Closes #1422 admin user actions now check for self before banning, deleting, or remov...

git-svn-id: http://code.elgg.org/elgg/trunk@7332 36083f99-b078-4883-b0ff-0f9b5a30f544

diff --git a/actions/admin/user/ban.php b/actions/admin/user/ban.php
index 6622673e64ea07c502ba2c5b7f600fe3a0112adf..5ad6c29c5c729c793c59ac82b3778b31d564e743 100644 (file)
--- a/actions/admin/user/ban.php
+++ b/actions/admin/user/ban.php
@@ -12,10 +12,15 @@
 admin_gatekeeper();
 
 $guid = get_input('guid');
-$obj = get_entity($guid);
+$user = get_entity($guid);
 
-if (($obj instanceof ElggUser) && ($obj->canEdit())) {
-       if ($obj->ban('banned')) {
+if ($guid == get_loggedin_userid()) {
+       register_error(elgg_echo('admin:user:self:ban:no'));
+       forward(REFERER);
+}
+
+if (($user instanceof ElggUser) && ($user->canEdit())) {
+       if ($user->ban('banned')) {
                system_message(elgg_echo('admin:user:ban:yes'));
        } else {
                register_error(elgg_echo('admin:user:ban:no'));
@@ -24,4 +29,4 @@ if (($obj instanceof ElggUser) && ($obj->canEdit())) {
        register_error(elgg_echo('admin:user:ban:no'));
 }
 
-forward('pg/admin/user/');
\ No newline at end of file
+forward(REFERER);
\ No newline at end of file

diff --git a/actions/admin/user/delete.php b/actions/admin/user/delete.php
index e8d83572255f4d6ddb2a8e72158b777516f95bb3..a5e1886ece4962af76401c856052f040fc6e1fb2 100644 (file)
--- a/actions/admin/user/delete.php
+++ b/actions/admin/user/delete.php
@@ -15,13 +15,18 @@ admin_gatekeeper();
 
 // Get the user
 $guid = get_input('guid');
-$obj = get_entity($guid);
+$user = get_entity($guid);
 
-$name = $obj->name;
-$username = $obj->username;
+if ($guid == get_loggedin_userid()) {
+       register_error(elgg_echo('admin:user:self:delete:no'));
+       forward(REFERER);
+}
+
+$name = $user->name;
+$username = $user->username;
 
-if (($obj instanceof ElggUser) && ($obj->canEdit())) {
-       if ($obj->delete()) {
+if (($user instanceof ElggUser) && ($user->canEdit())) {
+       if ($user->delete()) {
                system_message(elgg_echo('admin:user:delete:yes', array($name)));
        } else {
                register_error(elgg_echo('admin:user:delete:no'));

diff --git a/actions/admin/user/removeadmin.php b/actions/admin/user/removeadmin.php
index 46867094062cbf4676e1a6ff86efe7a109d24a8c..97bfc396b383cbadba00d1cd61644d1c2ce9ce13 100644 (file)
--- a/actions/admin/user/removeadmin.php
+++ b/actions/admin/user/removeadmin.php
@@ -11,6 +11,11 @@ admin_gatekeeper();
 $guid = get_input('guid');
 $user = get_entity($guid);
 
+if ($guid == get_loggedin_userid()) {
+       register_error(elgg_echo('admin:user:self:removeadmin:no'));
+       forward(REFERER);
+}
+
 if (($user instanceof ElggUser) && ($user->canEdit())) {
        if ($user->removeAdmin()) {
                system_message(elgg_echo('admin:user:removeadmin:yes'));

diff --git a/actions/admin/user/resetpassword.php b/actions/admin/user/resetpassword.php
index 24127eb8b9145ae11718c7abd9d4271b39b1f204..14de69cb6cd362427d4544dfa467f81d6f04fad0 100644 (file)
--- a/actions/admin/user/resetpassword.php
+++ b/actions/admin/user/resetpassword.php
@@ -17,22 +17,22 @@
 admin_gatekeeper();
 
 $guid = get_input('guid');
-$obj = get_entity($guid);
+$user = get_entity($guid);
 
-if (($obj instanceof ElggUser) && ($obj->canEdit())) {
+if (($user instanceof ElggUser) && ($user->canEdit())) {
        $password = generate_random_cleartext_password();
 
        // Always reset the salt before generating the user password.
-       $obj->salt = generate_random_cleartext_password();
-       $obj->password = generate_user_password($obj, $password);
+       $user->salt = generate_random_cleartext_password();
+       $user->password = generate_user_password($user, $password);
 
-       if ($obj->save()) {
+       if ($user->save()) {
                system_message(elgg_echo('admin:user:resetpassword:yes'));
 
-               notify_user($obj->guid,
+               notify_user($user->guid,
                        $CONFIG->site->guid,
                        elgg_echo('email:resetpassword:subject'),
-                       elgg_echo('email:resetpassword:body', array($obj->username, $password)),
+                       elgg_echo('email:resetpassword:body', array($user->username, $password)),
                        NULL,
                        'email');
        } else {

diff --git a/actions/admin/user/unban.php b/actions/admin/user/unban.php
index 66173623af1fd216bece5f6930a98fbe672e2145..883e074ed2d81cc8d466959e441799f622a24de2 100644 (file)
--- a/actions/admin/user/unban.php
+++ b/actions/admin/user/unban.php
@@ -12,10 +12,10 @@ $access_status = access_get_show_hidden_status();
 access_show_hidden_entities(true);
 
 $guid = get_input('guid');
-$obj = get_entity($guid);
+$user = get_entity($guid);
 
-if (($obj instanceof ElggUser) && ($obj->canEdit())) {
-       if ($obj->unban()) {
+if (($user instanceof ElggUser) && ($user->canEdit())) {
+       if ($user->unban()) {
                system_message(elgg_echo('admin:user:unban:yes'));
        } else {
                register_error(elgg_echo('admin:user:unban:no'));

diff --git a/languages/en.php b/languages/en.php
index 118ad888332d872635b76bf62b9628a336e7f868..ad6461fd030c581d3bbcf521bf19b1b9024471bd 100644 (file)
--- a/languages/en.php
+++ b/languages/en.php
@@ -519,10 +519,12 @@ To remove a widget drag it back to the <b>Widget gallery</b>.",
 
        'admin:user:ban:no' => "Can not ban user",
        'admin:user:ban:yes' => "User banned.",
+       'admin:user:self:ban:no' => "You cannot ban yourself",
        'admin:user:unban:no' => "Can not unban user",
        'admin:user:unban:yes' => "User un-banned.",
        'admin:user:delete:no' => "Can not delete user",
        'admin:user:delete:yes' => "The user %s has been deleted",
+       'admin:user:self:delete:no' => "You cannot delete yourself",
 
        'admin:user:resetpassword:yes' => "Password reset, user notified.",
        'admin:user:resetpassword:no' => "Password could not be reset.",
@@ -532,6 +534,7 @@ To remove a widget drag it back to the <b>Widget gallery</b>.",
 
        'admin:user:removeadmin:yes' => "User is no longer an admin.",
        'admin:user:removeadmin:no' => "We could not remove administrator privileges from this user.",
+       'admin:user:self:removeadmin:no' => "You cannot remove your own administrator privileges.",
 
        'admin:menu_items' => 'Menu Items',
        'admin:menu_items:configure' => 'Configure main menu items',