/**
* @param $data
* @return \Rocker\Object\User\UserInterface|null
*/
public function basicAuth($data, $server)
{
$parts = explode(':', base64_decode($data));
if (count($parts) == 2 && !is_numeric($parts[0])) {
// don't allow to login using user id
$user = $this->userFactory->load($parts[0]);
if ($user !== null && $user->hasPassword($parts[1])) {
return $user;
}
}
return null;
}
/**
* @inheritdoc
*/
public function exec(Server $server, ConnectionInterface $db, CacheInterface $cache)
{
// add possible config
$this->setConfig($server->config('application.user_object'));
// Create user factory
if (empty($this->conf['factory'])) {
$this->userFactory = new UserFactory($db, $cache);
} else {
$this->userFactory = new $this->conf['factory']($db, $cache);
}
$method = $this->request->getMethod();
$requestedUser = $this->requestedObject() ? $this->userFactory->load($this->requestedObject()) : false;
if (($method == 'POST' || $method == 'DELETE') && $requestedUser && !$this->user->isAdmin() && !$this->user->isEqual($requestedUser)) {
return new OperationResponse(401, array('error' => 'Only admins can edit/remove other users'));
}
if ($method == 'DELETE' && $requestedUser && $requestedUser->isAdmin()) {
return new OperationResponse(403, array('error' => 'A user with admin privileges can not be removed. You have to remove admin privileges first (/api/admin)'));
}
// Trigger event
$server->triggerEvent(strtolower($method) . '.user', $db, $cache);
return parent::exec($server, $db, $cache);
}
public function testCreateAdmin()
{
$user = self::$f->createUser('*****@*****.**', 'A user', '');
$this->assertFalse($user->isAdmin());
self::$f->setAdminPrivileges($user, true);
$this->assertTrue($user->isAdmin());
// reload user
$user = self::$f->load('*****@*****.**');
$this->assertTrue($user->isAdmin());
self::$f->setAdminPrivileges($user, false);
$this->assertFalse($user->isAdmin());
$user = self::$f->load('*****@*****.**');
$this->assertFalse($user->isAdmin());
}
/**
* @inheritdoc
*/
public function exec(Server $server, ConnectionInterface $db, CacheInterface $cache)
{
$userFactory = new UserFactory($db, $cache);
$user = $userFactory->load($_REQUEST['user']);
$response = new OperationResponse();
if (!$user) {
$response->setStatus(400);
$response->setBody(array('error' => 'Argument "user" is referring to a user that does not exist'));
} elseif ($this->user->isEqual($user)) {
$response->setStatus(400);
$response->setBody(array('error' => 'A user can not change admin privileges for its own user account'));
} else {
$userFactory->setAdminPrivileges($user, $_REQUEST['admin'] == '1');
$response->setStatus(204);
}
return $response;
}
/**
* @param Server $server
* @param ConnectionInterface $db
* @param \Rocker\Cache\CacheInterface $cache
* @return array
*/
public static function deleteUserEvent($server, $db, $cache)
{
$userFactory = new UserFactory($db, $cache);
$user = $userFactory->load(basename($server->request()->getPath()));
if ($user !== null && ($files = $user->meta()->get('files', array()))) {
$storage = self::loadStorageClass($server);
self::deleteAllFiles($user, $userFactory, $files, $storage);
}
}