[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  /**
   4   * @package     Joomla.Administrator
   5   * @subpackage  com_users
   6   *
   7   * @copyright   (C) 2007 Open Source Matters, Inc. <https://www.joomla.org>
   8   * @license     GNU General Public License version 2 or later; see LICENSE.txt
   9   */
  10  
  11  namespace Joomla\Component\Users\Administrator\Controller;
  12  
  13  use Joomla\CMS\Access\Access;
  14  use Joomla\CMS\MVC\Controller\FormController;
  15  use Joomla\CMS\MVC\Model\BaseDatabaseModel;
  16  use Joomla\CMS\Router\Route;
  17  use Joomla\CMS\Uri\Uri;
  18  
  19  // phpcs:disable PSR1.Files.SideEffects
  20  \defined('_JEXEC') or die;
  21  // phpcs:enable PSR1.Files.SideEffects
  22  
  23  /**
  24   * User controller class.
  25   *
  26   * @since  1.6
  27   */
  28  class UserController extends FormController
  29  {
  30      /**
  31       * @var    string  The prefix to use with controller messages.
  32       * @since  1.6
  33       */
  34      protected $text_prefix = 'COM_USERS_USER';
  35  
  36      /**
  37       * Overrides Joomla\CMS\MVC\Controller\FormController::allowEdit
  38       *
  39       * Checks that non-Super Admins are not editing Super Admins.
  40       *
  41       * @param   array   $data  An array of input data.
  42       * @param   string  $key   The name of the key for the primary key.
  43       *
  44       * @return  boolean  True if allowed, false otherwise.
  45       *
  46       * @since   1.6
  47       */
  48      protected function allowEdit($data = array(), $key = 'id')
  49      {
  50          // Check if this person is a Super Admin
  51          if (Access::check($data[$key], 'core.admin')) {
  52              // If I'm not a Super Admin, then disallow the edit.
  53              if (!$this->app->getIdentity()->authorise('core.admin')) {
  54                  return false;
  55              }
  56          }
  57  
  58          // Allow users to edit their own account
  59          if (isset($data[$key]) && (int) $this->app->getIdentity()->id === (int) $data[$key]) {
  60              return true;
  61          }
  62  
  63          return parent::allowEdit($data, $key);
  64      }
  65  
  66      /**
  67       * Override parent cancel to redirect when using status edit account.
  68       *
  69       * @param   string  $key  The name of the primary key of the URL variable.
  70       *
  71       * @return  boolean  True if access level checks pass, false otherwise.
  72       *
  73       * @since  4.0.0
  74       */
  75      public function cancel($key = null)
  76      {
  77          $result = parent::cancel();
  78  
  79          if ($return = $this->input->get('return', '', 'BASE64')) {
  80              $return = base64_decode($return);
  81  
  82              // Don't redirect to an external URL.
  83              if (!Uri::isInternal($return)) {
  84                  $return = Uri::base();
  85              }
  86  
  87              $this->app->redirect($return);
  88          }
  89  
  90          return $result;
  91      }
  92  
  93      /**
  94       * Override parent save to redirect when using status edit account.
  95       *
  96       * @param   string  $key     The name of the primary key of the URL variable.
  97       * @param   string  $urlVar  The name of the URL variable if different from the primary key (sometimes required to avoid router collisions).
  98       *
  99       * @return  boolean  True if successful, false otherwise.
 100       *
 101       * @since   4.0.0
 102       */
 103      public function save($key = null, $urlVar = null)
 104      {
 105          $result = parent::save($key, $urlVar);
 106  
 107          $task   = $this->getTask();
 108  
 109          if ($task === 'save' && $return = $this->input->get('return', '', 'BASE64')) {
 110              $return = base64_decode($return);
 111  
 112              // Don't redirect to an external URL.
 113              if (!Uri::isInternal($return)) {
 114                  $return = Uri::base();
 115              }
 116  
 117              $this->setRedirect($return);
 118          }
 119  
 120          return $result;
 121      }
 122  
 123      /**
 124       * Method to run batch operations.
 125       *
 126       * @param   object  $model  The model.
 127       *
 128       * @return  boolean  True on success, false on failure
 129       *
 130       * @since   2.5
 131       */
 132      public function batch($model = null)
 133      {
 134          $this->checkToken();
 135  
 136          // Set the model
 137          $model = $this->getModel('User', 'Administrator', array());
 138  
 139          // Preset the redirect
 140          $this->setRedirect(Route::_('index.php?option=com_users&view=users' . $this->getRedirectToListAppend(), false));
 141  
 142          return parent::batch($model);
 143      }
 144  
 145      /**
 146       * Function that allows child controller access to model data after the data has been saved.
 147       *
 148       * @param   BaseDatabaseModel  $model      The data model object.
 149       * @param   array              $validData  The validated data.
 150       *
 151       * @return  void
 152       *
 153       * @since   3.1
 154       */
 155      protected function postSaveHook(BaseDatabaseModel $model, $validData = array())
 156      {
 157      }
 158  }