[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  /**
   4   * @package     Joomla.Administrator
   5   * @subpackage  com_users
   6   *
   7   * @copyright   (C) 2005 Open Source Matters, Inc. <https://www.joomla.org>
   8   * @license     GNU General Public License version 2 or later; see LICENSE.txt
   9   */
  10  
  11  namespace Joomla\Component\Users\Administrator\Controller;
  12  
  13  use Joomla\CMS\Access\Exception\NotAllowed;
  14  use Joomla\CMS\Helper\ContentHelper;
  15  use Joomla\CMS\Language\Text;
  16  use Joomla\CMS\MVC\Controller\BaseController;
  17  use Joomla\CMS\Router\Route;
  18  
  19  // phpcs:disable PSR1.Files.SideEffects
  20  \defined('_JEXEC') or die;
  21  // phpcs:enable PSR1.Files.SideEffects
  22  
  23  /**
  24   * Users master display controller.
  25   *
  26   * @since  1.6
  27   */
  28  class DisplayController extends BaseController
  29  {
  30      /**
  31       * The default view.
  32       *
  33       * @var    string
  34       * @since  1.6
  35       */
  36      protected $default_view = 'users';
  37  
  38      /**
  39       * Checks whether a user can see this view.
  40       *
  41       * @param   string  $view  The view name.
  42       *
  43       * @return  boolean
  44       *
  45       * @since   1.6
  46       */
  47      protected function canView($view)
  48      {
  49          $canDo = ContentHelper::getActions('com_users');
  50  
  51          switch ($view) {
  52              // Special permissions.
  53              case 'groups':
  54              case 'group':
  55              case 'levels':
  56              case 'level':
  57                  return $canDo->get('core.admin');
  58  
  59              // Default permissions.
  60              default:
  61                  return true;
  62          }
  63      }
  64  
  65      /**
  66       * Method to display a view.
  67       *
  68       * @param   boolean  $cachable   If true, the view output will be cached
  69       * @param   array    $urlparams  An array of safe URL parameters and their variable types,
  70       *                               for valid values see {@link \Joomla\CMS\Filter\InputFilter::clean()}.
  71       *
  72       * @return  BaseController|boolean  This object to support chaining or false on failure.
  73       *
  74       * @since   1.5
  75       */
  76      public function display($cachable = false, $urlparams = array())
  77      {
  78          $view   = $this->input->get('view', 'users');
  79          $layout = $this->input->get('layout', 'default');
  80          $id     = $this->input->getInt('id');
  81  
  82          if (!$this->canView($view)) {
  83              throw new NotAllowed(Text::_('JERROR_ALERTNOAUTHOR'), 403);
  84          }
  85  
  86          // Check for edit form.
  87          if ($view == 'user' && $layout == 'edit' && !$this->checkEditId('com_users.edit.user', $id)) {
  88              // Somehow the person just went to the form - we don't allow that.
  89              if (!\count($this->app->getMessageQueue())) {
  90                  $this->setMessage(Text::sprintf('JLIB_APPLICATION_ERROR_UNHELD_ID', $id), 'error');
  91              }
  92  
  93              $this->setRedirect(Route::_('index.php?option=com_users&view=users', false));
  94  
  95              return false;
  96          } elseif ($view == 'group' && $layout == 'edit' && !$this->checkEditId('com_users.edit.group', $id)) {
  97              // Somehow the person just went to the form - we don't allow that.
  98              if (!\count($this->app->getMessageQueue())) {
  99                  $this->setMessage(Text::sprintf('JLIB_APPLICATION_ERROR_UNHELD_ID', $id), 'error');
 100              }
 101  
 102              $this->setRedirect(Route::_('index.php?option=com_users&view=groups', false));
 103  
 104              return false;
 105          } elseif ($view == 'level' && $layout == 'edit' && !$this->checkEditId('com_users.edit.level', $id)) {
 106              // Somehow the person just went to the form - we don't allow that.
 107              if (!\count($this->app->getMessageQueue())) {
 108                  $this->setMessage(Text::sprintf('JLIB_APPLICATION_ERROR_UNHELD_ID', $id), 'error');
 109              }
 110  
 111              $this->setRedirect(Route::_('index.php?option=com_users&view=levels', false));
 112  
 113              return false;
 114          } elseif ($view == 'note' && $layout == 'edit' && !$this->checkEditId('com_users.edit.note', $id)) {
 115              // Somehow the person just went to the form - we don't allow that.
 116              if (!\count($this->app->getMessageQueue())) {
 117                  $this->setMessage(Text::sprintf('JLIB_APPLICATION_ERROR_UNHELD_ID', $id), 'error');
 118              }
 119  
 120              $this->setRedirect(Route::_('index.php?option=com_users&view=notes', false));
 121  
 122              return false;
 123          } elseif (in_array($view, ['captive', 'callback', 'methods', 'method'])) {
 124              $controller = $this->factory->createController($view, 'Administrator', [], $this->app, $this->input);
 125              $task       = $this->input->get('task', '');
 126  
 127              return $controller->execute($task);
 128          }
 129  
 130          return parent::display($cachable, $urlparams);
 131      }
 132  }