2011-01-24 03:09:16 +01:00
|
|
|
<?php
|
|
|
|
|
2014-04-02 21:06:27 +02:00
|
|
|
final class PhabricatorPeopleNewController
|
2012-03-10 00:46:25 +01:00
|
|
|
extends PhabricatorPeopleController {
|
2011-01-24 03:09:16 +01:00
|
|
|
|
2015-01-13 00:18:16 +01:00
|
|
|
public function handleRequest(AphrontRequest $request) {
|
|
|
|
$this->requireApplicationCapability(
|
|
|
|
PeopleCreateUsersCapability::CAPABILITY);
|
|
|
|
$type = $request->getURIData('type');
|
2011-05-12 19:06:54 +02:00
|
|
|
$admin = $request->getUser();
|
2011-02-20 01:46:14 +01:00
|
|
|
|
2015-01-13 00:18:16 +01:00
|
|
|
switch ($type) {
|
2014-04-02 21:06:27 +02:00
|
|
|
case 'standard':
|
|
|
|
$is_bot = false;
|
|
|
|
break;
|
|
|
|
case 'bot':
|
|
|
|
$is_bot = true;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
return new Aphront404Response();
|
2011-05-12 19:06:54 +02:00
|
|
|
}
|
|
|
|
|
2014-04-02 21:06:27 +02:00
|
|
|
$user = new PhabricatorUser();
|
2014-05-12 18:51:40 +02:00
|
|
|
$require_real_name = PhabricatorEnv::getEnvConfig('user.require-real-name');
|
2011-05-12 19:06:54 +02:00
|
|
|
|
2011-01-24 03:09:16 +01:00
|
|
|
$e_username = true;
|
2014-05-12 18:51:40 +02:00
|
|
|
$e_realname = $require_real_name ? true : null;
|
2011-01-24 03:09:16 +01:00
|
|
|
$e_email = true;
|
|
|
|
$errors = array();
|
|
|
|
|
Revise administrative workflow for user creation
Summary:
- When an administrator creates a user, provide an option to send a welcome
email. Right now this workflow kind of dead-ends.
- Prevent administrators from changing the "System Agent" flag. If they can
change it, they can grab another user's certificate and then act as them. This
is a vaguely weaker security policy than is exhibited elsewhere in the
application. Instead, make user accounts immutably normal users or system agents
at creation time.
- Prevent administrators from changing email addresses after account creation.
Same deal as conduit certs. The 'bin/accountadmin' script can still do this if a
user has a real problem.
- Prevent administrators from resetting passwords. There's no need for this
anymore with welcome emails plus email login and it raises the same issues.
Test Plan:
- Created a new account, selected "send welcome email", got a welcome email,
logged in with the link inside it.
- Created a new system agent.
- Reset an account's password.
Reviewed By: aran
Reviewers: tuomaspelkonen, jungejason, aran
CC: anjali, aran, epriestley
Differential Revision: 379
2011-05-30 23:59:17 +02:00
|
|
|
$welcome_checked = true;
|
|
|
|
|
2012-05-07 19:29:33 +02:00
|
|
|
$new_email = null;
|
|
|
|
|
2011-01-24 03:09:16 +01:00
|
|
|
if ($request->isFormPost()) {
|
Revise administrative workflow for user creation
Summary:
- When an administrator creates a user, provide an option to send a welcome
email. Right now this workflow kind of dead-ends.
- Prevent administrators from changing the "System Agent" flag. If they can
change it, they can grab another user's certificate and then act as them. This
is a vaguely weaker security policy than is exhibited elsewhere in the
application. Instead, make user accounts immutably normal users or system agents
at creation time.
- Prevent administrators from changing email addresses after account creation.
Same deal as conduit certs. The 'bin/accountadmin' script can still do this if a
user has a real problem.
- Prevent administrators from resetting passwords. There's no need for this
anymore with welcome emails plus email login and it raises the same issues.
Test Plan:
- Created a new account, selected "send welcome email", got a welcome email,
logged in with the link inside it.
- Created a new system agent.
- Reset an account's password.
Reviewed By: aran
Reviewers: tuomaspelkonen, jungejason, aran
CC: anjali, aran, epriestley
Differential Revision: 379
2011-05-30 23:59:17 +02:00
|
|
|
$welcome_checked = $request->getInt('welcome');
|
|
|
|
|
2014-04-02 21:06:17 +02:00
|
|
|
$user->setUsername($request->getStr('username'));
|
|
|
|
|
|
|
|
$new_email = $request->getStr('email');
|
|
|
|
if (!strlen($new_email)) {
|
|
|
|
$errors[] = pht('Email is required.');
|
|
|
|
$e_email = pht('Required');
|
|
|
|
} else if (!PhabricatorUserEmail::isAllowedAddress($new_email)) {
|
|
|
|
$e_email = pht('Invalid');
|
|
|
|
$errors[] = PhabricatorUserEmail::describeAllowedAddresses();
|
|
|
|
} else {
|
|
|
|
$e_email = null;
|
2011-01-24 03:09:16 +01:00
|
|
|
}
|
2014-04-02 21:06:17 +02:00
|
|
|
|
2011-01-24 03:09:16 +01:00
|
|
|
$user->setRealName($request->getStr('realname'));
|
|
|
|
|
|
|
|
if (!strlen($user->getUsername())) {
|
2014-06-09 20:36:49 +02:00
|
|
|
$errors[] = pht('Username is required.');
|
2013-02-21 23:10:22 +01:00
|
|
|
$e_username = pht('Required');
|
2012-01-16 16:30:28 +01:00
|
|
|
} else if (!PhabricatorUser::validateUsername($user->getUsername())) {
|
2012-06-06 16:09:05 +02:00
|
|
|
$errors[] = PhabricatorUser::describeValidUsername();
|
2013-02-21 23:10:22 +01:00
|
|
|
$e_username = pht('Invalid');
|
2011-05-12 19:06:54 +02:00
|
|
|
} else {
|
|
|
|
$e_username = null;
|
2011-01-24 03:09:16 +01:00
|
|
|
}
|
|
|
|
|
2014-05-12 18:51:40 +02:00
|
|
|
if (!strlen($user->getRealName()) && $require_real_name) {
|
2013-02-21 23:10:22 +01:00
|
|
|
$errors[] = pht('Real name is required.');
|
|
|
|
$e_realname = pht('Required');
|
2011-05-12 19:06:54 +02:00
|
|
|
} else {
|
|
|
|
$e_realname = null;
|
2011-01-24 03:09:16 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
if (!$errors) {
|
2011-05-12 19:06:54 +02:00
|
|
|
try {
|
Revise administrative workflow for user creation
Summary:
- When an administrator creates a user, provide an option to send a welcome
email. Right now this workflow kind of dead-ends.
- Prevent administrators from changing the "System Agent" flag. If they can
change it, they can grab another user's certificate and then act as them. This
is a vaguely weaker security policy than is exhibited elsewhere in the
application. Instead, make user accounts immutably normal users or system agents
at creation time.
- Prevent administrators from changing email addresses after account creation.
Same deal as conduit certs. The 'bin/accountadmin' script can still do this if a
user has a real problem.
- Prevent administrators from resetting passwords. There's no need for this
anymore with welcome emails plus email login and it raises the same issues.
Test Plan:
- Created a new account, selected "send welcome email", got a welcome email,
logged in with the link inside it.
- Created a new system agent.
- Reset an account's password.
Reviewed By: aran
Reviewers: tuomaspelkonen, jungejason, aran
CC: anjali, aran, epriestley
Differential Revision: 379
2011-05-30 23:59:17 +02:00
|
|
|
|
2014-04-02 21:06:17 +02:00
|
|
|
$email = id(new PhabricatorUserEmail())
|
|
|
|
->setAddress($new_email)
|
|
|
|
->setIsVerified(0);
|
|
|
|
|
|
|
|
// Automatically approve the user, since an admin is creating them.
|
|
|
|
$user->setIsApproved(1);
|
2012-05-07 19:29:33 +02:00
|
|
|
|
2014-04-02 21:06:27 +02:00
|
|
|
// If the user is a bot, approve their email too.
|
|
|
|
if ($is_bot) {
|
|
|
|
$email->setIsVerified(1);
|
|
|
|
}
|
|
|
|
|
2014-04-02 21:06:17 +02:00
|
|
|
id(new PhabricatorUserEditor())
|
|
|
|
->setActor($admin)
|
|
|
|
->createNewUser($user, $email);
|
2013-11-13 20:24:56 +01:00
|
|
|
|
2014-04-02 21:06:27 +02:00
|
|
|
if ($is_bot) {
|
2012-05-25 16:30:44 +02:00
|
|
|
id(new PhabricatorUserEditor())
|
|
|
|
->setActor($admin)
|
2014-04-02 21:06:17 +02:00
|
|
|
->makeSystemAgentUser($user, true);
|
2012-07-26 23:41:14 +02:00
|
|
|
}
|
Revise administrative workflow for user creation
Summary:
- When an administrator creates a user, provide an option to send a welcome
email. Right now this workflow kind of dead-ends.
- Prevent administrators from changing the "System Agent" flag. If they can
change it, they can grab another user's certificate and then act as them. This
is a vaguely weaker security policy than is exhibited elsewhere in the
application. Instead, make user accounts immutably normal users or system agents
at creation time.
- Prevent administrators from changing email addresses after account creation.
Same deal as conduit certs. The 'bin/accountadmin' script can still do this if a
user has a real problem.
- Prevent administrators from resetting passwords. There's no need for this
anymore with welcome emails plus email login and it raises the same issues.
Test Plan:
- Created a new account, selected "send welcome email", got a welcome email,
logged in with the link inside it.
- Created a new system agent.
- Reset an account's password.
Reviewed By: aran
Reviewers: tuomaspelkonen, jungejason, aran
CC: anjali, aran, epriestley
Differential Revision: 379
2011-05-30 23:59:17 +02:00
|
|
|
|
2014-04-02 21:06:27 +02:00
|
|
|
if ($welcome_checked && !$is_bot) {
|
2012-07-26 23:41:14 +02:00
|
|
|
$user->sendWelcomeEmail($admin);
|
Revise administrative workflow for user creation
Summary:
- When an administrator creates a user, provide an option to send a welcome
email. Right now this workflow kind of dead-ends.
- Prevent administrators from changing the "System Agent" flag. If they can
change it, they can grab another user's certificate and then act as them. This
is a vaguely weaker security policy than is exhibited elsewhere in the
application. Instead, make user accounts immutably normal users or system agents
at creation time.
- Prevent administrators from changing email addresses after account creation.
Same deal as conduit certs. The 'bin/accountadmin' script can still do this if a
user has a real problem.
- Prevent administrators from resetting passwords. There's no need for this
anymore with welcome emails plus email login and it raises the same issues.
Test Plan:
- Created a new account, selected "send welcome email", got a welcome email,
logged in with the link inside it.
- Created a new system agent.
- Reset an account's password.
Reviewed By: aran
Reviewers: tuomaspelkonen, jungejason, aran
CC: anjali, aran, epriestley
Differential Revision: 379
2011-05-30 23:59:17 +02:00
|
|
|
}
|
Provide an activity log for login and administrative actions
Summary: This isn't complete, but I figured I'd ship it for review while it's still smallish.
Provide an activity log for high-level system actions (logins, admin actions). This basically allows two things to happen:
- The log itself is useful if there are shenanigans.
- Password login can check it and start CAPTCHA'ing users after a few failed attempts.
I'm going to change how the admin stuff works a little bit too, since right now you can make someone an agent, grab their certificate, revert them back to a normal user, and then act on their behalf over Conduit. This is a little silly, I'm going to move "agent" to the create workflow instead. I'll also add a confirm/email step to the administrative password reset flow.
Test Plan: Took various administrative and non-administrative actions, they appeared in the logs. Filtered the logs in a bunch of different ways.
Reviewers: jungejason, tuomaspelkonen, aran
CC:
Differential Revision: 302
2011-05-18 03:42:21 +02:00
|
|
|
|
2011-05-12 19:06:54 +02:00
|
|
|
$response = id(new AphrontRedirectResponse())
|
2014-04-02 21:06:17 +02:00
|
|
|
->setURI('/p/'.$user->getUsername().'/');
|
2011-05-12 19:06:54 +02:00
|
|
|
return $response;
|
2014-08-05 23:51:21 +02:00
|
|
|
} catch (AphrontDuplicateKeyQueryException $ex) {
|
2013-02-21 23:10:22 +01:00
|
|
|
$errors[] = pht('Username and email must be unique.');
|
2011-05-12 19:06:54 +02:00
|
|
|
|
|
|
|
$same_username = id(new PhabricatorUser())
|
|
|
|
->loadOneWhere('username = %s', $user->getUsername());
|
2012-05-07 19:29:33 +02:00
|
|
|
$same_email = id(new PhabricatorUserEmail())
|
|
|
|
->loadOneWhere('address = %s', $new_email);
|
2011-05-12 19:06:54 +02:00
|
|
|
|
|
|
|
if ($same_username) {
|
2013-02-21 23:10:22 +01:00
|
|
|
$e_username = pht('Duplicate');
|
2011-05-12 19:06:54 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if ($same_email) {
|
2013-02-21 23:10:22 +01:00
|
|
|
$e_email = pht('Duplicate');
|
2011-05-12 19:06:54 +02:00
|
|
|
}
|
|
|
|
}
|
2011-01-24 03:09:16 +01:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2014-04-02 21:06:27 +02:00
|
|
|
$form = id(new AphrontFormView())
|
|
|
|
->setUser($admin);
|
|
|
|
|
|
|
|
if ($is_bot) {
|
|
|
|
$form->appendRemarkupInstructions(
|
|
|
|
pht(
|
|
|
|
'You are creating a new **bot/script** user account.'));
|
|
|
|
} else {
|
|
|
|
$form->appendRemarkupInstructions(
|
|
|
|
pht(
|
|
|
|
'You are creating a new **standard** user account.'));
|
|
|
|
}
|
2011-01-24 03:09:16 +01:00
|
|
|
|
|
|
|
$form
|
|
|
|
->appendChild(
|
|
|
|
id(new AphrontFormTextControl())
|
2013-02-21 23:10:22 +01:00
|
|
|
->setLabel(pht('Username'))
|
2011-01-24 03:09:16 +01:00
|
|
|
->setName('username')
|
|
|
|
->setValue($user->getUsername())
|
2014-04-02 21:06:27 +02:00
|
|
|
->setError($e_username))
|
2011-01-24 03:09:16 +01:00
|
|
|
->appendChild(
|
|
|
|
id(new AphrontFormTextControl())
|
2013-02-21 23:10:22 +01:00
|
|
|
->setLabel(pht('Real Name'))
|
2011-01-24 03:09:16 +01:00
|
|
|
->setName('realname')
|
|
|
|
->setValue($user->getRealName())
|
2014-04-02 21:06:27 +02:00
|
|
|
->setError($e_realname))
|
2014-04-02 21:06:17 +02:00
|
|
|
->appendChild(
|
2014-04-02 21:06:27 +02:00
|
|
|
id(new AphrontFormTextControl())
|
|
|
|
->setLabel(pht('Email'))
|
|
|
|
->setName('email')
|
|
|
|
->setValue($new_email)
|
|
|
|
->setCaption(PhabricatorUserEmail::describeAllowedAddresses())
|
|
|
|
->setError($e_email));
|
|
|
|
|
|
|
|
if (!$is_bot) {
|
|
|
|
$form->appendChild(
|
2014-04-02 21:06:17 +02:00
|
|
|
id(new AphrontFormCheckboxControl())
|
|
|
|
->addCheckbox(
|
|
|
|
'welcome',
|
|
|
|
1,
|
2014-04-02 21:06:27 +02:00
|
|
|
pht('Send "Welcome to Phabricator" email with login instructions.'),
|
2014-04-02 21:06:17 +02:00
|
|
|
$welcome_checked));
|
2014-04-02 21:06:27 +02:00
|
|
|
}
|
Revise administrative workflow for user creation
Summary:
- When an administrator creates a user, provide an option to send a welcome
email. Right now this workflow kind of dead-ends.
- Prevent administrators from changing the "System Agent" flag. If they can
change it, they can grab another user's certificate and then act as them. This
is a vaguely weaker security policy than is exhibited elsewhere in the
application. Instead, make user accounts immutably normal users or system agents
at creation time.
- Prevent administrators from changing email addresses after account creation.
Same deal as conduit certs. The 'bin/accountadmin' script can still do this if a
user has a real problem.
- Prevent administrators from resetting passwords. There's no need for this
anymore with welcome emails plus email login and it raises the same issues.
Test Plan:
- Created a new account, selected "send welcome email", got a welcome email,
logged in with the link inside it.
- Created a new system agent.
- Reset an account's password.
Reviewed By: aran
Reviewers: tuomaspelkonen, jungejason, aran
CC: anjali, aran, epriestley
Differential Revision: 379
2011-05-30 23:59:17 +02:00
|
|
|
|
|
|
|
$form
|
2011-01-24 03:09:16 +01:00
|
|
|
->appendChild(
|
|
|
|
id(new AphrontFormSubmitControl())
|
2014-04-02 21:06:17 +02:00
|
|
|
->addCancelButton($this->getApplicationURI())
|
2014-04-02 21:06:27 +02:00
|
|
|
->setValue(pht('Create User')));
|
|
|
|
|
|
|
|
if ($is_bot) {
|
|
|
|
$form
|
|
|
|
->appendChild(id(new AphrontFormDividerControl()))
|
|
|
|
->appendRemarkupInstructions(
|
|
|
|
pht(
|
|
|
|
'**Why do bot/script accounts need an email address?**'.
|
|
|
|
"\n\n".
|
|
|
|
'Although bots do not normally receive email from Phabricator, '.
|
|
|
|
'they can interact with other systems which require an email '.
|
|
|
|
'address. Examples include:'.
|
|
|
|
"\n\n".
|
|
|
|
" - If the account takes actions which //send// email, we need ".
|
|
|
|
" an address to use in the //From// header.\n".
|
|
|
|
" - If the account creates commits, Git and Mercurial require ".
|
|
|
|
" an email address for authorship.\n".
|
|
|
|
" - If you send email //to// Phabricator on behalf of the ".
|
|
|
|
" account, the address can identify the sender.\n".
|
|
|
|
" - Some internal authentication functions depend on accounts ".
|
|
|
|
" having an email address.\n".
|
|
|
|
"\n\n".
|
|
|
|
"The address will automatically be verified, so you do not need ".
|
|
|
|
"to be able to receive mail at this address, and can enter some ".
|
|
|
|
"invalid or nonexistent (but correctly formatted) address like ".
|
|
|
|
"`bot@yourcompany.com` if you prefer."));
|
|
|
|
}
|
|
|
|
|
2011-01-24 03:09:16 +01:00
|
|
|
|
2014-04-02 21:06:17 +02:00
|
|
|
$title = pht('Create New User');
|
2011-01-24 03:09:16 +01:00
|
|
|
|
2013-09-25 20:23:29 +02:00
|
|
|
$form_box = id(new PHUIObjectBoxView())
|
2013-08-26 20:53:11 +02:00
|
|
|
->setHeaderText($title)
|
2014-01-10 18:17:37 +01:00
|
|
|
->setFormErrors($errors)
|
2013-08-26 20:53:11 +02:00
|
|
|
->setForm($form);
|
|
|
|
|
2014-04-02 21:06:27 +02:00
|
|
|
$crumbs = $this->buildApplicationCrumbs();
|
|
|
|
$crumbs->addTextCrumb($title);
|
2011-05-12 19:06:54 +02:00
|
|
|
|
2014-04-02 21:06:27 +02:00
|
|
|
return $this->buildApplicationPage(
|
2012-04-09 00:10:00 +02:00
|
|
|
array(
|
2014-04-02 21:06:27 +02:00
|
|
|
$crumbs,
|
|
|
|
$form_box,
|
2012-04-09 00:10:00 +02:00
|
|
|
),
|
2014-04-02 21:06:27 +02:00
|
|
|
array(
|
|
|
|
'title' => $title,
|
|
|
|
));
|
2012-04-09 00:10:00 +02:00
|
|
|
}
|
|
|
|
|
2011-01-24 03:09:16 +01:00
|
|
|
}
|