groups / lib / admin / class-groups-admin-users.php

class-groups-admin-users.php in Groups – Memberships and Access Control trunk, at lib/admin/class-groups-admin-users.php

399 lines 14.6 KB

Raw Download Zip

1	<?php
2	/**
3	* class-groups-admin-users.php
4	*
5	* Copyright (c) 2012 "kento" Karim Rahimpur www.itthinx.com
6	*
7	* This code is released under the GNU General Public License.
8	* See COPYRIGHT.txt and LICENSE.txt.
9	*
10	* This code is distributed in the hope that it will be useful,
11	* but WITHOUT ANY WARRANTY; without even the implied warranty of
12	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13	* GNU General Public License for more details.
14	*
15	* This header and all notices must be kept intact.
16	*
17	* @author Karim Rahimpur
18	* @package groups
19	* @since groups 1.0.0
20	*/
21
22	if ( !defined( 'ABSPATH' ) ) {
23	exit;
24	}
25
26	// phpcs:disable PluginCheck.Security.DirectDB.UnescapedDBParameter, WordPress.DB.DirectDatabaseQuery.DirectQuery, WordPress.DB.DirectDatabaseQuery.NoCaching
27
28	/**
29	* Users admin integration with Groups.
30	*/
31	class Groups_Admin_Users {
32
33	/**
34	* Column key.
35	*
36	* @var string
37	*/
38	const GROUPS = 'groups_user_groups';
39
40	/**
41	* Hooks into filters to add the Groups column to the users table.
42	*/
43	public static function init() {
44	// we hook this on admin_init so that current_user_can() is available
45	add_action( 'admin_init', array( __CLASS__, 'setup' ) );
46	}
47
48	/**
49	* Adds the filters and actions only for users who have the right Groups permissions.
50	*/
51	public static function setup() {
52	if ( Groups_User::current_user_can( GROUPS_ACCESS_GROUPS ) ) {
53	// filters to display the user's groups
54	add_filter( 'manage_users_columns', array( __CLASS__, 'manage_users_columns' ) );
55	// args: unknown, string $column_name, int $user_id
56	add_filter( 'manage_users_custom_column', array( __CLASS__, 'manage_users_custom_column' ), 10, 3 );
57	}
58	if ( Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
59	if ( !is_network_admin() ) {
60	// scripts
61	add_action( 'admin_enqueue_scripts', array( __CLASS__, 'admin_enqueue_scripts' ) );
62	// styles
63	// add_action( 'admin_head', array( __CLASS__, 'admin_head' ) );
64	// allow to add or remove selected users to groups
65	add_action( 'load-users.php', array( __CLASS__, 'load_users' ) );
66	// add links to filter users by group
67	add_filter( 'views_users', array( __CLASS__, 'views_users' ) );
68	// modify query to filter users by group
69	add_filter( 'pre_user_query', array( __CLASS__, 'pre_user_query' ) );
70	// WP_Users_List_Table implements extra_tablenav() where the restrict_manage_users action is invoked.
71	// As the extra_tablenav() method does not define a generic extension point, this is
72	// the best shot we get at inserting our group actions block (currently we're at WordPress 3.6.1).
73	// We choose to use our own group-actions block instead of re-using the existing bulk-actions,
74	// to have a more explicit user interface which makes it clear that these actions
75	// are directed at relating users and groups.
76	add_action( 'restrict_manage_users', array( __CLASS__, 'restrict_manage_users' ), 0 );
77	}
78	}
79	}
80
81	/**
82	* Modify query to filter users by group.
83	*
84	* @param WP_User_Query $user_query
85	*
86	* @return WP_User_Query
87	*/
88	public static function pre_user_query( $user_query ) {
89	global $pagenow, $wpdb;
90	if ( ( $pagenow == 'users.php' ) && empty( groups_sanitize_get( 'page' ) ) ) {
91	$filter_group_ids = groups_sanitize_request( 'filter_group_ids' );
92	if ( is_array( $filter_group_ids ) ) {
93	$group_ids = array();
94	foreach ( $filter_group_ids as $group_id ) {
95	$group_id = Groups_Utility::id( $group_id );
96	if ( $group_id !== false ) {
97	$group_ids[] = $group_id;
98	}
99	}
100	$n = count( $group_ids );
101	if ( $n > 0 ) {
102	$user_group_table = _groups_get_tablename( 'user_group' );
103	$group_ids = implode( ',', esc_sql( $group_ids ) );
104	$conjunctive = !empty( groups_sanitize_request( 'filter_groups_conjunctive' ) );
105	if ( !$conjunctive ) {
106	$user_query->query_where .= " AND $wpdb->users.ID IN ( SELECT DISTINCT user_id FROM $user_group_table WHERE group_id IN ( $group_ids ) ) ";
107	} else {
108	$user_query->query_where .=
109	" AND $wpdb->users.ID IN ( " .
110	"SELECT user_id FROM ( " .
111	"SELECT user_id, COUNT( group_id ) AS n FROM $user_group_table WHERE group_id IN ( $group_ids ) GROUP BY user_id " .
112	") group_counts WHERE n = " . intval( $n ) .
113	") ";
114	}
115	}
116	}
117	}
118	return $user_query;
119	}
120
121	/**
122	* Enqueue scripts the group-actions.
123	*/
124	public static function admin_enqueue_scripts() {
125
126	global $pagenow;
127
128	if ( ( $pagenow == 'users.php' ) && empty( groups_sanitize_get( 'page' ) ) ) {
129	Groups_UIE::enqueue( 'select' );
130	wp_enqueue_style( 'groups_admin_user' );
131	}
132	}
133
134	/**
135	* Adds the group add/remove buttons after the last action box.
136	*/
137	public static function admin_head() {
138
139	global $pagenow;
140
141	if ( ( $pagenow == 'users.php' ) && empty( groups_sanitize_get( 'page' ) ) ) {
142	// @since 2.18.0 moved to groups_admin_user.css
143	}
144	}
145
146	/**
147	* Renders group actions in the users table's extra_tablenav().
148	*/
149	public static function restrict_manage_users() {
150
151	global $pagenow, $wpdb, $groups_select_user_groups_index;
152
153	// We don't handle multiple instances so don't render another.
154	if ( !isset( $groups_select_user_groups_index ) ) {
155	$groups_select_user_groups_index = 0;
156	} else {
157	return '';
158	}
159
160	$output = '';
161
162	if ( ( $pagenow == 'users.php' ) && empty( groups_sanitize_get( 'page' ) ) ) {
163	// groups select
164	$groups_table = _groups_get_tablename( 'group' );
165	$groups = apply_filters( 'groups_admin_users_restrict_manage_users_groups', $wpdb->get_results( "SELECT * FROM $groups_table ORDER BY name" ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
166	$groups_select = '';
167	if ( $groups ) {
168	$groups_select = sprintf(
169	'<select id="user-groups" class="groups" name="group_ids[]" multiple="multiple" placeholder="%s" data-placeholder="%s">',
170	esc_attr__( 'Choose groups …', 'groups' ),
171	esc_attr__( 'Choose groups …', 'groups' )
172	);
173	foreach ( $groups as $group ) {
174	$is_member = false;
175	$groups_select .= sprintf(
176	'<option value="%d" %s>%s</option>',
177	Groups_Utility::id( $group->group_id ),
178	$is_member ? ' selected="selected" ' : '',
179	$group->name ? stripslashes( wp_filter_nohtml_kses( $group->name ) ) : ''
180	);
181	}
182	$groups_select .= '</select>';
183	}
184
185	// group bulk actions added through extra_tablenav()
186	$box = '<div id="group-bulk-actions" class="groups-bulk-container">';
187	$box .= '<div class="groups-select-container">';
188	$box .= $groups_select;
189	$box .= '</div>';
190	$box .= '<select class="groups-action" name="groups-action">';
191	$box .= '<option selected="selected" value="-1">' . esc_html__( 'Group Actions', 'groups' ) . '</option>';
192	$box .= '<option value="add-group">' . esc_html__( 'Add to group', 'groups' ) . '</option>';
193	$box .= '<option value="remove-group">' . esc_html__( 'Remove from group', 'groups' ) . '</option>';
194	$box .= '</select>';
195	$box .= sprintf( '<input class="button" type="submit" name="groups" value="%s" />', esc_attr__( 'Apply', 'groups' ) );
196	$box .= '</div>';
197	$box = str_replace( '"', "'", $box );
198
199	$nonce = wp_nonce_field( 'user-group', 'bulk-user-group-nonce', true, false );
200	$nonce = str_replace( '"', "'", $nonce );
201	$box .= $nonce;
202
203	$box .= '<script type="text/javascript">';
204	$box .= 'document.addEventListener( "DOMContentLoaded", function() {';
205	$box .= 'if ( typeof jQuery !== "undefined" ) {';
206	$box .= 'jQuery(".tablenav.top .alignleft.actions:last").after("<div id=\"groups-bulk-actions-block\" class=\"alignleft actions\"></div>");';
207	$box .= 'jQuery("#group-bulk-actions").appendTo(jQuery("#groups-bulk-actions-block"));';
208	$box .= '}'; // jQuery
209	$box .= '} );'; // document....
210	$box .= '</script>';
211
212	$output .= $box;
213	$output .= Groups_UIE::render_select( '#user-groups' );
214	}
215	echo $output; // phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
216	}
217
218	/**
219	* Hooked on filter in class-wp-list-table.php to filter by group.
220	*
221	* @param array $views
222	*
223	* @return array views
224	*/
225	public static function views_users( $views ) {
226	global $pagenow, $wpdb;
227	if ( ( $pagenow == 'users.php' ) && empty( groups_sanitize_get( 'page' ) ) ) {
228	$output = '<form id="filter-groups-form" action="" method="get">';
229	$output .= '<div class="groups-filter-container">';
230	$output .= '<div class="groups-select-container">';
231	$output .= sprintf(
232	'<select id="filter-groups" class="groups" name="filter_group_ids[]" multiple="multiple" placeholder="%s" data-placeholder="%s">',
233	esc_attr__( 'Choose groups …', 'groups' ),
234	esc_attr__( 'Choose groups …', 'groups' )
235	);
236	$user_group_table = _groups_get_tablename( 'user_group' );
237	$groups = apply_filters( 'groups_admin_users_views_users_groups', Groups_Group::get_groups( array( 'order_by' => 'name', 'order' => 'ASC' ) ) );
238	$user_counts = array();
239	$counts = apply_filters('groups_admin_users_views_users_counts', $wpdb->get_results( "SELECT COUNT(user_id) AS count, group_id FROM $user_group_table GROUP BY group_id" ) ); // phpcs:ignore WordPress.DB.PreparedSQL.InterpolatedNotPrepared
240	if ( !empty( $counts ) && is_array( $counts ) ) {
241	foreach ( $counts as $count ) {
242	if ( isset( $count->count ) && is_numeric( $count->count ) ) {
243	$user_counts[$count->group_id] = max( 0, intval( $count->count ) );
244	}
245	}
246	}
247	$filter_group_ids = groups_sanitize_request( 'filter_group_ids' );
248	if ( !is_array( $filter_group_ids ) ) {
249	$filter_group_ids = array();
250	}
251	foreach ( $groups as $group ) {
252	// Do not use $user_count = count( $group->users ); here,
253	// as it creates a lot of unneccessary objects and can lead
254	// to out of memory issues on large user bases.
255	$user_count = isset( $user_counts[$group->group_id] ) ? $user_counts[$group->group_id] : 0;
256	$selected = in_array( $group->group_id, $filter_group_ids );
257	$output .= sprintf(
258	'<option value="%d" %s>%s</option>',
259	Groups_Utility::id( $group->group_id ),
260	$selected ? ' selected="selected" ' : '',
261	sprintf(
262	'%s <span class="count">(%s)</span>',
263	$group->name ? stripslashes( wp_filter_nohtml_kses( $group->name ) ) : '',
264	esc_html( $user_count )
265	)
266	);
267	}
268	$output .= '</select>';
269	$output .= '</div>'; // .groups-select-container
270	$output .= '</div>'; // .groups-filter-container
271	$conjunctive = !empty( groups_sanitize_request( 'filter_groups_conjunctive' ) );
272	$output .= sprintf( '<label title="%s" style="margin-right: 4px;">', esc_html_x( 'Users must belong to all chosen groups', 'label title for conjunctive groups filter checkbox', 'groups' ) );
273	$output .= sprintf( '<input class="filter-groups-conjunctive" name="filter_groups_conjunctive" type="checkbox" value="1" %s />', $conjunctive ? ' checked="checked" ' : '' );
274	$output .= esc_html_x( '∩', 'label for conjunctive groups filter checkbox', 'groups' );
275	$output .= '</label>';
276	$output .= '<input class="button" style="vertical-align:middle" type="submit" value="' . esc_attr__( 'Filter', 'groups' ) . '"/>';
277	$output .= '</form>';
278	$output .= Groups_UIE::render_select( '#filter-groups' );
279	$views['groups'] = $output;
280	}
281	return $views;
282	}
283
284	/**
285	* Adds or removes users to/from groups.
286	*/
287	public static function load_users() {
288	if ( Groups_User::current_user_can( GROUPS_ADMINISTER_GROUPS ) ) {
289	$users = groups_sanitize_request( 'users' );
290	$action = null;
291	if ( !empty( $_REQUEST['groups'] ) ) { // phpcs:ignore WordPress.Security.NonceVerification.Recommended
292	if ( groups_sanitize_get( 'groups-action' ) === 'add-group' ) {
293	$action = 'add';
294	} else if ( groups_sanitize_get( 'groups-action' ) === 'remove-group' ) {
295	$action = 'remove';
296	}
297	}
298	if ( $users !== null && $action !== null && is_array( $users ) ) {
299	$users = array_map( 'intval', $users );
300	if ( groups_verify_request_nonce( 'bulk-user-group-nonce', 'user-group' ) ) {
301	foreach ( $users as $user_id ) {
302	switch ( $action ) {
303	case 'add':
304	$group_ids = groups_sanitize_get( 'group_ids' );
305	if ( $group_ids !== null && is_array( $group_ids ) ) {
306	foreach ( $group_ids as $group_id ) {
307	// Do NOT use Groups_User::user_is_member( ... ) here, as this must not be filtered:
308	if ( !Groups_User_Group::read( $user_id, $group_id ) ) {
309	Groups_User_Group::create(
310	array(
311	'user_id' => $user_id,
312	'group_id' => $group_id
313	)
314	);
315	}
316	}
317	}
318	break;
319	case 'remove':
320	$group_ids = groups_sanitize_get( 'group_ids' );
321	if ( $group_ids !== null && is_array( $group_ids ) ) {
322	foreach ( $group_ids as $group_id ) {
323	// Do NOT use Groups_User::user_is_member( ... ) here, as this must not be filtered:
324	if ( Groups_User_Group::read( $user_id, $group_id ) ) {
325	Groups_User_Group::delete( $user_id, $group_id );
326	}
327	}
328	}
329	break;
330	}
331	}
332	$referer = wp_get_referer();
333	if ( $referer ) {
334	$redirect_to = remove_query_arg( array( 'action', 'action2', 'add-to-group', 'bulk-user-group-nonce', 'group_id', 'new_role', 'remove-from-group', 'users', 'update', 'id' ), $referer );
335	wp_safe_redirect( $redirect_to );
336	exit;
337	}
338	}
339	}
340	}
341	}
342
343	/**
344	* Adds a new column to the users table to show the groups that users belong to.
345	*
346	* @param array $column_headers
347	*
348	* @return array column headers
349	*/
350	public static function manage_users_columns( $column_headers ) {
351	$column_headers[self::GROUPS] = _x( 'Groups', 'Column header (Users)', 'groups' );
352	return $column_headers;
353	}
354
355	/**
356	* Renders custom column content.
357	*
358	* @param string $output
359	* @param string $column_name
360	* @param int $user_id
361	*
362	* @return string custom column content
363	*/
364	public static function manage_users_custom_column( $output, $column_name, $user_id ) {
365	switch ( $column_name ) {
366	case self::GROUPS :
367	$groups_user = new Groups_User( $user_id );
368	$groups = $groups_user->get_groups();
369	if ( $groups !== null && count( $groups ) > 0 ) {
370	usort( $groups, array( __CLASS__, 'by_group_name' ) );
371	$output = '<ul>';
372	foreach ( $groups as $group ) {
373	$output .= '<li>';
374	$output .= $group->get_name() ? stripslashes( wp_filter_nohtml_kses( $group->get_name() ) ) : '';
375	$output .= '</li>';
376	}
377	$output .= '</ul>';
378	} else {
379	$output .= esc_html__( '--', 'groups' );
380	}
381	break;
382	}
383	return $output;
384	}
385
386	/**
387	* usort helper
388	*
389	* @param Groups_Group $o1
390	* @param Groups_Group $o2
391	*
392	* @return int strcmp result for group names
393	*/
394	public static function by_group_name( $o1, $o2 ) {
395	return strcmp( $o1->get_name(), $o2->get_name() );
396	}
397	}
398	Groups_Admin_Users::init();
399