summaryrefslogtreecommitdiff
path: root/web/html/account.php
blob: 2133734c814b022a304b7500085eede618a712af (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
<?php

set_include_path(get_include_path() . PATH_SEPARATOR . '../lib');

include_once('aur.inc.php');         # access AUR common functions
include_once('acctfuncs.inc.php');   # access Account specific functions

set_lang();                 # this sets up the visitor's language
check_sid();                # see if they're still logged in

html_header(__('Accounts'));

# Main page processing here
#
echo "<div class=\"box\">\n";
echo "  <h2>".__("Accounts")."</h2>\n";

$action = in_request("Action");

if (isset($_COOKIE["AURSID"])) {
	# visitor is logged in
	#
	$dbh = db_connect();
	$atype = account_from_sid($_COOKIE["AURSID"]);

	if ($action == "SearchAccounts") {

		# security check
		#
		if ($atype == "Trusted User" || $atype == "Developer") {
			# the user has entered search criteria, find any matching accounts
			#
			search_results_page($atype, in_request("O"), in_request("SB"),
					in_request("U"), in_request("T"), in_request("S"),
					in_request("E"), in_request("R"), in_request("I"),
					in_request("K"));

		} else {
			# a non-privileged user is trying to access the search page
			#
			print __("You are not allowed to access this area.")."<br />\n";
		}

	} elseif ($action == "DisplayAccount") {
		# the user has clicked 'edit', display the account details in a form
		#
		$row = account_details(in_request("ID"), in_request("U"));
		if (empty($row)) {
			print __("Could not retrieve information for the specified user.");
		} else {
			/* Verify user has permission to edit the account */
			if (can_edit_account($atype, $row, uid_from_sid($_COOKIE["AURSID"]))) {
				display_account_form($atype, "UpdateAccount", $row["Username"],
					$row["AccountType"], $row["Suspended"], $row["Email"],
					"", "", $row["RealName"], $row["LangPreference"],
					$row["IRCNick"], $row["PGPKey"], $row["ID"]);
			} else {
				print __("You do not have permission to edit this account.");
			}
		}

	} elseif ($action == "AccountInfo") {
		# no editing, just looking up user info
		#
		$row = account_details(in_request("ID"), in_request("U"));
		if (empty($row)) {
			print __("Could not retrieve information for the specified user.");
		} else {
			include("account_details.php");
		}

	} elseif ($action == "UpdateAccount") {
		$uid = uid_from_sid($_COOKIE['AURSID']);

		/* Details for account being updated */
		$acctinfo = account_details(in_request('ID'), in_request('U'));

		/* Verify user permissions and that the request is a valid POST */
		if (can_edit_account($atype, $acctinfo, $uid) && check_token()) {
			/* Update the details for the existing account */
			process_account_form($atype, "edit", "UpdateAccount",
					in_request("U"), in_request("T"), in_request("S"),
					in_request("E"), in_request("P"), in_request("C"),
					in_request("R"), in_request("L"), in_request("I"),
					in_request("K"), in_request("ID"));
		}
	} else {
		if ($atype == "Trusted User" || $atype == "Developer") {
			# display the search page if they're a TU/dev
			#
			print __("Use this form to search existing accounts.")."<br />\n";
			search_accounts_form();

		} else {
			print __("You are not allowed to access this area.");
		}
	}

} else {
	# visitor is not logged in
	#
	if ($action == "AccountInfo") {
		print __("You must log in to view user information.");
	}	elseif ($action == "NewAccount") {
		# process the form input for creating a new account
		#
		process_account_form("","new", "NewAccount",
				in_request("U"), 1, 0, in_request("E"),
				in_request("P"), in_request("C"), in_request("R"),
				in_request("L"), in_request("I"), in_request("K"));

	} else {
		# display the account request form
		#
		print __("Use this form to create an account.");
		display_account_form("", "NewAccount");
	}
}

echo "</div>";

html_footer(AUR_VERSION);

?>