94 lines
2.3 KiB
Go
94 lines
2.3 KiB
Go
package web
|
|
|
|
import (
|
|
"net/http"
|
|
"strconv"
|
|
|
|
"uPortal/internal/auth"
|
|
)
|
|
|
|
// HandleUsers lists every user in the system. Requires a super user.
|
|
func (s *WebService) HandleUsers(w http.ResponseWriter, r *http.Request) {
|
|
data, ok := s.basicViewData(w, r, "Users")
|
|
if !ok {
|
|
http.Redirect(w, r, "/signin", http.StatusSeeOther)
|
|
return
|
|
}
|
|
|
|
users, err := s.users.GetUsers(r.Context(), 1000, 0)
|
|
if err != nil {
|
|
http.Error(w, "Internal Server Error", http.StatusInternalServerError)
|
|
return
|
|
}
|
|
data.Users = users
|
|
|
|
s.render(w, r, "user/view.html", data)
|
|
}
|
|
|
|
// HandleUserResetPassword lets a super admin reset another user's password.
|
|
func (s *WebService) HandleUserResetPassword(w http.ResponseWriter, r *http.Request) {
|
|
if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
|
|
http.Redirect(w, r, "/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
|
|
if err := r.ParseForm(); err != nil {
|
|
http.Redirect(w, r, "/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
|
|
userIdStr := r.FormValue("user_id")
|
|
newPassword := r.FormValue("new_password")
|
|
|
|
userId, err := strconv.ParseInt(userIdStr, 10, 64)
|
|
if err != nil {
|
|
http.Redirect(w, r, "/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
|
|
if len(newPassword) < 6 {
|
|
http.Redirect(w, r, "/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
|
|
user, err := s.users.GetUserById(r.Context(), userId)
|
|
if err != nil {
|
|
http.Redirect(w, r, "/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
|
|
hashedPassword, err := auth.HashPassword(newPassword)
|
|
if err != nil {
|
|
http.Redirect(w, r, "/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
|
|
user.Password = hashedPassword
|
|
s.users.UpdateUser(r.Context(), user)
|
|
|
|
http.Redirect(w, r, "/users", http.StatusSeeOther)
|
|
}
|
|
|
|
// HandleUserEndSessions ends all sessions for a given user. Requires a super user.
|
|
func (s *WebService) HandleUserEndSessions(w http.ResponseWriter, r *http.Request) {
|
|
if err := auth.ValidateCsrf(r, CsrfCookieName, CsrfFieldName); err != nil {
|
|
http.Redirect(w, r, "/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
|
|
if err := r.ParseForm(); err != nil {
|
|
http.Redirect(w, r, "/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
|
|
userIdStr := r.FormValue("user_id")
|
|
userId, err := strconv.ParseInt(userIdStr, 10, 64)
|
|
if err != nil {
|
|
http.Redirect(w, r, "/users", http.StatusSeeOther)
|
|
return
|
|
}
|
|
|
|
s.auths.DeleteSessionsByUserId(r.Context(), userId)
|
|
http.Redirect(w, r, "/users", http.StatusSeeOther)
|
|
}
|