BookStack Code Mirror - bookstack/blob - app/Users/Controllers/UserAccountController.php

   1 <?php
   2
   3 namespace BookStack\Users\Controllers;
   4
   5 use BookStack\Access\SocialAuthService;
   6 use BookStack\Http\Controller;
   7 use BookStack\Permissions\PermissionApplicator;
   8 use BookStack\Settings\UserNotificationPreferences;
   9 use BookStack\Settings\UserShortcutMap;
  10 use BookStack\Uploads\ImageRepo;
  11 use BookStack\Users\UserRepo;
  12 use Closure;
  13 use Illuminate\Http\Request;
  14 use Illuminate\Validation\Rules\Password;
  15
  16 class UserAccountController extends Controller
  17 {
  18     public function __construct(
  19         protected UserRepo $userRepo,
  20     ) {
  21         $this->middleware(function (Request $request, Closure $next) {
  22             $this->preventGuestAccess();
  23             return $next($request);
  24         });
  25     }
  26
  27     /**
  28      * Redirect the root my-account path to the main/first category.
  29      * Required as a controller method, instead of the Route::redirect helper,
  30      * to ensure the URL is generated correctly.
  31      */
  32     public function redirect()
  33     {
  34         return redirect('/my-account/profile');
  35     }
  36
  37     /**
  38      * Show the profile form interface.
  39      */
  40     public function showProfile()
  41     {
  42         $this->setPageTitle(trans('preferences.profile'));
  43
  44         return view('users.account.profile', [
  45             'model' => user(),
  46             'category' => 'profile',
  47         ]);
  48     }
  49
  50     /**
  51      * Handle the submission of the user profile form.
  52      */
  53     public function updateProfile(Request $request, ImageRepo $imageRepo)
  54     {
  55         $this->preventAccessInDemoMode();
  56
  57         $user = user();
  58         $validated = $this->validate($request, [
  59             'name'             => ['min:2', 'max:100'],
  60             'email'            => ['min:2', 'email', 'unique:users,email,' . $user->id],
  61             'language'         => ['string', 'max:15', 'alpha_dash'],
  62             'profile_image'    => array_merge(['nullable'], $this->getImageValidationRules()),
  63         ]);
  64
  65         $this->userRepo->update($user, $validated, userCan('users-manage'));
  66
  67         // Save profile image if in request
  68         if ($request->hasFile('profile_image')) {
  69             $imageUpload = $request->file('profile_image');
  70             $imageRepo->destroyImage($user->avatar);
  71             $image = $imageRepo->saveNew($imageUpload, 'user', $user->id);
  72             $user->image_id = $image->id;
  73             $user->save();
  74         }
  75
  76         // Delete the profile image if reset option is in request
  77         if ($request->has('profile_image_reset')) {
  78             $imageRepo->destroyImage($user->avatar);
  79             $user->image_id = 0;
  80             $user->save();
  81         }
  82
  83         return redirect('/my-account/profile');
  84     }
  85
  86     /**
  87      * Show the user-specific interface shortcuts.
  88      */
  89     public function showShortcuts()
  90     {
  91         $shortcuts = UserShortcutMap::fromUserPreferences();
  92         $enabled = setting()->getForCurrentUser('ui-shortcuts-enabled', false);
  93
  94         $this->setPageTitle(trans('preferences.shortcuts_interface'));
  95
  96         return view('users.account.shortcuts', [
  97             'category' => 'shortcuts',
  98             'shortcuts' => $shortcuts,
  99             'enabled' => $enabled,
 100         ]);
 101     }
 102
 103     /**
 104      * Update the user-specific interface shortcuts.
 105      */
 106     public function updateShortcuts(Request $request)
 107     {
 108         $enabled = $request->get('enabled') === 'true';
 109         $providedShortcuts = $request->get('shortcut', []);
 110         $shortcuts = new UserShortcutMap($providedShortcuts);
 111
 112         setting()->putForCurrentUser('ui-shortcuts', $shortcuts->toJson());
 113         setting()->putForCurrentUser('ui-shortcuts-enabled', $enabled);
 114
 115         $this->showSuccessNotification(trans('preferences.shortcuts_update_success'));
 116
 117         return redirect('/my-account/shortcuts');
 118     }
 119
 120     /**
 121      * Show the notification preferences for the current user.
 122      */
 123     public function showNotifications(PermissionApplicator $permissions)
 124     {
 125         $this->checkPermission('receive-notifications');
 126
 127         $preferences = (new UserNotificationPreferences(user()));
 128
 129         $query = user()->watches()->getQuery();
 130         $query = $permissions->restrictEntityRelationQuery($query, 'watches', 'watchable_id', 'watchable_type');
 131         $query = $permissions->filterDeletedFromEntityRelationQuery($query, 'watches', 'watchable_id', 'watchable_type');
 132         $watches = $query->with('watchable')->paginate(20);
 133
 134         $this->setPageTitle(trans('preferences.notifications'));
 135         return view('users.account.notifications', [
 136             'category' => 'notifications',
 137             'preferences' => $preferences,
 138             'watches' => $watches,
 139         ]);
 140     }
 141
 142     /**
 143      * Update the notification preferences for the current user.
 144      */
 145     public function updateNotifications(Request $request)
 146     {
 147         $this->preventAccessInDemoMode();
 148         $this->checkPermission('receive-notifications');
 149         $data = $this->validate($request, [
 150            'preferences' => ['required', 'array'],
 151            'preferences.*' => ['required', 'string'],
 152         ]);
 153
 154         $preferences = (new UserNotificationPreferences(user()));
 155         $preferences->updateFromSettingsArray($data['preferences']);
 156         $this->showSuccessNotification(trans('preferences.notifications_update_success'));
 157
 158         return redirect('/my-account/notifications');
 159     }
 160
 161     /**
 162      * Show the view for the "Access & Security" account options.
 163      */
 164     public function showAuth(SocialAuthService $socialAuthService)
 165     {
 166         $mfaMethods = user()->mfaValues()->get()->groupBy('method');
 167
 168         $this->setPageTitle(trans('preferences.auth'));
 169
 170         return view('users.account.auth', [
 171             'category' => 'auth',
 172             'mfaMethods' => $mfaMethods,
 173             'authMethod' => config('auth.method'),
 174             'activeSocialDrivers' => $socialAuthService->getActiveDrivers(),
 175         ]);
 176     }
 177
 178     /**
 179      * Handle the submission for the auth change password form.
 180      */
 181     public function updatePassword(Request $request)
 182     {
 183         $this->preventAccessInDemoMode();
 184
 185         if (config('auth.method') !== 'standard') {
 186             $this->showPermissionError();
 187         }
 188
 189         $validated = $this->validate($request, [
 190             'password'         => ['required_with:password_confirm', Password::default()],
 191             'password-confirm' => ['same:password', 'required_with:password'],
 192         ]);
 193
 194         $this->userRepo->update(user(), $validated, false);
 195
 196         $this->showSuccessNotification(trans('preferences.auth_change_password_success'));
 197
 198         return redirect('/my-account/auth');
 199     }
 200
 201     /**
 202      * Show the user self-delete page.
 203      */
 204     public function delete()
 205     {
 206         $this->setPageTitle(trans('preferences.delete_my_account'));
 207
 208         return view('users.account.delete', [
 209             'category' => 'profile',
 210         ]);
 211     }
 212
 213     /**
 214      * Remove the current user from the system.
 215      */
 216     public function destroy(Request $request)
 217     {
 218         $this->preventAccessInDemoMode();
 219
 220         $requestNewOwnerId = intval($request->get('new_owner_id')) ?: null;
 221         $newOwnerId = userCan('users-manage') ? $requestNewOwnerId : null;
 222
 223         $this->userRepo->destroy(user(), $newOwnerId);
 224
 225         return redirect('/');
 226     }
 227 }