mirror of
https://github.com/lucaspalomodevelop/core.git
synced 2026-03-14 08:34:39 +00:00
1045 lines
45 KiB
PHP
1045 lines
45 KiB
PHP
<?php
|
|
|
|
/*
|
|
Copyright (C) 2014-2015 Deciso B.V.
|
|
Copyright (C) 2008 Shrew Soft Inc.
|
|
Copyright (C) 2005 Paul Taylor <paultaylor@winn-dixie.com>
|
|
Copyright (C) 2003-2005 Manuel Kasper <mk@neon1.net>
|
|
All rights reserved.
|
|
|
|
Redistribution and use in source and binary forms, with or without
|
|
modification, are permitted provided that the following conditions are met:
|
|
|
|
1. Redistributions of source code must retain the above copyright notice,
|
|
this list of conditions and the following disclaimer.
|
|
|
|
2. Redistributions in binary form must reproduce the above copyright
|
|
notice, this list of conditions and the following disclaimer in the
|
|
documentation and/or other materials provided with the distribution.
|
|
|
|
THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
|
|
INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
|
|
AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
|
|
OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
|
|
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
|
|
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
|
|
POSSIBILITY OF SUCH DAMAGE.
|
|
*/
|
|
require_once("guiconfig.inc");
|
|
|
|
function get_user_privdesc(& $user)
|
|
{
|
|
global $priv_list;
|
|
|
|
$privs = array();
|
|
|
|
if (!isset($user['priv']) || !is_array($user['priv'])) {
|
|
$user_privs = array();
|
|
} else {
|
|
$user_privs = $user['priv'];
|
|
}
|
|
|
|
$names = local_user_get_groups($user, true);
|
|
|
|
foreach ($names as $name) {
|
|
$group = getGroupEntry($name);
|
|
if (isset($group['priv']) && is_array($group['priv'])) {
|
|
foreach ($group['priv'] as $pname) {
|
|
if (in_array($pname, $user_privs)) {
|
|
continue;
|
|
}
|
|
if (empty($priv_list[$pname])) {
|
|
continue;
|
|
}
|
|
$priv = $priv_list[$pname];
|
|
$priv['group'] = $group['name'];
|
|
$priv['id'] = $pname;
|
|
$privs[] = $priv;
|
|
}
|
|
}
|
|
}
|
|
|
|
foreach ($user_privs as $pname) {
|
|
if (!empty($priv_list[$pname])) {
|
|
$priv_list[$pname]['id'] = $pname;
|
|
$privs[] = $priv_list[$pname];
|
|
}
|
|
}
|
|
|
|
legacy_html_escape_form_data($privs);
|
|
return $privs;
|
|
}
|
|
|
|
// link user section
|
|
if (!isset($config['system']['user']) || !is_array($config['system']['user'])) {
|
|
$config['system']['user'] = array();
|
|
}
|
|
$a_user = &$config['system']['user'];
|
|
|
|
// reset errors and action
|
|
$input_errors = array();
|
|
$act = null;
|
|
if ($_SERVER['REQUEST_METHOD'] === 'GET') {
|
|
// process get type actions
|
|
if (isset($_GET['userid']) && isset($a_user[$_GET['userid']])) {
|
|
$id = $_GET['userid'];
|
|
}
|
|
if (isset($_GET['act'])) {
|
|
$act = $_GET['act'];
|
|
}
|
|
if (isset($_GET['savemsg'])) {
|
|
$savemsg = htmlspecialchars($_GET['savemsg']);
|
|
}
|
|
if ($act == "expcert" && isset($id)) {
|
|
// export certificate
|
|
$cert =& lookup_cert($a_user[$id]['cert'][$_GET['certid']]);
|
|
|
|
$exp_name = urlencode("{$a_user[$id]['name']}-{$cert['descr']}.crt");
|
|
$exp_data = base64_decode($cert['crt']);
|
|
$exp_size = strlen($exp_data);
|
|
|
|
header("Content-Type: application/octet-stream");
|
|
header("Content-Disposition: attachment; filename={$exp_name}");
|
|
header("Content-Length: $exp_size");
|
|
echo $exp_data;
|
|
exit;
|
|
} elseif ($act == "expckey" && isset($id)) {
|
|
// export private key
|
|
$cert =& lookup_cert($a_user[$id]['cert'][$_GET['certid']]);
|
|
$exp_name = urlencode("{$a_user[$id]['name']}-{$cert['descr']}.key");
|
|
$exp_data = base64_decode($cert['prv']);
|
|
$exp_size = strlen($exp_data);
|
|
|
|
header("Content-Type: application/octet-stream");
|
|
header("Content-Disposition: attachment; filename={$exp_name}");
|
|
header("Content-Length: $exp_size");
|
|
echo $exp_data;
|
|
exit;
|
|
} elseif ($act == 'new' || $act == 'edit') {
|
|
// edit user, load or init data
|
|
$fieldnames = array('user_dn', 'descr', 'expires', 'scope', 'uid', 'priv', 'ipsecpsk', 'lifetime');
|
|
if (isset($id)) {
|
|
if (isset($a_user[$id]['authorizedkeys'])) {
|
|
$pconfig['authorizedkeys'] = base64_decode($a_user[$id]['authorizedkeys']);
|
|
}
|
|
if (isset($a_user[$id]['name'])) {
|
|
$pconfig['usernamefld'] = $a_user[$id]['name'];
|
|
}
|
|
$pconfig['groups'] = local_user_get_groups($a_user[$id]);
|
|
$pconfig['disabled'] = isset($a_user[$id]['disabled']);
|
|
foreach ($fieldnames as $fieldname) {
|
|
if (isset($a_user[$id][$fieldname])) {
|
|
$pconfig[$fieldname] = $a_user[$id][$fieldname];
|
|
} else {
|
|
$pconfig[$fieldname] = null;
|
|
}
|
|
}
|
|
} else {
|
|
// set defaults
|
|
$pconfig['groups'] = null;
|
|
$pconfig['disabled'] = false;
|
|
$pconfig['scope'] = "user";
|
|
$pconfig['lifetime'] = 365;
|
|
$pconfig['usernamefld'] = null;
|
|
foreach ($fieldnames as $fieldname) {
|
|
if (!isset($pconfig[$fieldname])) {
|
|
$pconfig[$fieldname] = null;
|
|
}
|
|
}
|
|
}
|
|
}
|
|
} elseif ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
// process post type requests
|
|
if (isset($_POST['userid']) && isset($a_user[$_POST['userid']])) {
|
|
$id = $_POST['userid'];
|
|
}
|
|
if (isset($_POST['act'])) {
|
|
$act = $_POST['act'];
|
|
}
|
|
$pconfig = $_POST;
|
|
|
|
if ($act == "deluser" && isset($id)) {
|
|
// drop user
|
|
local_user_del($a_user[$id]);
|
|
$userdeleted = $a_user[$id]['name'];
|
|
unset($a_user[$id]);
|
|
write_config();
|
|
$savemsg = gettext("User")." {$userdeleted} ". gettext("successfully deleted");
|
|
header("Location: system_usermanager.php?savemsg=".$savemsg);
|
|
exit;
|
|
} elseif ($act == "delpriv" && !empty($pconfig['priv_delete']) && isset($id)) {
|
|
// drop privilege from user
|
|
// search for priv id to delete
|
|
$privid = null;
|
|
if (!empty($a_user[$id]['priv'])) {
|
|
foreach ($a_user[$id]['priv'] as $key => $value) {
|
|
if ($value == $pconfig['priv_delete']) {
|
|
$privid = $key;
|
|
$privdeleted = $value;
|
|
}
|
|
}
|
|
}
|
|
|
|
if ($privid !== null) {
|
|
unset($a_user[$id]['priv'][$privid]);
|
|
local_user_set($a_user[$id]);
|
|
write_config();
|
|
$savemsg = gettext("Privilege")." {$privdeleted} ".
|
|
gettext("successfully deleted");
|
|
header("Location: system_usermanager.php?savemsg=".$savemsg."&act=edit&userid=".$id);
|
|
} else {
|
|
header("Location: system_usermanager.php?act=edit&userid=".$id);
|
|
}
|
|
exit;
|
|
} elseif ($act == "delcert" && isset($id)) {
|
|
// remove certificate association
|
|
$certdeleted = lookup_cert($a_user[$id]['cert'][$pconfig['certid']]);
|
|
$certdeleted = $certdeleted['descr'];
|
|
unset($a_user[$id]['cert'][$pconfig['certid']]);
|
|
write_config();
|
|
$savemsg = gettext("Certificate")." {$certdeleted} ".
|
|
gettext("association removed.");
|
|
header("Location: system_usermanager.php?savemsg=".$savemsg."&act=edit&userid=".$id);
|
|
exit;
|
|
} elseif ($act == "newApiKey" && isset($id)) {
|
|
// every action is using the sequence of the user, to keep it understandable, we will use
|
|
// the same strategy here (although we need a username to work with)
|
|
//
|
|
// the client side is (jquery) generates the actual download file.
|
|
$username = $a_user[$id]['name'];
|
|
$authFactory = new \OPNsense\Auth\AuthenticationFactory();
|
|
$authenticator = $authFactory->get("Local API");
|
|
$keyData = $authenticator->createKey($username);
|
|
if ($keyData != null) {
|
|
echo json_encode($keyData);
|
|
}
|
|
exit;
|
|
} elseif ($act =='delApiKey' && isset($id)) {
|
|
$username = $a_user[$id]['name'];
|
|
if (!empty($pconfig['api_delete'])) {
|
|
$authFactory = new \OPNsense\Auth\AuthenticationFactory();
|
|
$authenticator = $authFactory->get("Local API");
|
|
$authenticator->dropKey($username, $pconfig['api_delete']);
|
|
$savemsg = gettext("API key")." {$pconfig['api_delete']} ".
|
|
gettext("removed.");
|
|
} else {
|
|
$savemsg = gettext('No API key found');
|
|
}
|
|
// redirect
|
|
header("Location: system_usermanager.php?savemsg=".$savemsg."&act=edit&userid=".$id);
|
|
exit;
|
|
} elseif (isset($pconfig['save'])) {
|
|
// save user
|
|
/* input validation */
|
|
if (isset($id)) {
|
|
$reqdfields = explode(" ", "usernamefld");
|
|
$reqdfieldsn = array(gettext("Username"));
|
|
} else {
|
|
$reqdfields = explode(" ", "usernamefld passwordfld1");
|
|
$reqdfieldsn = array(
|
|
gettext("Username"),
|
|
gettext("Password"));
|
|
}
|
|
|
|
do_input_validation($pconfig, $reqdfields, $reqdfieldsn, $input_errors);
|
|
|
|
if (preg_match("/[^a-zA-Z0-9\.\-_]/", $pconfig['usernamefld'])) {
|
|
$input_errors[] = gettext("The username contains invalid characters.");
|
|
}
|
|
|
|
if (strlen($_POST['usernamefld']) > 16) {
|
|
$input_errors[] = gettext("The username is longer than 16 characters.");
|
|
}
|
|
|
|
if (($pconfig['passwordfld1']) && ($pconfig['passwordfld1'] != $pconfig['passwordfld2'])) {
|
|
$input_errors[] = gettext("The passwords do not match.");
|
|
}
|
|
|
|
if (isset($id)) {
|
|
$oldusername = $a_user[$id]['name'];
|
|
} else {
|
|
$oldusername = "";
|
|
}
|
|
/* make sure this user name is unique */
|
|
if (count($input_errors) == 0) {
|
|
foreach ($a_user as $userent) {
|
|
if ($userent['name'] == $pconfig['usernamefld'] && $oldusername != $pconfig['usernamefld']) {
|
|
$input_errors[] = gettext("Another entry with the same username already exists.");
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
/* also make sure it is not reserved */
|
|
if (count($input_errors) == 0) {
|
|
$system_users = explode("\n", file_get_contents("/etc/passwd"));
|
|
foreach ($system_users as $s_user) {
|
|
$ent = explode(":", $s_user);
|
|
if ($ent[0] == $pconfig['usernamefld'] && $oldusername != $pconfig['usernamefld']) {
|
|
$input_errors[] = gettext("That username is reserved by the system.");
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
|
|
/*
|
|
* Check for a valid expirationdate if one is set at all (valid means,
|
|
* DateTime puts out a time stamp so any DateTime compatible time
|
|
* format may be used. to keep it simple for the enduser, we only
|
|
* claim to accept MM/DD/YYYY as inputs. Advanced users may use inputs
|
|
* like "+1 day", which will be converted to MM/DD/YYYY based on "now".
|
|
* Otherwhise such an entry would lead to an invalid expiration data.
|
|
*/
|
|
if (!empty($pconfig['expires'])) {
|
|
try {
|
|
$expdate = new DateTime($pconfig['expires']);
|
|
//convert from any DateTime compatible date to MM/DD/YYYY
|
|
$pconfig['expires'] = $expdate->format("m/d/Y");
|
|
} catch (Exception $ex) {
|
|
$input_errors[] = gettext("Invalid expiration date format; use MM/DD/YYYY instead.");
|
|
}
|
|
}
|
|
|
|
if (!empty($pconfig['name'])) {
|
|
$ca = lookup_ca($pconfig['caref']);
|
|
if (!$ca) {
|
|
$input_errors[] = gettext("Invalid internal Certificate Authority") . "\n";
|
|
}
|
|
}
|
|
|
|
if (count($input_errors)==0) {
|
|
$userent = array();
|
|
|
|
if (isset($id)) {
|
|
$userent = $a_user[$id];
|
|
/* the user name was modified */
|
|
if ($pconfig['usernamefld'] != $pconfig['oldusername']) {
|
|
local_user_del($userent);
|
|
}
|
|
}
|
|
|
|
/* the user password was modified */
|
|
if (!empty($pconfig['passwordfld1'])) {
|
|
local_user_set_password($userent, $pconfig['passwordfld1']);
|
|
}
|
|
|
|
isset($pconfig['scope']) ? $userent['scope'] = $pconfig['scope'] : $userent['scope'] = "system";
|
|
|
|
$userent['name'] = $pconfig['usernamefld'];
|
|
$userent['descr'] = $pconfig['descr'];
|
|
$userent['expires'] = $pconfig['expires'];
|
|
$userent['authorizedkeys'] = base64_encode($pconfig['authorizedkeys']);
|
|
$userent['ipsecpsk'] = $pconfig['ipsecpsk'];
|
|
|
|
if (!empty($pconfig['disabled'])) {
|
|
$userent['disabled'] = true;
|
|
} elseif (isset($userent['disabled'])) {
|
|
unset($userent['disabled']);
|
|
}
|
|
|
|
if (isset($id)) {
|
|
$a_user[$id] = $userent;
|
|
} else {
|
|
$userent['uid'] = $config['system']['nextuid']++;
|
|
/* Add the user to All Users group. */
|
|
foreach ($config['system']['group'] as $gidx => $group) {
|
|
if ($group['name'] == "all") {
|
|
if (!is_array($config['system']['group'][$gidx]['member'])) {
|
|
$config['system']['group'][$gidx]['member'] = array();
|
|
}
|
|
$config['system']['group'][$gidx]['member'][] = $userent['uid'];
|
|
break;
|
|
}
|
|
}
|
|
|
|
$a_user[] = $userent;
|
|
}
|
|
|
|
local_user_set($userent);
|
|
local_user_set_groups($userent, $pconfig['groups']);
|
|
write_config();
|
|
|
|
if (!empty($pconfig['chkNewCert'])) {
|
|
// redirect to cert manager when a new cert is requested for this user
|
|
header("Location: system_certmanager.php?act=new&userid=".(count($a_user)-1));
|
|
} else {
|
|
header("Location: system_usermanager.php");
|
|
exit;
|
|
}
|
|
}
|
|
} elseif (isset($id)) {
|
|
header("Location: system_usermanager.php?userid=".$id);
|
|
exit;
|
|
} else {
|
|
header("Location: system_usermanager.php");
|
|
exit;
|
|
}
|
|
}
|
|
|
|
legacy_html_escape_form_data($pconfig);
|
|
legacy_html_escape_form_data($a_user);
|
|
|
|
include("head.inc");
|
|
|
|
?>
|
|
|
|
<body>
|
|
|
|
<?php include("fbegin.inc"); ?>
|
|
|
|
<script type="text/javascript">
|
|
//<![CDATA[
|
|
function clear_selected(id) {
|
|
selbox = document.getElementById(id);
|
|
count = selbox.options.length;
|
|
for (index = 0; index<count; index++) {
|
|
selbox.options[index].selected = false;
|
|
}
|
|
}
|
|
|
|
function remove_selected(id) {
|
|
selbox = document.getElementById(id);
|
|
index = selbox.options.length - 1;
|
|
for (; index >= 0; index--) {
|
|
if (selbox.options[index].selected) {
|
|
selbox.remove(index);
|
|
}
|
|
}
|
|
}
|
|
|
|
function copy_selected(srcid, dstid) {
|
|
src_selbox = document.getElementById(srcid);
|
|
dst_selbox = document.getElementById(dstid);
|
|
count = dst_selbox.options.length;
|
|
for (index = count - 1; index >= 0; index--) {
|
|
if (dst_selbox.options[index].value == '') {
|
|
dst_selbox.remove(index);
|
|
}
|
|
}
|
|
count = src_selbox.options.length;
|
|
for (index = 0; index < count; index++) {
|
|
if (src_selbox.options[index].selected) {
|
|
option = document.createElement('option');
|
|
option.text = src_selbox.options[index].text;
|
|
option.value = src_selbox.options[index].value;
|
|
dst_selbox.add(option, null);
|
|
}
|
|
}
|
|
}
|
|
|
|
function move_selected(srcid, dstid) {
|
|
copy_selected(srcid, dstid);
|
|
remove_selected(srcid);
|
|
}
|
|
|
|
function presubmit() {
|
|
clear_selected('notgroups');
|
|
|
|
selbox = document.getElementById("groups");
|
|
count = selbox.options.length;
|
|
for (index = 0; index<count; index++) {
|
|
selbox.options[index].selected = true;
|
|
}
|
|
}
|
|
//]]>
|
|
</script>
|
|
|
|
<script type="text/javascript">
|
|
$( document ).ready(function() {
|
|
// delete privilege
|
|
$(".act-del-priv").click(function(event){
|
|
event.preventDefault();
|
|
var priv_name = $(this).data('priv');
|
|
BootstrapDialog.show({
|
|
type:BootstrapDialog.TYPE_DANGER,
|
|
title: "<?= gettext("User");?>",
|
|
message: "<?=gettext("Do you really want to delete this privilege?");?> " + "<br/>("+priv_name+")",
|
|
buttons: [{
|
|
label: "<?= gettext("No");?>",
|
|
action: function(dialogRef) {
|
|
dialogRef.close();
|
|
}}, {
|
|
label: "<?= gettext("Yes");?>",
|
|
action: function(dialogRef) {
|
|
$("#priv_delete").val(priv_name);
|
|
$("#act").val("delpriv");
|
|
$("#iform").submit();
|
|
}
|
|
}]
|
|
});
|
|
});
|
|
|
|
// remove certificate association
|
|
$(".act-del-cert").click(function(event){
|
|
var certid = $(this).data('certid');
|
|
event.preventDefault();
|
|
BootstrapDialog.show({
|
|
type:BootstrapDialog.TYPE_DANGER,
|
|
title: "<?= gettext("Certificate");?>",
|
|
message: '<?=gettext("Do you really want to remove this certificate association?") .'\n'. gettext("(Certificate will not be deleted)");?>',
|
|
buttons: [{
|
|
label: "<?= gettext("No");?>",
|
|
action: function(dialogRef) {
|
|
dialogRef.close();
|
|
}}, {
|
|
label: "<?= gettext("Yes");?>",
|
|
action: function(dialogRef) {
|
|
$("#certid").val(certid);
|
|
$("#act").val("delcert");
|
|
$("#iform").submit();
|
|
}
|
|
}]
|
|
});
|
|
});
|
|
|
|
// remove user
|
|
$(".act-del-user").click(function(event){
|
|
var userid = $(this).data('userid');
|
|
var username = $(this).data('username');
|
|
event.preventDefault();
|
|
BootstrapDialog.show({
|
|
type:BootstrapDialog.TYPE_DANGER,
|
|
title: "<?= gettext("User");?>",
|
|
message: '<?=gettext("Do you really want to delete this user?");?>' + '<br/>('+username+")",
|
|
buttons: [{
|
|
label: "<?= gettext("No");?>",
|
|
action: function(dialogRef) {
|
|
dialogRef.close();
|
|
}}, {
|
|
label: "<?= gettext("Yes");?>",
|
|
action: function(dialogRef) {
|
|
$("#userid").val(userid);
|
|
$("#act2").val("deluser");
|
|
$("#iform2").submit();
|
|
}
|
|
}]
|
|
});
|
|
});
|
|
|
|
// expand ssh key section on click
|
|
$("#authorizedkeys").click(function(){
|
|
$(this).attr('rows', '7');
|
|
});
|
|
|
|
// import ldap users
|
|
$("#import_ldap_users").click(function(){
|
|
url="system_usermanager_import_ldap.php";
|
|
var oWin = window.open(url,"OPNsense","width=620,height=400,top=150,left=150,scrollbars=yes");
|
|
if (oWin==null || typeof(oWin)=="undefined") {
|
|
alert("<?=gettext('Popup blocker detected. Action aborted.');?>");
|
|
}
|
|
});
|
|
|
|
|
|
// generate a new API key for this user
|
|
$("#newApiKey").click(function(event){
|
|
event.preventDefault();
|
|
$.post(window.location, {act: 'newApiKey', userid: $("#userid").val() }, function(data) {
|
|
if (data['key'] != undefined) {
|
|
// only generate a key file if there's data
|
|
output_data = 'key='+data['key'] +'\n' + 'secret='+data['secret'] +'\n';
|
|
// create link, click and send to client
|
|
$('<a></a>')
|
|
.attr('id','downloadFile')
|
|
.attr('href','data:text/plain;charset=utf8,' + encodeURIComponent(output_data))
|
|
.attr('download','apikey.txt')
|
|
.appendTo('body');
|
|
|
|
$('#downloadFile').ready(function() {
|
|
$('#downloadFile').get(0).click();
|
|
});
|
|
// reload form
|
|
location.reload();
|
|
}
|
|
},'json');
|
|
});
|
|
|
|
// delete API key
|
|
$(".act-del-api-key").click(function(event){
|
|
event.preventDefault();
|
|
var apiKey = $(this).data('key');
|
|
BootstrapDialog.show({
|
|
type:BootstrapDialog.TYPE_DANGER,
|
|
title: "<?= gettext("User");?>",
|
|
message: '<?=gettext("Do you really want to delete this API key?");?>' + '<br/><small>('+apiKey.substring(0,40)+"...)</small>",
|
|
buttons: [{
|
|
label: "<?= gettext("No");?>",
|
|
action: function(dialogRef) {
|
|
dialogRef.close();
|
|
}}, {
|
|
label: "<?= gettext("Yes");?>",
|
|
action: function(dialogRef) {
|
|
$("#act").val("delApiKey");
|
|
$("#api_delete").val(apiKey);
|
|
$("#iform").submit();
|
|
}
|
|
}]
|
|
});
|
|
});
|
|
|
|
});
|
|
</script>
|
|
|
|
|
|
<section class="page-content-main">
|
|
<div class="container-fluid">
|
|
<div class="row">
|
|
<?php
|
|
if (isset($input_errors) && count($input_errors) > 0) {
|
|
print_input_errors($input_errors);
|
|
}
|
|
if (isset($savemsg)) {
|
|
print_info_box($savemsg);
|
|
}
|
|
?>
|
|
<section class="col-xs-12">
|
|
<div class="tab-content content-box col-xs-12 table-responsive">
|
|
<?php
|
|
if ($act == "new" || $act == "edit" ) :?>
|
|
<form action="system_usermanager.php" method="post" name="iform" id="iform" onsubmit="presubmit()">
|
|
<input type="hidden" id="act" name="act" value="<?=$act;?>" />
|
|
<input type="hidden" id="userid" name="userid" value="<?=(isset($id) ? $id : '');?>" />
|
|
<input type="hidden" id="priv_delete" name="priv_delete" value="" /> <!-- delete priv action -->
|
|
<input type="hidden" id="api_delete" name="api_delete" value="" /> <!-- delete api ke action -->
|
|
<input type="hidden" id="certid" name="certid" value="" /> <!-- remove cert association action -->
|
|
<table class="table table-striped">
|
|
<tr>
|
|
<td width="22%"></td>
|
|
<td width="78%" align="right">
|
|
<small><?=gettext("full help"); ?> </small>
|
|
<i class="fa fa-toggle-off text-danger" style="cursor: pointer;" id="show_all_help_page" type="button"></i></a>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td><?=gettext("Defined by");?></td>
|
|
<td>
|
|
<strong><?=strtoupper($pconfig['scope']);?></strong>
|
|
<input name="scope" type="hidden" value="<?=$pconfig['scope']?>" />
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Disabled");?></td>
|
|
<td>
|
|
<input name="disabled" type="checkbox" id="disabled" <?= $pconfig['disabled'] ? "checked=\"checked\"" : "" ?> />
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Username");?></td>
|
|
<td>
|
|
<input name="usernamefld" type="text" class="formfld user" id="usernamefld" size="20" maxlength="16" value="<?=$pconfig['usernamefld'];?>" <?= $pconfig['scope'] == "system" || !empty($pconfig['user_dn']) ? "readonly=\"readonly\"" : "";?> />
|
|
<input name="oldusername" type="hidden" id="oldusername" value="<?=$pconfig['usernamefld'];?>" />
|
|
</td>
|
|
</tr>
|
|
<?php
|
|
if (!empty($pconfig['user_dn'])):?>
|
|
<tr>
|
|
<td><i class="fa fa-info-circle text-muted"></i> <?=gettext("User distinguished name");?></td>
|
|
<td>
|
|
<input name="user_dn" type="text" class="formfld user" id="user_dn" size="20" maxlength="16" value="<?=$pconfig['user_dn'];?>"/ readonly>
|
|
</td>
|
|
</tr>
|
|
<?php
|
|
else:?>
|
|
<tr>
|
|
<td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Password");?></td>
|
|
<td>
|
|
<input name="passwordfld1" type="password" class="formfld pwd" id="passwordfld1" size="20" value="" /><br/>
|
|
<input name="passwordfld2" type="password" class="formfld pwd" id="passwordfld2" size="20" value="" />
|
|
<small><?= gettext("(confirmation)"); ?></small>
|
|
</td>
|
|
</tr>
|
|
<?php
|
|
endif;?>
|
|
<tr>
|
|
<td><a id="help_for_fullname" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Full name");?></td>
|
|
<td>
|
|
<input name="descr" type="text" value="<?=$pconfig['descr'];?>" <?= $pconfig['scope'] == "system" || !empty($pconfig['user_dn']) ? "readonly=\"readonly\"" : "";?> />
|
|
<div class="hidden" for="help_for_fullname">
|
|
<?=gettext("User's full name, for your own information only");?>
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td><a id="help_for_expires" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Expiration date"); ?></td>
|
|
<td>
|
|
<input name="expires" type="text" id="expires" size="10" value="<?=$pconfig['expires'];?>" />
|
|
<div class="hidden" for="help_for_expires">
|
|
<?=gettext("Leave blank if the account shouldn't expire, otherwise enter the expiration date in the following format: mm/dd/yyyy"); ?>
|
|
</div>
|
|
</tr>
|
|
<tr>
|
|
<td><a id="help_for_groups" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("Group Memberships");?></td>
|
|
<td>
|
|
<table class="table" width="100%" border="0" cellpadding="0" cellspacing="0">
|
|
<thead>
|
|
<tr>
|
|
<th><?=gettext("Not Member Of"); ?></th>
|
|
<th> </th>
|
|
<th><?=gettext("Member Of"); ?></th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<tr>
|
|
<td>
|
|
<select size="10" name="notgroups[]" id="notgroups" onchange="clear_selected('groups')" multiple="multiple">
|
|
<?php
|
|
foreach ($config['system']['group'] as $group) :
|
|
if (!empty($pconfig['groups']) && in_array($group['name'], $pconfig['groups'])) {
|
|
continue;
|
|
}
|
|
?>
|
|
<option value="<?=$group['name'];?>">
|
|
<?=htmlspecialchars($group['name']);?>
|
|
</option>
|
|
<?php
|
|
endforeach;?>
|
|
</select>
|
|
</td>
|
|
<td class="text-center">
|
|
<br />
|
|
<a href="javascript:move_selected('notgroups','groups')" class="btn btn-default btn-xs" data-toggle="tooltip" data-placement="left" title="<?=gettext("add groups"); ?>">
|
|
<span class="glyphicon glyphicon-arrow-right"></span>
|
|
</a>
|
|
<br /><br />
|
|
<a href="javascript:move_selected('groups','notgroups')" class="btn btn-default btn-xs" data-toggle="tooltip" data-placement="left" title="<?=gettext("remove groups"); ?>">
|
|
<span class="glyphicon glyphicon-arrow-left"></span>
|
|
</a>
|
|
</td>
|
|
<td>
|
|
<select size="10" name="groups[]" id="groups" onchange="clear_selected('notgroups')" multiple="multiple">
|
|
<?php
|
|
if (!empty($pconfig['groups'])) :
|
|
foreach ($config['system']['group'] as $group) :
|
|
if (!in_array($group['name'], $pconfig['groups'])) {
|
|
continue;
|
|
}
|
|
?>
|
|
<option value="<?=$group['name'];?>">
|
|
<?=htmlspecialchars($group['name']);?>
|
|
</option>
|
|
<?php
|
|
endforeach;
|
|
endif;
|
|
?>
|
|
</select>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
<div class="hidden" for="help_for_groups">
|
|
<?=gettext("Hold down CTRL (pc)/COMMAND (mac) key to select multiple items");?>
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
<?php
|
|
if (isset($pconfig['uid'])) :?>
|
|
<tr>
|
|
<td colspan="2"><i class="fa fa-info-circle text-muted"></i> <?=gettext("Effective Privileges");?></td>
|
|
</tr>
|
|
<tr>
|
|
<td colspan="2">
|
|
<table class="table table-striped table-condensed">
|
|
<tr>
|
|
<td width="20%"><b><?=gettext("Inherited From");?></b></td>
|
|
<td width="30%"><b><?=gettext("Name");?></b></td>
|
|
<td width="40%"><b><?=gettext("Description");?></b></td>
|
|
<td></td>
|
|
</tr>
|
|
<?php
|
|
foreach (get_user_privdesc($a_user[$id]) as $priv) :?>
|
|
<tr>
|
|
<td><?=!empty($priv['group']) ? $priv['group'] : ""?></td>
|
|
<td><?=$priv['name']?></td>
|
|
<td><?=!empty($priv['descr']) ? $priv['descr'] : ""?></td>
|
|
<td class="text-center">
|
|
<?php
|
|
if (empty($priv['group'])) :?>
|
|
<button type="button" data-priv="<?=$priv['id']?>" class="btn btn-default btn-xs act-del-priv"
|
|
title="<?=gettext("revoke privilege");?>" data-toggle="tooltip">
|
|
<span class="fa fa-trash text-muted"></span>
|
|
</button>
|
|
<?php
|
|
endif;?>
|
|
</td>
|
|
</tr>
|
|
<?php
|
|
endforeach;?>
|
|
<tr>
|
|
<td colspan="3"></td>
|
|
<td>
|
|
<a href="system_usermanager_addprivs.php?userid=<?=$id?>" class="btn btn-xs btn-default"
|
|
title="<?=gettext("assign privileges");?>" data-toggle="tooltip">
|
|
<span class="glyphicon glyphicon-plus"></span>
|
|
</a>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td><i class="fa fa-info-circle text-muted"></i> <?=gettext("User Certificates");?></td>
|
|
<td>
|
|
<table class="table table-condensed">
|
|
<tr>
|
|
<td><?=gettext("Name");?></td>
|
|
<td><?=gettext("CA");?></td>
|
|
<td></td>
|
|
</tr>
|
|
<?php
|
|
if (isset($a_user[$id]['cert']) && is_array($a_user[$id]['cert'])) :
|
|
$i = 0;
|
|
foreach ($a_user[$id]['cert'] as $certref) :
|
|
$cert = lookup_cert($certref);
|
|
$ca = lookup_ca($cert['caref']);
|
|
?>
|
|
<tr>
|
|
<td><?=htmlspecialchars($cert['descr']);?>
|
|
<?=is_cert_revoked($cert) ? "(<b>".gettext('Revoked')."</b>)" : "";?>
|
|
</td>
|
|
<td>
|
|
<?=htmlspecialchars($ca['descr']);?>
|
|
</td>
|
|
<td>
|
|
<a href="system_usermanager.php?act=expckey&certid=<?=$i?>&userid=<?=$id?>"
|
|
class="btn btn-default btn-xs" data-toggle="tooltip" title="<?=gettext("export private key");?>">
|
|
<span class="glyphicon glyphicon-arrow-down"></span>
|
|
</a>
|
|
<a href="system_usermanager.php?act=expcert&certid=<?=$i?>&userid=<?=$id?>"
|
|
class="btn btn-default btn-xs" data-toggle="tooltip" title="<?=gettext("export certificate");?>">
|
|
<span class="glyphicon glyphicon-arrow-down"></span>
|
|
</a>
|
|
<button type="submit" data-certid="<?=$i;?>" class="btn btn-default btn-xs act-del-cert"
|
|
title="<?=gettext("unlink certificate");?>" data-toggle="tooltip">
|
|
<span class="fa fa-trash text-muted"></span>
|
|
</button>
|
|
</td>
|
|
</tr>
|
|
<?php
|
|
$i++;
|
|
endforeach;
|
|
endif;?>
|
|
<tr>
|
|
<td colspan="2"></td>
|
|
<td>
|
|
<a href="system_certmanager.php?act=new&userid=<?=$id?>" class="btn btn-default btn-xs"
|
|
title="<?=gettext("create or link user certificate");?>" data-toggle="tooltip">
|
|
<span class="glyphicon glyphicon-plus"></span>
|
|
</a>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td><a id="help_for_apikeys" href="#" class="showhelp"><i class="fa fa-info-circle"></i></a> <?=gettext("API keys");?> </td>
|
|
<td>
|
|
<!-- -->
|
|
<table class="table table-condensed">
|
|
<thead>
|
|
<tr>
|
|
<th>
|
|
<?=gettext('key');?>
|
|
</th>
|
|
<th>
|
|
</th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<?php
|
|
if (isset($a_user[$id]['apikeys']['item'])):
|
|
foreach ($a_user[$id]['apikeys']['item'] as $userApiKey):?>
|
|
<tr>
|
|
<td>
|
|
<small>
|
|
<?php // listtags always changes our key item to an array.. ?>
|
|
<?php // don't want to change "key" to something less sane. ?>
|
|
<?=$userApiKey['key'][0];?>
|
|
<small>
|
|
</td>
|
|
<td>
|
|
<button data-key="<?=$userApiKey['key'][0];?>" type="button" class="btn btn-default btn-xs act-del-api-key"
|
|
title="<?=gettext("delete API key");?>" data-toggle="tooltip">
|
|
<span class="glyphicon glyphicon-trash"></span>
|
|
</button>
|
|
</td>
|
|
</tr>
|
|
<?php
|
|
endforeach;
|
|
endif;?>
|
|
</tbody>
|
|
<tfoot>
|
|
<tr>
|
|
<td></td>
|
|
<td>
|
|
<button type="button" class="btn btn-default btn-xs" id="newApiKey"
|
|
title="<?=gettext("create API key");?>" data-toggle="tooltip">
|
|
<span class="glyphicon glyphicon-plus"></span>
|
|
</button>
|
|
</td>
|
|
</tr>
|
|
</tfoot>
|
|
</table>
|
|
<div class="hidden" for="help_for_apikeys">
|
|
<hr/>
|
|
<?=gettext('manage API keys here for machine to machine interaction using this users credentials');?>
|
|
</div>
|
|
</td>
|
|
</tr>
|
|
<?php
|
|
else :?>
|
|
<tr id="usercertchck">
|
|
<td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Certificate");?></td>
|
|
<td>
|
|
<input type="checkbox" id="chkNewCert" name="chkNewCert" /> <?=gettext("Click to create a user certificate."); ?> (<?=gettext("Redirects on save"); ?>)
|
|
</td>
|
|
</tr>
|
|
<?php
|
|
endif;?>
|
|
<tr>
|
|
<td><i class="fa fa-info-circle text-muted"></i> <?=gettext("Authorized keys");?></td>
|
|
<td>
|
|
<textarea name="authorizedkeys" id="authorizedkeys" class="form-control" cols="65" rows="1" placeholder="<?=gettext("Paste an authorized keys file here.");?>" wrap='off'><?=$pconfig['authorizedkeys'];?></textarea>
|
|
</td>
|
|
</tr>
|
|
<tr id="ipsecpskrow">
|
|
<td><i class="fa fa-info-circle text-muted"></i> <?=gettext("IPsec Pre-Shared Key");?></td>
|
|
<td>
|
|
<input name="ipsecpsk" type="text" size="65" value="<?=$pconfig['ipsecpsk'];?>" />
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td> </td>
|
|
<td>
|
|
<input name="save" type="submit" class="btn btn-primary" value="<?=gettext("Save");?>" />
|
|
<input type="button" class="btn btn-default" value="<?=gettext("Cancel");?>"
|
|
onclick="window.location.href='<?=isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : '/system_usermanager.php';?>'" />
|
|
<?php
|
|
if (isset($id) && !empty($a_user[$id])) :?>
|
|
<input name="id" type="hidden" value="<?=htmlspecialchars($id);?>" />
|
|
<?php
|
|
endif;?>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</form>
|
|
<?php
|
|
else :?>
|
|
<form action="system_usermanager.php" method="post" name="iform2" id="iform2">
|
|
<input type="hidden" id="act2" name="act" value="" />
|
|
<input type="hidden" id="userid" name="userid" value="<?=(isset($id) ? $id : '');?>" />
|
|
<input type="hidden" id="username" name="username" value="" />
|
|
<table class="table table-striped">
|
|
<thead>
|
|
<tr>
|
|
<th><?=gettext("Username"); ?></th>
|
|
<th><?=gettext("Full name"); ?></th>
|
|
<th><?=gettext("Groups"); ?></th>
|
|
<th></th>
|
|
</tr>
|
|
</thead>
|
|
<tbody>
|
|
<?php
|
|
$i = 0;
|
|
foreach ($a_user as $userent) :?>
|
|
<tr>
|
|
<td>
|
|
<?php
|
|
if ($userent['scope'] != "user") {
|
|
$usrimg = "glyphicon glyphicon-user text-danger";
|
|
} elseif (isset($userent['disabled'])) {
|
|
$usrimg = "glyphicon glyphicon-user text-muted";
|
|
} else {
|
|
$usrimg = "glyphicon glyphicon-user text-info";
|
|
}?>
|
|
<span class="<?=$usrimg;?>"></span> <?=$userent['name'];?>
|
|
</td>
|
|
<td><?=$userent['descr'];?></td>
|
|
<td>
|
|
<?=implode(",", local_user_get_groups($userent));?>
|
|
</td>
|
|
<td>
|
|
<a href="system_usermanager.php?act=edit&userid=<?=$i?>"
|
|
class="btn btn-default btn-xs" data-toggle="tooltip" title="<?=gettext("edit user");?>">
|
|
<span class="glyphicon glyphicon-pencil"></span>
|
|
</a>
|
|
<?php
|
|
if ($userent['scope'] != "system") :?>
|
|
<button type="button" class="btn btn-default btn-xs act-del-user"
|
|
data-username="<?=$userent['name'];?>"
|
|
data-userid="<?=$i?>" title="<?=gettext("delete user");?>" data-toggle="tooltip">
|
|
<span class="fa fa-trash text-muted"></span>
|
|
</button>
|
|
<?php
|
|
endif;?>
|
|
</td>
|
|
</tr>
|
|
<?php
|
|
$i++;
|
|
endforeach;
|
|
?>
|
|
</tbody>
|
|
<tfoot>
|
|
<tr>
|
|
<td colspan="3"></td>
|
|
<td>
|
|
<a href="system_usermanager.php?act=new" class="btn btn-default btn-xs"
|
|
title="<?=gettext("add user");?>" data-toggle="tooltip">
|
|
<span class="glyphicon glyphicon-plus"></span>
|
|
</a>
|
|
<?php
|
|
$authcfg_type = auth_get_authserver($config['system']['webgui']['authmode'])['type'];
|
|
if ($authcfg_type == 'ldap') :?>
|
|
<button type="submit" name="import"
|
|
id="import_ldap_users"
|
|
class="btn btn-default btn-xs"
|
|
title="<?=gettext("import users")?>">
|
|
<i class="fa fa-cloud-download"></i>
|
|
</button>
|
|
<?php
|
|
endif;?>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td colspan="4">
|
|
<p class="col-xs-12 col-sm-10">
|
|
<?=gettext("Additional users can be added here. User permissions for accessing " .
|
|
"the webConfigurator can be assigned directly or inherited from group memberships. " .
|
|
"An icon that appears grey indicates that it is a system defined object. " .
|
|
"Some system object properties can be modified but they cannot be deleted."); ?>
|
|
<br /><br />
|
|
<?=gettext("Accounts created here are also used for other parts of the system " .
|
|
"such as OpenVPN, IPsec, and Captive Portal.");?>
|
|
</p>
|
|
</td>
|
|
</tr>
|
|
<tr>
|
|
<td colspan="4">
|
|
<table>
|
|
<tr>
|
|
<td></td>
|
|
<td width="20px"></td>
|
|
<td width="20px"><span class="glyphicon glyphicon-user text-danger"></span></td>
|
|
<td width="200px"><?= gettext('System Admininistrator') ?></td>
|
|
<td width="20px"><span class="glyphicon glyphicon-user text-muted"></span></td>
|
|
<td width="200px"><?= gettext('Disabled User') ?></td>
|
|
<td width="20px"><span class="glyphicon glyphicon-user text-info"></span></td>
|
|
<td width="200px"><?= gettext('Normal User') ?></td>
|
|
<td></td>
|
|
</tr>
|
|
</table>
|
|
</td>
|
|
</tr>
|
|
</tfoot>
|
|
</table>
|
|
</form>
|
|
<?php
|
|
endif;?>
|
|
</div>
|
|
</section>
|
|
</div>
|
|
</div>
|
|
</section>
|
|
|
|
<?php include("foot.inc");
|