From bc50ada7d9aa64535f50a266a159e83b26bf8a67 Mon Sep 17 00:00:00 2001
From: BlackLight <blacklight@autistici.org>
Date: Fri, 7 Jan 2011 18:07:17 +0100
Subject: [PATCH] userdel implemented

---
 commands/userdel.json   | 45 +++++++++++++++++++++
 modules/users/users.php | 90 ++++++++++++++++++++++++++++++++++++++---
 system/blash.json       |  1 +
 system/files_json.php   |  4 +-
 4 files changed, 133 insertions(+), 7 deletions(-)
 create mode 100644 commands/userdel.json

diff --git a/commands/userdel.json b/commands/userdel.json
new file mode 100644
index 0000000..7dfc21d
--- /dev/null
+++ b/commands/userdel.json
@@ -0,0 +1,45 @@
+{
+	"name" : "userdel",
+
+	"info" : {
+		"syntax" : "userdel &lt;username&gt;",
+		"brief" : "Remove a username from the system",
+	},
+
+	"action" : function ( arg )
+	{
+		if ( !arg || arg.length == 0 )
+		{
+			return "Usage: " + this.info.syntax + "<br/>\n";
+		}
+
+		shell.auto_prompt_refresh = false;
+
+		var users_php = window.location.href;
+		users_php = users_php.replace ( /\/([a-zA-Z\.]+)$/, '/modules/users/users.php' );
+		params = 'action=del&user=' + escape ( arg );
+
+		var http = new XMLHttpRequest();
+		http.open ( "POST", users_php, true );
+		http.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
+		http.setRequestHeader("Content-length", params.length);
+		http.setRequestHeader("Connection", "close");
+
+		http.onreadystatechange = function ()
+		{
+			if ( http.readyState == 4 && http.status == 200 )
+			{
+				if ( http.responseText.length > 0 )
+				{
+					shell.cmdOut.innerHTML = http.responseText;
+				}
+
+				shell.auto_prompt_refresh = true;
+				shell.refreshPrompt ( false, false );
+			}
+		}
+
+		http.send ( params );
+	}
+}
+
diff --git a/modules/users/users.php b/modules/users/users.php
index 6879a44..8ed8479 100644
--- a/modules/users/users.php
+++ b/modules/users/users.php
@@ -70,13 +70,97 @@ switch ( $action )
 		$perms['can_write'] = $username;
 
 		$GLOBALS['sudo_cmd'] = true;
+
 		print __mkdir ( '/home/'.$username, $perms )."<br/>\n";
 		set_content ( '/home/'.$username.'/.blashrc', file_get_contents ( '../../system/default_blashrc.json' ));
+
+		include "../../system/files_json.php";
+
+		if ( !$files_json || strlen ( $files_json ) == 0 )
+		{
+			return 'Error: Empty JSON file container';
+		}
+
+		$json = json_decode ( $files_json, true );
+
+		if ( !$json )
+		{
+			return 'Error: Empty JSON file container';
+		}
+
+		for ( $i=0; $i < count ( $json ); $i++ )
+		{
+			if ( $json[$i]['path'] == '/home/'.$username.'/.blashrc' )
+			{
+				$json[$i]['can_read'] = $username;
+				$json[$i]['can_write'] = $username;
+
+				if ( !( $fp = fopen ( "../../system/files_json.php", "w" )))
+				{
+					return "Unable to write on directories file\n";
+				}
+
+				fwrite ( $fp, "<?php\n\n\$files_json = <<<JSON\n".__json_encode ( $json )."\nJSON;\n\n?>");
+				fclose ( $fp );
+
+				break;
+			}
+		}
+
 		$GLOBALS['sudo_cmd'] = false;
 
 		print 'User "'.$username.'" successfully added, home directory set to "/home/'.$username."\"\n";
 		break;
 
+	case 'del':
+		$user= $_REQUEST['user'];
+
+		if ( $user == null )
+		{
+			return false;
+		}
+
+		$cur_user = getUser();
+
+		if ( $cur_user != 'root' && $cur_user != $user && !$GLOBALS['sudo_cmd'] )
+		{
+			print "You cannot remove the specified user: Permission denied\n";
+			return false;
+		}
+
+		if ( !( $xml = new SimpleXMLElement ( $xmlcontent )))
+		{
+			print "Unable to open the users XML file\n";
+			return false;
+		}
+
+		$user_found = false;
+
+		for ( $i = 0; $i < count ( $xml->user ) && !$user_found; $i++ )
+		{
+			if ( !strcmp ( $xml->user[$i]['name'], $user ))
+			{
+				unset ( $xml->user[$i] );
+				$user_found = true;
+			}
+		}
+
+		if ( !$user_found )
+		{
+			print "Username not found\n";
+			return false;
+		}
+
+		if ( !( $fp = fopen ( 'userlist.php', 'w' )))
+		{
+			print "Unable to add the specified user, unknown error\n";
+			return false;
+		}
+
+		fwrite ( $fp, '<?php'."\n\n".'$xmlcontent = <<<XML'."\n" . $xml->asXML() . "\nXML;\n\n?>\n" );
+		fclose ( $fp );
+		break;
+
 	case 'login':
 		$username = $_REQUEST['user'];
 		$password = $_REQUEST['pass'];
@@ -265,12 +349,6 @@ switch ( $action )
 		}
 
 		print set_content ( $file, $content );
-
-		// If this was a sudo command, for example for creating .blashrc file,
-		// revoke sudo permissions now
-		if ( $GLOBALS['sudo_cmd'] == true )
-			$GLOBALS['sudo_cmd'] = false;
-
 		break;
 
 	default :
diff --git a/system/blash.json b/system/blash.json
index 3aec8c6..815d0ee 100644
--- a/system/blash.json
+++ b/system/blash.json
@@ -73,6 +73,7 @@
 		"su",
 		"touch",
 		"useradd",
+		"userdel",
 		"whoami"
 	]
 }
diff --git a/system/files_json.php b/system/files_json.php
index d46a403..b7b5445 100644
--- a/system/files_json.php
+++ b/system/files_json.php
@@ -29,8 +29,10 @@ $files_json = <<<JSON
 , {"path": "/contacts", "type": "file", "content": "Contact me at spam@montypython.com"}
 , {"path": "/irc", "type": "file", "content": "IRC channel at #thegame@irc.randomstuff.com"}
 , {"path": "/root", "type": "directory", "can_write": "root", "can_read": "root"}
+, {"path": "/home/blacklight", "type": "directory", "owner": "blacklight", "can_read": "blacklight", "can_write": "blacklight"}
+, {"path": "/home/blacklight/.blashrc", "type": "file", "owner": "guest", "can_read": "blacklight", "can_write": "blacklight", "content": "/**<br/> * Sample configuration and contents<br/> */<br/><br/>{<br/>\u0009'banner' : 'Welcome back to blash&lt;br/&gt;&lt;br/&gt;',<br/>\u0009'machine' : 'localhost',<br/><br/>\u0009/**<br/>\u0009 * Macros for promptText:<br/>\u0009 * #{xxx} or #{xxxxxx} - use the specified HTML colour<br/>\u0009 * %n - username<br/>\u0009 * %m - machine name<br/>\u0009 * %W - current working directory<br/>\u0009 */<br/>\u0009'promptText' : '[#{008}%n#{888}@#{008}%m#{888} %W] $ '<br/>}<br/><br/>"}
 ]
 
 JSON;
 
-?>
+?>
\ No newline at end of file