1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
<?php
// There is the potential for a lot of mischief from users trying to
// access this file in ways the shouldn't. Users may try to type in
// a URL to get around functions that are not being displayed on the
// web page to them.
include_once 'includes/init.php';
load_user_layers ();
$error = "";
if ( ! $is_admin )
$user = $login;
// Handle delete
if ( ( $action == "Delete" || $action == translate ("Delete") ) &&
$formtype == "edituser" ) {
if ( $is_admin ) {
if ( $admin_can_delete_user ) {
user_delete_user ( $user ); // will also delete user's events
} else {
$error = translate("Deleting users not supported") . ".";
}
} else {
$error = translate("You are not authorized") . ".";
}
}
// Handle update of password
else if ( $formtype == "setpassword" && strlen ( $user ) ) {
if ( $upassword1 != $upassword2 ) {
$error = translate("The passwords were not identical") . ".";
} else if ( strlen ( $upassword1 ) ) {
if ( $user_can_update_password )
user_update_user_password ( $user, $upassword1 );
else
$error = translate("You are not authorized") . ".";
} else
$error = translate("You have not entered a password") . ".";
}
// Handle update of user info
else if ( $formtype == "edituser" ) {
if ( strlen ( $add ) && $is_admin ) {
if ( $upassword1 != $upassword2 ) {
$error = translate( "The passwords were not identical" ) . ".";
} else {
user_add_user ( $user, $upassword1, $ufirstname, $ulastname,
$uemail, $uis_admin );
}
} else if ( strlen ( $add ) && ! $is_admin ) {
$error = translate("You are not authorized") . ".";
} else {
// Don't allow a user to change themself to an admin by setting
// uis_admin in the URL by hand. They must be admin beforehand.
if ( ! $is_admin )
$uis_admin = "N";
user_update_user ( $user, $ufirstname, $ulastname,
$uemail, $uis_admin );
}
}
$nextURL = empty ( $is_admin ) ? "adminhome.php" : "users.php";
if ( ! empty ( $error ) ) {
print_header( '', '', '', true );
?>
<h2><?php etranslate("Error")?></h2>
<blockquote>
<?php
echo $error;
//if ( $sql != "" )
// echo "<br /><br /><strong>SQL:</strong> $sql";
//?>
</blockquote>
</body>
</html>
<?php } else if ( empty ($error) ) {
?><html><head></head><body onload="alert('<?php etranslate("Changes successfully saved");?>'); window.parent.location.href='<?php echo $nextURL;?>';">
</body></html><?php } ?>
|
