[aur-dev] [PATCH 1/2] Clean up user references in user_delete()
Explicitly clean up all references before deleting a user. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de> --- web/lib/acctfuncs.inc.php | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php index 73d01a5..943e80b 100644 --- a/web/lib/acctfuncs.inc.php +++ b/web/lib/acctfuncs.inc.php @@ -829,6 +829,41 @@ function user_suspended($id) { */ function user_delete($id) { $dbh = DB::connect(); + $id = intval($id); + + /* + * These are normally already taken care of by propagation constraints + * but it is better to be explicit here. + */ + $fields_delete = array( + array("Sessions", "UsersID"), + array("PackageVotes", "UsersID"), + array("CommentNotify", "UsersID") + ); + + $fields_set_null = array( + array("PackageBases", "SubmitterUID"), + array("PackageBases", "MaintainerUID"), + array("PackageBases", "SubmitterUID"), + array("PackageComments", "UsersID"), + array("PackageComments", "DelUsersID"), + array("PackageRequests", "UsersID"), + array("TU_VoteInfo", "SubmitterID"), + array("TU_Votes", "UserID") + ); + + foreach($fields_delete as list($table, $field)) { + $q = "DELETE FROM " . $table . " "; + $q.= "WHERE " . $field . " = " . $id; + $dbh->query($q); + } + + foreach($fields_set_null as list($table, $field)) { + $q = "UPDATE " . $table . " SET " . $field . " = NULL "; + $q.= "WHERE " . $field . " = " . $id; + $dbh->query($q); + } + $q = "DELETE FROM Users WHERE ID = " . $id; $dbh->query($q); return; -- 2.0.2
Users can now delete their own accounts by clicking a link in the account edit form and confirming the deletion on a follow-up page. Signed-off-by: Lukas Fleischer <archlinux@cryptocrack.de> --- po/POTFILES | 1 + web/html/account.php | 16 ++++++++++++++++ web/html/index.php | 2 ++ web/template/account_delete.php | 22 ++++++++++++++++++++++ web/template/account_edit_form.php | 4 ++++ 5 files changed, 45 insertions(+) create mode 100644 web/template/account_delete.php diff --git a/po/POTFILES b/po/POTFILES index 1b4d6a6..2b9322b 100644 --- a/po/POTFILES +++ b/po/POTFILES @@ -34,6 +34,7 @@ lib/stats.inc.php lib/streams.php lib/translator.inc.php lib/version.inc.php +template/account_delete.php template/account_details.php template/account_edit_form.php template/account_search_results.php diff --git a/web/html/account.php b/web/html/account.php index f212eab..d289950 100644 --- a/web/html/account.php +++ b/web/html/account.php @@ -55,6 +55,22 @@ if (isset($_COOKIE["AURSID"])) { } } + } elseif ($action == "DeleteAccount") { + /* Details for account being deleted. */ + $acctinfo = account_details(in_request('ID'), in_request('U')); + + if (can_edit_account($acctinfo)) { + $UID = $acctinfo['ID']; + if (in_request('confirm_Delete') && check_token()) { + user_delete($UID); + header('Location: /'); + } else { + $username = $acctinfo['Username']; + include("account_delete.php"); + } + } else { + print __("You do not have permission to edit this account."); + } } elseif ($action == "AccountInfo") { # no editing, just looking up user info # diff --git a/web/html/index.php b/web/html/index.php index 554e86c..e05b555 100644 --- a/web/html/index.php +++ b/web/html/index.php @@ -123,6 +123,8 @@ if (!empty($tokens[1]) && '/' . $tokens[1] == get_pkg_route()) { $_REQUEST['Action'] = "DisplayAccount"; } elseif ($tokens[3] == 'update') { $_REQUEST['Action'] = "UpdateAccount"; + } elseif ($tokens[3] == 'delete') { + $_REQUEST['Action'] = "DeleteAccount"; } else { header("HTTP/1.0 404 Not Found"); include "./404.php"; diff --git a/web/template/account_delete.php b/web/template/account_delete.php new file mode 100644 index 0000000..0d40e5a --- /dev/null +++ b/web/template/account_delete.php @@ -0,0 +1,22 @@ +<p> + <?= __('You can use this form to permanently delete the AUR account %s.', '<strong>' . htmlspecialchars($username) . '</strong>') ?> +</p> +<p> + <?= __('%sWARNING%s: This action cannot be undone.', '<strong>', '</strong>') ?> +</p> + +<form id="edit-profile-form" action="<?= get_user_uri($username) . 'delete/'; ?>" method="post"> + <fieldset> + <input type="hidden" name="Action" value="<?= $A ?>" /> + <input type="hidden" name="ID" value="<?= $UID ?>" /> + <input type="hidden" name="token" value="<?= htmlspecialchars($_COOKIE['AURSID']) ?>" /> + </fieldset> + <fieldset> + <p><input type="checkbox" name="confirm_Delete" value="1" /> + <?= __("Confirm deletion") ?></p> + + <p> + <input type="submit" class="button" value="<?= __("Delete") ?>" /> + </p> + </fieldset> +</form> diff --git a/web/template/account_edit_form.php b/web/template/account_edit_form.php index f5890fc..3733985 100644 --- a/web/template/account_edit_form.php +++ b/web/template/account_edit_form.php @@ -1,3 +1,7 @@ +<p> + <?= __('Click %shere%s if you want to permanently delete this account.', '<a href="' . get_user_uri($U) . 'delete/' . '">', '</a>') ?> +</p> + <?php if ($A == "UpdateAccount"): ?> <form id="edit-profile-form" action="<?= get_user_uri($U) . 'update/'; ?>" method="post"> <?php else: ?> -- 2.0.2
participants (1)
-
Lukas Fleischer