diff --git a/pandora_console/godmode/users/configure_user.php b/pandora_console/godmode/users/configure_user.php index acce545440..1d75d091ca 100644 --- a/pandora_console/godmode/users/configure_user.php +++ b/pandora_console/godmode/users/configure_user.php @@ -324,6 +324,16 @@ if ($create_user) { $user_is_admin = (int) get_parameter('is_admin', 0); + if (users_is_admin() === false && $user_is_admin !== 0) { + db_pandora_audit( + AUDIT_LOG_ACL_VIOLATION, + 'Trying to create with administrator privileges to user by non administrator user '.$config['id_user'], + ); + + include 'general/noaccess.php'; + exit; + } + $values = []; $values['id_user'] = (string) get_parameter('id_user'); $values['fullname'] = (string) get_parameter('fullname'); @@ -538,6 +548,16 @@ if ($update_user) { $values['default_event_filter'] = (int) get_parameter('default_event_filter'); $values['default_custom_view'] = (int) get_parameter('default_custom_view'); + if (users_is_admin() === false && (bool) $values['is_admin'] !== false) { + db_pandora_audit( + AUDIT_LOG_ACL_VIOLATION, + 'Trying to add administrator privileges to user by non administrator user '.$config['id_user'], + ); + + include 'general/noaccess.php'; + exit; + } + // eHorus user level conf. $values['ehorus_user_level_enabled'] = (bool) get_parameter('ehorus_user_level_enabled', false); $values['ehorus_user_level_user'] = (string) get_parameter('ehorus_user_level_user'); diff --git a/pandora_console/godmode/users/user_list.php b/pandora_console/godmode/users/user_list.php index 7ac3f55261..8e2e3ebd73 100644 --- a/pandora_console/godmode/users/user_list.php +++ b/pandora_console/godmode/users/user_list.php @@ -260,9 +260,21 @@ if (is_metaconsole() === true) { $disable_user = get_parameter('disable_user', false); -if ((bool) get_parameter('user_del', false) === true) { +$delete_user = (bool) get_parameter('user_del', false); + +if ($delete_user === true) { // Delete user. $id_user = get_parameter('delete_user', 0); + if (users_is_admin($id_user) === true && users_is_admin() === false) { + db_pandora_audit( + AUDIT_LOG_ACL_VIOLATION, + 'Trying to delete admininstrator user by non administrator user '.$config['id_user'], + ); + + include 'general/noaccess.php'; + exit; + } + // Only allow delete user if is not the actual user. if ($id_user != $config['id_user']) { $user_row = users_get_user_by_id($id_user); @@ -332,6 +344,16 @@ if ((bool) get_parameter('user_del', false) === true) { // Disable_user. $id_user = get_parameter('id', 0); + if (users_is_admin($id_user) === true && users_is_admin() === false) { + db_pandora_audit( + AUDIT_LOG_ACL_VIOLATION, + 'Trying to disable admininstrator user by non administrator user '.$config['id_user'], + ); + + include 'general/noaccess.php'; + exit; + } + if ($id_user !== 0) { $result = users_disable($id_user, $disable_user); } else { @@ -353,511 +375,511 @@ if ((bool) get_parameter('user_del', false) === true) { } } -$filter_group = (int) get_parameter('filter_group', 0); -$filter_search = get_parameter('filter_search', ''); -$search = (bool) get_parameter('search', false); + $filter_group = (int) get_parameter('filter_group', 0); + $filter_search = get_parameter('filter_search', ''); + $search = (bool) get_parameter('search', false); if (($filter_group == 0) && ($filter_search == '')) { $search = false; } -$table = new stdClass(); -$table->width = '100%'; -$table->class = 'databox filters'; -$table->rowclass[0] = ''; -$table->data[0][0] = ''.__('Group').''; -$table->data[0][1] = html_print_select_groups( - false, - 'AR', - true, - 'filter_group', - $filter_group, - '', - '', - 0, - true -); -$table->data[0][2] = ''.__('Search').''.ui_print_help_tip(__('Search by username, fullname or email'), true); -$table->data[0][3] = html_print_input_text( - 'filter_search', - $filter_search, - __('Search by username, fullname or email'), - 30, - 90, - true -); -$table->data[0][4] = html_print_submit_button( - __('Search'), - 'search', - false, - ['class' => 'sub search'], - true -); - -$is_management_allowed = true; -if (is_metaconsole() === false && is_management_allowed() === false) { - $is_management_allowed = false; - if (is_metaconsole() === false) { - $url = ''.__('metaconsole').''; - } else { - $url = __('any node'); - } - - ui_print_warning_message( - __( - 'This node is configured with centralized mode. All users information is read only. Go to %s to manage it.', - $url - ) - ); -} - - -if (is_metaconsole() === true) { - $table->width = '96%'; - $form_filter = "
'; - ui_toggle($form_filter, __('Show Options')); -} else { - $form_filter = "'; - ui_toggle( - $form_filter, - __('Users control filter'), - __('Toggle filter(s)'), - '', - !$search - ); -} - -// Urls to sort the table. -$url_up_id = '?sec='.$sec.'&sec2=godmode/users/user_list&sort_field=id_user&sort=up&pure='.$pure; -$url_down_id = '?sec='.$sec.'&sec2=godmode/users/user_list&sort_field=id_user&sort=down&pure='.$pure; -$url_up_name = '?sec='.$sec.'&sec2=godmode/users/user_list&sort_field=fullname&sort=up&pure='.$pure; -$url_down_name = '?sec='.$sec.'&sec2=godmode/users/user_list&sort_field=fullname&sort=down&pure='.$pure; -$url_up_last = '?sec='.$sec.'&sec2=godmode/users/user_list&sort_field=last_connect&sort=up&pure='.$pure; -$url_down_last = '?sec='.$sec.'&sec2=godmode/users/user_list&sort_field=last_connect&sort=down&pure='.$pure; - - -$table = new stdClass(); -$table->cellpadding = 0; -$table->cellspacing = 0; -$table->width = '100%'; -$table->class = 'info_table'; - -$table->head = []; -$table->data = []; -$table->align = []; -$table->size = []; -$table->valign = []; - -$table->head[0] = __('User ID').ui_get_sorting_arrows($url_up_id, $url_down_id, $selectUserIDUp, $selectUserIDDown); -$table->head[1] = __('Name').ui_get_sorting_arrows($url_up_name, $url_down_name, $selectFullnameUp, $selectFullnameDown); -$table->head[2] = __('Last contact').ui_get_sorting_arrows($url_up_last, $url_down_last, $selectLastConnectUp, $selectLastConnectDown); - -$table->head[3] = __('Admin'); -$table->head[4] = __('Profile / Group'); -$table->head[5] = __('Description'); -if ($is_management_allowed === true) { - $table->head[6] = ''.__('Op.').''; -} - -if (is_metaconsole() === false) { - $table->align[2] = ''; - $table->size[2] = '150px'; -} - -$table->align[3] = 'left'; - -if (is_metaconsole() === true) { - $table->size[6] = '110px'; -} else { - $table->size[6] = '85px'; -} - -if (is_metaconsole() === false) { - $table->valign[0] = 'top'; - $table->valign[1] = 'top'; - $table->valign[2] = 'top'; - $table->valign[3] = 'top'; - $table->valign[4] = 'top'; - $table->valign[5] = 'top'; - $table->valign[6] = 'top'; -} - -$info1 = []; - -$user_is_admin = users_is_admin(); - -if ($user_is_admin) { - $info1 = get_users($order); -} else { - $group_um = users_get_groups_UM($config['id_user']); - // 0 is the group 'all'. - if (isset($group_um[0])) { - $info1 = get_users($order); - } else { - foreach ($group_um as $group => $value) { - $info1 = array_merge($info1, users_get_users_by_group($group, $value)); - } - } -} - -// Filter the users. -if ($search) { - foreach ($info1 as $iterator => $user_info) { - $found = false; - - if (!empty($filter_search)) { - if (preg_match('/.*'.strtolower($filter_search).'.*/', strtolower($user_info['fullname'])) != 0) { - $found = true; - } - - if (preg_match('/.*'.strtolower($filter_search).'.*/', strtolower($user_info['id_user'])) != 0) { - $found = true; - } - - if (preg_match('/.*'.$filter_search.'.*/', $user_info['email']) != 0) { - $found = true; - } - } - - if ($filter_group != 0) { - $groups = users_get_groups( - $user_info['id_user'], - 'AR', - $user_info['is_admin'] - ); - - $id_groups = array_keys($groups); - - if (array_search($filter_group, $id_groups) !== false) { - $found = true; - } - } - - if (!$found) { - unset($info1[$iterator]); - } - } -} - -$info = $info1; - -// Prepare pagination. -ui_pagination(count($info)); - -$offset = (int) get_parameter('offset'); -$limit = (int) $config['block_size']; - -$rowPair = true; -$iterator = 0; -$cont = 0; -foreach ($info as $user_id => $user_info) { - if (!$user_is_admin && $user_info['is_admin']) { - // If user is not admin then don't display admin users. - continue; - } - - // User profiles. - if ($user_is_admin || $user_id == $config['id_user'] || isset($group_um[0])) { - $user_profiles = db_get_all_rows_field_filter( - 'tusuario_perfil', - 'id_usuario', - $user_id - ); - } else { - $user_profiles_aux = users_get_user_profile($user_id); - $user_profiles = []; - foreach ($group_um as $key => $value) { - if (isset($user_profiles_aux[$key]) === true) { - $user_profiles[$key] = $user_profiles_aux[$key]; - unset($user_profiles_aux[$key]); - } - } - - if (empty($user_profiles_aux) === false) { - $user_info['not_delete'] = 1; - } - - if ($user_profiles == false) { - continue; - } - } - - $cont++; - - // Manual pagination due the complicated process of the ACL data. - if ($cont <= $offset && $search !== true) { - continue; - } - - if ($cont > ($limit + $offset) && $search !== true) { - break; - } - - - if ($rowPair) { - $table->rowclass[$iterator] = 'rowPair'; - } else { - $table->rowclass[$iterator] = 'rowOdd'; - } - - $rowPair = !$rowPair; - if ($user_info['disabled']) { - $table->rowclass[$iterator] .= ' disabled_row_user'; - } - - $iterator++; - - if ($is_management_allowed === true - && ($user_is_admin - || $config['id_user'] == $user_info['id_user'] - || (!$user_info['is_admin'] && (!isset($user_info['edit']) - || isset($group_um[0]) || (isset($user_info['edit']) - && $user_info['edit'])))) - ) { - $data[0] = ''.$user_id.''; - } else { - $data[0] = $user_id; - } - - $data[1] = '