From 0c62ca25636b963ced0364689072e9ce1ebedad2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jan=20Dagef=C3=B6rde?= Date: Thu, 23 Jun 2016 14:36:34 +0200 Subject: [PATCH] MDL-28574 webservice: Allow admins to manage tokens created by others. Until now, admins could only modify (or even see) tokens they have created themselves. Tokens created by other users or even other admins were invisible unless you were looking into the database. In case there are former admins, their successors can be unable to inspect or delete existing tokens. --- admin/webservice/tokens.php | 2 +- lib/adminlib.php | 21 ++++++++++++++------- webservice/lib.php | 28 ++++++++++++++++++++++++++++ 3 files changed, 43 insertions(+), 8 deletions(-) diff --git a/admin/webservice/tokens.php b/admin/webservice/tokens.php index 60ea271005f..a1272231801 100644 --- a/admin/webservice/tokens.php +++ b/admin/webservice/tokens.php @@ -101,7 +101,7 @@ switch ($action) { break; case 'delete': - $token = $webservicemanager->get_created_by_user_ws_token($USER->id, $tokenid); + $token = $webservicemanager->get_token_by_id_with_details($tokenid); //Delete the token if ($confirm and confirm_sesskey()) { diff --git a/lib/adminlib.php b/lib/adminlib.php index 53866698d66..a8408feb8e1 100644 --- a/lib/adminlib.php +++ b/lib/adminlib.php @@ -9531,6 +9531,7 @@ class admin_setting_managewebservicetokens extends admin_setting { $strtoken = get_string('token', 'webservice'); $strservice = get_string('service', 'webservice'); $struser = get_string('user'); + $strcreator = get_string('tokencreator', 'webservice'); $strcontext = get_string('context', 'webservice'); $strvaliduntil = get_string('validuntil', 'webservice'); $striprestriction = get_string('iprestriction', 'webservice'); @@ -9538,8 +9539,8 @@ class admin_setting_managewebservicetokens extends admin_setting { $return = $OUTPUT->box_start('generalbox webservicestokenui'); $table = new html_table(); - $table->head = array($strtoken, $struser, $strservice, $striprestriction, $strvaliduntil, $stroperation); - $table->colclasses = array('leftalign', 'leftalign', 'leftalign', 'centeralign', 'centeralign', 'centeralign'); + $table->head = array($strtoken, $struser, $strservice, $striprestriction, $strvaliduntil, $strcreator, $stroperation); + $table->colclasses = array('leftalign', 'leftalign', 'leftalign', 'centeralign', 'centeralign', 'leftalign', 'centeralign'); $table->id = 'webservicetokens'; $table->attributes['class'] = 'admintable generaltable'; $table->data = array(); @@ -9549,10 +9550,11 @@ class admin_setting_managewebservicetokens extends admin_setting { //TODO: in order to let the administrator delete obsolete token, split this request in multiple request or use LEFT JOIN //here retrieve token list (including linked users firstname/lastname and linked services name) - $sql = "SELECT t.id, t.token, u.id AS userid, u.firstname, u.lastname, s.name, t.iprestriction, t.validuntil, s.id AS serviceid - FROM {external_tokens} t, {user} u, {external_services} s - WHERE t.creatorid=? AND t.tokentype = ? AND s.id = t.externalserviceid AND t.userid = u.id"; - $tokens = $DB->get_records_sql($sql, array($USER->id, EXTERNAL_TOKEN_PERMANENT)); + $sql = "SELECT t.id, t.token, u.id AS userid, u.firstname, u.lastname, s.name, t.iprestriction, t.validuntil, + s.id AS serviceid, c.id AS creatorid, c.username AS creator + FROM {external_tokens} t, {user} u, {external_services} s, {user} c + WHERE t.tokentype = ? AND s.id = t.externalserviceid AND t.userid = u.id AND t.creatorid = c.id"; + $tokens = $DB->get_records_sql($sql, array(EXTERNAL_TOKEN_PERMANENT)); if (!empty($tokens)) { foreach ($tokens as $token) { //TODO: retrieve context @@ -9594,7 +9596,12 @@ class admin_setting_managewebservicetokens extends admin_setting { } } - $table->data[] = array($token->token, $useratag, $token->name, $iprestriction, $validuntil, $delete); + $creatorprofileurl = new moodle_url('/user/profile.php?id='.$token->creatorid); + $creatoratag = html_writer::start_tag('a', array('href' => $creatorprofileurl)); + $creatoratag .= $token->creator; + $creatoratag .= html_writer::end_tag('a'); + + $table->data[] = array($token->token, $useratag, $token->name, $iprestriction, $validuntil, $creatoratag, $delete); } $return .= html_writer::table($table); diff --git a/webservice/lib.php b/webservice/lib.php index 0101ccacded..89e1499ab0e 100644 --- a/webservice/lib.php +++ b/webservice/lib.php @@ -402,6 +402,34 @@ class webservice { return $token; } + /** + * Return a token of an arbitrary user by tokenid, including details of the associated user and the service name. + * If no tokens exist an exception is thrown + * + * The returned value is a stdClass: + * ->id token id + * ->token + * ->firstname user firstname + * ->lastname + * ->name service name + * + * @param int $tokenid token id + * @return stdClass + */ + public function get_token_by_id_with_details($tokenid) { + global $DB; + $sql = "SELECT + t.id, t.token, u.id AS userid, u.firstname, u.lastname, s.name + FROM + {external_tokens} t, {user} u, {external_services} s + WHERE + t.id=? AND t.tokentype = " + . EXTERNAL_TOKEN_PERMANENT + . " AND s.id = t.externalserviceid AND t.userid = u.id"; + $token = $DB->get_record_sql($sql, array($tokenid), MUST_EXIST); + return $token; + } + /** * Return a database token record for a token id *