engelsystem/includes/controller/users_controller.php

<?php
use Engelsystem\ShiftCalendarRenderer;
use Engelsystem\ShiftsFilter;

/**
 * Route user actions.
 */
function users_controller()
{
    global $user;

    if (!isset($user)) {
        redirect(page_link_to(''));
    }

    if (!isset($_REQUEST['action'])) {
        $_REQUEST['action'] = 'list';
    }

    switch ($_REQUEST['action']) {
        default:
        case 'list':
            return users_list_controller();
        case 'view':
            return user_controller();
        case 'edit':
            return user_edit_controller();
        case 'delete':
            return user_delete_controller();
        case 'edit_vouchers':
            return user_edit_vouchers_controller();
    }
}

/**
 * Delete a user, requires to enter own password for reasons.
 */
function user_delete_controller()
{
    global $privileges, $user;

    if (isset($_REQUEST['user_id'])) {
        $user_source = User($_REQUEST['user_id']);
    } else {
        $user_source = $user;
    }

    if (!in_array('admin_user', $privileges)) {
        redirect(page_link_to(''));
    }

    // You cannot delete yourself
    if ($user['UID'] == $user_source['UID']) {
        error(_("You cannot delete yourself."));
        redirect(user_link($user));
    }

    if (isset($_REQUEST['submit'])) {
        $valid = true;

        if (!(isset($_REQUEST['password']) && verify_password($_REQUEST['password'], $user['Passwort'],
                $user['UID']))
        ) {
            $valid = false;
            error(_("Your password is incorrect.  Please try it again."));
        }

        if ($valid) {
            $result = User_delete($user_source['UID']);
            if ($result === false) {
                engelsystem_error('Unable to delete user.');
            }

            mail_user_delete($user_source);
            success(_("User deleted."));
            engelsystem_log(sprintf("Deleted %s", User_Nick_render($user_source)));

            redirect(users_link());
        }
    }

    return [
        sprintf(_("Delete %s"), $user_source['Nick']),
        User_delete_view($user_source)
    ];
}

function users_link()
{
    return page_link_to('users');
}

function user_edit_link($user)
{
    return page_link_to('admin_user') . '&user_id=' . $user['UID'];
}

function user_delete_link($user)
{
    return page_link_to('users') . '&action=delete&user_id=' . $user['UID'];
}

function user_link($user)
{
    return page_link_to('users') . '&action=view&user_id=' . $user['UID'];
}

function user_edit_vouchers_controller()
{
    global $privileges, $user;

    if (isset($_REQUEST['user_id'])) {
        $user_source = User($_REQUEST['user_id']);
    } else {
        $user_source = $user;
    }

    if (!in_array('admin_user', $privileges)) {
        redirect(page_link_to(''));
    }

    if (isset($_REQUEST['submit'])) {
        $valid = true;

        if (isset($_REQUEST['vouchers']) && test_request_int('vouchers') && trim($_REQUEST['vouchers']) >= 0) {
            $vouchers = trim($_REQUEST['vouchers']);
        } else {
            $valid = false;
            error(_("Please enter a valid number of vouchers."));
        }

        if ($valid) {
            $user_source['got_voucher'] = $vouchers;

            $result = User_update($user_source);
            if ($result === false) {
                engelsystem_error('Unable to update user.');
            }

            success(_("Saved the number of vouchers."));
            engelsystem_log(User_Nick_render($user_source) . ': ' . sprintf("Got %s vouchers",
                    $user_source['got_voucher']));

            redirect(user_link($user_source));
        }
    }

    return [
        sprintf(_("%s's vouchers"), $user_source['Nick']),
        User_edit_vouchers_view($user_source)
    ];
}

function user_controller()
{
    global $privileges, $user;

    $user_source = $user;
    if (isset($_REQUEST['user_id'])) {
        $user_source = User($_REQUEST['user_id']);
        if ($user_source == null) {
            error(_("User not found."));
            redirect('?');
        }
    }

    $shifts = Shifts_by_user($user_source, in_array("user_shifts_admin", $privileges));
    foreach ($shifts as &$shift) {
        // TODO: Move queries to model
        $shift['needed_angeltypes'] = sql_select("SELECT DISTINCT `AngelTypes`.* FROM `ShiftEntry` JOIN `AngelTypes` ON `ShiftEntry`.`TID`=`AngelTypes`.`id` WHERE `ShiftEntry`.`SID`='" . sql_escape($shift['SID']) . "'  ORDER BY `AngelTypes`.`name`");
        foreach ($shift['needed_angeltypes'] as &$needed_angeltype) {
            $needed_angeltype['users'] = sql_select("
          SELECT `ShiftEntry`.`freeloaded`, `User`.*
          FROM `ShiftEntry`
          JOIN `User` ON `ShiftEntry`.`UID`=`User`.`UID`
          WHERE `ShiftEntry`.`SID`='" . sql_escape($shift['SID']) . "'
          AND `ShiftEntry`.`TID`='" . sql_escape($needed_angeltype['id']) . "'");
        }
    }

    if ($user_source['api_key'] == "") {
        User_reset_api_key($user_source, false);
    }

    return [
        $user_source['Nick'],
        User_view(
            $user_source,
            in_array('admin_user', $privileges),
            User_is_freeloader($user_source),
            User_angeltypes($user_source),
            User_groups($user_source),
            $shifts,
            $user['UID'] == $user_source['UID']
        )
    ];
}

/**
 * List all users.
 */
function users_list_controller()
{
    global $privileges;

    if (!in_array('admin_user', $privileges)) {
        redirect(page_link_to(''));
    }

    $order_by = 'Nick';
    if (isset($_REQUEST['OrderBy']) && in_array($_REQUEST['OrderBy'], User_sortable_columns())) {
        $order_by = $_REQUEST['OrderBy'];
    }

    $users = Users($order_by);
    if ($users === false) {
        engelsystem_error('Unable to load users.');
    }

    foreach ($users as &$user) {
        $user['freeloads'] = count(ShiftEntries_freeloaded_by_user($user));
    }

    return [
        _('All users'),
        Users_view(
            $users,
            $order_by,
            User_arrived_count(),
            User_active_count(),
            User_force_active_count(),
            ShiftEntries_freeleaded_count(),
            User_tshirts_count(),
            User_got_voucher_count()
        )
    ];
}

/**
 * Second step of password recovery: set a new password using the token link from email
 */
function user_password_recovery_set_new_controller()
{
    global $min_password_length;
    $user_source = User_by_password_recovery_token($_REQUEST['token']);
    if ($user_source == null) {
        error(_("Token is not correct."));
        redirect(page_link_to('login'));
    }

    if (isset($_REQUEST['submit'])) {
        $valid = true;

        if (isset($_REQUEST['password']) && strlen($_REQUEST['password']) >= $min_password_length) {
            if ($_REQUEST['password'] != $_REQUEST['password2']) {
                $valid = false;
                error(_("Your passwords don't match."));
            }
        } else {
            $valid = false;
            error(_("Your password is to short (please use at least 6 characters)."));
        }

        if ($valid) {
            set_password($user_source['UID'], $_REQUEST['password']);
            success(_("Password saved."));
            redirect(page_link_to('login'));
        }
    }

    return User_password_set_view();
}

/**
 * First step of password recovery: display a form that asks for your email and send email with recovery link
 */
function user_password_recovery_start_controller()
{
    if (isset($_REQUEST['submit'])) {
        $valid = true;

        if (isset($_REQUEST['email']) && strlen(strip_request_item('email')) > 0) {
            $email = strip_request_item('email');
            if (check_email($email)) {
                $user_source = User_by_email($email);
                if ($user_source == null) {
                    $valid = false;
                    error(_("E-mail address is not correct."));
                }
            } else {
                $valid = false;
                error(_("E-mail address is not correct."));
            }
        } else {
            $valid = false;
            error(_("Please enter your e-mail."));
        }

        if ($valid) {
            $token = User_generate_password_recovery_token($user_source);
            engelsystem_email_to_user(
                $user_source,
                _("Password recovery"),
                sprintf(
                    _("Please visit %s to recover your password."),
                    page_link_to_absolute('user_password_recovery') . '&token=' . $token
                )
            );
            success(_("We sent an email containing your password recovery link."));
            redirect(page_link_to('login'));
        }
    }

    return User_password_recovery_view();
}

/**
 * User password recovery in 2 steps.
 * (By email)
 */
function user_password_recovery_controller()
{
    if (isset($_REQUEST['token'])) {
        return user_password_recovery_set_new_controller();
    } else {
        return user_password_recovery_start_controller();
    }
}

/**
 * Menu title for password recovery.
 */
function user_password_recovery_title()
{
    return _("Password recovery");
}

/**
 * Loads a user from param user_id.
 */
function load_user()
{
    if (!isset($_REQUEST['user_id'])) {
        redirect(page_link_to());
    }

    $user = User($_REQUEST['user_id']);
    if ($user === false) {
        engelsystem_error("Unable to load user.");
    }

    if ($user == null) {
        error(_("User doesn't exist."));
        redirect(page_link_to());
    }

    return $user;
}

function shiftCalendarRendererByShiftFilter(ShiftsFilter $shiftsFilter)
{
    $shifts = Shifts_by_ShiftsFilter($shiftsFilter);
    $needed_angeltypes_source = NeededAngeltypes_by_ShiftsFilter($shiftsFilter);
    $shift_entries_source = ShiftEntries_by_ShiftsFilter($shiftsFilter);

    $needed_angeltypes = [];
    $shift_entries = [];
    foreach ($shifts as $shift) {
        $needed_angeltypes[$shift['SID']] = [];
        $shift_entries[$shift['SID']] = [];
    }
    foreach ($shift_entries_source as $shift_entry) {
        if (isset($shift_entries[$shift_entry['SID']])) {
            $shift_entries[$shift_entry['SID']][] = $shift_entry;
        }
    }
    foreach ($needed_angeltypes_source as $needed_angeltype) {
        if (isset($needed_angeltypes[$needed_angeltype['SID']])) {
            $needed_angeltypes[$needed_angeltype['SID']][] = $needed_angeltype;
        }
    }
    unset($needed_angeltypes_source);
    unset($shift_entries_source);

    if (
        in_array(ShiftsFilter::FILLED_FREE, $shiftsFilter->getFilled())
        && in_array(ShiftsFilter::FILLED_FILLED, $shiftsFilter->getFilled())
    ) {
        return new ShiftCalendarRenderer($shifts, $needed_angeltypes, $shift_entries, $shiftsFilter);
    }

    $filtered_shifts = [];
    foreach ($shifts as $shift) {
        $needed_angels_count = 0;
        foreach ($needed_angeltypes[$shift['SID']] as $needed_angeltype) {
            $taken = 0;
            foreach ($shift_entries[$shift['SID']] as $shift_entry) {
                if ($needed_angeltype['angel_type_id'] == $shift_entry['TID'] && $shift_entry['freeloaded'] == 0) {
                    $taken++;
                }
            }

            $needed_angels_count += max(0, $needed_angeltype['count'] - $taken);
        }
        if (in_array(ShiftsFilter::FILLED_FREE, $shiftsFilter->getFilled()) && $taken < $needed_angels_count) {
            $filtered_shifts[] = $shift;
        }
        if (in_array(ShiftsFilter::FILLED_FILLED, $shiftsFilter->getFilled()) && $taken >= $needed_angels_count) {
            $filtered_shifts[] = $shift;
        }
    }

    return new ShiftCalendarRenderer($filtered_shifts, $needed_angeltypes, $shift_entries, $shiftsFilter);
}