apiuser.php — VikAppointments Services Booking Calendar trunk

vikappointments / admin / controllers / apiuser.php

vikappointments / admin / controllers Last commit date

apiuser.php

313 lines

1	<?php
2	/**
3	* @package VikAppointments
4	* @subpackage core
5	* @author E4J s.r.l.
6	* @copyright Copyright (C) 2021 E4J s.r.l. All Rights Reserved.
7	* @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
8	* @link https://vikwp.com
9	*/
10
11	// No direct access
12	defined('ABSPATH') or die('No script kiddies please!');
13
14	VAPLoader::import('libraries.mvc.controllers.admin');
15
16	/**
17	* VikAppointments API user controller.
18	*
19	* @since 1.7
20	*/
21	class VikAppointmentsControllerApiuser extends VAPControllerAdmin
22	{
23	/**
24	* Task used to access the creation page of a new record.
25	*
26	* @return boolean
27	*/
28	public function add()
29	{
30	$app = JFactory::getApplication();
31
32	// unset user state for being recovered again
33	$app->setUserState('vap.apiuser.data', array());
34
35	// check user permissions
36	if (!JFactory::getUser()->authorise('core.create', 'com_vikappointments') \|\| !VAPFactory::getApi()->isEnabled())
37	{
38	// back to main list, not authorised to create records
39	$app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
40	$this->cancel();
41
42	return false;
43	}
44
45	$this->setRedirect('index.php?option=com_vikappointments&view=manageapiuser');
46
47	return true;
48	}
49
50	/**
51	* Task used to access the management page of an existing record.
52	*
53	* @return boolean
54	*/
55	public function edit()
56	{
57	$app = JFactory::getApplication();
58
59	// unset user state for being recovered again
60	$app->setUserState('vap.apiuser.data', array());
61
62	// check user permissions
63	if (!JFactory::getUser()->authorise('core.edit', 'com_vikappointments') \|\| !VAPFactory::getApi()->isEnabled())
64	{
65	// back to main list, not authorised to edit records
66	$app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
67	$this->cancel();
68
69	return false;
70	}
71
72	$cid = $app->input->getString('cid', array(''));
73
74	$this->setRedirect('index.php?option=com_vikappointments&view=manageapiuser&cid[]=' . $cid[0]);
75
76	return true;
77	}
78
79	/**
80	* Task used to save the record data set in the request.
81	* After saving, the user is redirected to the main list.
82	*
83	* @return void
84	*/
85	public function saveclose()
86	{
87	if ($this->save())
88	{
89	$this->cancel();
90	}
91	}
92
93	/**
94	* Task used to save the record data set in the request.
95	* After saving, the user is redirected to the creation
96	* page of a new record.
97	*
98	* @return void
99	*/
100	public function savenew()
101	{
102	if ($this->save())
103	{
104	$this->setRedirect('index.php?option=com_vikappointments&task=apiuser.add');
105	}
106	}
107
108	/**
109	* Task used to save the record data set in the request.
110	* After saving, the user is redirected to the management
111	* page of the record that has been saved.
112	*
113	* @return boolean
114	*/
115	public function save()
116	{
117	$app = JFactory::getApplication();
118	$input = $app->input;
119	$user = JFactory::getUser();
120
121	/**
122	* Added token validation.
123	*
124	* @since 1.7
125	*/
126	if (!JSession::checkToken())
127	{
128	// back to main list, missing CSRF-proof token
129	$app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
130	$this->cancel();
131
132	return false;
133	}
134
135	$args = array();
136	$args['application'] = $input->getString('application');
137	$args['username'] = $input->getString('username');
138	$args['password'] = $input->getString('password');
139	$args['active'] = $input->getUint('active', 0);
140	$args['ips'] = $input->getString('ip', array());
141	$args['id'] = $input->getInt('id', 0);
142
143	// fetch denied plugins
144	$args['denied'] = array();
145	$denied = $input->get('plugin', array(), 'array');
146
147	foreach ($denied as $k => $v)
148	{
149	if ((int)$v != 1)
150	{
151	// register plugin only if not enabled
152	$args['denied'][] = $k;
153	}
154	}
155
156	$rule = 'core.' . ($args['id'] > 0 ? 'edit' : 'create');
157
158	// check user permissions
159	if (!$user->authorise($rule, 'com_vikappointments') \|\| !VAPFactory::getApi()->isEnabled())
160	{
161	// back to main list, not authorised to create/edit records
162	$app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
163	$this->cancel();
164
165	return false;
166	}
167
168	// get record model
169	$apiuser = $this->getModel();
170
171	// try to save arguments
172	$id = $apiuser->save($args);
173
174	if (!$id)
175	{
176	// update user state data by injecting the selected IPs and denied plugins
177	$data = $app->getUserState('vap.apiuser.data', array());
178	$data['denied'] = $args['denied'];
179	$data['ips'] = $args['ips'];
180	$app->setUserState('vap.apiuser.data', $data);
181
182	// get string error
183	$error = $apiuser->getError(null, true);
184
185	// display error message
186	$app->enqueueMessage(JText::sprintf('JLIB_APPLICATION_ERROR_SAVE_FAILED', $error), 'error');
187
188	$url = 'index.php?option=com_vikappointments&view=manageapiuser';
189
190	if ($args['id'])
191	{
192	$url .= '&cid[]=' . $args['id'];
193	}
194
195	// redirect to new/edit page
196	$this->setRedirect($url);
197
198	return false;
199	}
200
201	// display generic successful message
202	$app->enqueueMessage(JText::translate('JLIB_APPLICATION_SAVE_SUCCESS'));
203
204	// redirect to edit page
205	$this->setRedirect('index.php?option=com_vikappointments&task=apiuser.edit&cid[]=' . $id);
206
207	return true;
208	}
209
210	/**
211	* Deletes a list of records set in the request.
212	*
213	* @return boolean
214	*/
215	public function delete()
216	{
217	$app = JFactory::getApplication();
218	$cid = $app->input->get('cid', array(), 'string');
219
220	/**
221	* Added token validation.
222	* Both GET and POST are supported.
223	*
224	* @since 1.7
225	*/
226	if (!JSession::checkToken() && !JSession::checkToken('get'))
227	{
228	// back to main list, missing CSRF-proof token
229	$app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
230	$this->cancel();
231
232	return false;
233	}
234
235	// check user permissions
236	if (!JFactory::getUser()->authorise('core.delete', 'com_vikappointments') \|\| !VAPFactory::getApi()->isEnabled())
237	{
238	// back to main list, not authorised to delete records
239	$app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
240	$this->cancel();
241
242	return false;
243	}
244
245	// delete selected records
246	$res = $this->getModel()->delete($cid);
247
248	// back to main list
249	$this->cancel();
250
251	return true;
252	}
253
254	/**
255	* Verifies the selected records.
256	*
257	* @return boolean
258	*/
259	public function activate()
260	{
261	$app = JFactory::getApplication();
262	$user = JFactory::getUser();
263
264	/**
265	* Added token validation.
266	* Both GET and POST are supported.
267	*
268	* @since 1.7
269	*/
270	if (!JSession::checkToken() && !JSession::checkToken('get'))
271	{
272	// back to main list, missing CSRF-proof token
273	$app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
274	$this->cancel();
275
276	return false;
277	}
278
279	$cid = $app->input->get('cid', array(), 'uint');
280	$task = $app->input->get('task', null);
281
282	$state = $app->input->get('state', 0, 'uint');
283
284	// check user permissions
285	if (!$user->authorise('core.edit.state', 'com_vikappointments') \|\| !VAPFactory::getApi()->isEnabled())
286	{
287	// back to main list, not authorised to edit records
288	$app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
289	$this->cancel();
290
291	return false;
292	}
293
294	// change state of selected records
295	$this->getModel()->publish($cid, $state, 'active');
296
297	// back to main list
298	$this->cancel();
299
300	return true;
301	}
302
303	/**
304	* Redirects the users to the main records list.
305	*
306	* @return void
307	*/
308	public function cancel()
309	{
310	$this->setRedirect('index.php?option=com_vikappointments&view=apiusers');
311	}
312	}
313