From 4f2bea5cb1f4f78649d547d318cc65b11230fee2 Mon Sep 17 00:00:00 2001
From: nupplaPhil <admin+github@philipp.info>
Date: Fri, 21 Feb 2020 23:31:37 +0100
Subject: [PATCH] Move "regmod" functionality into Admin Users page

---
 mod/regmod.php                               | 59 --------------------
 src/Module/Admin/Users.php                   | 12 +++-
 view/templates/admin/users.tpl               |  4 +-
 view/theme/frio/templates/admin/users.tpl    |  4 +-
 view/theme/quattro/templates/admin/users.tpl |  4 +-
 5 files changed, 16 insertions(+), 67 deletions(-)
 delete mode 100644 mod/regmod.php

diff --git a/mod/regmod.php b/mod/regmod.php
deleted file mode 100644
index 6a31a356a..000000000
--- a/mod/regmod.php
+++ /dev/null
@@ -1,59 +0,0 @@
-<?php
-/**
- * @copyright Copyright (C) 2020, Friendica
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program.  If not, see <https://www.gnu.org/licenses/>.
- *
- */
-
-use Friendica\App;
-use Friendica\DI;
-use Friendica\Model\User;
-use Friendica\Module\Security\Login;
-
-function regmod_content(App $a)
-{
-	if (!local_user()) {
-		info(DI::l10n()->t('Please login.'));
-		return Login::form(DI::args()->getQueryString(), intval(DI::config()->get('config', 'register_policy')) === \Friendica\Module\Register::CLOSED ? 0 : 1);
-	}
-
-	if (!is_site_admin() || !empty($_SESSION['submanage'])) {
-		notice(DI::l10n()->t('Permission denied.'));
-		return '';
-	}
-
-	if ($a->argc != 3) {
-		exit();
-	}
-
-	$cmd = $a->argv[1];
-	$hash = $a->argv[2];
-
-	if ($cmd === 'deny') {
-		if (User::deny($hash)) {
-			notice(DI::l10n()->t('Registration revoked'));
-		}
-		DI::baseUrl()->redirect('admin/users/');
-	}
-
-	if ($cmd === 'allow') {
-		if (User::allow($hash)) {
-			info(DI::l10n()->t('Account approved.'));
-		}
-		DI::baseUrl()->redirect('admin/users/');
-	}
-}
diff --git a/src/Module/Admin/Users.php b/src/Module/Admin/Users.php
index d8594695d..07363b732 100644
--- a/src/Module/Admin/Users.php
+++ b/src/Module/Admin/Users.php
@@ -79,7 +79,6 @@ class Users extends BaseAdmin
 		}
 
 		if (!empty($_POST['page_users_approve'])) {
-			require_once 'mod/regmod.php';
 			foreach ($pending as $hash) {
 				if (User::allow($hash)) {
 					info(DI::l10n()->t('Account approved.'));
@@ -88,7 +87,6 @@ class Users extends BaseAdmin
 		}
 
 		if (!empty($_POST['page_users_deny'])) {
-			require_once 'mod/regmod.php';
 			foreach ($pending as $hash) {
 				if (User::deny($hash)) {
 					notice(DI::l10n()->t('Registration revoked'));
@@ -138,6 +136,16 @@ class Users extends BaseAdmin
 					User::block($uid, false);
 					notice(DI::l10n()->t('User "%s" unblocked', $user['username']));
 					break;
+				case 'allow':
+					parent::checkFormSecurityTokenRedirectOnError('/admin/users', 'admin_users', 't');
+					User::allow(Register::getPendingForUser($uid)['hash'] ?? '');
+					notice(DI::l10n()->t('Account approved.'));
+					break;
+				case 'deny':
+					parent::checkFormSecurityTokenRedirectOnError('/admin/users', 'admin_users', 't');
+					User::deny(Register::getPendingForUser($uid)['hash'] ?? '');
+					notice(DI::l10n()->t('Registration revoked'));
+					break;
 			}
 
 			DI::baseUrl()->redirect('admin/users');
diff --git a/view/templates/admin/users.tpl b/view/templates/admin/users.tpl
index 6ca85fe7a..8bbffbb7d 100644
--- a/view/templates/admin/users.tpl
+++ b/view/templates/admin/users.tpl
@@ -35,8 +35,8 @@
 					<td class="email">{{$u.email}}</td>
 					<td class="checkbox"><input type="checkbox" class="pending_ckbx" id="id_pending_{{$u.hash}}" name="pending[]" value="{{$u.hash}}" /></td>
 					<td class="tools">
-						<a href="{{$baseurl}}/regmod/allow/{{$u.hash}}" title='{{$approve}}'><span class='icon like'></span></a>
-						<a href="{{$baseurl}}/regmod/deny/{{$u.hash}}" title='{{$deny}}'><span class='icon dislike'></span></a>
+						<a href="{{$baseurl}}/admin/users/allow/{{$u.uid}}?t={{$form_security_token}}" title='{{$approve}}'><span class='icon like'></span></a>
+						<a href="{{$baseurl}}/admin/users/deny/{{$u.uid}}?t={{$form_security_token}}" title='{{$deny}}'><span class='icon dislike'></span></a>
 					</td>
 				</tr>
 				<tr>
diff --git a/view/theme/frio/templates/admin/users.tpl b/view/theme/frio/templates/admin/users.tpl
index 256d5cdae..a9c5f003e 100644
--- a/view/theme/frio/templates/admin/users.tpl
+++ b/view/theme/frio/templates/admin/users.tpl
@@ -49,8 +49,8 @@
 								<td>{{$u.name}}</td>
 								<td>{{$u.email}}</td>
 								<td>
-									<a href="{{$baseurl}}/regmod/allow/{{$u.hash}}" class="admin-settings-action-link" title="{{$approve}}"><i class="fa fa-check" aria-hidden="true"></i></a>
-									<a href="{{$baseurl}}/regmod/deny/{{$u.hash}}" class="admin-settings-action-link" title="{{$deny}}"><i class="fa fa-trash-o" aria-hidden="true"></i></a>
+									<a href="{{$baseurl}}/admin/users/allow/{{$u.uid}}?t={{$form_security_token}}" class="admin-settings-action-link" title="{{$approve}}"><i class="fa fa-check" aria-hidden="true"></i></a>
+									<a href="{{$baseurl}}/admin/users/deny/{{$u.uid}}?t={{$form_security_token}}" class="admin-settings-action-link" title="{{$deny}}"><i class="fa fa-trash-o" aria-hidden="true"></i></a>
 								</td>
 							</tr>
 							{{if $u.note}}
diff --git a/view/theme/quattro/templates/admin/users.tpl b/view/theme/quattro/templates/admin/users.tpl
index 97875a077..bd4e63ec7 100644
--- a/view/theme/quattro/templates/admin/users.tpl
+++ b/view/theme/quattro/templates/admin/users.tpl
@@ -35,8 +35,8 @@
 					<td class="email">{{$u.email}}</td>
 					<td class="checkbox"><input type="checkbox" class="pending_ckbx" id="id_pending_{{$u.hash}}" name="pending[]" value="{{$u.hash}}" /></td>
 					<td class="tools">
-						<a href="{{$baseurl}}/regmod/allow/{{$u.hash}}" title='{{$approve}}'><span class='icon like'></span></a>
-						<a href="{{$baseurl}}/regmod/deny/{{$u.hash}}" title='{{$deny}}'><span class='icon dislike'></span></a>
+						<a href="{{$baseurl}}/admin/users/allow/{{$u.uid}}?t={{$form_security_token}}" title='{{$approve}}'><span class='icon like'></span></a>
+						<a href="{{$baseurl}}/admin/users/deny/{{$u.uid}}?t={{$form_security_token}}" title='{{$deny}}'><span class='icon dislike'></span></a>
 					</td>
 				</tr>
 				<tr>