X-Git-Url: https://mop.ddnsfree.com/gitweb/?a=blobdiff_plain;f=web%2Fusermgmt.php;h=24948a135f3ead414c8ca09b2af43f7d57011109;hb=e8903530a6cf61a0b06c63bbabed10a813fea097;hp=307372c94f66839b466dc3b828ebc88edcc31394;hpb=c0cc54c9494acf8f43b92a0517d32d38b5006aa0;p=brisk.git

diff --git a/web/usermgmt.php b/web/usermgmt.php
index 307372c..24948a1 100644
--- a/web/usermgmt.php
+++ b/web/usermgmt.php
@@ -22,6 +22,30 @@
  *
  */
 
+foreach (array("HTTP_HOST", "DOCUMENT_ROOT") as $i) {
+    if (isset($_SERVER[$i])) {
+        $$i = $_SERVER[$i];
+        }
+    }
+
+foreach (array("pazz") as $i) {
+    if (isset($_POST[$i])) {
+        $$i = $_POST[$i];
+        }
+    }
+
+foreach (array("sess") as $i) {
+    if (isset($_COOKIE[$i])) {
+        $$i = $_COOKIE[$i];
+        }
+    }
+
+foreach (array("sess") as $i) {
+    if (isset($_COOKIE[$i])) {
+        $$i = $_COOKIE[$i];
+        }
+    }
+
 $G_base = "";
 
 $mlang_umgmt = array( 'nu_psubj' => array( 'it' => 'Brisk: credenziali di accesso.',
@@ -60,7 +84,12 @@ function check_auth()
 
     $socket = FALSE;
     $ret = FALSE;
-    $ip = $_SERVER["REMOTE_ADDR"];
+    if (array_key_exists("HTTP_X_REAL_IP", $_SERVER)) {
+        $ip = $_SERVER["HTTP_X_REAL_IP"];
+    }
+    else {
+        $ip = $_SERVER["REMOTE_ADDR"];
+    }
     $stp = 0;
     $private = md5($G_alarm_passwd.$ip.$sess);
     $cmd = array ("cmd" => "userauth", "sess" => $sess, "private" => $private, "the_end" => "true");
@@ -68,7 +97,7 @@ function check_auth()
     $cmd_len = mb_strlen($cmd_ser, "ASCII");
 
     do {
-        if (($socket = stream_socket_client("unix://".USOCK_PATH."2")) == FALSE)
+        if (($socket = stream_socket_client('unix://'.USOCK_PATH_PFX.'_admin.sock')) == FALSE)
             break;
         $stp = 1;
         if (($rwr = fwrite($socket, $cmd_ser, $cmd_len)) == FALSE
@@ -108,7 +137,7 @@ $s_style = "
 </style>";
 
 function main() {
-    GLOBAL $s_style, $G_dbpfx, $G_lang, $G_alarm_passwd, $G_domain, $G_webbase;
+    GLOBAL $s_style, $G_dbpfx, $G_lang, $G_alarm_passwd, $G_proto, $G_domain, $G_webbase;
     GLOBAL $mlang_umgmt, $mlang_indwr, $f_mailusers, $sess, $_POST, $_SERVER;
 
 
@@ -192,14 +221,14 @@ SELECT usr.*, guar.login AS guar_login
                     }
                     $hash = md5($curtime . $G_alarm_passwd . $usr_obj->login . $usr_obj->email);
 
-                    $confirm_page = sprintf("http://%s/%s/mailmgr.php?f_act=checkmail&f_code=%d&f_hash=%s",
-                                            $G_domain, $G_webbase, $mail_code, $hash);
+                    $confirm_page = sprintf("%s://%s/%s/mailmgr.php?f_act=checkmail&f_code=%d&f_hash=%s",
+                                            $G_proto, $G_domain, $G_webbase, $mail_code, $hash);
                     $subj = $mlang_indwr['nu_msubj'][$G_lang];
                     if (($usr_obj->type & USER_FLAG_TY_APPR) == USER_FLAG_TY_APPR) {
                         $body_txt = sprintf($mlang_indwr['ap_mtext'][$G_lang],
-                                            $cli_name, $confirm_page);
+                                            $usr_obj->login, $confirm_page);
                         $body_htm = sprintf($mlang_indwr['ap_mhtml'][$G_lang],
-                                            $cli_name, $confirm_page);
+                                            $usr_obj->login, $confirm_page);
                     }
                     else {
                         $body_txt = sprintf($mlang_indwr['nu_mtext'][$G_lang],
@@ -234,6 +263,73 @@ SELECT usr.*, guar.login AS guar_login
                 }
             }
         } // else if ($action == "accept") {
+        else if ($action == "delete") {
+            foreach($_POST as $key => $value) {
+                if (substr($key, 0, 9) != "f_newuser")
+                    continue;
+
+                $id = (int)substr($key, 9);
+                if ($id <= 0)
+                    continue;
+
+                // check existence of username or email
+                $is_trans = FALSE;
+                $res = FALSE;
+                do {
+                    if (($bdb = BriskDB::create()) == FALSE)
+                        break;
+
+                    // retrieve list added users
+                    $usr_sql = sprintf("
+SELECT usr.*, guar.login AS guar_login
+     FROM %susers AS usr
+     JOIN %susers AS guar ON guar.code = usr.guar_code
+     WHERE usr.type & (CAST (X'%x' as integer)) = (CAST (X'%x' as integer))
+         AND usr.disa_reas = %d AND usr.code = %d;",
+                               $G_dbpfx, $G_dbpfx,
+                               USER_FLAG_TY_DISABLE, USER_FLAG_TY_DISABLE,
+                               USER_DIS_REA_NU_ADDED, $id);
+                    if (($usr_pg = pg_query($bdb->dbconn->db(), $usr_sql)) == FALSE) {
+                        log_crit("stat-day: select from tournaments failed");
+                        break;
+                    }
+                    $usr_n = pg_numrows($usr_pg);
+                    if ($usr_n != 1) {
+                        $status .= sprintf("Inconsistency for code %d, returned %d records, skipped.<br>",
+                                          $id, $usr_n);
+                        break;
+                    }
+
+                    $usr_obj = pg_fetch_object($usr_pg, 0);
+
+                    $bdb->transaction('BEGIN');
+                    $is_trans = TRUE;
+
+                    // retrieve list added users
+                    $usr_sql = sprintf("
+                         DELETE FROM %susers
+                             WHERE (type & (CAST (X'%x' as integer))) = (CAST (X'%x' as integer))
+                               AND disa_reas = %d AND code = %d;",
+                               $G_dbpfx, USER_FLAG_TY_DISABLE, USER_FLAG_TY_DISABLE,
+                               USER_DIS_REA_NU_ADDED, $id);
+                    if (($usr_pg = pg_query($bdb->dbconn->db(), $usr_sql)) == FALSE) {
+                        log_crit(sprintf("Delete of user %d failed", $id));
+                        break;
+                    }
+
+                    $status .= sprintf("User %s removed: SUCCESS<br>", $usr_obj->login);
+                    $bdb->transaction('COMMIT');
+                    $res = TRUE;
+                } while(FALSE);
+                if ($res == FALSE) {
+                    $status .= sprintf("Error occurred during delete action<br>");
+                    if ($is_trans)
+                        $bdb->transaction('ROLLBACK');
+                    break;
+                }
+            }
+        } // else if ($action == "accept") {
+
 
 
         do {
@@ -490,8 +586,6 @@ SELECT usr.*, guar.login AS guar_login
             }
             exit;
         }
-
-
         else if ($action == "delete") {
             foreach($_POST as $key => $value) {
                 if (substr($key, 0, 9) != "f_newuser")
@@ -540,7 +634,7 @@ SELECT usr.*, guar.login AS guar_login
                                        $G_dbpfx, $usr_obj->code);
 
                     if (($del_pg = pg_query($bdb->dbconn->db(), $del_sql)) == FALSE) {
-                        log_crit("stat-day: select from tournaments failed");
+                        log_crit(sprintf("Delete user %d failed", $usr_obj->code));
                         break;
                     }
 
@@ -553,7 +647,7 @@ SELECT usr.*, guar.login AS guar_login
 Ti volevo segnalare che il nickname \'%s\' con cui ti volevi registrare
 non ha superato la fase di verifica manuale; il motivo può essere
 la sua illeggibilità per gli altri utenti o il contenuto poco ortodosso
-o troppo aggressivo o o ci sono troppe cifre consecutive o qualcosa del genere.
+o troppo aggressivo o ci sono troppe cifre consecutive o qualcosa del genere.
 
 La procedura di registrazione va ripetuta.
 
@@ -563,7 +657,7 @@ Saluti e buone partite, mop.', $usr_obj->login);
 Ti volevo segnalare che il nickname \'%s\' con cui ti volevi registrare
 non ha superato la fase di verifica manuale; il motivo può essere
 la sua illeggibilità per gli altri utenti o il contenuto poco ortodosso
-o troppo aggressivo o o ci sono troppe cifre consecutive o qualcosa del genere.<br><br>
+o troppo aggressivo o ci sono troppe cifre consecutive o qualcosa del genere.<br><br>
 La procedura di registrazione va ripetuta.<br><br>
 Saluti e buone partite, mop.', $usr_obj->login);
                     /* } */