includes/SpecialUserrights.php

   1 <?php
   2
   3 /**
   4  * Special page to allow managing user group membership
   5  *
   6  * @addtogroup SpecialPage
   7  * @todo This code is disgusting and needs a total rewrite
   8  */
   9
  10 /** */
  11 require_once( dirname(__FILE__) . '/HTMLForm.php');
  12
  13 /** Entry point */
  14 function wfSpecialUserrights() {
  15         global $wgRequest;
  16         $form = new UserrightsForm($wgRequest);
  17         $form->execute();
  18 }
  19
  20 /**
  21  * A class to manage user levels rights.
  22  * @addtogroup SpecialPage
  23  */
  24 class UserrightsForm extends HTMLForm {
  25         var $mPosted, $mRequest, $mSaveprefs;
  26         /** Escaped local url name*/
  27         var $action;
  28
  29         /** Constructor*/
  30         public function __construct( &$request ) {
  31                 $this->mPosted = $request->wasPosted();
  32                 $this->mRequest =& $request;
  33                 $this->mName = 'userrights';
  34
  35                 $titleObj = SpecialPage::getTitleFor( 'Userrights' );
  36                 $this->action = $titleObj->escapeLocalURL();
  37         }
  38
  39         /**
  40          * Manage forms to be shown according to posted data.
  41          * Depending on the submit button used, call a form or a save function.
  42          */
  43         function execute() {
  44                 // show the general form
  45                 $this->switchForm();
  46                 if( $this->mPosted ) {
  47                         // show some more forms
  48                         if( $this->mRequest->getCheck( 'ssearchuser' ) ) {
  49                                 $this->editUserGroupsForm( $this->mRequest->getVal( 'user-editname' ) );
  50                         }
  51
  52                         // save settings
  53                         if( $this->mRequest->getCheck( 'saveusergroups' ) ) {
  54                                 global $wgUser;
  55                                 $username = $this->mRequest->getVal( 'user-editname' );
  56                                 $reason = $this->mRequest->getVal( 'user-reason' );
  57                                 if( $wgUser->matchEditToken( $this->mRequest->getVal( 'wpEditToken' ), $username ) ) {
  58                                         $this->saveUserGroups( $username,
  59                                                 $this->mRequest->getArray( 'member' ),
  60                                                 $this->mRequest->getArray( 'available' ),
  61                                                 $reason );
  62                                 }
  63                         }
  64                 }
  65         }
  66
  67         /**
  68          * Save user groups changes in the database.
  69          * Data comes from the editUserGroupsForm() form function
  70          *
  71          * @param string $username Username to apply changes to.
  72          * @param array $removegroup id of groups to be removed.
  73          * @param array $addgroup id of groups to be added.
  74          * @param string $reason Reason for group change
  75          *
  76          */
  77         function saveUserGroups( $username, $removegroup, $addgroup, $reason = '' ) {
  78                 global $wgOut;
  79                 $u = User::newFromName($username);
  80
  81                 if(is_null($u)) {
  82                         $wgOut->addWikiText( wfMsg( 'nosuchusershort', htmlspecialchars( $username ) ) );
  83                         return;
  84                 }
  85
  86                 if($u->getID() == 0) {
  87                         $wgOut->addWikiText( wfMsg( 'nosuchusershort', htmlspecialchars( $username ) ) );
  88                         return;
  89                 }
  90
  91                 $oldGroups = $u->getGroups();
  92                 $newGroups = $oldGroups;
  93                 // remove then add groups
  94                 if(isset($removegroup)) {
  95                         $newGroups = array_diff($newGroups, $removegroup);
  96                         foreach( $removegroup as $group ) {
  97                                 if ( $this->canRemove( $group ) ) {
  98                                         $u->removeGroup( $group );
  99                                 }
 100                         }
 101                 }
 102                 if(isset($addgroup)) {
 103                         $newGroups = array_merge($newGroups, $addgroup);
 104                         foreach( $addgroup as $group ) {
 105                                 if ( $this->canAdd( $group ) ) {
 106                                         $u->addGroup( $group );
 107                                 }
 108                         }
 109                 }
 110                 $newGroups = array_unique( $newGroups );
 111
 112                 wfDebug( 'oldGroups: ' . print_r( $oldGroups, true ) );
 113                 wfDebug( 'newGroups: ' . print_r( $newGroups, true ) );
 114
 115                 wfRunHooks( 'UserRights', array( &$u, $addgroup, $removegroup ) );
 116                 $log = new LogPage( 'rights' );
 117                 $log->addEntry( 'rights', Title::makeTitle( NS_USER, $u->getName() ), $reason, array( $this->makeGroupNameList( $oldGroups ),
 118                         $this->makeGroupNameList( $newGroups ) ) );
 119         }
 120
 121         function makeGroupNameList( $ids ) {
 122                 return implode( ', ', $ids );
 123         }
 124
 125         /**
 126          * Output a form to allow searching for a user
 127          */
 128         function switchForm() {
 129                 global $wgOut, $wgRequest;
 130                 $username = $wgRequest->getText( 'user-editname' );
 131                 $form  = Xml::openElement( 'form', array( 'method' => 'post', 'action' => $this->action, 'name' => 'uluser' ) );
 132                 $form .= '<fieldset><legend>' . wfMsgHtml( 'userrights-lookup-user' ) . '</legend>';
 133                 $form .= '<p>' . Xml::inputLabel( wfMsg( 'userrights-user-editname' ), 'user-editname', 'username', 30, $username ) . '</p>';
 134                 $form .= '<p>' . Xml::submitButton( wfMsg( 'editusergroup' ), array( 'name' => 'ssearchuser' ) ) . '</p>';
 135                 $form .= '</fieldset>';
 136                 $form .= '</form>';
 137                 $wgOut->addHTML( $form );
 138         }
 139
 140         /**
 141          * Edit user groups membership
 142          * @param string $username Name of the user.
 143          */
 144         function editUserGroupsForm($username) {
 145                 global $wgOut;
 146
 147                 $user = User::newFromName($username);
 148                 if( is_null( $user ) ) {
 149                         $wgOut->addWikiText( wfMsg( 'nouserspecified' ) );
 150                         return;
 151                 } elseif( $user->getID() == 0 ) {
 152                         $wgOut->addWikiText( wfMsg( 'nosuchusershort', wfEscapeWikiText( $username ) ) );
 153                         return;
 154                 }
 155
 156                 $this->showEditUserGroupsForm( $username, $user->getGroups() );
 157                 $this->showLogFragment( $user, $wgOut );
 158         }
 159
 160         /**
 161          * Go through used and available groups and return the ones that this
 162          * form will be able to manipulate based on the current user's system
 163          * permissions.
 164          *
 165          * @param $groups Array: list of groups the given user is in
 166          * @return Array:  Tuple of addable, then removable groups
 167          */
 168         protected function splitGroups( $groups ) {
 169                 list($addable, $removable) = array_values( $this->changeableGroups() );
 170                 $removable = array_intersect($removable, $groups ); // Can't remove groups the user doesn't have
 171                 $addable   = array_diff(     $addable,   $groups ); // Can't add groups the user does have
 172
 173                 return array( $addable, $removable );
 174         }
 175
 176         /**
 177          * Show the form to edit group memberships.
 178          *
 179          * @todo make all CSS-y and semantic
 180          * @param $username  String: Name of user you're editing
 181          * @param $groups    Array:  Array of groups the user is in
 182          */
 183         protected function showEditUserGroupsForm( $username, $groups ) {
 184                 global $wgOut, $wgUser;
 185
 186                 list( $addable, $removable ) = $this->splitGroups( $groups );
 187
 188                 $wgOut->addHTML(
 189                         Xml::openElement( 'form', array( 'method' => 'post', 'action' => $this->action, 'name' => 'editGroup' ) ) .
 190                         Xml::hidden( 'user-editname', $username ) .
 191                         Xml::hidden( 'wpEditToken', $wgUser->editToken( $username ) ) .
 192                         Xml::openElement( 'fieldset' ) .
 193                         Xml::element( 'legend', array(), wfMsg( 'userrights-editusergroup' ) ) .
 194                         $wgOut->parse( wfMsg( 'editinguser', $username ) ) .
 195                         $this->explainRights() .
 196                         "<table border='0'>
 197                         <tr>
 198                                 <td></td>
 199                                 <td>
 200                                 <table width='400'>
 201                                         <tr>
 202                                                 <td width='50%'>" . $this->removeSelect( $removable ) . "</td>
 203                                                 <td width='50%'>" . $this->addSelect( $addable ) . "</td>
 204                                         </tr>
 205                                 </table>
 206                         </tr>
 207                         <tr>
 208                                 <td colspan='2'>" .
 209                                         $wgOut->parse( wfMsg('userrights-groupshelp') ) .
 210                                 "</td>
 211                         </tr>
 212                         <tr>
 213                                 <td>" .
 214                                         Xml::label( wfMsg( 'userrights-reason' ), 'wpReason' ) .
 215                                 "</td>
 216                                 <td>" .
 217                                         Xml::input( 'user-reason', 60, false, array( 'id' => 'wpReason' ) ) .
 218                                 "</td>
 219                         </tr>
 220                         <tr>
 221                                 <td></td>
 222                                 <td>" .
 223                                 Xml::submitButton( wfMsg( 'saveusergroups' ), array( 'name' => 'saveusergroups' ) ) .
 224                                 "</td>
 225                         </tr>
 226                         </table>\n" .
 227                         Xml::closeElement( 'fieldset' ) .
 228                         Xml::closeElement( 'form' ) . "\n"
 229                 );
 230         }
 231
 232         /**
 233          * Prepare a list of groups the user is able to add and remove
 234          *
 235          * @return string
 236          */
 237         private function explainRights() {
 238                 global $wgUser, $wgLang;
 239
 240                 $out = array();
 241                 list( $add, $remove ) = array_values( $this->changeableGroups() );
 242
 243                 if( count( $add ) > 0 )
 244                         $out[] = wfMsgExt( 'userrights-available-add', 'parseinline', $wgLang->listToText( $add ) );
 245                 if( count( $remove ) > 0 )
 246                         $out[] = wfMsgExt( 'userrights-available-remove', 'parseinline', $wgLang->listToText( $remove ) );
 247
 248                 return count( $out ) > 0
 249                         ? implode( ' ', $out )
 250                         : wfMsgExt( 'userrights-available-none', 'parseinline' );
 251         }
 252
 253         /**
 254          * Adds the <select> thingie where you can select what groups to remove
 255          *
 256          * @param array $groups The groups that can be removed
 257          * @return string XHTML <select> element
 258          */
 259         private function removeSelect( $groups ) {
 260                 return $this->doSelect( $groups, 'member' );
 261         }
 262
 263         /**
 264          * Adds the <select> thingie where you can select what groups to add
 265          *
 266          * @param array $groups The groups that can be added
 267          * @return string XHTML <select> element
 268          */
 269         private function addSelect( $groups ) {
 270                 return $this->doSelect( $groups, 'available' );
 271         }
 272
 273         /**
 274          * Adds the <select> thingie where you can select what groups to add/remove
 275          *
 276          * @param array  $groups The groups that can be added/removed
 277          * @param string $name   'member' or 'available'
 278          * @return string XHTML <select> element
 279          */
 280         private function doSelect( $groups, $name ) {
 281                 $ret = wfMsgHtml( "{$this->mName}-groups$name" ) .
 282                 Xml::openElement( 'select', array(
 283                                 'name' => "{$name}[]",
 284                                 'multiple' => 'multiple',
 285                                 'size' => '6',
 286                                 'style' => 'width: 100%;'
 287                         )
 288                 );
 289                 foreach ($groups as $group) {
 290                         $ret .= Xml::element( 'option', array( 'value' => $group ), User::getGroupName( $group ) );
 291                 }
 292                 $ret .= Xml::closeElement( 'select' );
 293                 return $ret;
 294         }
 295
 296         /**
 297          * @param  string $group The name of the group to check
 298          * @return bool Can we remove the group?
 299          */
 300         private function canRemove( $group ) {
 301                 // $this->changeableGroups()['remove'] doesn't work, of course. Thanks,
 302                 // PHP.
 303                 $groups = $this->changeableGroups();
 304                 return in_array( $group, $groups['remove'] );
 305         }
 306
 307         /**
 308          * @param  string $group The name of the group to check
 309          * @return bool Can we add the group?
 310          */
 311         private function canAdd( $group ) {
 312                 $groups = $this->changeableGroups();
 313                 return in_array( $group, $groups['add'] );
 314         }
 315
 316         /**
 317          * Returns an array of the groups that the user can add/remove.
 318          *
 319          * @return Array array( 'add' => array( addablegroups ), 'remove' => array( removablegroups ) )
 320          */
 321         private function changeableGroups() {
 322                 global $wgUser, $wgGroupPermissions;
 323
 324                 $groups = array( 'add' => array(), 'remove' => array() );
 325                 $addergroups = $wgUser->getEffectiveGroups();
 326
 327                 foreach ($addergroups as $addergroup) {
 328                         $groups = array_merge_recursive(
 329                                 $groups, $this->changeableByGroup($addergroup)
 330                         );
 331                         $groups['add']    = array_unique( $groups['add'] );
 332                         $groups['remove'] = array_unique( $groups['remove'] );
 333                 }
 334                 return $groups;
 335         }
 336
 337         /**
 338          * Returns an array of the groups that a particular group can add/remove.
 339          *
 340          * @param String $group The group to check for whether it can add/remove
 341          * @return Array array( 'add' => array( addablegroups ), 'remove' => array( removablegroups ) )
 342          */
 343         private function changeableByGroup( $group ) {
 344                 global $wgGroupPermissions, $wgAddGroups, $wgRemoveGroups;
 345
 346                 if( empty($wgGroupPermissions[$group]['userrights']) ) {
 347                         // This group doesn't give the right to modify anything
 348                         return array( 'add' => array(), 'remove' => array() );
 349                 }
 350                 if( empty($wgAddGroups[$group]) and empty($wgRemoveGroups[$group]) ) {
 351                         // This group gives the right to modify everything (reverse-
 352                         // compatibility with old "userrights lets you change
 353                         // everything")
 354                         return array(
 355                                 'add' => User::getAllGroups(),
 356                                 'remove' => User::getAllGroups()
 357                         );
 358                 }
 359
 360                 // Okay, it's not so simple, we have to go through the arrays
 361                 $groups = array( 'add' => array(), 'remove' => array() );
 362                 if( empty($wgAddGroups[$group]) ) {
 363                         // Don't add anything to $groups
 364                 } elseif( $wgAddGroups[$group] === true ) {
 365                         // You get everything
 366                         $groups['add'] = User::getAllGroups();
 367                 } elseif( is_array($wgAddGroups[$group]) ) {
 368                         $groups['add'] = $wgAddGroups[$group];
 369                 }
 370
 371                 // Same thing for remove
 372                 if( empty($wgRemoveGroups[$group]) ) {
 373                 } elseif($wgRemoveGroups[$group] === true ) {
 374                         $groups['remove'] = User::getAllGroups();
 375                 } elseif( is_array($wgRemoveGroups[$group]) ) {
 376                         $groups['remove'] = $wgRemoveGroups[$group];
 377                 }
 378                 return $groups;
 379         }
 380
 381         /**
 382          * Show a rights log fragment for the specified user
 383          *
 384          * @param User $user User to show log for
 385          * @param OutputPage $output OutputPage to use
 386          */
 387         protected function showLogFragment( $user, $output ) {
 388                 $viewer = new LogViewer(
 389                         new LogReader(
 390                                 new FauxRequest(
 391                                         array(
 392                                                 'type' => 'rights',
 393                                                 'page' => $user->getUserPage()->getPrefixedUrl(),
 394                                         )
 395                                 )
 396                         )
 397                 );
 398                 $output->addHtml( "<h2>" . htmlspecialchars( LogPage::logName( 'rights' ) ) . "</h2>\n" );
 399                 $viewer->showList( $output );
 400         }
 401
 402 }