· 8 years ago · Mar 15, 2018, 12:04 PM
1<?php
2
3 /**
4 * Users Controller
5 * Controller Class for Usuarios
6 * ---
7 * Written by Jordi Adame <jordi@jordi.net>
8 * J. Carlos Nieto <xiam@astrata.com.mx>
9 * Copyright (c) 2007 Astrata Software S.A. de C.V.
10 *
11 *
12 * @author Jordi Adame <jordi>
13 * @author J. Carlos Nieto <xiam>
14 * @copyright Copyright (c) 2007, Astrata Software S.A. de C.V.
15 * @version $Revision: 1.0 $
16 * @modifiedby $LastChangedBy: jordi$
17 * @lastmodified $Date: 2007-08-28 18:09:55$
18 *
19 */
20
21class UsersController extends AppController {
22
23 public $uses = array('User','Variable');
24 public $permissions = array(
25 'all' => array(
26 'index',
27 'login',
28 'logout',
29 'verifyUser',
30 'ajax_login',
31 'ajax_my_account',
32 'ajax_change_password',
33 'ajax_register',
34 'ajax_forgot_password',
35 'ajax_save_conf',
36 'ajax_delete_conf',
37 'ajax_send_invites',
38 'invite_register'
39 ),
40 'admin'=>array(
41 'super_index',
42 'admin_ajax_delete',
43 'admin_ajax_edit',
44 'admin_ajax_create',
45 'admin_ajax_index',
46 'admin_index',
47 'admin_ajax_change_active',
48 'admin_ajax_search_autocomplete',
49 'admin_ajax_edit_variables',
50
51 )
52 );
53
54 public function validExistenceEmail($email){
55
56 $exist_users = $this->User->findByEmail($email);
57 // valida si existe en users, y envites, y si esta bien formado el mail
58 if( $exist_users['User']['email'] == $email || !$this->_validemail($email) ) {
59 return true;
60 } else {
61 return false;
62 }
63 }
64 /**
65 * User access validation (for sensitive stuff)
66 *
67 * @author xiam
68 */
69 private function verifyUser($user_id, $plain_password) {
70 $user = $this->User->findById($user_id, 'User.password');
71 if ($user['User']['password'] == md5($plain_password)) {
72 return true;
73 }
74 return false;
75 }
76
77 /**
78 * Deletes an user
79 *
80 * @author xiam
81 */
82 public function admin_ajax_delete($id) {
83 if ($this->data) {
84 // action
85 if ($id == $this->data['User']['id']) {
86 $this->User->delete($id);
87 $this->json->response(
88 array(
89 'execute' => $this->meteora->rpcNotebookClosePage(
90 'usersAdminNotebook',
91 'delete_'.$id
92 ),
93 'successMessage' => _('The user has been deleted.')
94 )
95 );
96 }
97 } else {
98 $this->data = $this->User->findById($id, array('User.id'));
99
100 $this->set('id', $id);
101 $this->json->response(
102 array(
103 'execute' => $this->meteora->rpcNotebookOpenPage(
104 'usersAdminNotebook',
105 'delete_'.$id,
106 _('Delete user'),
107 $this->renderBuff()
108 )
109 )
110 );
111
112 }
113 }
114
115 /**
116 * Edits an user via ajax
117 *
118 * @author xiam
119 */
120 public function admin_ajax_edit($id) {
121 if ($this->data) {
122
123 $this->User->id = $id;
124
125 $user = $this->User->findByEmail($this->data['User']['email'], array('User.id'));
126
127 if ($user && $user['User']['id'] != $id) {
128 $this->json->response(
129 array(
130 'errorMessage' => _('The email is already registered for another user.')
131 )
132 );
133 }
134
135 $data = array(
136 'User' => array(
137 'first_name' => $this->data['User']['first_name'],
138 'last_name' => $this->data['User']['last_name'],
139 'email' => $this->data['User']['email'],
140 'group_id'=> $this->data['User']['group_id'],
141 'active'=>$this->data['User']['active']
142 )
143 );
144
145 if ($this->data['User']['password']) {
146 $data['User']['password'] = md5($this->data['User']['password']);
147 }
148
149 $this->User->save($data);
150
151 $this->json->response(
152 array(
153 'successMessage' => _('The user information has been updated'),
154 'execute' => $this->meteora->rpcNotebookClosePage(
155 'usersAdminNotebook',
156 'edit_'.$id
157 )
158 )
159 );
160 } else {
161 $this->User->Group->expects();
162 $this->set('Groups',$this->User->Group->find('list'));
163 $this->data = $this->User->findById($id);
164 $this->set('id', $id);
165 $this->data['User']['password'] = null;
166 $this->json->response(
167 array(
168 'execute' => $this->meteora->rpcNotebookOpenPage(
169 'usersAdminNotebook',
170 'edit_'.$id,
171 _('Editing user'),
172 $this->renderBuff()
173 )
174 )
175 );
176 }
177 }
178
179 /**
180 * Creates a new user via ajax
181 *
182 * @author xiam
183 */
184 public function admin_ajax_create() {
185 if ($this->data) {
186
187 if ($this->User->findByEmail($this->data['User']['email'])) {
188 $this->json->response(
189 array(
190 'errorMessage' => _('The email address has been already assigned.')
191 )
192 );
193 } else {
194 $this->User->id = null;
195
196 $this->data['User']['password'] = md5($this->data['User']['password']);
197
198 $this->User->save(
199 array(
200 'email' => $this->data['User']['email'],
201 'password' => md5($this->data['User']['password']),
202 'first_name' => $this->data['User']['first_name'],
203 'last_name' => $this->data['User']['last_name'],
204 'active' => 1,
205 'group_id'=>$this->data['User']['group_id']
206 )
207 );
208
209 $this->json->response(
210 array(
211 'execute' => array(
212 $this->meteora->rpcNotebookUpdatePage(
213 'usersAdminNotebook',
214 'index'
215 ),
216 $this->meteora->rpcNotebookSelectPage(
217 'usersAdminNotebook',
218 'index'
219 )
220 ),
221 'successMessage' => _('A new user has been added.')
222 )
223 );
224
225 }
226 }
227 //show template
228 $this->User->Group->expects();
229 $this->set('Groups',$this->User->Group->find('list'));
230 }
231
232 /**
233 * Ajax list of users
234 *
235 * @author xiam
236 */
237 public function admin_ajax_index() {
238 $page = $this->params['url']['page'];
239 $column = $this->params['url']['column'];
240 $order = $this->params['url']['order']? 1:0;
241 if($order){
242 $orderby = 'User.'.$this->params['url']['column']." DESC";
243 } else {
244 $orderby = 'User.'.$this->params['url']['column']." ASC";
245 }
246 $perpage=20;
247 if( $users = $this->User->findAll(null,null,$orderby,$perpage,$page)) {
248 $this->set('users', $users);
249 $this->set('countpages',ceil(count($this->User->findAll())/$perpage));
250 $this->set('actualpage',$page);
251 $this->set('column',$column);
252 $this->set('order',$order);
253 } else {
254 die();
255 }
256 }
257
258 public function admin_ajax_search_autocomplete() {
259 $str_search = $this->params['url']['search'];
260 $user = $this->User->find('all',array('conditions'=>"User.email like '%".$str_search."%'"));
261 $res = array();
262 if($user!=false){
263 foreach($user as $sea) {
264 $res[$sea['User']['id']] = $sea['User']['email'];
265 }
266 $this->json->response($res);
267 } else { die(); }
268
269 }
270
271 public function admin_ajax_change_active($user_id) {
272 $this->User->id=$user_id;
273
274 $this->data= $this->User->read();
275
276 $this->data['User']['active'] = $this->data['User']['active'] ? 0:1;
277 $this->User->save($this->data);
278 $this->json->response( array('successMessage'=>"Change active status of ".$this->data['User']['email']));
279
280 }
281
282 /**
283 * Display management controls
284 *
285 * @author xiam
286 */
287 public function admin_index() {
288
289 }
290
291 /**
292 * Helps the user to reset his/hers password
293 *
294 * @author xiam
295 */
296 public function ajax_forgot_password($step = 0) {
297 if ($this->data) {
298 switch ($step) {
299 case 2:
300
301 if ($this->data['User']['token']) {
302 $user = $this->User->find("
303 User.email = '{$this->data['User']['email']}'
304 AND User.forgot_password_token = '".md5($this->data['User']['token'])."'
305 ", array('id'));
306 } else {
307 $user = null;
308 }
309
310 if ($user && $this->data['User']['new_password'] && $this->data['User']['new_password'] == $this->data['User']['repeat_password']) {
311 $this->User->id = $user['User']['id'];
312 $this->User->save(
313 array(
314 'User' => array(
315 'password' => md5($this->data['User']['new_password']),
316 'forgot_password_token' => ''
317 )
318 )
319 );
320
321 $this->json->response(
322 array(
323 'successMessage' => _('Please login with your new username and password.'),
324 'execute' => array(
325 $this->meteora->rpcNotebookSelectPage(
326 'usersLoginNotebook',
327 'login'
328 ),
329 $this->meteora->rpcNotebookUpdatePage(
330 'usersLoginNotebook',
331 'forgot_password',
332 array('url' => '/users/ajax_forgot_password')
333 )
334 )
335 )
336 );
337 } else {
338 $this->json->response(
339 array(
340 'errorMessage' => _('The passwords do not match.')
341 )
342 );
343 }
344 break;
345 case 1:
346
347 if ($this->data['User']['token']) {
348 $user = $this->User->find("
349 User.email = '{$this->data['User']['email']}'
350 AND User.forgot_password_token = '".md5($this->data['User']['token'])."'
351 ", array('id'));
352 } else {
353 $user = null;
354 }
355
356 if ($user) {
357 // next step
358 $this->set('step', 2);
359
360 $this->json->response(
361 array(
362 'successMessage' => _('Access granted! now you can specify a new password.'),
363 'execute' => array(
364 $this->meteora->rpcNotebookUpdatePage(
365 'usersLoginNotebook',
366 'forgot_password',
367 $this->renderBuff()
368 )
369 )
370 )
371 );
372 } else {
373 $this->json->response(
374 array(
375 'errorMessage' => _('The security token is incorrect.')
376 )
377 );
378 }
379 break;
380 default:
381
382 // sucks
383 $token = substr(md5(base64_encode(time()*rand())), 0, 16);
384
385 $user = $this->User->findByEmail($this->data['User']['email'], 'id');
386
387 if ($user) {
388 // next step
389 $this->set('step', 1);
390
391 // receives the user's email and creates the token
392 $this->User->id = $user['User']['id'];
393 $this->User->save(
394 array(
395 'User' => array(
396 'forgot_password_token' => md5($token)
397 )
398 )
399 );
400 // TODO: send an email
401 } else {
402 // should we notify when the user enters a wrong e-mail?
403 }
404 $this->json->response(
405 array(
406 'successMessage' => _('A security token has been sent to your e-mail. '.$token),
407 'execute' => array(
408 $this->meteora->rpcNotebookUpdatePage(
409 'usersLoginNotebook',
410 'forgot_password',
411 $this->renderBuff()
412 )
413 )
414 )
415 );
416 break;
417 }
418 }
419 $this->set('step', $step);
420 }
421
422 /**
423 * Registers a new user.
424 *
425 * @author xiam
426 */
427 public function ajax_register() {
428 if($this->data) {
429 if($this->validExistenceEmail($this->data['User']['email']) ) {
430 $message = array("errorMessage"=>"Email exist or invalid ");
431 } else if ($this->data['User']['password']!=$this->data['User']['password2']){
432 $message = array('errorMessage'=>'Password not match ');
433 } else {
434 $this->data['User']['password'] = md5($this->data['User']['password']);
435 $users= $this->User->Group->findByName('users');
436 $this->data['User']['group_id']=$users['Group']['id'];
437 $this->data['User']['money'] = $this->Variable->getMoney('register');
438 if($this->User->save($this->data)) {
439 $usser = $this->User->getLastInsertID();
440 $this->User->balanceLog(
441 $usser,
442 'register_user',
443 $usser
444 );
445 $message = array("successMessage"=>"Account Create, now you can login ","execute"=>"dia.close(); Meteora.removeOverlay();");
446
447 } else {
448 $message = array("errorMessage" => "Error on request");
449 }
450 }
451 $this->json->response($message);
452 } else {
453 //show template
454 }
455 }
456
457 /**
458 * Performs a login.
459 *
460 * @author jordi adame
461 * @author xiam
462 */
463 public function ajax_login() {
464
465 if ($this->data) {
466 $logged_in = $this->auth->login($this->data);
467 if ($logged_in) {
468 $exists = $this->User->findByEmail($this->data['User']['email']);
469 $this->conf->stop = true;
470 $this->json->response(
471 array(
472 'successMessage' => _('Logged in, please wait...'),
473 'redirectTo' => '/users'
474 )
475 );
476 } else {
477 $this->json->response(
478 array(
479 'errorMessage' => _('Login failed')
480 )
481 );
482 }
483 } else {
484 //print_r($_SESSION);
485 }
486
487 }
488
489 /**
490 * Login view
491 */
492 public function login() {
493 $this->layout = 'login';
494 }
495
496 /**
497 * logout function
498 *
499 * @author Jordi Adame <jordi@astrata.com.mx>
500 * @version 1.0
501 * @since 1.0
502 */
503 public function logout() {
504 $this->auth->logout();
505 $this->conf->stop = true;
506 $_SESSION = array();
507 $this->Session->renew();
508 $this->redirect('/');
509 }
510
511 /**
512 * Shows user options if the user is logged in
513 *
514 * @author xiam
515 */
516 public function index() {
517 if ($this->Session->read('uid')) {
518
519 } else {
520 $this->redirect('/users/login');
521 }
522 }
523
524 /**
525 * Performs self account modifications
526 *
527 * @author xiam
528 */
529 public function ajax_my_account() {
530 if($this->data){
531 // mail repetido
532 $mail_exist = $this->User->findByEmail($this->data['User']['email']);
533 if($this->data['User']['id']!=$mail_exist['User']['id'] && !$this->_validemail($this->data['User']['email'])){
534 $message=array("errorMessage"=>"Email Exist");
535 } else {
536 $this->User->id = $this->data['User']['id'];
537 if($this->User->save($this->data)){
538 $this->json->response(array('successMessage' => 'The account has been updated',
539 'execute'=> $this->meteora->rpcNotebookUpdatePage(
540 'usersAccountNotebook',
541 'index'
542 )
543 )
544 );
545 } else {
546 $this->json->response(array('errorMessage' => 'The account has no been updated'));
547
548 }
549
550 }
551 $this->json->response($message);
552 } else {
553 //show template
554 $this->data = $this->User->findById($this->Session->read('uid'));
555 }
556 }
557
558 /**
559 * Performs a self password modification
560 *
561 * @author xiam
562 */
563 public function ajax_change_password() {
564 if ($this->data) {
565 if ($this->verifyUser($this->data['User']['id'], $this->data['User']['password'])) {
566
567 // the passwords must match and not be null
568 if ($this->data['User']['new_password'] && $this->data['User']['new_password'] == $this->data['User']['confirm_password']) {
569 $data = Array(
570 'User' => array(
571 'password' => md5($this->data['User']['new_password'])
572 )
573 );
574 $this->User->id = $this->data['User']['id'];
575 $this->User->save($data);
576
577 $this->json->response(
578 array(
579 'successMessage' => _('Your password has been updated.'),
580 'execute' => array(
581 $this->meteora->rpcNotebookUpdatePage(
582 'usersAccountNotebook',
583 'index'
584 ),
585 $this->meteora->rpcNotebookSelectPage(
586 'usersAccountNotebook',
587 'index'
588 )
589 )
590 )
591 );
592 } else {
593
594 $this->json->response(
595 array(
596 'errorMessage' => _('Passwords do not match.')
597 )
598 );
599 }
600
601 } else {
602 $this->json->response(
603 array(
604 'errorMessage' => _('The given password is incorrect.')
605 )
606 );
607 }
608 } else {
609 $this->data = $this->User->findById($this->Session->read('uid'));
610 if (empty($this->data)) {
611 // this should not happen
612 die(0);
613 } else {
614 $this->data['User']['password'] = null;
615 }
616
617 }
618 }
619
620 /// admin index of ADMIN
621
622 function super_index() {
623 // show view template with the dirs of all admins
624 }
625
626 // admin of variables
627 //
628 function admin_ajax_edit_variables() {
629 if($this->data){
630
631 if(!$this->_isfloat($this->data['Variable1']['value']) && !$this->_isfloat($this->data['Variable2']['value'])) {
632 $message = array('errorMessage' => "The value is not float");
633 } else {
634
635 $data1 = $this->Variable->findByVar($this->data['Variable1']['var']); // accept_invite
636 if(!$data1){ // insert a row table empty
637 $data = array(
638 'Variable'=> array(
639 'var'=>'user_accept_invite_money',
640 'value'=>$this->data['Variable1']['value'],
641 'id'=>null
642 )
643 );
644 $this->Variable->save($data);
645 $data1 = $this->Variable->findByVar($this->data['Variable1']['var']);
646 }
647 $data1['Variable']['value'] = $this->data['Variable1']['value'];
648
649
650 $data2 = $this->Variable->findByVar($this->data['Variable2']['var']); // invite
651 if(!$data2){ // insert a row table empty
652
653 $data = array(
654 'Variable'=> array(
655 'var'=>'user_invite_money',
656 'value'=>$this->data['Variable2']['value'],
657 'id'=>null
658 )
659 );
660 $this->Variable->save($data);
661 $data2 = $this->Variable->findByVar($this->data['Variable2']['var']);
662
663 }
664
665 $data2['Variable']['value']=$this->data['Variable2']['value'];
666
667 $data3 = $this->Variable->findByVar($this->data['Variable3']['var']);
668 if(!$data3){ // insert a row table empty
669 $data = array(
670 'Variable'=> array(
671 'var'=>'user_register_money',
672 'value'=> $this->data['Variable3']['value'],
673 'id'=>null
674 )
675 );
676 $this->Variable->save($data);
677 $data3 = $this->Variable->findByVar($this->data['Variable3']['var']);
678 }
679 $data3['Variable']['value']=$this->data['Variable3']['value'];
680
681 $this->Variable->save($data1);
682 $this->Variable->save($data2);
683 $this->Variable->save($data3);
684
685 $message = array('successMessage'=>"Variable save",'execute'=>
686 $this->meteora->rpcNotebookUpdatePage('usersAdminNotebook','variables')
687 );
688 }
689 $this->json->response($message);
690 } else {
691
692 // show template
693 $this->set('accept_invite',$this->Variable->find(array('var'=>'user_accept_invite_money')));
694 $this->set('invite',$this->Variable->find(array('var'=>'user_invite_money')));
695 $this->set('register',$this->Variable->find(array('var'=>'user_register_money')));
696
697
698 }
699
700 }
701 function ajax_send_invites(){
702 $this->data = $this->User->findById($this->Session->read('uid'));
703
704 }
705 function invite_register(){
706 if(empty($this->data)){ // show template
707 $hash = $this->params['url']['hash'];
708 $user=$this->User->Invite->findByHash($hash);
709
710 if($this->validExistenceEmail($user['Invite']['email'])){ // if the invite is already registerd redirect to /
711 $this->redirect('/');
712 }
713
714 $this->set('email',$user['Invite']['email']); // register the mail of invite
715
716 } else { // save user
717 if($this->validExistenceEmail($this->data['User']['email']) ) {
718 $message = array("errorMessage"=>"Email ".$this->data['User']['email']." exist or invalid ");
719 } else if ($this->data['User']['password']!=$this->data['User']['password2']){
720 $message = array('errorMessage'=>'Password not match ');
721 } else {
722 //register user
723 $this->data['User']['password'] = md5($this->data['User']['password']);
724 $users= $this->User->Group->findByName('users');
725 $this->data['User']['group_id'] = $users['Group']['id'];
726 $this->data['User']['money'] = $this->Variable->getMoney('register'); // agrega dinero inicial
727
728 if($this->User->save($this->data)) {
729 $nuid = $this->User->getLastInsertID();
730 $this->User->balanceLog($nuid,'register_user',$nuid);
731 $message = array(
732 "successMessage"=>"Account Create, now you can login with the mail: "+$this->data['User']['email'],
733 'redirectTo'=>'/users/'
734 );
735 // search the user who invite the new user
736 $user_invite = $this->User->Invite->findByEmail($this->data['User']['email']);
737 $user = $this->User->findbyId( $user_invite['Invite']['user_id']);
738 $user['User']['money']+= $this->Variable->getMoney('accept_invite');
739 $this->User->balanceLog($user['User']['id'],'accept_invite',$user_invite['Invite']['id']);
740 $this->User->save($user);
741
742 } else {
743 $message = array("errorMessage" => "Error on request");
744 }
745 }
746 $this->json->response($message);
747 }
748 }
749
750
751}