groups / lib / admin / class-groups-admin-users.php

class-groups-admin-users.php in Groups – Memberships and Access Control 3.9.0, at lib/admin/class-groups-admin-users.php

394 lines 14.8 KB

Raw Download Zip

1	<?php
2	/**
3	* class-groups-admin-users.php
4	*
5	* Copyright (c) 2012 "kento" Karim Rahimpur www.itthinx.com
6	*
7	* This code is released under the GNU General Public License.
8	* See COPYRIGHT.txt and LICENSE.txt.
9	*
10	* This code is distributed in the hope that it will be useful,
11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	* GNU General Public License for more details.
14	*
15	* This header and all notices must be kept intact.
16	*
17	* @author Karim Rahimpur
18	* @package groups
19	* @since groups 1.0.0
20	*/
21
22	if ( !defined( 'ABSPATH' ) ) {
23	exit;
24	}
25
26	// phpcs:disable PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
27
28	/**
29	* Users admin integration with Groups.
30	*/
31	class Groups_Admin_Users {
32
33	/**
34	* Column key.
35	*
36	* @var string
37	*/
38	const GROUPS = 'groups_user_groups';
39
40	/**
41	* Hooks into filters to add the Groups column to the users table.
42	*/
43	public static function init() {
44	// we hook this on admin_init so that current_user_can() is available
45	add_action( 'admin_init', array( __CLASS__, 'setup' ) );
46	}
47
48	/**
49	* Adds the filters and actions only for users who have the right Groups permissions.
50	*/
51	public static function setup() {
52	if ( Groups_User::current_user_can( GROUPS_ACCESS_GROUPS ) ) {
53	// filters to display the user's groups
54	add_filter( 'manage_users_columns', array( __CLASS__, 'manage_users_columns' ) );
55	// args: unknown, string $column_name, int $user_id
56	add_filter( 'manage_users_custom_column', array( __CLASS__, 'manage_users_custom_column' ), 10, 3 );
57	}
58	if ( Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
59	if ( !is_network_admin() ) {
60	// scripts
61	add_action( 'admin_enqueue_scripts', array( __CLASS__, 'admin_enqueue_scripts' ) );
62	// styles
63	// add_action( 'admin_head', array( __CLASS__, 'admin_head' ) );
64	// allow to add or remove selected users to groups
65	add_action( 'load-users.php', array( __CLASS__, 'load_users' ) );
66	// add links to filter users by group
67	add_filter( 'views_users', array( __CLASS__, 'views_users' ) );
68	// modify query to filter users by group
69	add_filter( 'pre_user_query', array( __CLASS__, 'pre_user_query' ) );
70	// WP_Users_List_Table implements extra_tablenav() where the restrict_manage_users action is invoked.
71	// As the extra_tablenav() method does not define a generic extension point, this is
72	// the best shot we get at inserting our group actions block (currently we're at WordPress 3.6.1).
73	// We choose to use our own group-actions block instead of re-using the existing bulk-actions,
74	// to have a more explicit user interface which makes it clear that these actions
75	// are directed at relating users and groups.
76	add_action( 'restrict_manage_users', array( __CLASS__, 'restrict_manage_users' ), 0 );
77	}
78	}
79	}
80
81	/**
82	* Modify query to filter users by group.
83	*
84	* @param WP_User_Query $user_query
85	*
86	* @return WP_User_Query
87	*/
88	public static function pre_user_query( $user_query ) {
89	global $pagenow, $wpdb;
90	if ( ( $pagenow == 'users.php' ) && empty( $_GET['page'] ) ) {
91	if ( isset( $_REQUEST['filter_group_ids'] ) && is_array( $_REQUEST['filter_group_ids'] ) ) {
92	$group_ids = array();
93	foreach ( $_REQUEST['filter_group_ids'] as $group_id ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
94	$group_id = Groups_Utility::id( $group_id );
95	if ( $group_id !== false ) {
96	$group_ids[] = $group_id;
97	}
98	}
99	$n = count( $group_ids );
100	if ( $n > 0 ) {
101	$user_group_table = _groups_get_tablename( 'user_group' );
102	$group_ids = implode( ',', esc_sql( $group_ids ) );
103	$conjunctive = !empty( $_REQUEST['filter_groups_conjunctive'] );
104	if ( !$conjunctive ) {
105	$user_query->query_where .= " AND $wpdb->users.ID IN ( SELECT DISTINCT user_id FROM $user_group_table WHERE group_id IN ( $group_ids ) ) ";
106	} else {
107	$user_query->query_where .=
108	" AND $wpdb->users.ID IN ( " .
109	"SELECT user_id FROM ( " .
110	"SELECT user_id, COUNT( group_id ) AS n FROM $user_group_table WHERE group_id IN ( $group_ids ) GROUP BY user_id " .
111	") group_counts WHERE n = " . intval( $n ) .
112	") ";
113	}
114	}
115	}
116	}
117	return $user_query;
118	}
119
120	/**
121	* Enqueue scripts the group-actions.
122	*/
123	public static function admin_enqueue_scripts() {
124
125	global $pagenow;
126
127	if ( ( $pagenow == 'users.php' ) && empty( $_GET['page'] ) ) {
128	Groups_UIE::enqueue( 'select' );
129	wp_enqueue_style( 'groups_admin_user' );
130	}
131	}
132
133	/**
134	* Adds the group add/remove buttons after the last action box.
135	*/
136	public static function admin_head() {
137
138	global $pagenow;
139
140	if ( ( $pagenow == 'users.php' ) && empty( $_GET['page'] ) ) {
141	// @since 2.18.0 moved to groups_admin_user.css
142	}
143	}
144
145	/**
146	* Renders group actions in the users table's extra_tablenav().
147	*/
148	public static function restrict_manage_users() {
149
150	global $pagenow, $wpdb, $groups_select_user_groups_index;
151
152	// We don't handle multiple instances so don't render another.
153	if ( !isset( $groups_select_user_groups_index ) ) {
154	$groups_select_user_groups_index = 0;
155	} else {
156	return '';
157	}
158
159	$output = '';
160
161	if ( ( $pagenow == 'users.php' ) && empty( $_GET['page'] ) ) {
162	// groups select
163	$groups_table = _groups_get_tablename( 'group' );
164	$groups = apply_filters( 'groups_admin_users_restrict_manage_users_groups', $wpdb->get_results( "SELECT * FROM $groups_table ORDER BY name" ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
165	$groups_select = '';
166	if ( $groups ) {
167	$groups_select = sprintf(
168	'<select id="user-groups" class="groups" name="group_ids[]" multiple="multiple" placeholder="%s" data-placeholder="%s">',
169	esc_attr__( 'Choose groups …', 'groups' ),
170	esc_attr__( 'Choose groups …', 'groups' )
171	);
172	foreach( $groups as $group ) {
173	$is_member = false;
174	$groups_select .= sprintf(
175	'<option value="%d" %s>%s</option>',
176	Groups_Utility::id( $group->group_id ),
177	$is_member ? ' selected="selected" ' : '',
178	$group->name ? stripslashes( wp_filter_nohtml_kses( $group->name ) ) : ''
179	);
180	}
181	$groups_select .= '</select>';
182	}
183
184	// group bulk actions added through extra_tablenav()
185	$box = '<div id="group-bulk-actions" class="groups-bulk-container">';
186	$box .= '<div class="groups-select-container">';
187	$box .= $groups_select;
188	$box .= '</div>';
189	$box .= '<select class="groups-action" name="groups-action">';
190	$box .= '<option selected="selected" value="-1">' . esc_html__( 'Group Actions', 'groups' ) . '</option>';
191	$box .= '<option value="add-group">' . esc_html__( 'Add to group', 'groups' ) . '</option>';
192	$box .= '<option value="remove-group">' . esc_html__( 'Remove from group', 'groups' ) . '</option>';
193	$box .= '</select>';
194	$box .= sprintf( '<input class="button" type="submit" name="groups" value="%s" />', esc_attr__( 'Apply', 'groups' ) );
195	$box .= '</div>';
196	$box = str_replace( '"', "'", $box );
197
198	$nonce = wp_nonce_field( 'user-group', 'bulk-user-group-nonce', true, false );
199	$nonce = str_replace( '"', "'", $nonce );
200	$box .= $nonce;
201
202	$box .= '<script type="text/javascript">';
203	$box .= 'document.addEventListener( "DOMContentLoaded", function() {';
204	$box .= 'if ( typeof jQuery !== "undefined" ) {';
205	$box .= 'jQuery(".tablenav.top .alignleft.actions:last").after("<div id=\"groups-bulk-actions-block\" class=\"alignleft actions\"></div>");';
206	$box .= 'jQuery("#group-bulk-actions").appendTo(jQuery("#groups-bulk-actions-block"));';
207	$box .= '}'; // jQuery
208	$box .= '} );'; // document....
209	$box .= '</script>';
210
211	$output .= $box;
212	$output .= Groups_UIE::render_select( '#user-groups' );
213	}
214	echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
215	}
216
217	/**
218	* Hooked on filter in class-wp-list-table.php to filter by group.
219	*
220	* @param array $views
221	*
222	* @return array views
223	*/
224	public static function views_users( $views ) {
225	global $pagenow, $wpdb;
226	if ( ( $pagenow == 'users.php' ) && empty( $_GET['page'] ) ) {
227	$output = '<form id="filter-groups-form" action="" method="get">';
228	$output .= '<div class="groups-filter-container">';
229	$output .= '<div class="groups-select-container">';
230	$output .= sprintf(
231	'<select id="filter-groups" class="groups" name="filter_group_ids[]" multiple="multiple" placeholder="%s" data-placeholder="%s">',
232	esc_attr__( 'Choose groups …', 'groups' ),
233	esc_attr__( 'Choose groups …', 'groups' )
234	);
235	$user_group_table = _groups_get_tablename( 'user_group' );
236	$groups = apply_filters( 'groups_admin_users_views_users_groups', Groups_Group::get_groups( array( 'order_by' => 'name', 'order' => 'ASC' ) ) );
237	$user_counts = array();
238	$counts = apply_filters('groups_admin_users_views_users_counts', $wpdb->get_results( "SELECT COUNT(user_id) AS count, group_id FROM $user_group_table GROUP BY group_id" ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
239	if ( !empty( $counts ) && is_array( $counts ) ) {
240	foreach( $counts as $count ) {
241	if ( isset( $count->count ) && is_numeric( $count->count ) ) {
242	$user_counts[$count->group_id] = max( 0, intval( $count->count ) );
243	}
244	}
245	}
246	foreach( $groups as $group ) {
247	// Do not use $user_count = count( $group->users ); here,
248	// as it creates a lot of unneccessary objects and can lead
249	// to out of memory issues on large user bases.
250	$user_count = isset( $user_counts[$group->group_id] ) ? $user_counts[$group->group_id] : 0;
251	$selected = isset( $_REQUEST['filter_group_ids'] ) && is_array( $_REQUEST['filter_group_ids'] ) && in_array( $group->group_id, $_REQUEST['filter_group_ids'] );
252	$output .= sprintf(
253	'<option value="%d" %s>%s</option>',
254	Groups_Utility::id( $group->group_id ),
255	$selected ? ' selected="selected" ' : '',
256	sprintf(
257	'%s <span class="count">(%s)</span>',
258	$group->name ? stripslashes( wp_filter_nohtml_kses( $group->name ) ) : '',
259	esc_html( $user_count )
260	)
261	);
262	}
263	$output .= '</select>';
264	$output .= '</div>'; // .groups-select-container
265	$output .= '</div>'; // .groups-filter-container
266	$conjunctive = !empty( $_REQUEST['filter_groups_conjunctive'] );
267	$output .= sprintf( '<label title="%s" style="margin-right: 4px;">', esc_html_x( 'Users must belong to all chosen groups', 'label title for conjunctive groups filter checkbox', 'groups' ) );
268	$output .= sprintf( '<input class="filter-groups-conjunctive" name="filter_groups_conjunctive" type="checkbox" value="1" %s />', $conjunctive ? ' checked="checked" ' : '' );
269	$output .= esc_html_x( '∩', 'label for conjunctive groups filter checkbox', 'groups' );
270	$output .= '</label>';
271	$output .= '<input class="button" style="vertical-align:middle" type="submit" value="' . esc_attr__( 'Filter', 'groups' ) . '"/>';
272	$output .= '</form>';
273	$output .= Groups_UIE::render_select( '#filter-groups' );
274	$views['groups'] = $output;
275	}
276	return $views;
277	}
278
279	/**
280	* Adds or removes users to/from groups.
281	*/
282	public static function load_users() {
283	if ( Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
284	$users = isset( $_REQUEST['users'] ) ? $_REQUEST['users'] : null; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
285	$action = null;
286	if ( !empty( $_REQUEST['groups'] ) ) {
287	if ( $_GET['groups-action'] == "add-group" ) {
288	$action = 'add';
289	} else if ( $_GET['groups-action'] == "remove-group" ) {
290	$action = 'remove';
291	}
292	}
293	if ( $users !== null && $action !== null && is_array( $users ) ) {
294	$users = array_map( 'intval', $users );
295	if ( wp_verify_nonce( $_REQUEST['bulk-user-group-nonce'], 'user-group' ) ) { // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
296	foreach( $users as $user_id ) {
297	switch ( $action ) {
298	case 'add':
299	$group_ids = isset( $_GET['group_ids'] ) ? $_GET['group_ids'] : null; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
300	if ( $group_ids !== null && is_array( $group_ids ) ) {
301	foreach ( $group_ids as $group_id ) {
302	// Do NOT use Groups_User::user_is_member( ... ) here, as this must not be filtered:
303	if ( !Groups_User_Group::read( $user_id, $group_id ) ) {
304	Groups_User_Group::create(
305	array(
306	'user_id' => $user_id,
307	'group_id' => $group_id
308	)
309	);
310	}
311	}
312	}
313	break;
314	case 'remove':
315	$group_ids = isset( $_GET['group_ids'] ) ? $_GET['group_ids'] : null; // phpcs:ignore WordPress.Security.ValidatedSanitizedInput.InputNotSanitized
316	if ( $group_ids !== null && is_array( $group_ids ) ) {
317	foreach ( $group_ids as $group_id ) {
318	// Do NOT use Groups_User::user_is_member( ... ) here, as this must not be filtered:
319	if ( Groups_User_Group::read( $user_id, $group_id ) ) {
320	Groups_User_Group::delete( $user_id, $group_id );
321	}
322	}
323	}
324	break;
325	}
326	}
327	$referer = wp_get_referer();
328	if ( $referer ) {
329	$redirect_to = remove_query_arg( array( 'action', 'action2', 'add-to-group', 'bulk-user-group-nonce', 'group_id', 'new_role', 'remove-from-group', 'users', 'update', 'id' ), $referer );
330	wp_safe_redirect( $redirect_to );
331	exit;
332	}
333	}
334	}
335	}
336	}
337
338	/**
339	* Adds a new column to the users table to show the groups that users belong to.
340	*
341	* @param array $column_headers
342	*
343	* @return array column headers
344	*/
345	public static function manage_users_columns( $column_headers ) {
346	$column_headers[self::GROUPS] = _x( 'Groups', 'Column header (Users)', 'groups' );
347	return $column_headers;
348	}
349
350	/**
351	* Renders custom column content.
352	*
353	* @param string $output
354	* @param string $column_name
355	* @param int $user_id
356	*
357	* @return string custom column content
358	*/
359	public static function manage_users_custom_column( $output, $column_name, $user_id ) {
360	switch ( $column_name ) {
361	case self::GROUPS :
362	$groups_user = new Groups_User( $user_id );
363	$groups = $groups_user->get_groups();
364	if ( $groups !== null && count( $groups ) > 0 ) {
365	usort( $groups, array( __CLASS__, 'by_group_name' ) );
366	$output = '<ul>';
367	foreach( $groups as $group ) {
368	$output .= '<li>';
369	$output .= $group->get_name() ? stripslashes( wp_filter_nohtml_kses( $group->get_name() ) ) : '';
370	$output .= '</li>';
371	}
372	$output .= '</ul>';
373	} else {
374	$output .= esc_html__( '--', 'groups' );
375	}
376	break;
377	}
378	return $output;
379	}
380
381	/**
382	* usort helper
383	*
384	* @param Groups_Group $o1
385	* @param Groups_Group $o2
386	*
387	* @return int strcmp result for group names
388	*/
389	public static function by_group_name( $o1, $o2 ) {
390	return strcmp( $o1->get_name(), $o2->get_name() );
391	}
392	}
393	Groups_Admin_Users::init();
394