Blame Identity/Webenv/App/Mantis/1.1.2-1.fc9/manage_user_update.php

f2e824
f2e824
# Mantis - a php based bugtracking system
f2e824
f2e824
# Copyright (C) 2000 - 2002  Kenzaburo Ito - kenito@300baud.org
f2e824
# Copyright (C) 2002 - 2007  Mantis Team   - mantisbt-dev@lists.sourceforge.net
f2e824
f2e824
# Mantis is free software: you can redistribute it and/or modify
f2e824
# it under the terms of the GNU General Public License as published by
f2e824
# the Free Software Foundation, either version 2 of the License, or
f2e824
# (at your option) any later version.
f2e824
#
f2e824
# Mantis is distributed in the hope that it will be useful,
f2e824
# but WITHOUT ANY WARRANTY; without even the implied warranty of
f2e824
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
f2e824
# GNU General Public License for more details.
f2e824
#
f2e824
# You should have received a copy of the GNU General Public License
f2e824
# along with Mantis.  If not, see <http://www.gnu.org/licenses/>.
f2e824
f2e824
	#------------------------------
f2e824
	#   $Revision: 2643 $
f2e824
	#     $Author: al $    
f2e824
	#       $Date: 2009-06-18 19:06:27 -0400 (Thu, 18 Jun 2009) $  
f2e824
	#------------------------------
f2e824
f2e824
	require_once( 'core.php' );
f2e824
f2e824
	$t_core_path = config_get( 'core_path' );
f2e824
f2e824
	require_once( $t_core_path.'email_api.php' );
f2e824
f2e824
	auth_reauthenticate();
f2e824
f2e824
	form_security_validate('manage_user_update');
f2e824
f2e824
	access_ensure_global_level( config_get( 'manage_user_threshold' ) );
f2e824
f2e824
	$f_protected	= gpc_get_bool( 'protected' );
f2e824
	$f_enabled		= gpc_get_bool( 'enabled' );
f2e824
	$f_email		= gpc_get_string( 'email', '' );
f2e824
	$f_username		= gpc_get_string( 'username', '' );
f2e824
	$f_realname		= gpc_get_string( 'realname', '' );
f2e824
	$f_access_level	= gpc_get_int( 'access_level' );
f2e824
	$f_user_id		= gpc_get_int( 'user_id' );
f2e824
f2e824
	$f_email	= trim( $f_email );
f2e824
	$f_username	= trim( $f_username );
f2e824
f2e824
	$t_old_username = user_get_field( $f_user_id, 'username' );
f2e824
f2e824
	# check that the username is unique
f2e824
	if ( 0 != strcasecmp( $t_old_username, $f_username )
f2e824
        && false == user_is_name_unique( $f_username ) ) {
f2e824
		trigger_error( ERROR_USER_NAME_NOT_UNIQUE, ERROR );
f2e824
	}
f2e824
f2e824
	user_ensure_name_valid( $f_username );
f2e824
	user_ensure_realname_valid( $f_realname );
f2e824
	user_ensure_realname_unique( $f_username, $f_realname );
f2e824
f2e824
	$f_email = email_append_domain( $f_email );
f2e824
	email_ensure_valid( $f_email );
f2e824
	email_ensure_not_disposable( $f_email );
f2e824
f2e824
	$c_email		= db_prepare_string( $f_email );
f2e824
	$c_username		= db_prepare_string( $f_username );
f2e824
	$c_realname		= db_prepare_string( $f_realname );
f2e824
	$c_protected	= db_prepare_bool( $f_protected );
f2e824
	$c_enabled		= db_prepare_bool( $f_enabled );
f2e824
	$c_user_id			= db_prepare_int( $f_user_id );
f2e824
	$c_access_level	= db_prepare_int( $f_access_level );
f2e824
f2e824
	$t_user_table = config_get( 'mantis_user_table' );
f2e824
f2e824
	$t_old_protected = user_get_field( $f_user_id, 'protected' );
f2e824
	
f2e824
	# check that we are not downgrading the last administrator
f2e824
	$t_old_access = user_get_field( $f_user_id, 'access_level' );
f2e824
	if ( ( ADMINISTRATOR == $t_old_access ) && ( $t_old_access <> $f_access_level ) && ( 1 >= user_count_level( ADMINISTRATOR ) ) ) {
f2e824
		trigger_error( ERROR_USER_CHANGE_LAST_ADMIN, ERROR );
f2e824
	}	   
f2e824
f2e824
	# Project specific access rights override global levels, hence, for users who are changed
f2e824
	# to be administrators, we have to remove project specific rights.
f2e824
        if ( ( $c_access_level >= ADMINISTRATOR ) && ( !user_is_administrator( $c_user_id ) ) ) {
f2e824
		user_delete_project_specific_access_levels( $c_user_id );
f2e824
	}
f2e824
f2e824
	# if the user is already protected and the admin is not removing the
f2e824
	#  protected flag then don't update the access level and enabled flag.
f2e824
	#  If the user was unprotected or the protected flag is being turned off
f2e824
	#  then proceed with a full update.
f2e824
	if ( $f_protected && $t_old_protected ) {
f2e824
	    $query = "UPDATE $t_user_table
f2e824
	    		SET username='$c_username', email='$c_email',
f2e824
	    			protected='$c_protected', realname='$c_realname'
f2e824
	    		WHERE id='$c_user_id'";
f2e824
	} else {
f2e824
	    $query = "UPDATE $t_user_table
f2e824
	    		SET username='$c_username', email='$c_email',
f2e824
	    			access_level='$c_access_level', enabled='$c_enabled',
f2e824
	    			protected='$c_protected', realname='$c_realname'
f2e824
	    		WHERE id='$c_user_id'";
f2e824
	}
f2e824
f2e824
	$result = db_query( $query );
f2e824
	$t_redirect_url = 'manage_user_edit_page.php?user_id=' . $c_user_id;
f2e824
?>
f2e824
f2e824
f2e824
	if ( $result ) {
f2e824
		html_meta_redirect( $t_redirect_url );
f2e824
	}
f2e824
?>
f2e824
f2e824
f2e824
f2e824
f2e824
	if ( $f_protected && $t_old_protected ) {				# PROTECTED
f2e824
		echo '

' . lang_get( 'manage_user_protected_msg' ) . '

';
f2e824
	} else if ( $result ) {							# SUCCESS
f2e824
		echo '

' . lang_get( 'operation_successful' ) . '

';
f2e824
	} else {								# FAILURE
f2e824
		echo '

' . print_sql_error( $query ) . '

';
f2e824
	}
f2e824
f2e824
	print_bracket_link( $t_redirect_url, lang_get( 'proceed' ) );
f2e824
?>
f2e824
f2e824
f2e824