sydney/IPB
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Version 4.7.13

Browse Source
This commit is contained in:
Neo committed 2025-12-19 16:14:56 -08:00
1 parent fd22d99e69
commit 7124a02564
954 files changed
+29277 -59308
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

applications/core/modules/admin/members/members.php
+81 -69
View File
@@ -26,6 +26,76 @@ class _members extends \IPS\Helpers\CoverPhoto\Controller
* @brief Has been CSRF-protected
*/
public static $csrfProtected = TRUE;
/**
* Get the available filters for the main table
*
* @return array
*/
protected static function _getTableFilters() : array
{
$filters = [
'members_filter_banned' => 'temp_ban<>0',
'members_filter_spam' => \IPS\Db::i()->bitwiseWhere( \IPS\Member::$bitOptions['members_bitoptions'], 'bw_is_spammer' ),
'members_filter_validating' => '( v.lost_pass=0 AND v.forgot_security=0 AND v.vid IS NOT NULL )',
'members_filter_administrators' => '(1=1)' // We use a straight join when this filter is activated, so there's no additional where needed
];
if ( \IPS\Db::i()->select( 'COUNT(*)', 'core_members', array( "email <> '' and name=''" ) )->first() )
{
$filters['members_filtered_reserved'] = "(name='')";
}
if( \IPS\Settings::i()->ipb_bruteforce_attempts )
{
/* We do this so we can put the locked filter at the 'end' of the buttons - array_unshift does not give us a simple method to retain keys */
$filters += array( 'members_filter_locked' => '( failed_login_count>=' . (int) \IPS\Settings::i()->ipb_bruteforce_attempts . ' OR failed_mfa_attempts>=' . (int) \IPS\Settings::i()->security_questions_tries . ')' );
}
return $filters;
}
/**
* Get the joins for the main table
*
* @returns array
*/
protected static function _getTableJoins( array $joinFields, \IPS\Helpers\Table\Db $table ) : array
{
$joins = [
array(
'select' => 'v.vid, v.coppa_user, v.lost_pass, v.forgot_security, v.new_reg, v.email_chg, v.user_verified, v.spam_flag, v.reg_cancelled',
'from' => array( 'core_validating', 'v' ),
'where' => 'v.member_id=core_members.member_id AND v.lost_pass != 1 AND v.forgot_security != 1' ),
array(
'select' => implode( ',', $joinFields ),
'from' => array( 'core_pfields_content', 'p' ),
'where' => 'p.member_id=core_members.member_id' ),
array(
'select' => 'm.row_id',
'from' => array( 'core_admin_permission_rows', 'm' ),
'where' => "( m.row_id_type='group' and ( m.row_id=core_members.member_group_id OR FIND_IN_SET( m.row_id, core_members.mgroup_others ) ) or ( m.row_id=core_members.member_id AND m.row_id_type='member' ))",
'type' => 'STRAIGHT_JOIN' )
];
/* Makes query less efficient */
if ( $table->filter !== 'members_filter_administrators' )
{
unset( $joins[2] );
}
if ( $table->filter !== 'members_filter_validating' )
{
unset( $joins[0] );
}
if ( ! isset( \IPS\Request::i()->advanced_search_submitted ) )
{
unset( $joins[1] );
}
return $joins;
}
/**
* Manage Members
@@ -51,7 +121,7 @@ class _members extends \IPS\Helpers\CoverPhoto\Controller
}
/* Create the table */
$table = new \IPS\Helpers\Table\Db( 'core_members', \IPS\Http\Url::internal( 'app=core&module=members&controller=members' ), array( array( 'email<>?', '' ) ), $forceIndex );
$table = new \IPS\Helpers\Table\Db( 'core_members', \IPS\Http\Url::internal( 'app=core&module=members&controller=members' ), array( array( 'core_members.email<>?', '' ) ), $forceIndex );
$table->langPrefix = 'members_';
/* Columns we need */
@@ -149,37 +219,7 @@ class _members extends \IPS\Helpers\CoverPhoto\Controller
}
/* Joins */
$table->joins = array(
array(
'select' => 'v.vid, v.coppa_user, v.lost_pass, v.forgot_security, v.new_reg, v.email_chg, v.user_verified, v.spam_flag, v.reg_cancelled',
'from' => array( 'core_validating', 'v' ),
'where' => 'v.member_id=core_members.member_id AND v.lost_pass != 1 AND v.forgot_security != 1' ),
array(
'select' => implode( ',', $joinFields ),
'from' => array( 'core_pfields_content', 'p' ),
'where' => 'p.member_id=core_members.member_id' ),
array(
'select' => 'm.row_id',
'from' => array( 'core_admin_permission_rows', 'm' ),
'where' => "( m.row_id_type='group' and ( m.row_id=core_members.member_group_id OR FIND_IN_SET( m.row_id, core_members.mgroup_others ) ) or ( m.row_id=core_members.member_id AND m.row_id_type='member' ))",
'type' => 'STRAIGHT_JOIN' )
);
/* Makes query less efficient */
if ( $table->filter !== 'members_filter_administrators' )
{
unset( $table->joins[2] );
}
if ( $table->filter !== 'members_filter_validating' )
{
unset( $table->joins[0] );
}
if ( ! isset( \IPS\Request::i()->advanced_search_submitted ) )
{
unset( $table->joins[1] );
}
$table->joins = static::_getTableJoins( $joinFields, $table );
/* Ranks */
$rankOptions = array( '' => 'any' );
@@ -206,7 +246,10 @@ class _members extends \IPS\Helpers\CoverPhoto\Controller
return array( "core_members.member_id=?", (float) $v[1] );
}
} ),
'email' => \IPS\Helpers\Table\SEARCH_CONTAINS_TEXT,
'email' => array( \IPS\Helpers\Table\SEARCH_CONTAINS_TEXT, array(), function( $val )
{
return array( "core_members.email LIKE ?", '%' . $val . '%' );
} ),
'ip_address' => array( \IPS\Helpers\Table\SEARCH_CONTAINS_TEXT, array(), function( $val )
{
return array( "core_members.ip_address LIKE ?", '%' . $val . '%' );
@@ -266,23 +309,7 @@ class _members extends \IPS\Helpers\CoverPhoto\Controller
}
/* Filters */
$table->filters = array(
'members_filter_banned' => 'temp_ban<>0',
'members_filter_spam' => \IPS\Db::i()->bitwiseWhere( \IPS\Member::$bitOptions['members_bitoptions'], 'bw_is_spammer' ),
'members_filter_validating' => '( v.lost_pass=0 AND v.forgot_security=0 AND v.vid IS NOT NULL )',
'members_filter_administrators' => '(1=1)' // We use a straight join when this filter is activated, so there's no additional where needed
);
if ( \IPS\Db::i()->select( 'COUNT(*)', 'core_members', array( "email <> '' and name=''" ) )->first() )
{
$table->filters['members_filtered_reserved'] = "(name='')";
}
if( \IPS\Settings::i()->ipb_bruteforce_attempts )
{
/* We do this so we can put the locked filter at the 'end' of the buttons - array_unshift does not give us a simple method to retain keys */
$table->filters = array( 'members_filter_locked' => '( failed_login_count>=' . (int) \IPS\Settings::i()->ipb_bruteforce_attempts . ' OR failed_mfa_attempts>=' . (int) \IPS\Settings::i()->security_questions_tries . ')' ) + $table->filters;
}
$table->filters = static::_getTableFilters();
/* Custom parsers */
$table->parsers = array(
@@ -2896,7 +2923,7 @@ class _members extends \IPS\Helpers\CoverPhoto\Controller
unset( \IPS\Data\Store::i()->bannedIpAddresses );
}
$member->save();
\IPS\Session::i()->log( 'acplog__members_edited', array( $member->name => FALSE ) );
@@ -4272,8 +4299,8 @@ class _members extends \IPS\Helpers\CoverPhoto\Controller
}
/* Cells starting with =, + or - can be a security risk. */
if ( !isset( $wizardData['includeInsecure'] ) and !\in_array( $column, array( 'primary_group_name', 'secondary_group_names', 'skin_name', 'language_name', 'members_pass_hash', 'members_pass_salt' ) ) and \in_array( mb_substr( $valueToWrite, 0, 1 ), array( '=', '+', '-', '@' ) ) )
{
if ( !isset( $wizardData['includeInsecure'] ) and !\in_array( $column, array( 'primary_group_name', 'secondary_group_names', 'skin_name', 'language_name', 'members_pass_hash', 'members_pass_salt' ) ) and \in_array( mb_substr( $valueToWrite, 0, 1 ), array( '=', '+', '-', '@' ) ) and ! is_numeric( \str_replace( ' ', '', $valueToWrite ) ) )
{
$mrData['removedData'][ $member['member_id'] ] = array( $column, base64_encode( $valueToWrite ) );
return FALSE;
}
@@ -4378,22 +4405,7 @@ class _members extends \IPS\Helpers\CoverPhoto\Controller
}
else
{
/* Init */
$xml = \IPS\Xml\SimpleXML::create('member_export');
$xml->addAttribute( 'created', \IPS\DateTime::ts( time() )->rfc3339() );
/* Get the data */
foreach( \IPS\Application::allExtensions( 'core', 'MemberExportPersonalInformation', TRUE, 'core' ) AS $key => $ext )
{
if ( $data = $ext->getData( $member ) and \is_array( $data ) and \count( $data ) )
{
$child = $xml->addChild( $key );
foreach( $data as $k => $v )
{
$child->addChild( $k, $v );
}
}
}
$xml = $member->getPiiData( $member );
\IPS\Session::i()->log( 'acplog__member_pii_exported', array( $member->name => FALSE ) );
applications/core/modules/admin/members/privacy.php
+300
View File
@@ -0,0 +1,300 @@
<?php
/**
* @brief privacy
* @author <a href='https://www.invisioncommunity.com'>Invision Power Services, Inc.</a>
* @copyright (c) Invision Power Services, Inc.
* @license https://www.invisioncommunity.com/legal/standards/
* @package Invision Community
* @since 07 Mar 2023
*/
namespace IPS\core\modules\admin\members;
/* To prevent PHP errors (extending class does not exist) revealing path */
use IPS\Member;
use IPS\Output;
if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
{
header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
exit;
}
/**
* privacy
*/
class _privacy extends \IPS\Dispatcher\Controller
{
/**
* @brief Has been CSRF-protected
*/
public static $csrfProtected = TRUE;
/**
* Execute
*
* @return void
*/
public function execute()
{
\IPS\Dispatcher::i()->checkAcpPermission( 'privacy_manage' );
\IPS\Output::i()->sidebar['actions']['settings'] = array(
'icon' => 'cog',
'title' => 'settings',
'link' => $this->url->setQueryString( 'do', 'settings' ),
'data' => array( 'ipsDialog' => '', 'ipsDialog-title' => \IPS\Member::loggedIn()->language()->addToStack('settings') )
);
parent::execute();
}
/**
* Manage
*
* @return void
*/
protected function manage()
{
/* Some advanced search links may bring us here */
\IPS\Output::i()->bypassCsrfKeyCheck = true;
/* Create the table */
$where = [ [ \IPS\Db::i()->in('action', [\IPS\Member\PrivacyAction::TYPE_REQUEST_DELETE, \IPS\Member\PrivacyAction::TYPE_REQUEST_PII] ) ], ['approved=?', 0] ];
$table = new \IPS\Helpers\Table\Db( 'core_member_privacy_actions', \IPS\Http\Url::internal( 'app=core&module=members&controller=privacy' ), $where );
$table->include = [ 'photo', 'name', 'email', 'joined','action','request_date' ];
$table->filters = [
'deletion_request' => ['action=?', \IPS\Member\PrivacyAction::TYPE_REQUEST_DELETE],
'pii_data' => ['action=?', \IPS\Member\PrivacyAction::TYPE_REQUEST_PII],
];
$table->joins = [
[ 'select' => 'm.*', 'from' => [ 'core_members', 'm' ], 'where' => 'core_member_privacy_actions.member_id=m.member_id' ]
];
$table->parsers = [
'photo' => function( $val, $row )
{
return \IPS\Theme::i()->getTemplate( 'global', 'core' )->userPhoto( \IPS\Member::constructFromData( $row ), 'tiny' );
},
'name' => function( $val, $row ){
if( $val )
{
$member = \IPS\Member::constructFromData( $row );
if( $banned = $member->isBanned() )
{
if( $banned instanceof \IPS\DateTime )
{
$title = \IPS\Member::loggedIn()->language()->addToStack( 'suspended_until', FALSE, array( 'sprintf' => array( $banned->localeDate() ) ) );
}else
{
$title = \IPS\Member::loggedIn()->language()->addToStack( 'banned' );
}
return "<a href='".\IPS\Http\Url::internal( 'app=core&module=members&controller=members&do=view&id=' ).$row[ 'member_id' ]."'>".htmlentities( $val, ENT_DISALLOWED, 'UTF-8', FALSE )."</a> &nbsp; <span class='ipsBadge ipsBadge_negative'>".$title.'</span> ';
}else
{
return "<a href='".\IPS\Http\Url::internal( 'app=core&module=members&controller=members&do=view&id=' ).$row[ 'member_id' ]."'>".htmlentities( $val, ENT_DISALLOWED, 'UTF-8', FALSE ).'</a>';
}
}
else
{
return \IPS\Theme::i()->getTemplate( 'members', 'core', 'admin' )->memberReserved( \IPS\Member::constructFromData( $row ) );
}
},
'joined' => function( $val, $row )
{
return \IPS\DateTime::ts( $val )->localeDate();
},
'request_date' => function( $val, $row )
{
return \IPS\DateTime::ts( $val )->localeDate();
},
'action' => function( $val, $row )
{
switch ( $val )
{
case \IPS\Member\PrivacyAction::TYPE_REQUEST_PII:
return \IPS\Member::loggedIn()->language()->addToStack('pii_download_requested');
case \IPS\Member\PrivacyAction::TYPE_REQUEST_DELETE:
return \IPS\Member::loggedIn()->language()->addToStack('account_deletion_requested');
}
}
];
$table->rowButtons = function( $row )
{
$return = [];
if( $row['action'] == \IPS\Member\PrivacyAction::TYPE_REQUEST_PII )
{
$return[ 'approve' ] = [
'title' => 'approve',
'icon' => 'check-circle',
'link' => \IPS\Http\Url::internal( 'app=core&module=members&controller=privacy&do=approvePii&id='.$row[ 'id' ] )->csrf()->getSafeUrlFromFilters(),
];
$return['reject'] = [
'icon' => 'times',
'title' => 'reject',
'link' => \IPS\Http\Url::internal( 'app=core&module=members&controller=privacy&do=rejectPii&id=' . $row['id'] )->csrf()->getSafeUrlFromFilters(),
];
}
else if( $row['action'] == \IPS\Member\PrivacyAction::TYPE_REQUEST_DELETE )
{
$member = \IPS\Member::constructFromData( $row );
$return[ 'approveDeletion' ] = [
'title' => 'approve',
'icon' => 'check-circle',
'link' => \IPS\Http\Url::internal( 'app=core&module=members&controller=privacy&do=approveDeletion&id='.$row[ 'id' ] )->csrf()->getSafeUrlFromFilters(),
'data' => [ 'confirm' => '', 'confirmSubMessage' => \IPS\Member::loggedIn()->language()->addToStack( 'delete_member_confirm', FALSE, array( 'sprintf' => $member->name ) ) ]
];
$return['rejectDeletion'] = [
'icon' => 'times',
'title' => 'reject',
'link' => \IPS\Http\Url::internal( 'app=core&module=members&controller=privacy&do=rejectDeletion&id=' . $row['id'] )->csrf()->getSafeUrlFromFilters(),
'data' => array(
)
];
}
return $return;
};
/* Display */
\IPS\Output::i()->title = \IPS\Member::loggedIn()->language()->addToStack( 'menu__core_members_privacy');
\IPS\Output::i()->output = \IPS\Theme::i()->getTemplate( 'global', 'core' )->block( 'title', (string) $table );
}
/**
* Approve PII Request
*
* @return void
*/
protected function approvePii()
{
\IPS\Session::i()->csrfCheck();
try
{
$request = \IPS\Member\PrivacyAction::load( \IPS\Request::i()->id );
$request->approvePiiRequest();
\IPS\Session::i()->log( 'acplog__piirequest_approved', array( $request->member->name => FALSE ) );
}
catch( \OutOfRangeException $e )
{
\IPS\Output::i()->error( 'node_error', '2C432/1', 404, '' );
}
\IPS\Output::i()->redirect( \IPS\Http\Url::internal( 'app=core&module=members&controller=privacy' )->getSafeUrlFromFilters(), 'approved' );
}
/**
* Reject PII Request
*
* @return void
*/
protected function rejectPii()
{
\IPS\Session::i()->csrfCheck();
try
{
$request = \IPS\Member\PrivacyAction::load( \IPS\Request::i()->id );
$request->rejectPiiRequest();
\IPS\Session::i()->log( 'acplog__piirequest_rejected', array( $request->member->name => FALSE ) );
}
catch( \OutOfRangeException $e )
{
\IPS\Output::i()->error( 'node_error', '2C432/2', 404, '' );
}
\IPS\Output::i()->redirect( \IPS\Http\Url::internal( 'app=core&module=members&controller=privacy' )->getSafeUrlFromFilters(), 'pii_request_rejected' );
}
/**
* Approve deletion request
*
* @return void
*/
protected function approveDeletion()
{
\IPS\Session::i()->csrfCheck();
try
{
$request = \IPS\Member\PrivacyAction::load( \IPS\Request::i()->id );
\IPS\Request::i()->confirmedDelete( message: \IPS\Member::loggedIn()->language()->addToStack( 'delete_member_confirm', FALSE, array( 'sprintf' => $request->member->name ) ) );
$request->deleteAccount();
\IPS\Session::i()->log( 'acplog__deletionrequest__approved', array( $request->member->name => FALSE ) );
}
catch( \OutOfRangeException $e )
{
\IPS\Output::i()->error( 'node_error', '2C432/3', 404, '' );
}
\IPS\Output::i()->redirect( \IPS\Http\Url::internal( 'app=core&module=members&controller=privacy' )->getSafeUrlFromFilters(), 'approved' );
}
/**
* Reject deletion request
*
* @return void
*/
protected function rejectDeletion()
{
\IPS\Session::i()->csrfCheck();
try
{
$request = \IPS\Member\PrivacyAction::load( \IPS\Request::i()->id );
$request->rejectDeletionRequest();
\IPS\Session::i()->log( 'acplog__deletionrequest__rejected', array( $request->member->name => FALSE ) );
}
catch( \OutOfRangeException $e )
{
\IPS\Output::i()->error( 'node_error', '2C432/4', 404, '' );
}
\IPS\Output::i()->redirect( \IPS\Http\Url::internal( 'app=core&module=members&controller=privacy' )->getSafeUrlFromFilters(), 'rejected' );
}
protected function settings()
{
$form = new \IPS\Helpers\Form();
$form->add( new \IPS\Helpers\Form\Radio( 'pii_type', \IPS\Settings::i()->pii_type, FALSE, array(
'options' => array(
'off' => 'disabled',
'on' => 'enabled',
'redirect' => "pii_external" ),
'toggles' => array(
'off' => array( '' ),
'redirect' => array( 'pii_link' ),
'on' => array(),
)
) ) );
$form->add( new \IPS\Helpers\Form\Url( 'pii_link', \IPS\Settings::i()->pii_link, FALSE, array(), NULL, NULL, NULL, 'pii_link' ) );
$form->add( new \IPS\Helpers\Form\Radio( 'right_to_be_forgotten_type', \IPS\Settings::i()->right_to_be_forgotten_type, FALSE, array(
'options' => array(
'off' => 'disabled',
'on' => 'enabled',
'redirect' => "right_to_be_forgotten_external" ),
'toggles' => array(
'off' => array( '' ),
'redirect' => array( 'right_to_be_forgotten_link' ),
'on' => array(),
)
) ) );
$form->add( new \IPS\Helpers\Form\Url( 'right_to_be_forgotten_link', \IPS\Settings::i()->right_to_be_forgotten_link, FALSE, array(), NULL, NULL, NULL, 'right_to_be_forgotten_link' ) );
if( $values = $form->values() )
{
$form->saveAsSettings();
\IPS\Output::i()->redirect( \IPS\Http\Url::internal( 'app=core&module=members&controller=privacy' ), 'saved' );
}
\IPS\Output::i()->title = \IPS\Member::loggedIn()->language()->addToStack( 'settings');
\IPS\Output::i()->output = \IPS\Theme::i()->getTemplate( 'global', 'core' )->block( 'title', (string) $form );
}
}