From 75c8481676b29579272a72fdac72cf73531d0632 Mon Sep 17 00:00:00 2001 From: Baoshuo Date: Mon, 17 Oct 2022 22:13:08 +0800 Subject: [PATCH] feat(web/user): allow admins to edit user info and read system msgs --- web/app/controllers/faq.php | 4 +- web/app/controllers/problem_solutions.php | 2 +- web/app/controllers/subdomain/blog/blog.php | 2 +- .../subdomain/blog/blog_delete.php | 2 +- web/app/controllers/user_info.php | 4 +- ...hange_user_info.php => user_info_edit.php} | 72 +++++++++++++------ web/app/controllers/user_msg.php | 6 +- web/app/controllers/user_system_msg.php | 20 ++++-- web/app/route.php | 10 +-- web/app/views/blog-nav.php | 6 +- web/app/views/main-nav.php | 6 +- web/app/views/page-header.php | 6 +- web/app/views/user-info.php | 7 +- web/js/uoj.js | 2 +- 14 files changed, 95 insertions(+), 54 deletions(-) rename web/app/controllers/{change_user_info.php => user_info_edit.php} (74%) diff --git a/web/app/controllers/faq.php b/web/app/controllers/faq.php index 09f61b4..83517cf 100644 --- a/web/app/controllers/faq.php +++ b/web/app/controllers/faq.php @@ -84,8 +84,8 @@ 题目相关问题请联系各校区的竞赛教练以及题目管理员。

- 系统相关问题请邮件联系 baoshuo（i@baoshuo.ren） - 和 nekko（1139855151@qq.com）。 + 系统相关问题请邮件联系 baoshuo（i@baoshuo.ren） + 和 nekko（1139855151@qq.com）。

开源项目
diff --git a/web/app/controllers/problem_solutions.php b/web/app/controllers/problem_solutions.php index 1eeaebc..fd4cce6 100644 --- a/web/app/controllers/problem_solutions.php +++ b/web/app/controllers/problem_solutions.php @@ -180,7 +180,7 @@ EOD;
- + diff --git a/web/app/controllers/subdomain/blog/blog.php b/web/app/controllers/subdomain/blog/blog.php index a832249..23b6cc9 100644 --- a/web/app/controllers/subdomain/blog/blog.php +++ b/web/app/controllers/subdomain/blog/blog.php @@ -206,7 +206,7 @@ media-left "> - " class="d-none d-sm-block text-decoration-none "> diff --git a/web/app/controllers/subdomain/blog/blog_delete.php b/web/app/controllers/subdomain/blog/blog_delete.php index 56ceff3..2484ac9 100644 --- a/web/app/controllers/subdomain/blog/blog_delete.php +++ b/web/app/controllers/subdomain/blog/blog_delete.php @@ -31,7 +31,7 @@

您的博客 {$blog['title']}（ID：{$blog['id']}）已经被 {$admin_user_link} 删除，现将博客原文备份发送给您，请查收。

{$blog_content}
EOD; - sendSystemMsg($blog['poster'], '博客删除通知', $content); + sendSystemMsg($blog['poster'], '博客删除通知', $content); } deleteBlog($blog['id']); diff --git a/web/app/controllers/user_info.php b/web/app/controllers/user_info.php index 5b8ca30..6744dee 100644 --- a/web/app/controllers/user_info.php +++ b/web/app/controllers/user_info.php @@ -81,9 +81,9 @@
- + - + diff --git a/web/app/controllers/change_user_info.php b/web/app/controllers/user_info_edit.php similarity index 74% rename from web/app/controllers/change_user_info.php rename to web/app/controllers/user_info_edit.php index 29317d2..853381c 100644 --- a/web/app/controllers/change_user_info.php +++ b/web/app/controllers/user_info_edit.php @@ -3,22 +3,32 @@ redirectToLogin(); } + if (!validateUsername($_GET['username']) || !($user = queryUser($_GET['username']))) { + become404Page(); + } + + if (!isSuperUser($myUser) && $myUser['username'] != $user['username']) { + become403Page(); + } + function handlePost() { - global $myUser; - if (!isset($_POST['old_password'])) { - return '无效表单'; - } - $old_password = $_POST['old_password']; - if (!validatePassword($old_password) || !checkPassword($myUser, $old_password)) { - return "失败：密码错误。"; + global $myUser, $user; + if ($user['username'] == Auth::id()) { + if (!isset($_POST['old_password'])) { + return '无效表单'; + } + $old_password = $_POST['old_password']; + if (!validatePassword($old_password) || !checkPassword($user, $old_password)) { + return "失败：密码错误。"; + } } if ($_POST['ptag']) { $password = $_POST['password']; if (!validatePassword($password)) { return "失败：无效密码。"; } - $password = getPasswordToStore($password, $myUser['username']); - DB::update("update user_info set password = '$password' where username = '{$myUser['username']}'"); + $password = getPasswordToStore($password, $user['username']); + DB::update("update user_info set password = '$password' where username = '{$user['username']}'"); } $email = $_POST['email']; @@ -26,7 +36,7 @@ return "失败：无效电子邮箱。"; } $esc_email = DB::escape($email); - DB::update("update user_info set email = '$esc_email' where username = '{$myUser['username']}'"); + DB::update("update user_info set email = '$esc_email' where username = '{$user['username']}'"); if ($_POST['Qtag']) { $qq = $_POST['qq']; @@ -34,19 +44,19 @@ return "失败：无效QQ。"; } $esc_qq = DB::escape($qq); - DB::update("update user_info set qq = '$esc_qq' where username = '{$myUser['username']}'"); + DB::update("update user_info set qq = '$esc_qq' where username = '{$user['username']}'"); } else { - DB::update("update user_info set QQ = NULL where username = '{$myUser['username']}'"); + DB::update("update user_info set QQ = NULL where username = '{$user['username']}'"); } if ($_POST['sex'] == "U" || $_POST['sex'] == 'M' || $_POST['sex'] == 'F') { $sex = $_POST['sex']; $esc_sex = DB::escape($sex); - DB::update("update user_info set sex = '$esc_sex' where username = '{$myUser['username']}'"); + DB::update("update user_info set sex = '$esc_sex' where username = '{$user['username']}'"); } if (validateMotto($_POST['motto'])) { $esc_motto = DB::escape($_POST['motto']); - DB::update("update user_info set motto = '$esc_motto' where username = '{$myUser['username']}'"); + DB::update("update user_info set motto = '$esc_motto' where username = '{$user['username']}'"); } return "ok"; @@ -60,8 +70,18 @@ $REQUIRE_LIB['md5'] = ''; ?> -

+

+ + + + 修改 的个人信息 + +

+ +

您正在使用管理特权修改 的个人信息。

+
+

@@ -70,6 +90,7 @@
+

@@ -82,14 +103,14 @@
- +
- +
@@ -97,16 +118,16 @@
- + 格言支持 Markdown 语法。
@@ -126,7 +147,10 @@ function validateUpdatePost() { var ok = true; ok &= getFormErrorAndShowHelp('email', validateEmail); + + ok &= getFormErrorAndShowHelp('old_password', validatePassword); + if ($('#input-password').val().length > 0) ok &= getFormErrorAndShowHelp('password', validateSettingPassword); @@ -138,14 +162,16 @@ function submitUpdatePost() { if (!validateUpdatePost()) return; - $.post('/user/modify-profile', { + $.post('', { change : '', etag : $('#input-email').val().length, ptag : $('#input-password').val().length, Qtag : $('#input-qq').val().length, email : $('#input-email').val(), password : md5($('#input-password').val(), ""), + old_password : md5($('#input-old_password').val(), ""), + qq : $('#input-qq').val(), sex : $('#input-sex').val(), motto : $('#input-motto').val() @@ -162,7 +188,7 @@ } }], onhidden : function(dialog) { - window.location.href = '/user/profile/'; + window.location.href = '/user/'; } }); } else { diff --git a/web/app/controllers/user_msg.php b/web/app/controllers/user_msg.php index a91ed62..c536fa1 100644 --- a/web/app/controllers/user_msg.php +++ b/web/app/controllers/user_msg.php @@ -210,7 +210,7 @@ function submitMessagePost(conversationName) { $('#help-message').text(''); $('#form-group-message').removeClass('has-error'); - $.post('/user/msg', { + $.post('', { user_msg : 1, receiver : conversationName, message : $('#input-message').val() @@ -224,7 +224,7 @@ function refreshHistory(conversation, page) { var ret = false; $('#conversation-name').text(conversation); $('#pageShow').text("第" + page.toString() + "页"); - $.get('/user/msg', { + $.get('', { getHistory : '', conversationName : conversation, pageNumber : page @@ -246,7 +246,7 @@ function refreshHistory(conversation, page) { function refreshConversations() { $("#conversations").empty(); - $.get('/user/msg', { + $.get('', { getConversations : "" }, function(msg) { var result = JSON.parse(msg); diff --git a/web/app/controllers/user_system_msg.php b/web/app/controllers/user_system_msg.php index f359a90..cc9a0f4 100644 --- a/web/app/controllers/user_system_msg.php +++ b/web/app/controllers/user_system_msg.php @@ -1,8 +1,16 @@ 消息 @@ -10,7 +18,7 @@ EOD; function echoSysMsg($msg) { - echo $msg['read_time'] == null ? '' : ''; + echo $msg['read_time'] == null ? '' : ''; echo ''; echo '

'.$msg['title'].'

'; echo $msg['content']; @@ -21,6 +29,10 @@ EOD; ?>

系统消息

- array('table'))) ?> - + array('table'))) ?> + diff --git a/web/app/route.php b/web/app/route.php index c923838..dd77b1e 100644 --- a/web/app/route.php +++ b/web/app/route.php @@ -70,10 +70,12 @@ Route::group([ Route::any('/register', '/register.php'); Route::any('/forgot-password', '/forgot_pw.php'); Route::any('/reset-password', '/reset_pw.php'); - Route::any('/user/profile/{username}', '/user_info.php'); - Route::any('/user/modify-profile', '/change_user_info.php'); - Route::any('/user/msg', '/user_msg.php'); - Route::any('/user/system-msg', '/user_system_msg.php'); + + Route::any('/user/{username}', '/user_info.php'); + Route::any('/user/{username}/edit', '/user_info_edit.php'); + Route::any('/user_msg', '/user_msg.php'); + Route::any('/user/{username}/system_msg', '/user_system_msg.php'); + Route::any('/super-manage(?:/{tab})?', '/super_manage.php'); Route::any('/download.php', '/download.php'); diff --git a/web/app/views/blog-nav.php b/web/app/views/blog-nav.php index b0cb795..a51c607 100644 --- a/web/app/views/blog-nav.php +++ b/web/app/views/blog-nav.php @@ -119,12 +119,12 @@ mb-4" role="navigation">