pfSense

<?php

/* $Id$ */

 *	Copyright (c)  2004-2015  Electric Sheep Fencing, LLC. All rights reserved.

 *	Copyright (c)  2004, 2005 Scott Ullrich

 *	Copyright (c)  2003-2005 Manuel Kasper <mk@neon1.net>

 *	Copyright (c)  2008 Shrew Soft Inc.

 *	Copyright (c)  2005 Paul Taylor <paultaylor@winn-dixie.com>

 *

 *	Redistribution and use in source and binary forms, with or without modification,

 *	are permitted provided that the following conditions are met:

 *

 *	1. Redistributions of source code must retain the above copyright notice,

 *		this list of conditions and the following disclaimer.

 *

 *	2. Redistributions in binary form must reproduce the above copyright

 *		notice, this list of conditions and the following disclaimer in

 *		the documentation and/or other materials provided with the

 *		distribution.

 *

 *	3. All advertising materials mentioning features or use of this software

 *		must display the following acknowledgment:

 *		"This product includes software developed by the pfSense Project

 *		 for use in the pfSense software distribution. (http://www.pfsense.org/).

 *

 *	4. The names "pfSense" and "pfSense Project" must not be used to

 *		 endorse or promote products derived from this software without

 *		 prior written permission. For written permission, please contact

 *		 coreteam@pfsense.org.

 *

 *	5. Products derived from this software may not be called "pfSense"

 *		nor may "pfSense" appear in their names without prior written

 *		permission of the Electric Sheep Fencing, LLC.

 *

 *	6. Redistributions of any form whatsoever must retain the following

 *		acknowledgment:

 *

 *	"This product includes software developed by the pfSense Project

 *	for use in the pfSense software distribution (http://www.pfsense.org/).

 *

 *	THIS SOFTWARE IS PROVIDED BY THE pfSense PROJECT ``AS IS'' AND ANY

 *	EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 *	IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 *	PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE pfSense PROJECT OR

 *	ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 *	SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 *	NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 *	LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 *	HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 *	STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 *	ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 *	OF THE POSSIBILITY OF SUCH DAMAGE.

 *

 *	====================================================================

 *

 */

##|*IDENT=page-system-usermanager

##|*NAME=System: User Manager page

##|*DESCR=Allow access to the 'System: User Manager' page.

##|*MATCH=system_usermanager.php*

##|-PRIV

	$id = $_GET['userid'];

}

	$pconfig['usernamefld'] = $a_user[$id]['name'];

	$pconfig['descr'] = $a_user[$id]['descr'];

	$pconfig['expires'] = $a_user[$id]['expires'];

	$pconfig['groups'] = local_user_get_groups($a_user[$id]);

	$pconfig['utype'] = $a_user[$id]['scope'];

	$pconfig['uid'] = $a_user[$id]['uid'];

	$pconfig['authorizedkeys'] = base64_decode($a_user[$id]['authorizedkeys']);

	$pconfig['priv'] = $a_user[$id]['priv'];

	$pconfig['ipsecpsk'] = $a_user[$id]['ipsecpsk'];

	$pconfig['disabled'] = isset($a_user[$id]['disabled']);

}

		exit;

	unset($a_user[$id]);

	write_config();

	$savemsg = gettext("User")." {$userdeleted} ".

	 * set this value cause the text field is read only

	 * and the user should not be able to mess with this

	 * setting.

	 */

	$pconfig['utype'] = "user";

	$pconfig['lifetime'] = 3650;

}

	$del_users = $_POST['delete_check'];

		foreach ($del_users as $userid) {

				conf_mount_rw();

				local_user_del($a_user[$userid]);

				conf_mount_ro();

				unset($a_user[$userid]);

			}

		}

		$savemsg = gettext("Selected users removed successfully!");

		write_config($savemsg);

	}

}

	if (!$a_user[$id]) {

		pfSenseHeader("system_usermanager.php");

		exit;

	}

	$certdeleted = lookup_cert($a_user[$id]['cert'][$_POST['certid']]);

	$certdeleted = $certdeleted['descr'];

	unset($a_user[$id]['cert'][$_POST['certid']]);

	write_config();

	$_POST['act'] = "edit";

	$savemsg = gettext("Certificate") . " {$certdeleted} " . gettext("association removed.") . "<br />";

}

	$pconfig = $_POST;

	if (isset($id) && ($a_user[$id])) {

		$reqdfields = explode(" ", "usernamefld");

		$reqdfieldsn = array(gettext("Username"));

	} else {

		if (empty($_POST['name'])) {

			$reqdfields = explode(" ", "usernamefld passwordfld1");

			$reqdfieldsn = array(

				gettext("Username"),

				gettext("Password"));

			$reqdfieldsn = array(

				gettext("Username"),

				gettext("Password"),

				gettext("Descriptive name"),

				gettext("Certificate authority"),

				gettext("Key length"),

				gettext("Lifetime"));

	if (!$input_errors) {

		foreach ($a_user as $userent) {

			if ($userent['name'] == $_POST['usernamefld'] && $oldusername != $_POST['usernamefld']) {

				$input_errors[] = gettext("Another entry with the same username already exists.");

				break;

	/* also make sure it is not reserved */

	if (!$input_errors) {

		$system_users = explode("\n", file_get_contents("/etc/passwd"));

		foreach ($system_users as $s_user) {

			$ent = explode(":", $s_user);

			if ($ent[0] == $_POST['usernamefld'] && $oldusername != $_POST['usernamefld']) {

				$input_errors[] = gettext("That username is reserved by the system.");

				break;

	 * claim to accept MM/DD/YYYY as inputs. Advanced users may use inputs

	 * like "+1 day", which will be converted to MM/DD/YYYY based on "now".

			$expdate = new DateTime($_POST['expires']);

			//convert from any DateTime compatible date to MM/DD/YYYY

			$_POST['expires'] = $expdate->format("m/d/Y");

		$ca = lookup_ca($_POST['caref']);

	if (isAjax() && is_array($input_errors)) {

		input_errors2Ajax($input_errors);

		exit;

	}

		if ($a_user[$id] && !empty($_POST['privid'])) {

			foreach ($_POST['privid'] as $i)

				unset($a_user[$id]['priv'][$i]);

		}

		$userent = array();

		/* the user name was modified */

		}

		$userent['descr'] = $_POST['descr'];

		$userent['expires'] = $_POST['expires'];

		$userent['authorizedkeys'] = base64_encode($_POST['authorizedkeys']);

		$userent['ipsecpsk'] = $_POST['ipsecpsk'];

				$cert = array();

				$cert['refid'] = uniqid();

				$cert['descr'] = $_POST['name'];

					'countryName' => $subject[0]['v'],

					'stateOrProvinceName' => $subject[1]['v'],

					'localityName' => $subject[2]['v'],

					'organizationName' => $subject[3]['v'],

					'emailAddress' => $subject[4]['v'],

					'commonName' => $userent['name']);

				cert_create($cert, $_POST['caref'], $_POST['keylen'],

					(int)$_POST['lifetime'], $dn);

				$userent['cert'][] = $cert['refid'];

			}

			$userent['uid'] = $config['system']['nextuid']++;

			/* Add the user to All Users group. */

			foreach ($config['system']['group'] as $gidx => $group) {

				if ($group['name'] == "all") {

					break;

				}

			}

		local_user_set_groups($userent,$_POST['groups']);

		conf_mount_ro();

	global $a_user, $id;

	$privhtml = '<div class="table-responsive">';

	$privhtml .=	'<table class="table table-striped table-hover table-condensed">';

	$privhtml .=		'<thead>';

	$privhtml .=				'<th>' . gettext('Inherited from') . '</th>';

	$privhtml .=				'<th>' . gettext('Name') . '</th>';

	$privhtml .=				'<th>' . gettext('Description') . '</th>';

	$privhtml .=			'</tr>';

	$privhtml .=		'<tbody>';

	foreach (get_user_privdesc($a_user[$id]) as $i => $priv) {

		$privhtml .=		'<tr>';

		$privhtml .=			'<td>' . htmlspecialchars($priv['group']) . '</td>';

		$privhtml .=			'<td>' . htmlspecialchars($priv['name']) . '</td>';

		$privhtml .=			'<td>' . htmlspecialchars($priv['descr']) . '</td>';

		$privhtml .=		'</tr>';

	}

	$privhtml .=		'</tbody>';

	$privhtml .=	'</table>';

	$privhtml .= '</div>';

	$privhtml .= '<nav class="action-buttons">';

	$privhtml .=	'<a href="system_usermanager_addprivs.php?userid=' . $id . '" class="btn btn-success">' . gettext("Add") . '</a>';

	$privhtml .= '</nav>';

	return($privhtml);

}

	global $a_user, $id;

	$certhtml = '<div class="table-responsive">';

	$certhtml .=	'<table class="table table-striped table-hover table-condensed">';

	$certhtml .=		'<thead>';

	$certhtml .=				'<th>' . gettext('Name') . '</th>';

	$certhtml .=				'<th>' . gettext('CA') . '</th>';

	$certhtml .=		'<tbody>';

	$a_cert = $a_user[$id]['cert'];

	if (is_array($a_cert)) {

		$i = 0;

		foreach ($a_cert as $certref) {

			$ca = lookup_ca($cert['caref']);

			$revokedstr =	is_cert_revoked($cert) ? '<b> Revoked</b>':'';

			$certhtml .=			gettext('Remove this certificate association? (Certificate will not be deleted)') . '">Delete</a>';

	$certhtml .=		'</tbody>';

	$certhtml .=	'</table>';

	$certhtml .= '</div>';

	$certhtml .= '<nav class="action-buttons">';

	$certhtml .=	'<a href="system_certmanager.php?act=new&amp;userid=' . $id . '" class="btn btn-success">' . gettext("Add") . '</a>';

	$certhtml .= '</nav>';

	return($certhtml);

}

	print_input_errors($input_errors);

$tab_array = array();

$tab_array[] = array(gettext("Users"), true, "system_usermanager.php");

$tab_array[] = array(gettext("Groups"), false, "system_groupmanager.php");

$tab_array[] = array(gettext("Settings"), false, "system_usermanager_settings.php");

$tab_array[] = array(gettext("Servers"), false, "system_authservers.php");

display_top_tabs($tab_array);

<div class="table-responsive">

		<thead>

			<tr>

				<th>&nbsp;</th>

				<th><?=gettext("Username")?></th>

				<th><?=gettext("Full name")?></th>

				<th><?=gettext("Disabled")?></th>

				<th><?=gettext("Groups")?></th>

			</tr>

		</thead>

		<tbody>

		</tbody>

		<tbody>

foreach($a_user as $i => $userent):

	?>

				<td>

					<input type="checkbox" id="frc<?=$i?>" name="delete_check[]" value="<?=$i?>" <?=($userent['scope'] == "system" ? 'disabled="disabled"' : '')?>/>

				</td>

				<td>

	if($userent['scope'] != "user")

		$usrimg = 'eye-open';

	else

		$usrimg = 'user';

?>

					<?=htmlspecialchars($userent['name'])?>

				</td>

				<td><?=htmlspecialchars($userent['descr'])?></td>

				<td><?php if(isset($userent['disabled'])) echo "*"?></td>

				<td><?=implode(",",local_user_get_groups($userent))?></td>

				<td>

					<a href="?act=edit&amp;userid=<?=$i?>" class="btn btn-xs btn-primary">edit</a>

			</tr>

	</table>

<nav class="action-buttons">

	<a href="?act=new" class="btn btn-success">add new</a>

</nav>

	<?=gettext("Additional users can be added here. User permissions for accessing " .

	"the webConfigurator can be assigned directly or inherited from group memberships. " .

	"An icon that appears grey indicates that it is a system defined object. " .

	"Some system object properties can be modified but they cannot be deleted.")?>

	<br /><br />

	<?=gettext("Accounts created here are also used for other parts of the system " .

	"such as OpenVPN, IPsec, and Captive Portal.")?>

</p>

<?php

	include("foot.inc");

	exit;

}

		'act',

		null,

		'hidden',

		''

	));

		'userid',

		null,

		'hidden',

		isset($id) ? $id:''

	));

		'privid',

		null,

		'hidden',

		''

	));

		'certid',

		null,

		'hidden',

		''

	));

	if ($pconfig['utype'] == "system") {

		$ro = "readonly=\"readonly\"";

	}

		'Defined by',

		strtoupper($pconfig['utype'])

	));

		'utype',

		null,

		'hidden',

		$pconfig['utype']

	));

		'disabled',

		'Disabled',

		'This user cannot login',

		$pconfig['disabled']

	));

		'usernamefld',

		'Username',

		'text',

		$pconfig['usernamefld']

	));

	$form->addGlobal(new Form_Input(

		'oldusername',

		$pconfig['usernamefld']

	$group->add(new Form_Input(

		'passwordfld1',

		'Password',

		'password'

	));

	$group->add(new Form_Input(

		'passwordfld2',

		'Confirm Password',

		'password'

	));

	$section->add($group);

	$section->addInput($input = new Form_Input(

		'descr',

		'Full name',

		'text',

		htmlspecialchars($pconfig['descr'])

	))->setHelp('User\'s full name, for your own information only');

	if ($ro)

		$input->setDisabled();

	$section->addInput(new Form_Input(

		'expires',

		'Expiration date',

		'date',

		$pconfig['expires']

	))->setHelp('Leave blank if the account shouldn\'t expire, otherwise enter '.

		'the expiration date');

	// ==== Group membership ==================================================

	$group = new Form_Group('Group membership');

	$systemGroups = array();

	$usersGroups = array();

	$usergid = [$pconfig['usernamefld']];

	foreach ($config['system']['group'] as $Ggroup) {

			if(($act == 'edit') && $Ggroup['member'] && in_array($pconfig['uid'], $Ggroup['member']))

				$usersGroups[ $Ggroup['name'] ] = $Ggroup['name'];	// Add it to the user's list

			else

				$systemGroups[ $Ggroup['name'] ] = $Ggroup['name']; // Add it to the 'not a member of' list

		}

	$group->add(new Form_Select(

		'sysgroups',

		null,

		array_combine((array)$pconfig['groups'], (array)$pconfig['groups']),

		$systemGroups,

		true

	))->setHelp('Not member of');