Skip to content

Commit d77a088

Browse files
christianbeeznestchristianbeeznest
authored
Merge pull request chamilo#6774 from christianbeeznest/chamiloGH-6762
Internal: Remove ADMIN vs SUPERADMIN redundancy - refs chamilo#6762
2 parents d99c5aa + 4ef7fb9 commit d77a088

File tree

11 files changed

+408
-181
lines changed

11 files changed

+408
-181
lines changed

‎assets/vue/store/security.js‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,10 @@ export default {
1717
return state.isAuthenticated
1818
},
1919
isAdmin(state, getters) {
20-
return getters.isAuthenticated && (getters.hasRole("ROLE_SUPER_ADMIN") || getters.hasRole("ROLE_ADMIN"))
20+
return (
21+
getters.isAuthenticated &&
22+
(getters.hasRole("ROLE_ADMIN") || getters.hasRole("ROLE_GLOBAL_ADMIN"))
23+
)
2124
},
2225
isCourseAdmin(state, getters) {
2326
if (getters.isAdmin) {
@@ -34,8 +37,7 @@ export default {
3437
if (!getters.isAuthenticated) {
3538
return false
3639
}
37-
38-
if (getters.hasRole("ROLE_SUPER_ADMIN") || getters.hasRole("ROLE_ADMIN")) {
40+
if (getters.hasRole("ROLE_ADMIN") || getters.hasRole("ROLE_GLOBAL_ADMIN")) {
3941
return true
4042
}
4143

@@ -52,7 +54,7 @@ export default {
5254
},
5355
hasRole(state) {
5456
return (role) => {
55-
if (state.user.roles) {
57+
if (state.user && state.user.roles) {
5658
return state.user.roles.indexOf(role) !== -1
5759
}
5860

‎assets/vue/store/securityStore.js‎

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ export const useSecurityStore = defineStore("security", () => {
2727
* @param {string} role
2828
*/
2929
const removeRole = (role) => {
30+
if (!user.value || !user.value.roles) return
3031
const index = user.value.roles.indexOf(role)
3132

3233
if (index > -1) {
@@ -40,20 +41,21 @@ export const useSecurityStore = defineStore("security", () => {
4041

4142
const isHRM = computed(() => hasRole.value("ROLE_HR"))
4243

43-
const isTeacher = computed(() => (isAdmin.value ? true : hasRole.value("ROLE_TEACHER")))
44+
const isAdmin = computed(() => hasRole.value("ROLE_ADMIN") || hasRole.value("ROLE_GLOBAL_ADMIN"))
4445

45-
const isCurrentTeacher = computed(() => (isAdmin.value ? true : hasRole.value("ROLE_CURRENT_COURSE_TEACHER")))
46+
const isTeacher = computed(() => isAdmin.value || hasRole.value("ROLE_TEACHER"))
4647

47-
const isCourseAdmin = computed(() =>
48-
isAdmin.value
49-
? true
50-
: hasRole.value("ROLE_CURRENT_COURSE_SESSION_TEACHER") || hasRole.value("ROLE_CURRENT_COURSE_TEACHER"),
48+
const isCurrentTeacher = computed(() => isAdmin.value || hasRole.value("ROLE_CURRENT_COURSE_TEACHER"))
49+
50+
const isCourseAdmin = computed(
51+
() =>
52+
isAdmin.value ||
53+
hasRole.value("ROLE_CURRENT_COURSE_SESSION_TEACHER") ||
54+
hasRole.value("ROLE_CURRENT_COURSE_TEACHER"),
5155
)
5256

5357
const isSessionAdmin = computed(() => hasRole.value("ROLE_SESSION_MANAGER"))
5458

55-
const isAdmin = computed(() => hasRole.value("ROLE_SUPER_ADMIN") || hasRole.value("ROLE_ADMIN"))
56-
5759
async function checkSession() {
5860
isLoading.value = true
5961
try {

‎assets/vue/views/lp/LpList.vue‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -354,7 +354,7 @@ const load = async () => {
354354
355355
let allowed = await checkIsAllowedToEdit(true, true, true, false)
356356
const roles = securityStore.user?.roles ?? []
357-
if (!allowed && Array.isArray(roles) && (roles.includes("ROLE_ADMIN") || roles.includes("ROLE_SUPER_ADMIN"))) {
357+
if (!allowed && Array.isArray(roles) && (roles.includes("ROLE_ADMIN") || roles.includes("ROLE_GLOBAL_ADMIN"))) {
358358
allowed = true
359359
}
360360
rawCanEdit.value = !!allowed

‎config/packages/security.yaml‎

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -42,18 +42,17 @@ security:
4242
- ROLE_CURRENT_COURSE_TEACHER
4343
- ROLE_CURRENT_COURSE_SESSION_TEACHER
4444
- ROLE_CURRENT_COURSE_GROUP_TEACHER
45-
ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH] # Admin that can log in as another user.
46-
ROLE_GLOBAL_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH] # The user that installed the platform.
45+
- ROLE_ALLOWED_TO_SWITCH
46+
ROLE_GLOBAL_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
4747
ROLE_TEACHER: [ROLE_STUDENT]
4848
ROLE_HR: [ROLE_TEACHER, ROLE_ALLOWED_TO_SWITCH]
4949
ROLE_QUESTION_MANAGER: [ROLE_STUDENT]
5050
ROLE_SESSION_MANAGER: [ROLE_STUDENT, ROLE_ALLOWED_TO_SWITCH]
5151
ROLE_STUDENT_BOSS: [ROLE_STUDENT]
5252
ROLE_INVITEE: [ROLE_STUDENT]
53-
54-
ROLE_CURRENT_COURSE_STUDENT: [ROLE_CURRENT_COURSE_STUDENT] # Set in the CidReqListener
55-
ROLE_CURRENT_COURSE_TEACHER: [ROLE_CURRENT_COURSE_TEACHER, ROLE_CURRENT_COURSE_STUDENT] # Set in the course listener
56-
ROLE_CURRENT_COURSE_GROUP_STUDENT: [ROLE_CURRENT_COURSE_GROUP_STUDENT] # Set in the CidReqListener
53+
ROLE_CURRENT_COURSE_STUDENT: [ROLE_CURRENT_COURSE_STUDENT]
54+
ROLE_CURRENT_COURSE_TEACHER: [ROLE_CURRENT_COURSE_TEACHER, ROLE_CURRENT_COURSE_STUDENT]
55+
ROLE_CURRENT_COURSE_GROUP_STUDENT: [ROLE_CURRENT_COURSE_GROUP_STUDENT]
5756
ROLE_CURRENT_COURSE_GROUP_TEACHER: [ROLE_CURRENT_COURSE_GROUP_TEACHER, ROLE_CURRENT_COURSE_GROUP_STUDENT]
5857
ROLE_CURRENT_COURSE_SESSION_STUDENT: [ROLE_CURRENT_COURSE_SESSION_STUDENT]
5958
ROLE_CURRENT_COURSE_SESSION_TEACHER: [ROLE_CURRENT_COURSE_SESSION_STUDENT, ROLE_CURRENT_COURSE_SESSION_TEACHER]
@@ -124,5 +123,5 @@ security:
124123

125124
access_control:
126125
- { path: ^/login/token/check, roles: PUBLIC_ACCESS }
127-
- {path: ^/login, roles: PUBLIC_ACCESS}
128-
- {path: ^/api/authentication_token, roles: PUBLIC_ACCESS}
126+
- { path: ^/login, roles: PUBLIC_ACCESS }
127+
- { path: ^/api/authentication_token, roles: PUBLIC_ACCESS }

‎public/main/admin/user_list.php‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ function prepare_user_sql_query(bool $getCount, bool $showDeletedUsers = false):
264264
}
265265
$mappedStatuses = array_values(array_unique($mappedStatuses));
266266

267-
$adminVariants = ['ROLE_PLATFORM_ADMIN','PLATFORM_ADMIN','ROLE_SUPER_ADMIN','SUPER_ADMIN','ROLE_GLOBAL_ADMIN','GLOBAL_ADMIN','ROLE_ADMIN','ADMIN'];
267+
$adminVariants = ['ROLE_PLATFORM_ADMIN','PLATFORM_ADMIN','ROLE_GLOBAL_ADMIN','GLOBAL_ADMIN','ROLE_ADMIN','ADMIN'];
268268
$needsAdminLeftJoin = (bool) array_intersect($roles, $adminVariants);
269269
if ($needsAdminLeftJoin) {
270270
$sql .= " LEFT JOIN $admin_table a ON (a.user_id = u.id) ";
@@ -467,25 +467,23 @@ function get_user_data(int $from, int $number_of_items, int $column, string $dir
467467
title="'.api_get_person_name($user[2], $user[3]).'" />';
468468

469469
if (1 == $user[7] && !empty($user['exp'])) {
470-
// check expiration date
471470
$expiration_time = api_strtotime($user['exp']);
472-
// if expiration date is passed, store a special value for active field
473471
if ($expiration_time < $t) {
474472
$user[7] = '-1';
475473
}
476474
}
477475

478476
// forget about the expiration date field
479477
$users[] = [
480-
$user[0], // id
478+
$user[0],
481479
$photo,
482480
$user[1],
483481
$user[2],
484482
$user[3],
485-
$user[4], // username
486-
$user[5], // email
483+
$user[4],
484+
$user[5],
487485
$user[0],
488-
$user[7], // active
486+
$user[7],
489487
api_get_local_time($user[8]),
490488
api_get_local_time($user[9], null, null, true),
491489
$user[0],
@@ -598,7 +596,6 @@ function modify_filter($user_id, $url_params, $row): string
598596
$userRoles = $userEntity ? $userEntity->getRoles() : [];
599597

600598
$isAdminByRole = in_array('ROLE_PLATFORM_ADMIN', $userRoles, true)
601-
|| in_array('ROLE_SUPER_ADMIN', $userRoles, true)
602599
|| in_array('ROLE_GLOBAL_ADMIN', $userRoles, true)
603600
|| in_array('ROLE_ADMIN', $userRoles, true);
604601

‎public/main/inc/ajax/user_manager.ajax.php‎

Lines changed: 14 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -72,8 +72,6 @@
7272
.$user_info['official_code'];
7373

7474
if ($isAnonymous) {
75-
// Only allow anonymous users to see user popup if the popup user
76-
// is a teacher (which might be necessary to illustrate a course)
7775
if (COURSEMANAGER === (int) $user_info['status']) {
7876
if ($user_info['status'] === COURSEMANAGER) {
7977
echo $userData;
@@ -218,22 +216,21 @@
218216
);
219217
$body = get_lang('Dear')." ".stripslashes($recipientName).",\n\n";
220218
$body .= sprintf(
221-
get_lang('Your account on %s has just been approved by one of our administrators.'),
222-
api_get_setting('siteName')
223-
)."\n";
219+
get_lang('Your account on %s has just been approved by one of our administrators.'),
220+
api_get_setting('siteName')
221+
)."\n";
224222
$body .= sprintf(
225-
get_lang('You can now login at %s using the login and the password you have provided.'),
226-
api_get_path(WEB_PATH)
227-
).",\n\n";
223+
get_lang('You can now login at %s using the login and the password you have provided.'),
224+
api_get_path(WEB_PATH)
225+
).",\n\n";
228226
$body .= get_lang('Have fun,')."\n\n";
229-
//$body.=get_lang('In case of trouble, contact us.'). "\n\n". get_lang('Sincerely');
230227
$body .= api_get_person_name(
231-
api_get_setting('administratorName'),
232-
api_get_setting('administratorSurname')
233-
)."\n".
234-
get_lang('Administrator')." ".
235-
api_get_setting('siteName')."\nT. ".api_get_setting('administratorTelephone')."\n".
236-
get_lang('E-mail')." : ".api_get_setting('emailAdministrator');
228+
api_get_setting('administratorName'),
229+
api_get_setting('administratorSurname')
230+
)."\n".
231+
get_lang('Administrator')." ".
232+
api_get_setting('siteName')."\nT. ".api_get_setting('administratorTelephone')."\n".
233+
get_lang('E-mail')." : ".api_get_setting('emailAdministrator');
237234

238235
MessageManager::send_message_simple(
239236
$user_id,
@@ -281,7 +278,7 @@
281278

282279
$urlId = api_get_current_access_url_id();
283280

284-
$roleList = ['ROLE_TEACHER', 'ROLE_ADMIN', 'ROLE_SUPER_ADMIN'];
281+
$roleList = ['ROLE_TEACHER', 'ROLE_ADMIN', 'ROLE_GLOBAL_ADMIN'];
285282

286283
$users = Container::getUserRepository()->findByRoleList(
287284
$roleList,
@@ -312,7 +309,7 @@
312309

313310
$urlId = api_get_current_access_url_id();
314311

315-
$roleList = ['ROLE_STUDENT', 'ROLE_TEACHER', 'ROLE_ADMIN', 'ROLE_SUPER_ADMIN'];
312+
$roleList = ['ROLE_STUDENT', 'ROLE_TEACHER', 'ROLE_ADMIN', 'ROLE_GLOBAL_ADMIN'];
316313

317314
$users = Container::getUserRepository()->findByRoleList(
318315
$roleList,

‎public/main/inc/lib/api.lib.php‎

Lines changed: 13 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -6376,9 +6376,8 @@ function api_get_roles(): array
63766376

63776377
$codes = Container::$container
63786378
->get(\Chamilo\CoreBundle\Helpers\PermissionHelper::class)
6379-
->getUserRoles(); // list of role codes from DB
6379+
->getUserRoles();
63806380

6381-
// Built-in labels fallbacks. DB codes are used as keys.
63826381
$labels = [
63836382
'ROLE_STUDENT' => get_lang('Learner'),
63846383
'STUDENT' => get_lang('Learner'),
@@ -6398,8 +6397,6 @@ function api_get_roles(): array
63986397
'ADMIN' => get_lang('Admin'),
63996398
'ROLE_PLATFORM_ADMIN' => get_lang('Administrator'),
64006399
'PLATFORM_ADMIN' => get_lang('Administrator'),
6401-
'ROLE_SUPER_ADMIN' => get_lang('Super admin'),
6402-
'SUPER_ADMIN' => get_lang('Super admin'),
64036400
'ROLE_GLOBAL_ADMIN' => get_lang('Global admin'),
64046401
'GLOBAL_ADMIN' => get_lang('Global admin'),
64056402
'ROLE_ANONYMOUS' => 'Anonymous',
@@ -6795,7 +6792,6 @@ function api_drh_can_access_all_session_content()
67956792
function api_can_login_as($loginAsUserId, $userId = null)
67966793
{
67976794
$loginAsUserId = (int) $loginAsUserId;
6798-
67996795
if (empty($loginAsUserId)) {
68006796
return false;
68016797
}
@@ -6808,9 +6804,8 @@ function api_can_login_as($loginAsUserId, $userId = null)
68086804
return false;
68096805
}
68106806

6811-
// Check if the user to login is an admin
6807+
// If target is an admin, only global admins can login to admin accounts
68126808
if (api_is_platform_admin_by_id($loginAsUserId)) {
6813-
// Only super admins can login to admin accounts
68146809
if (!api_global_admin_can_edit_admin($loginAsUserId)) {
68156810
return false;
68166811
}
@@ -6821,25 +6816,18 @@ function api_can_login_as($loginAsUserId, $userId = null)
68216816
$isDrh = function () use ($loginAsUserId) {
68226817
if (api_is_drh()) {
68236818
if (api_drh_can_access_all_session_content()) {
6824-
$users = SessionManager::getAllUsersFromCoursesFromAllSessionFromStatus(
6825-
'drh_all',
6826-
api_get_user_id()
6827-
);
6828-
$userList = [];
6819+
$users = SessionManager::getAllUsersFromCoursesFromAllSessionFromStatus('drh_all', api_get_user_id());
6820+
$userIds = [];
68296821
if (is_array($users)) {
68306822
foreach ($users as $user) {
6831-
$userList[] = $user['id'];
6823+
$userIds[] = $user['id'];
68326824
}
68336825
}
6834-
if (in_array($loginAsUserId, $userList)) {
6835-
return true;
6836-
}
6837-
} else {
6838-
if (api_is_drh() &&
6839-
UserManager::is_user_followed_by_drh($loginAsUserId, api_get_user_id())
6840-
) {
6841-
return true;
6842-
}
6826+
return in_array($loginAsUserId, $userIds);
6827+
}
6828+
6829+
if (UserManager::is_user_followed_by_drh($loginAsUserId, api_get_user_id())) {
6830+
return true;
68436831
}
68446832
}
68456833

@@ -6852,9 +6840,9 @@ function api_can_login_as($loginAsUserId, $userId = null)
68526840
$loginAsStatusForSessionAdmins[] = COURSEMANAGER;
68536841
}
68546842

6855-
return api_is_platform_admin() ||
6856-
(api_is_session_admin() && in_array($userInfo['status'], $loginAsStatusForSessionAdmins)) ||
6857-
$isDrh();
6843+
return api_is_platform_admin() // local admins can login as (except into other admins unless allowed above)
6844+
|| (api_is_session_admin() && in_array($userInfo['status'], $loginAsStatusForSessionAdmins))
6845+
|| $isDrh();
68586846
}
68596847

68606848
/**

‎public/main/inc/lib/usermanager.lib.php‎

Lines changed: 3 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -5499,51 +5499,18 @@ public static function loginAsUser($userId, $checkIfUserCanLoginAs = true)
54995499
}
55005500

55015501
if ($userId) {
5502-
$logInfo = [
5502+
Event::registerLog([
55035503
'tool' => 'logout',
55045504
'tool_id' => 0,
55055505
'tool_id_detail' => 0,
55065506
'action' => '',
55075507
'info' => 'Change user (login as)',
5508-
];
5509-
Event::registerLog($logInfo);
5508+
]);
55105509

5511-
// Logout the current user
5510+
// Logout current user
55125511
self::loginDelete(api_get_user_id());
55135512

55145513
return true;
5515-
5516-
Session::erase('_user');
5517-
Session::erase('is_platformAdmin');
5518-
Session::erase('is_allowedCreateCourse');
5519-
Session::erase('_uid');
5520-
5521-
// Cleaning session variables
5522-
$_user['firstName'] = $userInfo['firstname'];
5523-
$_user['lastName'] = $userInfo['lastname'];
5524-
$_user['mail'] = $userInfo['email'];
5525-
$_user['official_code'] = $userInfo['official_code'];
5526-
$_user['picture_uri'] = $userInfo['picture_uri'];
5527-
$_user['user_id'] = $userId;
5528-
$_user['id'] = $userId;
5529-
$_user['status'] = $userInfo['status'];
5530-
5531-
// Filling session variables with new data
5532-
Session::write('_uid', $userId);
5533-
Session::write('_user', $userInfo);
5534-
Session::write('is_platformAdmin', (bool) self::is_admin($userId));
5535-
Session::write('is_allowedCreateCourse', 1 == $userInfo['status']);
5536-
// will be useful later to know if the user is actually an admin or not (example reporting)
5537-
Session::write('login_as', true);
5538-
$logInfo = [
5539-
'tool' => 'login',
5540-
'tool_id' => 0,
5541-
'tool_id_detail' => 0,
5542-
'info' => $userId,
5543-
];
5544-
Event::registerLog($logInfo);
5545-
5546-
return true;
55475514
}
55485515

55495516
return false;

0 commit comments

Comments
 (0)