From be2491b093b1f0ca430bede679ecbb670041e483 Mon Sep 17 00:00:00 2001 From: cassio Date: Tue, 2 Jul 2013 09:46:45 +0400 Subject: restructuring of boca's git --- src/admin/user.php | 469 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 469 insertions(+) create mode 100644 src/admin/user.php (limited to 'src/admin/user.php') diff --git a/src/admin/user.php b/src/admin/user.php new file mode 100644 index 0000000..adde9db --- /dev/null +++ b/src/admin/user.php @@ -0,0 +1,469 @@ +. +//////////////////////////////////////////////////////////////////////////////// +// Last modified 05/aug/2012 by cassio@ime.usp.br +require('header.php'); + +if (isset($_GET["site"]) && isset($_GET["user"]) && is_numeric($_GET["site"]) && is_numeric($_GET["user"]) && + isset($_GET["logout"]) && $_GET["logout"] == 1) { + DBLogOut($_SESSION["usertable"]["contestnumber"], $_GET["site"], $_GET["user"]); + ForceLoad("user.php"); +} +if (isset($_POST["usersitenumber"]) && isset($_POST["usernumber"]) && is_numeric($_POST["usersitenumber"]) && + is_numeric($_POST["usernumber"]) && isset($_POST["confirmation"]) && $_POST["confirmation"] == "delete") { + if (!DBDeleteUser($_SESSION["usertable"]["contestnumber"], $_POST["usersitenumber"], $_POST["usernumber"])) + MSGError("User could not be removed."); + ForceLoad("user.php"); +} + +if(($ct = DBContestInfo($_SESSION["usertable"]["contestnumber"])) == null) + ForceLoad("../index.php"); +if($ct["contestlocalsite"]==$ct["contestmainsite"]) $main=true; else $main=false; + +if (isset($_POST["username"]) && isset($_POST["userfullname"]) && isset($_POST["userdesc"]) && isset($_POST["userip"]) && + isset($_POST["usernumber"]) && isset($_POST["usersitenumber"]) && isset($_POST["userenabled"]) && isset($_POST["usericpcid"]) && + isset($_POST["usermultilogin"]) && isset($_POST["usertype"]) && isset($_POST["confirmation"]) && + isset($_POST["passwordn1"]) && isset($_POST["passwordn2"]) && isset($_POST["passwordo"]) && $_POST["confirmation"] == "confirm") { + $param['user'] = htmlspecialchars($_POST["usernumber"]); + $param['site'] = htmlspecialchars($_POST["usersitenumber"]); + $param['username'] = htmlspecialchars($_POST["username"]); + $param['usericpcid'] = htmlspecialchars($_POST["usericpcid"]); + $param['enabled'] = htmlspecialchars($_POST["userenabled"]); + $param['multilogin'] = htmlspecialchars($_POST["usermultilogin"]); + $param['userfull'] = htmlspecialchars($_POST["userfullname"]); + $param['userdesc'] = htmlspecialchars($_POST["userdesc"]); + $param['type'] = htmlspecialchars($_POST["usertype"]); + $param['permitip'] = htmlspecialchars($_POST["userip"]); + $param['contest'] = $_SESSION["usertable"]["contestnumber"]; + + $passcheck = htmlspecialchars($_POST["passwordo"]); + $a = DBUserInfo($_SESSION["usertable"]["contestnumber"], $_SESSION["usertable"]["usersitenumber"], $_SESSION["usertable"]["usernumber"], null, false); + if(myhash($a['userpassword'] . session_id()) != $passcheck) { + MSGError('Admin password is incorrect'); + } else { + if ($_POST["passwordn1"] == $_POST["passwordn2"]) { + $param['pass'] = bighexsub(htmlspecialchars($_POST["passwordn1"]),$a['userpassword']); + if($param['user'] != 1000) + DBNewUser($param); + } + else MSGError ("Passwords don't match."); + } + ForceLoad("user.php"); +} +else if (isset($_FILES["importfile"]) && isset($_POST["Submit"]) && $_FILES["importfile"]["name"]!="") { + if ($_POST["confirmation"] == "confirm") { + $type=myhtmlspecialchars($_FILES["importfile"]["type"]); + $size=myhtmlspecialchars($_FILES["importfile"]["size"]); + $name=myhtmlspecialchars($_FILES["importfile"]["name"]); + $temp=myhtmlspecialchars($_FILES["importfile"]["tmp_name"]); + if (!is_uploaded_file($temp)) { + IntrusionNotify("file upload problem."); + ForceLoad("../index.php"); + } + + if (($ar = file($temp)) === false) { + IntrusionNotify("Unable to open the uploaded file."); + ForceLoad("user.php"); + } + $userlist=array(); + if(strtolower(substr($name,-4))==".tsv") { + for ($i=0; $i < count($ar) && strpos($ar[$i], "File_Version\t1") === false; $i++) ; + if($i >= count($ar)) MSGError('File format not recognized'); + $oklines=0; + for ($i++; $i < count($ar); $i++) { + $x = explode("\t",trim($ar[$i])); + if(count($x)==7) { + $param['site']=trim($x[2]); + $param['username']=trim($x[1]); + $param['usericpcid']=trim($x[1]); + $param['usernumber']=trim($x[1]); + if(trim($x[5])!='') + $param['userfull']=trim($x[3]) . ' - ' . trim($x[5]); + else + $param['userfull']=trim($x[3]); + $param['userdesc']=trim($x[4]); + $param['type']='team'; + $param['enabled']='t'; + $param['multilogin']='f'; + $userlist[$param['site'] . '-' . $param['usernumber']] = randstr(6,'0123456789'); + $param['pass']=myhash($userlist[$param['site'] . '-' . $param['usernumber']]); + + $param['contest']=$_SESSION["usertable"]["contestnumber"]; + if($_SESSION["usertable"]["usersitenumber"] == $param['site'] || $main) + if($param['usernumber'] != 1000 && DBNewUser($param)) { + $oklines++; + } else { + unset($userlist[$param['site'] . '-' . $param['usernumber']]); + break; + } + } + } + MSGError($oklines . ' users included/updated successfully'); + } else if(strtolower(substr($name,-4))==".tab") { + $oklines=0; + for ($i=0; $i= count($ar)) MSGError('File format not recognized'); + for ($i++; $i < count($ar) && $ar[$i][0] != "["; $i++) { + $x = trim($ar[$i]); + if (strpos($x, "user") !== false && strpos($x, "user") == 0) { + $param = array(); + while (strpos($x, "user") !== false && strpos($x, "user") == 0) { + $tmp = explode ("=", $x, 2); + switch (trim($tmp[0])) { + case "usersitenumber": $param['site']=trim($tmp[1]); break; + case "username": $param['username']=trim($tmp[1]); break; + case "usericpcid": $param['usericpcid']=trim($tmp[1]); break; + case "usernumber": $param['usernumber']=trim($tmp[1]); break; + case "userfullname": $param['userfull']=trim($tmp[1]); break; + case "userdesc": $param['userdesc']=trim($tmp[1]); break; + case "usertype": $param['type']=trim($tmp[1]); break; + case "userenabled": $param['enabled']=trim($tmp[1]); break; + case "usermultilogin": $param['multilogin']=trim($tmp[1]); break; + case "userpassword": $param['pass']=myhash(trim($tmp[1])); break; + case "userip": $param['permitip']=trim($tmp[1]); break; + } + $i++; + if ($i>=count($ar)) break; + $x = trim($ar[$i]); + } + $param['contest']=$_SESSION["usertable"]["contestnumber"]; + if($_SESSION["usertable"]["usersitenumber"] == $param['site'] || $main) + if($param['usernumber'] != 1000) DBNewUser($param); + } + } + } + if(count($userlist) > 0) { +?> +
+
TAKE NOTE OF THE USERS AND PASSWORDS AND KEEP THEM SECRET

+ + + + + + $pass) { + $x = explode('-',$user); + echo "\n"; + } +?> +
SiteUser #Password
" . $x[0] . "" . $x[1] . "$pass


TAKE NOTE OF THE USERS AND PASSWORDS AND KEEP THEM SECRET
+ + + +
+ + + + + + + + + + + + + + + +\n"; + if(($usr[$i]["usersitenumber"] == $_SESSION["usertable"]["usersitenumber"] || $main==true) && + //$usr[$i]["usertype"] != 'site' && + ($usr[$i]["usernumber"] != $_SESSION["usertable"]["usernumber"] || + $usr[$i]["usersitenumber"] != $_SESSION["usertable"]["usersitenumber"])) + echo " \n"; + else + echo " \n"; + + echo " \n"; + echo " \n"; + echo " \n"; + echo " \n"; + if ($usr[$i]["userpermitip"]!="") + echo " \n"; + else + echo " \n"; + if ($usr[$i]["userlastlogin"] < 1) + echo " \n"; + else + echo " \n"; + if ($usr[$i]["usersession"] != "") + echo " \n"; + else { + if ($usr[$i]["userlastlogout"] < 1) + echo " \n"; + else + echo " \n"; + } + if ($usr[$i]["userenabled"] == "t") + echo " \n"; + else + echo " \n"; + if ($usr[$i]["usermultilogin"] == "t") + echo " \n"; + else + echo " \n"; + echo " \n"; + echo " \n"; + echo ""; +} +echo "
User #SiteUsernameICPC IDTypeIPLastLoginLastLogoutEnabledMultiFullnameDescription
" . $usr[$i]["usernumber"] . "" . $usr[$i]["usernumber"] . "" . $usr[$i]["usersitenumber"] . "" . $usr[$i]["username"] . " " . $usr[$i]["usericpcid"] . " " . $usr[$i]["usertype"] . " " . $usr[$i]["userpermitip"] . "* " . $usr[$i]["userip"] . " never" . dateconv($usr[$i]["userlastlogin"]) . "Force Logoutnever" . dateconv($usr[$i]["userlastlogout"]) . "YesNoYesNo" . $usr[$i]["userfullname"] . " " . $usr[$i]["userdesc"] . " 
\n"; + +unset($u); +if (isset($_GET["site"]) && isset($_GET["user"]) && is_numeric($_GET["site"]) && is_numeric($_GET["user"])) + $u = DBUserInfo($_SESSION["usertable"]["contestnumber"], $_GET["site"], $_GET["user"]); + +?> + + + + +

Clicking on a user number will bring the user data for edition.
+To import the users, just fill in the import file field.
+The file must be in the format defined in the admin's manual.
+ +
+ +
+ + + + + +
Import file: + +
+
+ +
+ + +
+
+ +

+
+To create/edit one user, enter the data below.
+Note that any changes will overwrite the already defined data.
+(Specially care if you use a user number that is already existent.)
+
+ + + + + +
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
User Site Number: + size="20" maxlength="20" /> +
User Number: + " size="20" maxlength="20" /> +
Username: + " size="20" maxlength="20" /> +
ICPC ID: + " size="20" maxlength="50" /> +
Type: + +
Enabled: + +
MultiLogins (local teams should be set to No): + +
User Full Name: + " size="50" maxlength="200" /> +
User Description: + " size="50" maxlength="300" /> +
User IP: + " size="20" maxlength="20" /> +
Password: + +
Retype Password: + +
Admin (this user) Password: + +
+
+
+ + + + + + +

WARNING: deleting a user will completely remove EVERYTHING related to it (including runs, clarifications, etc).
+ +
+ + + + -- cgit v1.2.3