File inc/user.inc.php changed (mode: 100644) (index 88dbfa4..b9cc58e) |
... |
... |
$rg_user_rights = array( |
19 |
19 |
"R" => "Remove user", |
"R" => "Remove user", |
20 |
20 |
"S" => "Suspend user", |
"S" => "Suspend user", |
21 |
21 |
"G" => "Grant rights", |
"G" => "Grant rights", |
22 |
|
'R' => 'Revoke rights', |
|
|
22 |
|
'K' => 'Revoke rights', |
23 |
23 |
"M" => "Give admin rights" |
"M" => "Give admin rights" |
24 |
24 |
); |
); |
25 |
25 |
|
|
|
... |
... |
function rg_user_edit($db, $d) |
759 |
759 |
* @uid - the uid of the user to be removed |
* @uid - the uid of the user to be removed |
760 |
760 |
* This function only marks the user to be removed. |
* This function only marks the user to be removed. |
761 |
761 |
*/ |
*/ |
762 |
|
function rg_user_remove($db, $rg, $uid) |
|
|
762 |
|
function rg_user_remove($db) |
763 |
763 |
{ |
{ |
764 |
764 |
rg_prof_start('user_remove'); |
rg_prof_start('user_remove'); |
765 |
|
rg_log_enter('user_remove: uid=$uid'); |
|
|
765 |
|
rg_log_enter('user_remove'); |
766 |
766 |
|
|
767 |
767 |
$ret = FALSE; |
$ret = FALSE; |
768 |
768 |
while (1) { |
while (1) { |
769 |
|
if (rg_rights_allow($db, $rg, 'user', $uid, 'R', '') !== TRUE) { |
|
|
769 |
|
$ui_login = rg_ui_login(); |
|
770 |
|
|
|
771 |
|
$x = array(); |
|
772 |
|
$x['type'] = 'user'; |
|
773 |
|
$x['obj_id'] = $ui_login['uid']; |
|
774 |
|
$x['owner'] = $ui_login['uid']; |
|
775 |
|
$x['needed_rights'] = 'R'; |
|
776 |
|
if (rg_rights_allow($db, $x) !== TRUE) { |
770 |
777 |
rg_user_set_error('no rights'); |
rg_user_set_error('no rights'); |
771 |
778 |
break; |
break; |
772 |
779 |
} |
} |
|
... |
... |
function rg_user_remove($db, $rg, $uid) |
774 |
781 |
$now = time(); |
$now = time(); |
775 |
782 |
$params = array( |
$params = array( |
776 |
783 |
'now' => $now, |
'now' => $now, |
777 |
|
'uid' => $uid |
|
|
784 |
|
'uid' => $ui_login['uid'] |
778 |
785 |
); |
); |
779 |
786 |
$sql = 'UPDATE users SET deleted = @@now@@' |
$sql = 'UPDATE users SET deleted = @@now@@' |
780 |
787 |
. ' WHERE uid = @@uid@@'; |
. ' WHERE uid = @@uid@@'; |
File tests/http_del_account.php added (mode: 100644) (index 0000000..38bfae0) |
|
1 |
|
<?php |
|
2 |
|
error_reporting(E_ALL | E_STRICT); |
|
3 |
|
ini_set("track_errors", "On"); |
|
4 |
|
|
|
5 |
|
$rg_cache_debug = TRUE; |
|
6 |
|
$test_normal = TRUE; |
|
7 |
|
|
|
8 |
|
$INC = dirname(__FILE__) . "/../inc"; |
|
9 |
|
require_once(dirname(__FILE__) . "/config.php"); |
|
10 |
|
require_once($INC . "/init.inc.php"); |
|
11 |
|
require_once($INC . "/util.inc.php"); |
|
12 |
|
require_once("helpers.inc.php"); |
|
13 |
|
require_once("http.inc.php"); |
|
14 |
|
|
|
15 |
|
rg_log_set_file("http_del_account.log"); |
|
16 |
|
|
|
17 |
|
require_once("common.php"); |
|
18 |
|
|
|
19 |
|
$_testns = 'http_del_account'; |
|
20 |
|
|
|
21 |
|
|
|
22 |
|
$now = time(); |
|
23 |
|
|
|
24 |
|
rg_test_create_user($db, $rg_ui); |
|
25 |
|
$info = array('id' => $rg_ui['username']); |
|
26 |
|
prepare_http($info); |
|
27 |
|
|
|
28 |
|
|
|
29 |
|
rg_log(''); |
|
30 |
|
rg_log_enter("Loading delete account form - without being logged-in"); |
|
31 |
|
$data = array(); |
|
32 |
|
$headers = array(); |
|
33 |
|
$r = do_req($info, $test_url . "/op/settings/delete_account?t=load_delete_account_form_no_login", $data, $headers); |
|
34 |
|
if (!strstr($r['body'], 'Please <a href="/op/login">login</a> first.')) { |
|
35 |
|
rg_log_ml('r: ' . print_r($r, TRUE)); |
|
36 |
|
rg_log("Seems we can load the delete account form without being logged in! Not good!"); |
|
37 |
|
exit(1); |
|
38 |
|
} |
|
39 |
|
rg_log_exit(); |
|
40 |
|
|
|
41 |
|
|
|
42 |
|
|
|
43 |
|
$r = test_login($test_url, $rg_ui); |
|
44 |
|
if ($r === FALSE) { |
|
45 |
|
rg_log("Cannot login!"); |
|
46 |
|
exit(1); |
|
47 |
|
} |
|
48 |
|
|
|
49 |
|
|
|
50 |
|
|
|
51 |
|
rg_log(''); |
|
52 |
|
rg_log_enter("Loading delete account form"); |
|
53 |
|
$data = array(); |
|
54 |
|
$headers = array(); |
|
55 |
|
$r = do_req($info, $test_url . "/op/settings/delete_account?t=load_delete_account_form", $data, $headers); |
|
56 |
|
if (!strstr($r['body'], "action=\"/op/settings/delete_account\"")) { |
|
57 |
|
rg_log_ml('r: ' . print_r($r, TRUE)); |
|
58 |
|
rg_log("Cannot load form!"); |
|
59 |
|
exit(1); |
|
60 |
|
} |
|
61 |
|
$good_token = $r['tokens']['delete_account']; |
|
62 |
|
rg_log_exit(); |
|
63 |
|
|
|
64 |
|
|
|
65 |
|
rg_log(''); |
|
66 |
|
rg_log_enter('Posting delete account form'); |
|
67 |
|
$data = array( |
|
68 |
|
'doit' => 1, |
|
69 |
|
'token' => $good_token, |
|
70 |
|
'are_you_sure' => '1' |
|
71 |
|
); |
|
72 |
|
$headers = array(); |
|
73 |
|
$r = do_req($info, $test_url . "/op/settings/delete_account?t=post_delete_account_form", $data, $headers); |
|
74 |
|
if (!strstr($r['body'], 'The user account has been deleted.')) { |
|
75 |
|
rg_log_ml('r: ' . print_r($r, TRUE)); |
|
76 |
|
rg_log("Cannot delete account!"); |
|
77 |
|
exit(1); |
|
78 |
|
} |
|
79 |
|
rg_log_exit(); |
|
80 |
|
|
|
81 |
|
|
|
82 |
|
rg_log(''); |
|
83 |
|
rg_log_enter('Checking if user is still accessible...'); |
|
84 |
|
$data = array(); |
|
85 |
|
$headers = array(); |
|
86 |
|
$r = do_req($info, $test_url . '/user/' . $rg_ui['username'], $data, $headers); |
|
87 |
|
if (!strstr($r['body'], 'Invalid user.')) { |
|
88 |
|
rg_log_ml('r: ' . print_r($r, TRUE)); |
|
89 |
|
rg_log('We still can access the user page!'); |
|
90 |
|
exit(1); |
|
91 |
|
} |
|
92 |
|
rg_log_exit(); |
|
93 |
|
|
|
94 |
|
|
|
95 |
|
|
|
96 |
|
rg_log('OK!'); |