X-Git-Url: http://source.bookstackapp.com/bookstack/blobdiff_plain/4cc73657a1298e6411901075416be0596d0e9139..e1b8fe45b0271e66adbcc06c7d75ddb1a80b4556:/app/Http/Controllers/UserController.php diff --git a/app/Http/Controllers/UserController.php b/app/Http/Controllers/UserController.php index 4c56516dc..414bfefeb 100644 --- a/app/Http/Controllers/UserController.php +++ b/app/Http/Controllers/UserController.php @@ -2,245 +2,380 @@ namespace BookStack\Http\Controllers; -use BookStack\Activity; +use BookStack\Actions\ActivityType; +use BookStack\Auth\Access\SocialAuthService; +use BookStack\Auth\Access\UserInviteService; +use BookStack\Auth\User; +use BookStack\Auth\UserRepo; +use BookStack\Exceptions\ImageUploadException; +use BookStack\Exceptions\UserUpdateException; +use BookStack\Uploads\ImageRepo; use Exception; use Illuminate\Http\Request; - -use Illuminate\Http\Response; -use BookStack\Http\Requests; -use BookStack\Repos\UserRepo; -use BookStack\Services\SocialAuthService; -use BookStack\User; +use Illuminate\Support\Str; +use Illuminate\Validation\ValidationException; class UserController extends Controller { - protected $user; protected $userRepo; + protected $inviteService; + protected $imageRepo; /** * UserController constructor. - * @param User $user - * @param UserRepo $userRepo */ - public function __construct(User $user, UserRepo $userRepo) + public function __construct(User $user, UserRepo $userRepo, UserInviteService $inviteService, ImageRepo $imageRepo) { $this->user = $user; $this->userRepo = $userRepo; - parent::__construct(); + $this->inviteService = $inviteService; + $this->imageRepo = $imageRepo; } /** * Display a listing of the users. - * @param Request $request - * @return Response */ public function index(Request $request) { $this->checkPermission('users-manage'); $listDetails = [ - 'order' => $request->has('order') ? $request->get('order') : 'asc', - 'search' => $request->has('search') ? $request->get('search') : '', - 'sort' => $request->has('sort') ? $request->get('sort') : 'name', + 'order' => $request->get('order', 'asc'), + 'search' => $request->get('search', ''), + 'sort' => $request->get('sort', 'name'), ]; $users = $this->userRepo->getAllUsersPaginatedAndSorted(20, $listDetails); - $this->setPageTitle('Users'); + + $this->setPageTitle(trans('settings.users')); $users->appends($listDetails); - return view('users/index', ['users' => $users, 'listDetails' => $listDetails]); + + return view('users.index', ['users' => $users, 'listDetails' => $listDetails]); } /** * Show the form for creating a new user. - * @return Response */ public function create() { $this->checkPermission('users-manage'); $authMethod = config('auth.method'); - $roles = $this->userRepo->getAssignableRoles(); - return view('users/create', ['authMethod' => $authMethod, 'roles' => $roles]); + $roles = $this->userRepo->getAllRoles(); + + return view('users.create', ['authMethod' => $authMethod, 'roles' => $roles]); } /** * Store a newly created user in storage. - * @param Request $request - * @return Response + * + * @throws UserUpdateException + * @throws ValidationException */ public function store(Request $request) { $this->checkPermission('users-manage'); $validationRules = [ - 'name' => 'required', - 'email' => 'required|email|unique:users,email' + 'name' => ['required'], + 'email' => ['required', 'email', 'unique:users,email'], ]; $authMethod = config('auth.method'); - if ($authMethod === 'standard') { - $validationRules['password'] = 'required|min:5'; - $validationRules['password-confirm'] = 'required|same:password'; - } elseif ($authMethod === 'ldap') { - $validationRules['external_auth_id'] = 'required'; + $sendInvite = ($request->get('send_invite', 'false') === 'true'); + + if ($authMethod === 'standard' && !$sendInvite) { + $validationRules['password'] = ['required', 'min:6']; + $validationRules['password-confirm'] = ['required', 'same:password']; + } elseif ($authMethod === 'ldap' || $authMethod === 'saml2' || $authMethod === 'openid') { + $validationRules['external_auth_id'] = ['required']; } $this->validate($request, $validationRules); - $user = $this->user->fill($request->all()); if ($authMethod === 'standard') { - $user->password = bcrypt($request->get('password')); - } elseif ($authMethod === 'ldap') { + $user->password = bcrypt($request->get('password', Str::random(32))); + } elseif ($authMethod === 'ldap' || $authMethod === 'saml2' || $authMethod === 'openid') { $user->external_auth_id = $request->get('external_auth_id'); } + $user->refreshSlug(); $user->save(); - if ($request->has('roles')) { + if ($sendInvite) { + $this->inviteService->sendInvitation($user); + } + + if ($request->filled('roles')) { $roles = $request->get('roles'); - $user->roles()->sync($roles); + $this->userRepo->setUserRoles($user, $roles); } - // Get avatar from gravatar and save - if (!config('services.disable_services')) { - try { - $avatar = \Images::saveUserGravatar($user); - $user->avatar()->associate($avatar); - $user->save(); - } catch (Exception $e) { - \Log::error('Failed to save user gravatar image'); - } + $this->userRepo->downloadAndAssignUserAvatar($user); - } + $this->logActivity(ActivityType::USER_CREATE, $user); return redirect('/settings/users'); } /** * Show the form for editing the specified user. - * @param int $id - * @param SocialAuthService $socialAuthService - * @return Response */ - public function edit($id, SocialAuthService $socialAuthService) + public function edit(int $id, SocialAuthService $socialAuthService) { - $this->checkPermissionOr('users-manage', function () use ($id) { - return $this->currentUser->id == $id; - }); + $this->checkPermissionOrCurrentUser('users-manage', $id); - $authMethod = config('auth.method'); + /** @var User $user */ + $user = $this->user->newQuery()->with(['apiTokens', 'mfaValues'])->findOrFail($id); + + $authMethod = ($user->system_name) ? 'system' : config('auth.method'); - $user = $this->user->findOrFail($id); $activeSocialDrivers = $socialAuthService->getActiveDrivers(); - $this->setPageTitle('User Profile'); - $roles = $this->userRepo->getAssignableRoles(); - return view('users/edit', ['user' => $user, 'activeSocialDrivers' => $activeSocialDrivers, 'authMethod' => $authMethod, 'roles' => $roles]); + $mfaMethods = $user->mfaValues->groupBy('method'); + $this->setPageTitle(trans('settings.user_profile')); + $roles = $this->userRepo->getAllRoles(); + + return view('users.edit', [ + 'user' => $user, + 'activeSocialDrivers' => $activeSocialDrivers, + 'mfaMethods' => $mfaMethods, + 'authMethod' => $authMethod, + 'roles' => $roles, + ]); } /** * Update the specified user in storage. - * @param Request $request - * @param int $id - * @return Response + * + * @throws UserUpdateException + * @throws ImageUploadException + * @throws ValidationException */ - public function update(Request $request, $id) + public function update(Request $request, int $id) { - $this->preventAccessForDemoUsers(); - $this->checkPermissionOr('users-manage', function () use ($id) { - return $this->currentUser->id == $id; - }); + $this->preventAccessInDemoMode(); + $this->checkPermissionOrCurrentUser('users-manage', $id); $this->validate($request, [ 'name' => 'min:2', - 'email' => 'min:2|email|unique:users,email,' . $id, - 'password' => 'min:5|required_with:password_confirm', - 'password-confirm' => 'same:password|required_with:password' - ], [ - 'password-confirm.required_with' => 'Password confirmation required' + 'email' => ['min:2', 'email', 'unique:users,email,' . $id], + 'password' => ['min:6', 'required_with:password_confirm'], + 'password-confirm' => ['same:password', 'required_with:password'], + 'setting' => 'array', + 'profile_image' => array_merge(['nullable'], $this->getImageValidationRules()), ]); - $user = $this->user->findOrFail($id); - $user->fill($request->all()); + $user = $this->userRepo->getById($id); + $user->fill($request->except(['email'])); + + // Email updates + if (userCan('users-manage') && $request->filled('email')) { + $user->email = $request->get('email'); + } + + // Refresh the slug if the user's name has changed + if ($user->isDirty('name')) { + $user->refreshSlug(); + } // Role updates - if (userCan('users-manage') && $request->has('roles')) { + if (userCan('users-manage') && $request->filled('roles')) { $roles = $request->get('roles'); - $user->roles()->sync($roles); + $this->userRepo->setUserRoles($user, $roles); } // Password updates - if ($request->has('password') && $request->get('password') != '') { + if ($request->filled('password')) { $password = $request->get('password'); $user->password = bcrypt($password); } // External auth id updates - if ($this->currentUser->can('users-manage') && $request->has('external_auth_id')) { + if (user()->can('users-manage') && $request->filled('external_auth_id')) { $user->external_auth_id = $request->get('external_auth_id'); } + // Save an user-specific settings + if ($request->filled('setting')) { + foreach ($request->get('setting') as $key => $value) { + setting()->putUser($user, $key, $value); + } + } + + // Save profile image if in request + if ($request->hasFile('profile_image')) { + $imageUpload = $request->file('profile_image'); + $this->imageRepo->destroyImage($user->avatar); + $image = $this->imageRepo->saveNew($imageUpload, 'user', $user->id); + $user->image_id = $image->id; + } + + // Delete the profile image if reset option is in request + if ($request->has('profile_image_reset')) { + $this->imageRepo->destroyImage($user->avatar); + } + $user->save(); - session()->flash('success', 'User successfully updated'); + $this->showSuccessNotification(trans('settings.users_edit_success')); + $this->logActivity(ActivityType::USER_UPDATE, $user); + + $redirectUrl = userCan('users-manage') ? '/settings/users' : ('/settings/users/' . $user->id); - $redirectUrl = userCan('users-manage') ? '/settings/users' : '/settings/users/' . $user->id; return redirect($redirectUrl); } /** * Show the user delete page. - * @param $id - * @return \Illuminate\View\View */ - public function delete($id) + public function delete(int $id) { - $this->checkPermissionOr('users-manage', function () use ($id) { - return $this->currentUser->id == $id; - }); + $this->checkPermissionOrCurrentUser('users-manage', $id); - $user = $this->user->findOrFail($id); - $this->setPageTitle('Delete User ' . $user->name); - return view('users/delete', ['user' => $user]); + $user = $this->userRepo->getById($id); + $this->setPageTitle(trans('settings.users_delete_named', ['userName' => $user->name])); + + return view('users.delete', ['user' => $user]); } /** * Remove the specified user from storage. - * @param int $id - * @return Response + * + * @throws Exception */ - public function destroy($id) + public function destroy(Request $request, int $id) { - $this->preventAccessForDemoUsers(); - $this->checkPermissionOr('users-manage', function () use ($id) { - return $this->currentUser->id == $id; - }); + $this->preventAccessInDemoMode(); + $this->checkPermissionOrCurrentUser('users-manage', $id); $user = $this->userRepo->getById($id); + $newOwnerId = $request->get('new_owner_id', null); if ($this->userRepo->isOnlyAdmin($user)) { - session()->flash('error', 'You cannot delete the only admin'); + $this->showErrorNotification(trans('errors.users_cannot_delete_only_admin')); + return redirect($user->getEditUrl()); } - $this->userRepo->destroy($user); - session()->flash('success', 'User successfully removed'); + if ($user->system_name === 'public') { + $this->showErrorNotification(trans('errors.users_cannot_delete_guest')); + + return redirect($user->getEditUrl()); + } + + $this->userRepo->destroy($user, $newOwnerId); + $this->showSuccessNotification(trans('settings.users_delete_success')); + $this->logActivity(ActivityType::USER_DELETE, $user); return redirect('/settings/users'); } /** - * Show the user profile page - * @param $id - * @return \Illuminate\Contracts\View\Factory|\Illuminate\View\View + * Update the user's preferred book-list display setting. */ - public function showProfilePage($id) + public function switchBooksView(Request $request, int $id) { - $user = $this->userRepo->getById($id); - $userActivity = $this->userRepo->getActivity($user); - $recentlyCreated = $this->userRepo->getRecentlyCreated($user, 5, 0); - $assetCounts = $this->userRepo->getAssetCounts($user); - return view('users/profile', [ - 'user' => $user, - 'activity' => $userActivity, - 'recentlyCreated' => $recentlyCreated, - 'assetCounts' => $assetCounts - ]); + return $this->switchViewType($id, $request, 'books'); + } + + /** + * Update the user's preferred shelf-list display setting. + */ + public function switchShelvesView(Request $request, int $id) + { + return $this->switchViewType($id, $request, 'bookshelves'); + } + + /** + * Update the user's preferred shelf-view book list display setting. + */ + public function switchShelfView(Request $request, int $id) + { + return $this->switchViewType($id, $request, 'bookshelf'); + } + + /** + * For a type of list, switch with stored view type for a user. + */ + protected function switchViewType(int $userId, Request $request, string $listName) + { + $this->checkPermissionOrCurrentUser('users-manage', $userId); + + $viewType = $request->get('view_type'); + if (!in_array($viewType, ['grid', 'list'])) { + $viewType = 'list'; + } + + $user = $this->userRepo->getById($userId); + $key = $listName . '_view_type'; + setting()->putUser($user, $key, $viewType); + + return redirect()->back(302, [], "/settings/users/$userId"); + } + + /** + * Change the stored sort type for a particular view. + */ + public function changeSort(Request $request, string $id, string $type) + { + $validSortTypes = ['books', 'bookshelves', 'shelf_books']; + if (!in_array($type, $validSortTypes)) { + return redirect()->back(500); + } + + return $this->changeListSort($id, $request, $type); + } + + /** + * Toggle dark mode for the current user. + */ + public function toggleDarkMode() + { + $enabled = setting()->getForCurrentUser('dark-mode-enabled', false); + setting()->putUser(user(), 'dark-mode-enabled', $enabled ? 'false' : 'true'); + + return redirect()->back(); + } + + /** + * Update the stored section expansion preference for the given user. + */ + public function updateExpansionPreference(Request $request, string $id, string $key) + { + $this->checkPermissionOrCurrentUser('users-manage', $id); + $keyWhitelist = ['home-details']; + if (!in_array($key, $keyWhitelist)) { + return response('Invalid key', 500); + } + + $newState = $request->get('expand', 'false'); + + $user = $this->user->findOrFail($id); + setting()->putUser($user, 'section_expansion#' . $key, $newState); + + return response('', 204); + } + + /** + * Changed the stored preference for a list sort order. + */ + protected function changeListSort(int $userId, Request $request, string $listName) + { + $this->checkPermissionOrCurrentUser('users-manage', $userId); + + $sort = $request->get('sort'); + if (!in_array($sort, ['name', 'created_at', 'updated_at', 'default'])) { + $sort = 'name'; + } + + $order = $request->get('order'); + if (!in_array($order, ['asc', 'desc'])) { + $order = 'asc'; + } + + $user = $this->user->findOrFail($userId); + $sortKey = $listName . '_sort'; + $orderKey = $listName . '_sort_order'; + setting()->putUser($user, $sortKey, $sort); + setting()->putUser($user, $orderKey, $order); + + return redirect()->back(302, [], "/settings/users/$userId"); } }