add: prevent supporters from modifying their own accounts via support

[gigi.git] / src / org / cacert / gigi / pages / admin / support / SupportUserDetailsForm.java

diff --git a/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsForm.java b/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsForm.java
index 16ece06789d6c7be0f20477420b062bbe706fa79..d3589c8e4ad6b9a187b681400f7251a6399c7634 100644 (file)
--- a/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsForm.java
+++ b/src/org/cacert/gigi/pages/admin/support/SupportUserDetailsForm.java
@@ -1,7 +1,6 @@
 package org.cacert.gigi.pages.admin.support;
 
 import java.io.PrintWriter;
-import java.util.Iterator;
 import java.util.Map;
 import java.util.Set;
 
@@ -15,24 +14,21 @@ import org.cacert.gigi.dbObjects.User;
 import org.cacert.gigi.localisation.Language;
 import org.cacert.gigi.output.ArrayIterable;
 import org.cacert.gigi.output.DateSelector;
+import org.cacert.gigi.output.GroupIterator;
 import org.cacert.gigi.output.GroupSelector;
 import org.cacert.gigi.output.template.Form;
-import org.cacert.gigi.output.template.IterableDataset;
-import org.cacert.gigi.output.template.Outputable;
-import org.cacert.gigi.output.template.SprintfCommand;
 import org.cacert.gigi.output.template.Template;
-import org.cacert.gigi.output.template.TranslateCommand;
-import org.cacert.gigi.pages.PasswordResetPage;
+import org.cacert.gigi.pages.LoginPage;
 
 public class SupportUserDetailsForm extends Form {
 
-    private static final Template t = new Template(FindDomainForm.class.getResource("SupportUserDetailsForm.templ"));
+    private static final Template t = new Template(FindUserByDomainForm.class.getResource("SupportUserDetailsForm.templ"));
 
     private SupportedUser user;
 
     private DateSelector dobSelector;
 
-    private GroupSelector value = new GroupSelector("groupToModify");
+    private GroupSelector value = new GroupSelector("groupToModify", true);
 
     public SupportUserDetailsForm(HttpServletRequest hsr, SupportedUser user) {
         super(hsr);
@@ -45,22 +41,20 @@ public class SupportUserDetailsForm extends Form {
         if (user.getTicket() == null) {
             return false;
         }
-        if ((req.getParameter("detailupdate") != null ? 1 : 0) + (req.getParameter("grant") != null ? 1 : 0) + (req.getParameter("deny") != null ? 1 : 0) + (req.getParameter("resetPass") != null ? 1 : 0) != 1) {
+        if (user.getTargetUser() == LoginPage.getUser(req)) {
+            throw new GigiApiException("Supporter may not modify himself.");
+        }
+        if ((req.getParameter("detailupdate") != null ? 1 : 0) + (req.getParameter("addGroup") != null ? 1 : 0) + (req.getParameter("removeGroup") != null ? 1 : 0) + (req.getParameter("resetPass") != null ? 1 : 0) != 1) {
             throw new GigiApiException("More than one action requested!");
         }
-        if (req.getParameter("grant") != null || req.getParameter("deny") != null) {
-            String actionType = "granted";
+        if (req.getParameter("addGroup") != null || req.getParameter("removeGroup") != null) {
             value.update(req);
             Group toMod = value.getGroup();
-            if (req.getParameter("grant") != null) {
+            if (req.getParameter("addGroup") != null) {
                 user.grant(toMod);
             } else {
-                actionType = "revoked";
                 user.revoke(toMod);
             }
-            String subject = "Change Group Permissions";
-            Outputable message = SprintfCommand.createSimple("The group permission {0} was {1}.", toMod.getDatabaseName(), actionType);
-            user.sendSupportNotification(subject, message);
             return true;
         }
         if (req.getParameter("resetPass") != null) {
@@ -68,12 +62,7 @@ public class SupportUserDetailsForm extends Form {
             if (aword == null || aword.equals("")) {
                 throw new GigiApiException("An A-Word is required to perform a password reset.");
             }
-            Language l = Language.getInstance(user.getTargetUser().getPreferredLocale());
-            String method = l.getTranslation("A password reset was triggered. Please enter the required text sent to you by support on this page:");
-            String subject = l.getTranslation("Password reset by support.");
-            PasswordResetPage.initPasswordResetProcess(out, user.getTargetUser(), req, aword, l, method, subject);
-            Outputable message = new TranslateCommand("A password reset was triggered and an email was sent to user.");
-            user.sendSupportNotification(subject, message);
+            user.triggerPasswordReset(aword, out, req);
             return true;
         }
         dobSelector.update(req);
@@ -81,10 +70,6 @@ public class SupportUserDetailsForm extends Form {
             throw new GigiApiException("Invalid date of birth!");
         }
         user.setDob(dobSelector.getDate());
-
-        String subject = "Change Account Data";
-        Outputable message = new TranslateCommand("The account data was changed.");
-        user.sendSupportNotification(subject, message);
         return true;
     }
 
@@ -92,6 +77,7 @@ public class SupportUserDetailsForm extends Form {
     protected void outputContent(PrintWriter out, Language l, Map<String, Object> vars) {
         User user = this.user.getTargetUser();
         vars.put("mail", user.getEmail());
+        vars.put("status", l.getTranslation(user.isValidEmail(user.getEmail()) ? "verified" : "not verified"));
         vars.put("exNames", new ArrayIterable<Name>(user.getNames()) {
 
             @Override
@@ -105,22 +91,9 @@ public class SupportUserDetailsForm extends Form {
         vars.put("dob", dobSelector);
         vars.put("assurancepoints", user.getAssurancePoints());
         vars.put("exppoints", user.getExperiencePoints());
-        vars.put("id", user.getId());
         final Set<Group> gr = user.getGroups();
-        vars.put("groups", new IterableDataset() {
-
-            Iterator<Group> i = gr.iterator();
-
-            @Override
-            public boolean next(Language l, Map<String, Object> vars) {
-                if ( !i.hasNext()) {
-                    return false;
-                }
-                Group g = i.next();
-                vars.put("group_name", g.getName());
-                return true;
-            }
-        });
+        vars.put("support-groups", new GroupIterator(gr.iterator(), true));
+        vars.put("groups", new GroupIterator(gr.iterator(), false));
         vars.put("groupSelector", value);
         t.output(out, l, vars);
     }