BookStack Code Mirror - bookstack/blob - app/Http/Controllers/UserController.php

   1 <?php
   2
   3 namespace BookStack\Http\Controllers;
   4
   5 use BookStack\Auth\Access\SocialAuthService;
   6 use BookStack\Auth\Queries\UsersAllPaginatedAndSorted;
   7 use BookStack\Auth\Role;
   8 use BookStack\Auth\User;
   9 use BookStack\Auth\UserRepo;
  10 use BookStack\Exceptions\ImageUploadException;
  11 use BookStack\Exceptions\UserUpdateException;
  12 use BookStack\Uploads\ImageRepo;
  13 use BookStack\Util\SimpleListOptions;
  14 use Exception;
  15 use Illuminate\Http\Request;
  16 use Illuminate\Support\Facades\DB;
  17 use Illuminate\Validation\Rules\Password;
  18 use Illuminate\Validation\ValidationException;
  19
  20 class UserController extends Controller
  21 {
  22     protected UserRepo $userRepo;
  23     protected ImageRepo $imageRepo;
  24
  25     /**
  26      * UserController constructor.
  27      */
  28     public function __construct(UserRepo $userRepo, ImageRepo $imageRepo)
  29     {
  30         $this->userRepo = $userRepo;
  31         $this->imageRepo = $imageRepo;
  32     }
  33
  34     /**
  35      * Display a listing of the users.
  36      */
  37     public function index(Request $request)
  38     {
  39         $this->checkPermission('users-manage');
  40
  41         $listOptions = SimpleListOptions::fromRequest($request, 'users')->withSortOptions([
  42             'name' => trans('common.sort_name'),
  43             'email' => trans('auth.email'),
  44             'created_at' => trans('common.sort_created_at'),
  45             'updated_at' => trans('common.sort_updated_at'),
  46             'last_activity_at' => trans('settings.users_latest_activity'),
  47         ]);
  48
  49         $users = (new UsersAllPaginatedAndSorted())->run(20, $listOptions);
  50
  51         $this->setPageTitle(trans('settings.users'));
  52         $users->appends($listOptions->getPaginationAppends());
  53
  54         return view('users.index', [
  55             'users'       => $users,
  56             'listOptions' => $listOptions,
  57         ]);
  58     }
  59
  60     /**
  61      * Show the form for creating a new user.
  62      */
  63     public function create()
  64     {
  65         $this->checkPermission('users-manage');
  66         $authMethod = config('auth.method');
  67         $roles = Role::query()->orderBy('display_name', 'asc')->get();
  68         $this->setPageTitle(trans('settings.users_add_new'));
  69
  70         return view('users.create', ['authMethod' => $authMethod, 'roles' => $roles]);
  71     }
  72
  73     /**
  74      * Store a new user in storage.
  75      *
  76      * @throws ValidationException
  77      */
  78     public function store(Request $request)
  79     {
  80         $this->checkPermission('users-manage');
  81
  82         $authMethod = config('auth.method');
  83         $sendInvite = ($request->get('send_invite', 'false') === 'true');
  84         $externalAuth = $authMethod === 'ldap' || $authMethod === 'saml2' || $authMethod === 'oidc';
  85         $passwordRequired = ($authMethod === 'standard' && !$sendInvite);
  86
  87         $validationRules = [
  88             'name'             => ['required', 'max:100'],
  89             'email'            => ['required', 'email', 'unique:users,email'],
  90             'language'         => ['string', 'max:15', 'alpha_dash'],
  91             'roles'            => ['array'],
  92             'roles.*'          => ['integer'],
  93             'password'         => $passwordRequired ? ['required', Password::default()] : null,
  94             'password-confirm' => $passwordRequired ? ['required', 'same:password'] : null,
  95             'external_auth_id' => $externalAuth ? ['required'] : null,
  96         ];
  97
  98         $validated = $this->validate($request, array_filter($validationRules));
  99
 100         DB::transaction(function () use ($validated, $sendInvite) {
 101             $this->userRepo->create($validated, $sendInvite);
 102         });
 103
 104         return redirect('/settings/users');
 105     }
 106
 107     /**
 108      * Show the form for editing the specified user.
 109      */
 110     public function edit(int $id, SocialAuthService $socialAuthService)
 111     {
 112         $this->checkPermissionOrCurrentUser('users-manage', $id);
 113
 114         /** @var User $user */
 115         $user = User::query()->with(['apiTokens', 'mfaValues'])->findOrFail($id);
 116
 117         $authMethod = ($user->system_name) ? 'system' : config('auth.method');
 118
 119         $activeSocialDrivers = $socialAuthService->getActiveDrivers();
 120         $mfaMethods = $user->mfaValues->groupBy('method');
 121         $this->setPageTitle(trans('settings.user_profile'));
 122         $roles = Role::query()->orderBy('display_name', 'asc')->get();
 123
 124         return view('users.edit', [
 125             'user'                => $user,
 126             'activeSocialDrivers' => $activeSocialDrivers,
 127             'mfaMethods'          => $mfaMethods,
 128             'authMethod'          => $authMethod,
 129             'roles'               => $roles,
 130         ]);
 131     }
 132
 133     /**
 134      * Update the specified user in storage.
 135      *
 136      * @throws UserUpdateException
 137      * @throws ImageUploadException
 138      * @throws ValidationException
 139      */
 140     public function update(Request $request, int $id)
 141     {
 142         $this->preventAccessInDemoMode();
 143         $this->checkPermissionOrCurrentUser('users-manage', $id);
 144
 145         $validated = $this->validate($request, [
 146             'name'             => ['min:2', 'max:100'],
 147             'email'            => ['min:2', 'email', 'unique:users,email,' . $id],
 148             'password'         => ['required_with:password_confirm', Password::default()],
 149             'password-confirm' => ['same:password', 'required_with:password'],
 150             'language'         => ['string', 'max:15', 'alpha_dash'],
 151             'roles'            => ['array'],
 152             'roles.*'          => ['integer'],
 153             'external_auth_id' => ['string'],
 154             'profile_image'    => array_merge(['nullable'], $this->getImageValidationRules()),
 155         ]);
 156
 157         $user = $this->userRepo->getById($id);
 158         $this->userRepo->update($user, $validated, userCan('users-manage'));
 159
 160         // Save profile image if in request
 161         if ($request->hasFile('profile_image')) {
 162             $imageUpload = $request->file('profile_image');
 163             $this->imageRepo->destroyImage($user->avatar);
 164             $image = $this->imageRepo->saveNew($imageUpload, 'user', $user->id);
 165             $user->image_id = $image->id;
 166             $user->save();
 167         }
 168
 169         // Delete the profile image if reset option is in request
 170         if ($request->has('profile_image_reset')) {
 171             $this->imageRepo->destroyImage($user->avatar);
 172         }
 173
 174         $redirectUrl = userCan('users-manage') ? '/settings/users' : "/settings/users/{$user->id}";
 175
 176         return redirect($redirectUrl);
 177     }
 178
 179     /**
 180      * Show the user delete page.
 181      */
 182     public function delete(int $id)
 183     {
 184         $this->checkPermissionOrCurrentUser('users-manage', $id);
 185
 186         $user = $this->userRepo->getById($id);
 187         $this->setPageTitle(trans('settings.users_delete_named', ['userName' => $user->name]));
 188
 189         return view('users.delete', ['user' => $user]);
 190     }
 191
 192     /**
 193      * Remove the specified user from storage.
 194      *
 195      * @throws Exception
 196      */
 197     public function destroy(Request $request, int $id)
 198     {
 199         $this->preventAccessInDemoMode();
 200         $this->checkPermissionOrCurrentUser('users-manage', $id);
 201
 202         $user = $this->userRepo->getById($id);
 203         $newOwnerId = $request->get('new_owner_id', null);
 204
 205         $this->userRepo->destroy($user, $newOwnerId);
 206
 207         return redirect('/settings/users');
 208     }
 209
 210     /**
 211      * Update the user's preferred book-list display setting.
 212      */
 213     public function switchBooksView(Request $request, int $id)
 214     {
 215         return $this->switchViewType($id, $request, 'books');
 216     }
 217
 218     /**
 219      * Update the user's preferred shelf-list display setting.
 220      */
 221     public function switchShelvesView(Request $request, int $id)
 222     {
 223         return $this->switchViewType($id, $request, 'bookshelves');
 224     }
 225
 226     /**
 227      * Update the user's preferred shelf-view book list display setting.
 228      */
 229     public function switchShelfView(Request $request, int $id)
 230     {
 231         return $this->switchViewType($id, $request, 'bookshelf');
 232     }
 233
 234     /**
 235      * For a type of list, switch with stored view type for a user.
 236      */
 237     protected function switchViewType(int $userId, Request $request, string $listName)
 238     {
 239         $this->checkPermissionOrCurrentUser('users-manage', $userId);
 240
 241         $viewType = $request->get('view_type');
 242         if (!in_array($viewType, ['grid', 'list'])) {
 243             $viewType = 'list';
 244         }
 245
 246         $user = $this->userRepo->getById($userId);
 247         $key = $listName . '_view_type';
 248         setting()->putUser($user, $key, $viewType);
 249
 250         return redirect()->back(302, [], "/settings/users/$userId");
 251     }
 252
 253     /**
 254      * Change the stored sort type for a particular view.
 255      */
 256     public function changeSort(Request $request, string $id, string $type)
 257     {
 258         $validSortTypes = ['books', 'bookshelves', 'shelf_books', 'users', 'roles', 'webhooks'];
 259         if (!in_array($type, $validSortTypes)) {
 260             return redirect()->back(500);
 261         }
 262
 263         $this->checkPermissionOrCurrentUser('users-manage', $id);
 264
 265         $sort = substr($request->get('sort') ?: 'name', 0, 50);
 266         $order = $request->get('order') === 'desc' ? 'desc' : 'asc';
 267
 268         $user = $this->userRepo->getById($id);
 269         $sortKey = $type . '_sort';
 270         $orderKey = $type . '_sort_order';
 271         setting()->putUser($user, $sortKey, $sort);
 272         setting()->putUser($user, $orderKey, $order);
 273
 274         return redirect()->back(302, [], "/settings/users/{$id}");
 275     }
 276
 277     /**
 278      * Toggle dark mode for the current user.
 279      */
 280     public function toggleDarkMode()
 281     {
 282         $enabled = setting()->getForCurrentUser('dark-mode-enabled', false);
 283         setting()->putUser(user(), 'dark-mode-enabled', $enabled ? 'false' : 'true');
 284
 285         return redirect()->back();
 286     }
 287
 288     /**
 289      * Update the stored section expansion preference for the given user.
 290      */
 291     public function updateExpansionPreference(Request $request, string $id, string $key)
 292     {
 293         $this->checkPermissionOrCurrentUser('users-manage', $id);
 294         $keyWhitelist = ['home-details'];
 295         if (!in_array($key, $keyWhitelist)) {
 296             return response('Invalid key', 500);
 297         }
 298
 299         $newState = $request->get('expand', 'false');
 300
 301         $user = $this->userRepo->getById($id);
 302         setting()->putUser($user, 'section_expansion#' . $key, $newState);
 303
 304         return response('', 204);
 305     }
 306
 307     public function updateCodeLanguageFavourite(Request $request)
 308     {
 309         $validated = $this->validate($request, [
 310             'language' => ['required', 'string', 'max:20'],
 311             'active'   => ['required', 'bool'],
 312         ]);
 313
 314         $currentFavoritesStr = setting()->getForCurrentUser('code-language-favourites', '');
 315         $currentFavorites = array_filter(explode(',', $currentFavoritesStr));
 316
 317         $isFav = in_array($validated['language'], $currentFavorites);
 318         if (!$isFav && $validated['active']) {
 319             $currentFavorites[] = $validated['language'];
 320         } elseif ($isFav && !$validated['active']) {
 321             $index = array_search($validated['language'], $currentFavorites);
 322             array_splice($currentFavorites, $index, 1);
 323         }
 324
 325         setting()->putUser(user(), 'code-language-favourites', implode(',', $currentFavorites));
 326     }
 327 }