Skip to content

Commit 7cd851e

Browse files
HaGuestoHaGuesto
authored
Merge pull request #817 from boxwise/fix-hoo-user-editing-themselves
List current logged-in HoO user as editable row in cms_users
2 parents 9a837ab + 97ccdd2 commit 7cd851e

4 files changed

Lines changed: 55 additions & 15 deletions

File tree

‎include/cms_users.php‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@
2828

2929
// Execution of queries in cms_users_page.php
3030
$cms_users_lower_level_query = '
31-
SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 0 as disableifistrue
31+
SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 0 as disableifistrue, 0 AS preventedit
3232
FROM cms_users AS u
3333
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
3434
LEFT OUTER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
@@ -46,13 +46,14 @@
4646
// Do not forget to specify :userGroupLevel and :user in the db call later
4747
// related to this trello card https://trello.com/c/KI47eGPI
4848
$cms_users_same_or_upper_level_query = '
49-
SELECT u.*, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue
49+
SELECT u.*, IF(u.id = :user, 1, 0) AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue, IF(u.id = :user, 0, 1) AS preventedit
5050
FROM cms_users AS u
5151
INNER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
5252
INNER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
5353
INNER JOIN cms_usergroups_levels AS l ON l.id = g.userlevel
54-
WHERE (l.level >= :userGroupLevel AND u.id != :user)
55-
AND uc.camp_id IN ('.($_SESSION['camp']['id'] ?: 0).')
54+
WHERE l.level >= :userGroupLevel
55+
AND (u.id != :user OR :userGroupLevel = 100)
56+
AND uc.camp_id IN ('.(intval($_SESSION['camp']['id']) ?: 0).')
5657
AND NOT (u.valid_lastday < CURDATE() AND UNIX_TIMESTAMP(u.valid_lastday) != 0)
5758
AND UNIX_TIMESTAMP(u.deleted) = 0
5859
GROUP BY u.id

‎include/cms_users_deactivated.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
);
2525

2626
// Execution of queries in cms_users_page.php
27-
$cms_users_lower_level_query = 'SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue
27+
$cms_users_lower_level_query = 'SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue, 0 as preventedit
2828
FROM cms_users AS u
2929
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
3030
LEFT OUTER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
@@ -40,7 +40,7 @@
4040

4141
// Do not forget to specify :usergroup and :user in the db call later
4242
$cms_users_same_level_query = '
43-
SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue
43+
SELECT u.id, u.naam, SUBSTR(u.email, 1, LENGTH(u.email)-LENGTH(".deleted.")-LENGTH(u.id)) AS email, u.valid_firstday, u.valid_lastday, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue, 1 AS preventedit
4444
FROM cms_users AS u
4545
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
4646
WHERE u.cms_usergroups_id = :usergroup

‎include/cms_users_edit.php‎

Lines changed: 46 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,41 @@
7474
WHERE ug.id = :id AND (NOT ug.deleted OR ug.deleted IS NULL)', ['id' => $_POST['cms_usergroups_id'][0]]);
7575
$is_admin = $_SESSION['user']['is_admin'];
7676
$organisation_allowed = ($_SESSION['organisation']['id'] == $posteduser['organisation_id']);
77-
// allow admins to create another admin account
77+
// allow HoO to create another HoO account
7878
// related to this trello card https://trello.com/c/YAF3Az4P
7979
$userlevel_allowed = ($_SESSION['usergroup']['userlevel'] > $posteduser['userlevel']) || ($_SESSION['usergroup']['userlevel'] == $posteduser['userlevel'] && '100' == $_SESSION['usergroup']['userlevel']);
8080

81+
// Prevent HoO user from downgrading their usergroup if they're the only HoO
82+
if (!$is_admin
83+
&& $_POST['id'] == $_SESSION['user']['id']
84+
&& 100 == $_SESSION['usergroup']['userlevel']) {
85+
// Count how many HoO users exist in this organization
86+
$hoo_count = db_value(
87+
'
88+
SELECT COUNT(DISTINCT u.id)
89+
FROM cms_users AS u
90+
LEFT JOIN cms_usergroups AS ug ON ug.id = u.cms_usergroups_id
91+
LEFT JOIN cms_usergroups_levels AS ugl ON ugl.id = ug.userlevel
92+
WHERE ug.organisation_id = :org_id
93+
AND ugl.level = 100
94+
AND (NOT u.deleted OR u.deleted IS NULL)
95+
AND (NOT ug.deleted OR ug.deleted IS NULL)
96+
AND NOT (u.valid_lastday < CURDATE() AND UNIX_TIMESTAMP(u.valid_lastday) != 0)',
97+
['org_id' => $_SESSION['organisation']['id']]
98+
);
99+
100+
// If this is the last HoO, prevent the change
101+
if ($hoo_count <= 1) {
102+
if ($posteduser['userlevel'] < $_SESSION['usergroup']['userlevel']) {
103+
redirect('?action=cms_users_edit&id='.$_POST['id'].'&origin='.$_POST['_origin'].'&warning=1&message=You cannot downgrade yourself. Your organisation must have at least one Head of Operations user.');
104+
trigger_error('You cannot downgrade yourself. Your organisation must have at least one Head of Operations user.', E_USER_NOTICE);
105+
} elseif (('' !== $_POST['valid_firstday']) || ('' !== $_POST['valid_lastday'])) {
106+
redirect('?action=cms_users_edit&id='.$_POST['id'].'&origin='.$_POST['_origin'].'&warning=1&message=You cannot edit yourself. Your organisation must have at least one Head of Operations user.');
107+
trigger_error('You cannot edit yourself. Your organisation must have at least one Head of Operations user.', E_USER_NOTICE);
108+
}
109+
}
110+
}
111+
81112
if ($is_admin || ($organisation_allowed && $userlevel_allowed)) {
82113
$keys = ['naam', 'email', 'cms_usergroups_id', 'valid_firstday', 'valid_lastday'];
83114
$userId = db_transaction(function () use ($table, $keys, $userId) {
@@ -114,7 +145,12 @@
114145
FROM cms_usergroups AS ug
115146
LEFT OUTER JOIN cms_usergroups_levels AS ugl ON ugl.id=ug.userlevel
116147
WHERE ug.id = :id AND (NOT ug.deleted OR ug.deleted IS NULL)', ['id' => $data['cms_usergroups_id']]);
117-
if (!$_SESSION['user']['is_admin'] && ($data && ($data['is_admin'] || ($_SESSION['organisation']['id'] != $requesteduser['organisation_id']) || ($_SESSION['usergroup']['userlevel'] <= $requesteduser['userlevel'])))) {
148+
if (!$_SESSION['user']['is_admin']
149+
&& $data
150+
&& $data['id'] != $_SESSION['user']['id']
151+
&& ($data['is_admin']
152+
|| $_SESSION['organisation']['id'] != $requesteduser['organisation_id']
153+
|| $_SESSION['usergroup']['userlevel'] <= $requesteduser['userlevel'])) {
118154
throw new Exception('You do not have access to this user!', 403);
119155
}
120156

@@ -130,11 +166,14 @@
130166
// display admin role in the usergroup - only for user with admin roles
131167
// related to this trello card https://trello.com/c/YAF3Az4P
132168
$usergroups = db_array('
133-
SELECT ug.id AS value, ug.label
134-
FROM cms_usergroups AS ug
135-
LEFT OUTER JOIN cms_usergroups_levels AS ugl ON (ugl.id=ug.userlevel)
136-
WHERE ug.organisation_id = :organisation_id AND (ugl.level < :userlevel OR :is_admin OR (ugl.level <= :userlevel AND 100 = :userlevel)) AND (NOT ug.deleted OR ug.deleted IS NULL)
137-
ORDER BY ug.label', ['organisation_id' => $_SESSION['organisation']['id'], 'userlevel' => $_SESSION['usergroup']['userlevel'], 'is_admin' => $_SESSION['user']['is_admin']]);
169+
SELECT ug.id AS value, ug.label
170+
FROM cms_usergroups AS ug
171+
LEFT OUTER JOIN cms_usergroups_levels AS ugl ON (ugl.id=ug.userlevel)
172+
WHERE ug.organisation_id = :organisation_id
173+
AND (:is_admin OR (ugl.level < :userlevel OR (ugl.level <= :userlevel AND 100 = :userlevel)))
174+
AND (:is_admin OR ug.label != "Boxtribute God")
175+
AND (NOT ug.deleted OR ug.deleted IS NULL)
176+
ORDER BY ug.label', ['organisation_id' => $_SESSION['organisation']['id'], 'userlevel' => $_SESSION['usergroup']['userlevel'], 'is_admin' => $_SESSION['user']['is_admin']]);
138177
addfield('select', 'Select user group', 'cms_usergroups_id', ['required' => true, 'options' => $usergroups, 'testid' => 'user_group']);
139178

140179
addfield('line');

‎include/cms_users_expired.php‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@
2929
);
3030

3131
// Execution of queries in cms_users_page.php
32-
$cms_users_lower_level_query = 'SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue
32+
$cms_users_lower_level_query = 'SELECT u.*, NOT u.is_admin AS visible, g.label AS usergroup, 0 AS preventdelete, 1 as disableifistrue, 0 AS preventedit
3333
FROM cms_users AS u
3434
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
3535
LEFT OUTER JOIN cms_usergroups_camps AS uc ON uc.cms_usergroups_id = g.id
@@ -46,7 +46,7 @@
4646

4747
// Do not forget to specify :usergroup and :user in the db call later
4848
$cms_users_same_level_query = '
49-
SELECT u.*, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue
49+
SELECT u.*, 0 AS visible, g.label AS usergroup, 1 AS preventdelete, 1 as disableifistrue, 1 AS preventedit
5050
FROM cms_users AS u
5151
LEFT OUTER JOIN cms_usergroups AS g ON g.id = u.cms_usergroups_id
5252
WHERE u.cms_usergroups_id = :usergroup

0 commit comments

Comments
 (0)