first argument is > "0", it |
|
491 // should return the permissions assigned to that particular template only. If |
|
492 // second argument is true, only the permission names are returned. |
|
493 |
|
494 function get_permissions_by_template_id($templ_id=0,$return_name_only=false) { |
|
495 global $db; |
|
496 |
|
497 if ($templ_id > 0) { |
|
498 $limit = ", perm_templ_items |
|
499 WHERE perm_templ_items.templ_id = " . $db->quote($templ_id) . " |
|
500 AND perm_templ_items.perm_id = perm_items.id"; |
|
501 } |
|
502 |
|
503 $query = "SELECT perm_items.id AS id, |
|
504 perm_items.name AS name, |
|
505 perm_items.descr AS descr |
|
506 FROM perm_items" |
|
507 . $limit . " |
|
508 ORDER BY descr"; |
|
509 $result = $db->query($query); |
|
510 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
511 |
|
512 $permission_list = array(); |
|
513 while ($permission = $result->fetchRow()) { |
|
514 if ($return_name_only == false) { |
|
515 $permission_list[] = array( |
|
516 "id" => $permission['id'], |
|
517 "name" => $permission['name'], |
|
518 "descr" => $permission['descr'] |
|
519 ); |
|
520 } else { |
|
521 $permission_list[] = $permission['name']; |
|
522 } |
|
523 } |
|
524 return $permission_list; |
|
525 } |
|
526 |
|
527 |
|
528 // Get name and description of template based on template ID. |
|
529 |
|
530 function get_permission_template_details($templ_id) { |
|
531 global $db; |
|
532 |
|
533 $query = "SELECT * |
|
534 FROM perm_templ |
|
535 WHERE perm_templ.id = " . $db->quote($templ_id); |
|
536 |
|
537 $result = $db->query($query); |
|
538 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
539 |
|
540 while($details = $result->fetchRow()) { |
|
541 $detail_list[] = array ( |
|
542 "name" => $details['name'], |
|
543 "descr" => $details['descr'] |
|
544 ); |
|
545 } |
|
546 return $detail_list; |
|
547 } |
|
548 |
|
549 |
|
550 // Get a list of all available permission templates. |
|
551 |
|
552 function get_list_permission_templates() { |
|
553 global $db; |
|
554 |
|
555 $query = "SELECT * FROM perm_templ"; |
|
556 $result = $db->query($query); |
|
557 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
558 |
|
559 $perm_templ_list = array(); |
|
560 while ($perm_templ = $result->fetchRow()) { |
|
561 $perm_templ_list[] = array( |
|
562 "id" => $perm_templ['id'], |
|
563 "name" => $perm_templ['name'], |
|
564 "descr" => $perm_templ['descr'] |
|
565 ); |
|
566 } |
|
567 return $perm_templ_list; |
|
568 } |
|
569 |
|
570 |
|
571 // Update all details of a permission template. |
|
572 |
|
573 function update_perm_templ_details($details) { |
|
574 global $db; |
|
575 |
|
576 // Fix permission template name and description first. |
|
577 |
|
578 $query = "UPDATE perm_templ |
|
579 SET name = " . $db->quote($details['templ_name']) . ", |
|
580 descr = " . $db->quote($details['templ_descr']) . " |
|
581 WHERE id = " . $db->quote($details['templ_id']) ; |
|
582 |
|
583 $result = $db->query($query); |
|
584 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
585 |
|
586 // Now, update list of permissions assigned to this template. We could do |
|
587 // this The Correct Way [tm] by comparing the list of permissions that are |
|
588 // currently assigned with a list of permissions that should be assigned and |
|
589 // apply the difference between these two lists to the database. That sounds |
|
590 // like to much work. Just delete all the permissions currently assigned to |
|
591 // the template, than assign all the permessions the template should have. |
|
592 |
|
593 $query = "DELETE FROM perm_templ_items WHERE templ_id = " . $details['templ_id'] ; |
|
594 $result = $db->query($query); |
|
595 if (pear::iserror($response)) { error($response->getmessage()); return false; } |
|
596 |
|
597 foreach ($details['perm_id'] AS $perm_id) { |
|
598 $r_insert_values[] = "(''," . $db->quote($details['templ_id']) . "," . $db->quote($perm_id) . ")"; |
|
599 } |
|
600 $query = "INSERT INTO perm_templ_items VALUES " . implode(',', $r_insert_values) ; |
|
601 $result = $db->query($query); |
|
602 if (pear::iserror($response)) { error($response->getmessage()); return false; } |
|
603 |
|
604 return true; |
|
605 } |
|
606 |
|
607 function update_user_details($details) { |
|
608 |
|
609 global $db; |
|
610 |
|
611 verify_permission(user_edit_own) ? $perm_edit_own = "1" : $perm_edit_own = "0" ; |
|
612 verify_permission(user_edit_others) ? $perm_edit_others = "1" : $perm_edit_others = "0" ; |
|
613 |
|
614 if (($details['uid'] == $_SESSION["userid"] && $perm_edit_own == "1") || |
|
615 ($details['uid'] != $_SESSION["userid"] && $perm_edit_others == "1" )) { |
|
616 |
|
617 if (!is_valid_email($details['email'])) { |
|
618 error(ERR_INV_EMAIL); |
|
619 return false; |
|
620 } |
|
621 |
|
622 if (!isset($details['active']) || $details['active'] != "on" ) { |
|
623 $active = 0; |
|
624 } else { |
|
625 $active = 1; |
|
626 } |
|
627 |
|
628 // Before updating the database we need to check whether the user wants to |
|
629 // change the username. If the user wants to change the username, we need |
|
630 // to make sure it doesn't already exists. |
|
631 // |
|
632 // First find the current username of the user ID we want to change. If the |
|
633 // current username is not the same as the username that was given by the |
|
634 // user, the username should apparantly changed. If so, check if the "new" |
|
635 // username already exists. |
|
636 $query = "SELECT username FROM users WHERE id = " . $db->quote($details['uid']); |
|
637 $result = $db->query($query); |
|
638 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
639 |
|
640 $usercheck = array(); |
|
641 $usercheck = $result->fetchRow(); |
|
642 |
|
643 if ($usercheck['username'] != $details['username']) { |
|
644 // Username of user ID in the database is different from the name |
|
645 // we have been given. User wants a change of username. Now, make |
|
646 // sure it doesn't already exist. |
|
647 $query = "SELECT id FROM users WHERE username = " . $db->quote($details['username']); |
|
648 $result = $db->query($query); |
|
649 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
650 |
|
651 if($result->numRows() > 0) { |
|
652 error(ERR_USER_EXIST); |
|
653 return false; |
|
654 } |
|
655 } |
|
656 |
|
657 // So, user doesn't want to change username or, if he wants, there is not |
|
658 // another user that goes by the wanted username. So, go ahead! |
|
659 |
|
660 $query = "UPDATE users SET |
|
661 username = " . $db->quote($details['username']) . ", |
|
662 fullname = " . $db->quote($details['fullname']) . ", |
|
663 email = " . $db->quote($details['email']) . ", |
|
664 perm_templ = " . $db->quote($details['templ_id']) . ", |
|
665 description = " . $db->quote($details['descr']) . ", |
|
666 active = " . $db->quote($active) ; |
|
667 |
|
668 // TODO Check if function works if password is set too. |
|
669 if($details['password'] != "") { |
|
670 $query .= ", password = '" . md5($db->quote($details['password'])) . "' "; |
|
671 } |
|
672 |
|
673 $query .= " WHERE id = " . $db->quote($details['uid']) ; |
|
674 |
|
675 $result = $db->query($query); |
|
676 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
677 |
|
678 } else { |
|
679 error(ERR_PERM_EDIT_USER); |
|
680 return false; |
|
681 } |
|
682 return true; |
|
683 } |
|
684 |
|
685 // Add a new user |
|
686 |
|
687 function add_new_user($details) { |
|
688 global $db; |
|
689 |
|
690 if (!verify_permission(user_add_new)) { |
|
691 error(ERR_PERM_ADD_USER); |
|
692 |
|
693 } elseif (user_exists($details['username'])) { |
|
694 error(ERR_USER_EXISTS); |
|
695 |
|
696 } elseif (!is_valid_email($details['email'])) { |
|
697 error(ERR_INV_EMAIL); |
|
698 |
|
699 } elseif ($details['active'] == 1) { |
|
700 $active = 1; |
|
701 } else { |
|
702 $active = 0; |
|
703 } |
|
704 |
|
705 $query = "INSERT INTO users VALUES ( " |
|
706 . "'', " |
|
707 . $db->quote($details['username']) . ", " |
|
708 . $db->quote(md5($details['password'])) . ", " |
|
709 . $db->quote($details['fullname']) . ", " |
|
710 . $db->quote($details['email']) . ", " |
|
711 . $db->quote($details['descr']) . ", " |
|
712 . $db->quote($details['perm_templ']) . ", " |
|
713 . $db->quote($active) |
|
714 . ")"; |
|
715 |
|
716 $result = $db->query($query); |
|
717 if (PEAR::isError($response)) { error($response->getMessage()); return false; } |
|
718 |
|
719 return true; |
|
720 } |
|
721 |
|
722 |
|
723 |
395 ?> |
724 ?> |