21use Luracast\Restler\RestException;
23require_once DOL_DOCUMENT_ROOT.
'/user/class/user.class.php';
24require_once DOL_DOCUMENT_ROOT.
'/user/class/usergroup.class.php';
38 public static $FIELDS = array(
55 $this->useraccount =
new User($this->db);
74 public function index($sortfield =
"t.rowid", $sortorder =
'ASC', $limit = 100, $page = 0, $user_ids =
'0', $category = 0, $sqlfilters =
'', $properties =
'')
76 if (!DolibarrApiAccess::$user->hasRight(
'user',
'user',
'lire') && empty(DolibarrApiAccess::$user->admin)) {
77 throw new RestException(403,
"You are not allowed to read list of users");
85 $sql =
"SELECT t.rowid";
86 $sql .=
" FROM ".MAIN_DB_PREFIX.
"user AS t LEFT JOIN ".MAIN_DB_PREFIX.
"user_extrafields AS ef ON (ef.fk_object = t.rowid)";
88 $sql .=
", ".$this->db->prefix().
"categorie_user as c";
90 $sql .=
' WHERE t.entity IN ('.getEntity(
'user').
')';
92 $sql .=
" AND t.rowid IN (".$this->db->sanitize($user_ids).
")";
97 $sql .=
" AND c.fk_categorie = ".((int) $category);
98 $sql .=
" AND c.fk_user = t.rowid";
106 throw new RestException(400,
'Error when validating parameter sqlfilters -> '.$errormessage);
110 $sql .= $this->db->order($sortfield, $sortorder);
115 $offset = $limit * $page;
117 $sql .= $this->db->plimit($limit + 1, $offset);
120 $result = $this->db->query($sql);
124 $num = $this->db->num_rows($result);
125 $min = min($num, ($limit <= 0 ? $num : $limit));
127 $obj = $this->db->fetch_object($result);
128 $user_static =
new User($this->db);
129 if ($user_static->fetch($obj->rowid)) {
135 throw new RestException(503,
'Error when retrieve User list : '.$this->db->lasterror());
151 public function get($id, $includepermissions = 0)
153 if (!DolibarrApiAccess::$user->hasRight(
'user',
'user',
'lire') && empty(DolibarrApiAccess::$user->admin) && $id != 0 && DolibarrApiAccess::$user->id != $id) {
154 throw new RestException(403,
'Not allowed');
158 $result = $this->useraccount->initAsSpecimen();
160 $result = $this->useraccount->fetch($id);
163 throw new RestException(404,
'User not found');
167 throw new RestException(403,
'Access not allowed for login '.DolibarrApiAccess::$user->login);
170 if ($includepermissions) {
171 $this->useraccount->getRights();
193 throw new RestException(400,
'Bad parameters');
196 if (!DolibarrApiAccess::$user->hasRight(
'user',
'user',
'lire') && empty(DolibarrApiAccess::$user->admin) && DolibarrApiAccess::$user->login != $login) {
197 throw new RestException(403,
'Not allowed');
200 $result = $this->useraccount->fetch(
'', $login);
202 throw new RestException(404,
'User not found');
206 throw new RestException(403,
'Access not allowed for login '.DolibarrApiAccess::$user->login);
209 if ($includepermissions) {
210 $this->useraccount->getRights();
232 throw new RestException(400,
'Bad parameters');
235 if (!DolibarrApiAccess::$user->hasRight(
'user',
'user',
'lire') && empty(DolibarrApiAccess::$user->admin) && DolibarrApiAccess::$user->email != $email) {
236 throw new RestException(403,
'Not allowed');
239 $result = $this->useraccount->fetch(
'',
'',
'', 0, -1, $email);
241 throw new RestException(404,
'User not found');
245 throw new RestException(403,
'Access not allowed for login '.DolibarrApiAccess::$user->login);
248 if ($includepermissions) {
249 $this->useraccount->getRights();
266 public function getInfo($includepermissions = 0)
268 if (!DolibarrApiAccess::$user->hasRight(
'user',
'self',
'creer') && !DolibarrApiAccess::$user->hasRight(
'user',
'user',
'lire') && empty(DolibarrApiAccess::$user->admin)) {
269 throw new RestException(403,
'Not allowed');
272 $apiUser = DolibarrApiAccess::$user;
274 $result = $this->useraccount->fetch($apiUser->id);
276 throw new RestException(404,
'User not found');
280 throw new RestException(403,
'Access not allowed for login '.DolibarrApiAccess::$user->login);
283 if ($includepermissions) {
284 $this->useraccount->getRights();
288 $userGroupList = $usergroup->listGroupsForUser($apiUser->id,
false);
289 if (!is_array($userGroupList)) {
290 throw new RestException(404,
'User group not found');
306 public function post($request_data =
null)
309 if (!DolibarrApiAccess::$user->hasRight(
'user',
'creer') && empty(DolibarrApiAccess::$user->admin)) {
310 throw new RestException(403,
"User creation not allowed for login ".DolibarrApiAccess::$user->login);
322 foreach ($request_data as $field => $value) {
323 if (in_array($field, array(
'pass_crypted',
'pass_indatabase',
'pass_indatabase_crypted',
'pass_temp',
'api_key'))) {
325 throw new RestException(405,
'The property '.$field.
" can't be set/modified using the APIs");
327 if ($field ===
'caller') {
329 $this->useraccount->context[
'caller'] =
sanitizeVal($request_data[
'caller'],
'aZ09');
340 $this->useraccount->$field = $this->
_checkValForAPI($field, $value, $this->useraccount);
343 if ($this->useraccount->create(DolibarrApiAccess::$user) < 0) {
344 throw new RestException(500,
'Error creating', array_merge(array($this->useraccount->error), $this->useraccount->errors));
346 return $this->useraccount->id;
361 public function put($id, $request_data =
null)
364 if (!DolibarrApiAccess::$user->hasRight(
'user',
'user',
'creer') && empty(DolibarrApiAccess::$user->admin)) {
365 throw new RestException(403,
"User update not allowed");
368 $result = $this->useraccount->fetch($id);
370 throw new RestException(404,
'Account not found');
374 throw new RestException(403,
'Access not allowed for login '.DolibarrApiAccess::$user->login);
377 foreach ($request_data as $field => $value) {
378 if (in_array($field, array(
'pass_crypted',
'pass_indatabase',
'pass_indatabase_crypted',
'pass_temp',
'api_key'))) {
380 throw new RestException(405,
'The property '.$field.
" can't be set/modified using the APIs");
382 if ($field ==
'id') {
385 if ($field ==
'pass') {
386 if ($this->useraccount->id != DolibarrApiAccess::$user->id && !DolibarrApiAccess::$user->hasRight(
'user',
'user',
'password')) {
387 throw new RestException(403,
'You are not allowed to modify password of other users');
389 if ($this->useraccount->id == DolibarrApiAccess::$user->id && !DolibarrApiAccess::$user->hasRight(
'user',
'self',
'password')) {
390 throw new RestException(403,
'You are not allowed to modify your own password');
393 if ($field ===
'caller') {
395 $this->useraccount->context[
'caller'] =
sanitizeVal($request_data[
'caller'],
'aZ09');
399 if (DolibarrApiAccess::$user->admin) {
400 if ($field ==
'admin' && $value != $this->useraccount->admin && empty($value)) {
401 throw new RestException(403,
'Reseting the admin status of a user is not possible using the API');
404 if ($field ==
'admin' && $value != $this->useraccount->admin) {
405 throw new RestException(403,
'Only an admin user can modify the admin status of another user');
408 if ($field ==
'entity' && $value != $this->useraccount->entity) {
409 throw new RestException(403,
'Changing entity of a user using the APIs is not possible');
414 if ($field ==
'statut' || $field ==
'status') {
415 $result = $this->useraccount->setstatus($value);
417 throw new RestException(500,
'Error when updating status of user: '.$this->useraccount->error);
420 $this->useraccount->$field = $this->
_checkValForAPI($field, $value, $this->useraccount);
426 if ($this->useraccount->update(DolibarrApiAccess::$user) >= 0) {
427 return $this->
get($id);
429 throw new RestException(500, $this->useraccount->error);
447 if (!DolibarrApiAccess::$user->hasRight(
'user',
'user',
'lire') && empty(DolibarrApiAccess::$user->admin)) {
448 throw new RestException(403);
451 $user =
new User($this->db);
452 $result = $user->fetch($id);
454 throw new RestException(404,
'user not found');
458 $groups = $usergroup->listGroupsForUser($id,
false);
460 foreach ($groups as $group) {
485 if (!DolibarrApiAccess::$user->hasRight(
'user',
'user',
'creer') && empty(DolibarrApiAccess::$user->admin)) {
486 throw new RestException(403);
489 $result = $this->useraccount->fetch($id);
491 throw new RestException(404,
'User not found');
495 throw new RestException(403,
'Access not allowed for login '.DolibarrApiAccess::$user->login);
498 if (isModEnabled(
'multicompany') &&
getDolGlobalString(
'MULTICOMPANY_TRANSVERSE_MODE') && !empty(DolibarrApiAccess::$user->admin) && empty(DolibarrApiAccess::$user->entity)) {
499 $entity = (!empty($entity) ? $entity : $conf->entity);
503 $entity = (DolibarrApiAccess::$user->entity > 0 ? DolibarrApiAccess::$user->entity : $conf->entity);
506 $result = $this->useraccount->SetInGroup($group, $entity);
507 if (!($result > 0)) {
508 throw new RestException(500, $this->useraccount->error);
534 public function listGroups($sortfield =
"t.rowid", $sortorder =
'ASC', $limit = 100, $page = 0, $group_ids =
'0', $sqlfilters =
'', $properties =
'')
540 if ((!
getDolGlobalString(
'MAIN_USE_ADVANCED_PERMS') && !DolibarrApiAccess::$user->hasRight(
'user',
'user',
'lire') && empty(DolibarrApiAccess::$user->admin)) ||
541 getDolGlobalString(
'MAIN_USE_ADVANCED_PERMS') && !DolibarrApiAccess::$user->hasRight(
'user',
'group_advance',
'read') && empty(DolibarrApiAccess::$user->admin)) {
542 throw new RestException(403,
"You are not allowed to read groups");
548 $sql =
"SELECT t.rowid";
549 $sql .=
" FROM ".MAIN_DB_PREFIX.
"usergroup AS t LEFT JOIN ".MAIN_DB_PREFIX.
"usergroup_extrafields AS ef ON (ef.fk_object = t.rowid)";
550 $sql .=
' WHERE t.entity IN ('.getEntity(
'user').
')';
552 $sql .=
" AND t.rowid IN (".$this->db->sanitize($group_ids).
")";
559 throw new RestException(400,
'Error when validating parameter sqlfilters -> '.$errormessage);
563 $sql .= $this->db->order($sortfield, $sortorder);
568 $offset = $limit * $page;
570 $sql .= $this->db->plimit($limit + 1, $offset);
573 $result = $this->db->query($sql);
577 $num = $this->db->num_rows($result);
578 $min = min($num, ($limit <= 0 ? $num : $limit));
580 $obj = $this->db->fetch_object($result);
581 $group_static =
new UserGroup($this->db);
582 if ($group_static->fetch($obj->rowid)) {
588 throw new RestException(503,
'Error when retrieve Group list : '.$this->db->lasterror());
612 if ((!
getDolGlobalString(
'MAIN_USE_ADVANCED_PERMS') && !DolibarrApiAccess::$user->hasRight(
'user',
'user',
'lire') && empty(DolibarrApiAccess::$user->admin)) ||
613 getDolGlobalString(
'MAIN_USE_ADVANCED_PERMS') && !DolibarrApiAccess::$user->hasRight(
'user',
'group_advance',
'read') && empty(DolibarrApiAccess::$user->admin)) {
614 throw new RestException(403,
"You are not allowed to read groups");
617 $group_static =
new UserGroup($this->db);
618 $result = $group_static->fetch($group,
'', $load_members);
621 throw new RestException(404,
'Group not found');
636 public function delete($id)
638 if (!DolibarrApiAccess::$user->hasRight(
'user',
'user',
'supprimer') && empty(DolibarrApiAccess::$user->admin)) {
639 throw new RestException(403,
'Not allowed');
641 $result = $this->useraccount->fetch($id);
643 throw new RestException(404,
'User not found');
647 throw new RestException(403,
'Access not allowed for login '.DolibarrApiAccess::$user->login);
649 $this->useraccount->oldcopy = clone $this->useraccount;
651 if (!$this->useraccount->delete(DolibarrApiAccess::$user)) {
652 throw new RestException(500);
658 'message' =>
'Ticket deleted'
677 unset(
$object->default_values);
678 unset(
$object->lastsearch_values);
679 unset(
$object->lastsearch_values_tmp);
683 unset(
$object->total_localtax1);
684 unset(
$object->total_localtax2);
687 unset(
$object->label_incoterms);
688 unset(
$object->location_incoterms);
690 unset(
$object->fk_delivery_address);
692 unset(
$object->all_permissions_are_loaded);
693 unset(
$object->shipping_method_id);
697 unset(
$object->clicktodial_loaded);
701 unset(
$object->pass_indatabase);
702 unset(
$object->pass_indatabase_crypted);
705 unset(
$object->clicktodial_password);
711 $canreadsalary = ((isModEnabled(
'salaries') && DolibarrApiAccess::$user->hasRight(
'salaries',
'read')) || !isModEnabled(
'salaries'));
713 if (!$canreadsalary) {
731 $cleanObjectList = array();
733 foreach ($objectList as
$object) {
734 $cleanObject = parent::_cleanObjectDatas(
$object);
736 unset($cleanObject->default_values);
737 unset($cleanObject->lastsearch_values);
738 unset($cleanObject->lastsearch_values_tmp);
740 unset($cleanObject->total_ht);
741 unset($cleanObject->total_tva);
742 unset($cleanObject->total_localtax1);
743 unset($cleanObject->total_localtax2);
744 unset($cleanObject->total_ttc);
746 unset($cleanObject->libelle_incoterms);
747 unset($cleanObject->location_incoterms);
749 unset($cleanObject->fk_delivery_address);
750 unset($cleanObject->fk_incoterms);
751 unset($cleanObject->all_permissions_are_loaded);
752 unset($cleanObject->shipping_method_id);
753 unset($cleanObject->nb_rights);
754 unset($cleanObject->search_sid);
755 unset($cleanObject->ldap_sid);
756 unset($cleanObject->clicktodial_loaded);
758 unset($cleanObject->datec);
759 unset($cleanObject->tms);
760 unset($cleanObject->members);
761 unset($cleanObject->note);
762 unset($cleanObject->note_private);
764 $cleanObjectList[] = $cleanObject;
767 return $cleanObjectList;
780 foreach (Users::$FIELDS as $field) {
781 if (!isset($data[$field])) {
782 throw new RestException(400,
"$field field missing");
784 $account[$field] = $data[$field];
if( $user->socid > 0) if(! $user->hasRight('accounting', 'chartofaccount')) $object
_filterObjectProperties($object, $properties)
Filter properties that will be returned on object.
static _checkAccessToResource($resource, $resource_id=0, $dbtablename='', $feature2='', $dbt_keyfield='fk_soc', $dbt_select='rowid')
Check access by user to a given resource.
_checkValForAPI($field, $value, $object)
Check and convert a string depending on its type/name.
Class to manage user groups.
Class to manage Dolibarr users.
put($id, $request_data=null)
Update user account.
listGroups($sortfield="t.rowid", $sortorder='ASC', $limit=100, $page=0, $group_ids='0', $sqlfilters='', $properties='')
List Groups.
index($sortfield="t.rowid", $sortorder='ASC', $limit=100, $page=0, $user_ids='0', $category=0, $sqlfilters='', $properties='')
List Users.
_cleanObjectDatas($object)
Clean sensible object datas.
getInfo($includepermissions=0)
Get more properties of a user.
_cleanUserGroupListDatas($objectList)
Clean sensible user group list datas.
setGroup($id, $group, $entity=1)
Add a user into a group.
infoGroups($group, $load_members=0)
Get properties of an group object.
_validate($data)
Validate fields before create or update object.
getByEmail($email, $includepermissions=0)
Get properties of an user object by Email.
getGroups($id)
List the groups of a user.
post($request_data=null)
Create user account.
getByLogin($login, $includepermissions=0)
Get properties of an user object by login.
__construct()
Constructor.
forgeSQLFromUniversalSearchCriteria($filter, &$errorstr='', $noand=0, $nopar=0, $noerror=0)
forgeSQLFromUniversalSearchCriteria
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
sanitizeVal($out='', $check='alphanohtml', $filter=null, $options=null)
Return a sanitized or empty value after checking value against a rule.