diff --git a/include/functions.inc b/include/functions.inc
index c9c3046..e057f69 100644
--- a/include/functions.inc
+++ b/include/functions.inc
@@ -36,7 +36,6 @@ function head($title="", $config = []) {
["href" => "/manage/event.php", "text" => "Events"],
["href" => "/manage/users.php", "text" => "Users"],
["href" => "/manage/user-notes.php", "text" => "Notes"],
- ["href" => "/manage/github.php", "text" => "Github"],
];
$CSS = ["/styles/master.css"];
$SEARCH = [];
@@ -258,6 +257,11 @@ function find_group_address_from_notes_for($id) {
define("MT_USER_APPROVE_MAIL", "group@php.net");
define("MT_USER_REMOVE_MAIL", "group@php.net");
function user_approve($id) {
+ if (!is_admin($_SESSION["username"])) {
+ warn("you're not allowed to take actions on users.");
+ exit;
+ }
+
$res = db_query_safe("UPDATE users SET cvsaccess=1, enable=1 WHERE userid=?", [$id]);
if ($res && mysql_affected_rows()) {
$cc = find_group_address_from_notes_for($id);
@@ -284,6 +288,10 @@ function user_approve($id) {
}
function user_remove($id) {
+ if (!is_admin($_SESSION["username"])) {
+ warn("you're not allowed to take actions on users.");
+ exit;
+ }
$userinfo = fetch_user($id);
$res = db_query_safe("DELETE FROM users WHERE userid=?", [$id]);
if ($res && mysql_affected_rows()) {
@@ -313,6 +321,21 @@ function user_remove($id) {
}
}
+function user_unlink_github($id) {
+ $db = DB::connect();
+
+ if(!can_modify($_SESSION['username'], $id)) {
+ warn("you're not allowed to take actions on users.");
+ exit;
+ }
+
+ $query = $db->prepare('UPDATE users SET github = ? WHERE userid = ?');
+ $query->execute([null, (int)$id]);
+
+ warn("record $id updated");
+ exit;
+}
+
function is_admin($user) {
$admins = [
"jimw",
@@ -428,6 +451,7 @@ function validateAction($k) {
switch($k) {
case "approve":
case "remove":
+ case "github_unlink":
return $k;
default:
warn("that action ('" . hsc($k) . "') is not understood.");
diff --git a/public/manage/github.php b/public/manage/github.php
index d340be2..c7bd692 100644
--- a/public/manage/github.php
+++ b/public/manage/github.php
@@ -1,176 +1,65 @@
- $options]);
-
- $url = 'https://api.github.com'.$endpoint;
- $s = @file_get_contents($url, false, $ctxt);
- if ($s === false) {
- die('Request to GitHub failed. Endpoint: '.$endpoint);
- }
-
- return json_decode($s);
+$oauth = new OAuthClient(GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET);
+if (!isset($_GET['code'])) {
+ header('Location: ' . $oauth->getRequestCodeUrl());
+ exit;
}
-function github_current_user($access_token = false)
-{
- if (!$access_token) {
- $access_token = $_SESSION['github']['access_token'];
- }
+head("github administration");
- if (empty($_SESSION['github']['current_user'])) {
- $user = github_api('/user?access_token='.urlencode($access_token));
- if (!$user->login) {
- die('Failed to get current user');
- }
+try {
+ if (isset($_GET['code'])) {
+ $response = $oauth->requestAccessToken($_GET['code']);
+ if (!isset($response['access_token'])) {
+ throw new RuntimeException('Can not receive the access token');
+ }
- $_SESSION['github']['current_user'] = $user;
- }
+ $client = new Client($response['access_token']);
+ $user = $client->me();
- return $_SESSION['github']['current_user'];
-}
+ if (!isset($user['login'])) {
+ throw new RuntimeException('Can not get the user GitHub login');
+ }
-function github_require_valid_user()
-{
- if (isset($_SESSION['github']['access_token'])) {
- return true;
- }
+ $username = $_SESSION['credentials'][0];
- if (isset($_GET['code'])) {
- $data = [
- 'client_id' => GITHUB_CLIENT_ID,
- 'client_secret' => GITHUB_CLIENT_SECRET,
- 'code' => $_GET['code']
- ];
- $data_encoded = http_build_query($data);
- $opts = [
- 'method' => 'POST',
- 'user_agent' => GITHUB_USER_AGENT,
- 'header' => 'Content-type: application/x-www-form-urlencoded',
- 'content' => $data_encoded,
- ];
- $ctxt = stream_context_create(['http' => $opts]);
- $s = @file_get_contents('https://github.com/login/oauth/access_token', false, $ctxt);
- if (!$s) {
- die('Failed while checking with GitHub,either you are trying to hack us or our configuration is wrong (GITHUB_CLIENT_SECRET outdated?)');
- }
- $gh = [];
- parse_str($s, $gh);
- if (empty($gh['access_token'])) {
- die("GitHub responded but didn't send an access_token");
- }
+ $db = \App\DB::connect();
+ $query = $db->prepare('SELECT userid FROM users WHERE username = ?');
+ $query->execute([$username]);
+ if (!$query->rowCount()) {
+ throw new RuntimeException('was not able to find user matching ' . $username);
+ }
- $user = github_current_user($gh['access_token']);
+ $account = $query->fetch();
+ $query = $db->prepare('SELECT userid FROM users WHERE github = ? AND userid != ?');
+ $query->execute([$user['login'], $account['userid']]);
+ if ($query->rowCount() > 0) {
+ throw new RuntimeException('GitHub account ' . $user['login'] . ' is already linked');
+ }
- $endpoint = '/teams/'.urlencode((string)GITHUB_PHP_OWNER_TEAM_ID).'/members/'.urlencode($user->login);
- $opts = ['user_agent' => GITHUB_USER_AGENT];
- $ctxt = stream_context_create(['http' => $opts]);
- $is_member = file_get_contents('https://api.github.com'.$endpoint.'?access_token='.urlencode($gh['access_token']), false, $ctxt);
+ $query = $db->prepare('UPDATE users SET github = ? WHERE userid = ?');
+ $query->execute([$user['login'], $account['userid']]);
- if ($is_member === false) {
- head("github administration");
- echo 'You (Authenticated GitHub user: '.htmlentities($user->login). ') are no member of the php organization on github.
'.
- 'Please contact an existing member if you see need.
';
- foot();
- exit;
+ echo 'We linked your GitHub account with your profile.
' .
+ 'Back to profile
';
}
- // SUCCESS
- $_SESSION['github']['access_token'] = $gh['access_token'];
- header('Location: github.php');
- exit;
- }
-
- // Start oauth
- header('Location: https://github.com/login/oauth/authorize?scope=repo&client_id='.urlencode(GITHUB_CLIENT_ID));
- exit;
-}
-
-if (isset($_POST['description']) && isset($_SESSION['github']['access_token'])) {
- action_create_repo();
-} elseif (isset($_GET['login']) || isset($_GET['code']) || isset($_SESSION['github']['access_token'])) {
- action_form();
-} else {
- action_default();
-}
-
-function action_default()
-{
- head("github administration");
- echo 'This tool is for administrating PHP repos on GitHub. Currently it is used for adding repos only.
';
- echo 'NOTE: Only members of the PHP organisation on GitHub can use this tool. We try to keep the number of members limited.
';
- echo 'In case you are a member you can login using GitHub.
';
- foot();
-}
-
-function action_form()
-{
- github_require_valid_user();
- $user = $_SESSION['github']['current_user'];
- head("github administration");
-?>
-GitHub user: login); ?>
-Creating a GitHub repo using this form ensures the proper configuration. This
-includes disabling the GitHub wiki and issue tracker as well as enabling the
-php-pulls user to push changes made on git.php.net.
-The name, description and homepage should follow other existing repositories.
-