/**
 * This populates an option list with the appropriate users by access level
 * @todo from print_reporter_option_list
 * @param integer|array $p_user_id    A user identifier or a list of them.
 * @param integer       $p_project_id A project identifier.
 * @param integer       $p_access     An access level.
 * @return void
 */
function print_user_option_list($p_user_id, $p_project_id = null, $p_access = ANYBODY)
{
    $t_current_user = auth_get_current_user_id();
    if (null === $p_project_id) {
        $p_project_id = helper_get_current_project();
    }
    if ($p_project_id === ALL_PROJECTS) {
        $t_projects = user_get_accessible_projects($t_current_user);
        # Get list of users having access level for all accessible projects
        $t_users = array();
        foreach ($t_projects as $t_project_id) {
            $t_project_users_list = project_get_all_user_rows($t_project_id, $p_access);
            # Do a 'smart' merge of the project's user list, into an
            # associative array (to remove duplicates)
            foreach ($t_project_users_list as $t_id => $t_user) {
                $t_users[$t_id] = $t_user;
            }
            # Clear the array to release memory
            unset($t_project_users_list);
        }
        unset($t_projects);
    } else {
        $t_users = project_get_all_user_rows($p_project_id, $p_access);
    }
    # Add the specified user ID to the list
    # If we have an array of user IDs, then we've been called from a filter
    # so don't add anything
    if (!is_array($p_user_id) && $p_user_id != NO_USER && !array_key_exists($p_user_id, $t_users)) {
        $t_row = user_get_row($p_user_id);
        if ($t_row === false) {
            # User doesn't exist - create a dummy record for display purposes
            $t_name = user_get_name($p_user_id);
            $t_row = array('id' => $p_user_id, 'username' => $t_name, 'realname' => $t_name);
        }
        $t_users[$p_user_id] = $t_row;
    }
    $t_display = array();
    $t_sort = array();
    $t_show_realname = ON == config_get('show_realname');
    $t_sort_by_last_name = ON == config_get('sort_by_last_name');
    foreach ($t_users as $t_key => $t_user) {
        $t_user_name = string_attribute($t_user['username']);
        $t_sort_name = utf8_strtolower($t_user_name);
        if ($t_show_realname && $t_user['realname'] != '') {
            $t_user_name = string_attribute($t_user['realname']);
            if ($t_sort_by_last_name) {
                $t_sort_name_bits = explode(' ', utf8_strtolower($t_user_name), 2);
                $t_sort_name = (isset($t_sort_name_bits[1]) ? $t_sort_name_bits[1] . ', ' : '') . $t_sort_name_bits[0];
            } else {
                $t_sort_name = utf8_strtolower($t_user_name);
            }
        }
        $t_display[] = $t_user_name;
        $t_sort[] = $t_sort_name;
    }
    array_multisort($t_sort, SORT_ASC, SORT_STRING, $t_users, $t_display);
    unset($t_sort);
    $t_count = count($t_users);
    for ($i = 0; $i < $t_count; $i++) {
        $t_row = $t_users[$i];
        echo '<option value="' . $t_row['id'] . '" ';
        check_selected($p_user_id, (int) $t_row['id']);
        echo '>' . $t_display[$i] . '</option>';
    }
}

require_api('html_api.php');
require_api('lang_api.php');
require_api('print_api.php');
require_api('project_api.php');
require_api('user_api.php');
form_security_validate('manage_proj_user_remove');
auth_reauthenticate();
$f_project_id = gpc_get_int('project_id');
$f_user_id = gpc_get_int('user_id', 0);
# We should check both since we are in the project section and an
#  admin might raise the first threshold and not realize they need
#  to raise the second
access_ensure_project_level(config_get('manage_project_threshold'), $f_project_id);
access_ensure_project_level(config_get('project_user_threshold'), $f_project_id);
if (0 == $f_user_id) {
    # Confirm with the user
    helper_ensure_confirmed(lang_get('remove_all_users_sure_msg'), lang_get('remove_all_users_button'));
    project_remove_all_users($f_project_id, access_get_project_level($f_project_id));
} else {
    # Don't allow removal of users from the project who have a higher access level than the current user
    access_ensure_project_level(access_get_project_level($f_project_id, $f_user_id), $f_project_id);
    $t_user = user_get_row($f_user_id);
    # Confirm with the user
    helper_ensure_confirmed(lang_get('remove_user_sure_msg') . '<br/>' . lang_get('username_label') . lang_get('word_separator') . $t_user['username'], lang_get('remove_user_button'));
    project_remove_user($f_project_id, $f_user_id);
}
form_security_purge('manage_proj_user_remove');
$t_redirect_url = 'manage_proj_edit_page.php?project_id=' . $f_project_id;
html_page_top(null, $t_redirect_url);
html_operation_successful($t_redirect_url);
html_page_bottom();

function user_get_field($p_user_id, $p_field_name)
{
    if (NO_USER == $p_user_id) {
        trigger_error('user_get_field() for NO_USER', WARNING);
        return "@null@";
    }
    $row = user_get_row($p_user_id);
    if (isset($row[$p_field_name])) {
        return $row[$p_field_name];
    } else {
        error_parameters($p_field_name);
        trigger_error(ERROR_DB_FIELD_NOT_FOUND, WARNING);
        return '';
    }
}

/**
 * return the specified user field for the user id
 *
 * @param integer $p_user_id    A valid user identifier.
 * @param string  $p_field_name The field name to retrieve.
 * @return string
 */
function user_get_field($p_user_id, $p_field_name)
{
    if (NO_USER == $p_user_id) {
        error_parameters(NO_USER);
        trigger_error(ERROR_USER_BY_ID_NOT_FOUND, WARNING);
        return '@null@';
    }
    $t_row = user_get_row($p_user_id);
    if (isset($t_row[$p_field_name])) {
        switch ($p_field_name) {
            case 'access_level':
                return (int) $t_row[$p_field_name];
            default:
                return $t_row[$p_field_name];
        }
    } else {
        error_parameters($p_field_name);
        trigger_error(ERROR_DB_FIELD_NOT_FOUND, WARNING);
        return '';
    }
}

/**
 * Allows scripts to login using a login name or ( login name + password )
 * @param string $p_username username
 * @param string $p_password username
 * @return bool indicates if authentication was successful
 * @access public
 */
function auth_attempt_script_login($p_username, $p_password = null)
{
    global $g_script_login_cookie, $g_cache_current_user_id;
    $t_user_id = user_get_id_by_name($p_username);
    if (false === $t_user_id) {
        return false;
    }
    $t_user = user_get_row($t_user_id);
    # check for disabled account
    if (OFF == $t_user['enabled']) {
        return false;
    }
    # validate password if supplied
    if (null !== $p_password) {
        if (!auth_does_password_match($t_user_id, $p_password)) {
            return false;
        }
    }
    # ok, we're good to login now
    # With cases like RSS feeds and MantisConnect there is a login per operation, hence, there is no
    # real significance of incrementing login count.
    # increment login count
    # user_increment_login_count( $t_user_id );
    # set the cookies
    $g_script_login_cookie = $t_user['cookie_string'];
    # cache user id for future reference
    $g_cache_current_user_id = $t_user_id;
    return true;
}

 * @link http://www.mantisbt.org
 */
/**
 * MantisBT Core API's
 */
require_once 'core.php';
require_once 'current_user_api.php';
$t_use_gravatar = config_get('use_gravatar', false, auth_get_current_user_id(), ALL_PROJECTS);
#============ Parameters ============
# (none)
#============ Permissions ============
auth_ensure_user_authenticated();
current_user_ensure_unprotected();
# extracts the user information for the currently logged in user
# and prefixes it with u_
$row = user_get_row(auth_get_current_user_id());
extract($row, EXTR_PREFIX_ALL, 'u');
$t_ldap = LDAP == config_get('login_method');
# In case we're using LDAP to get the email address... this will pull out
#  that version instead of the one in the DB
$u_email = user_get_email($u_id, $u_username);
# note if we are being included by a script of a different name, if so,
#  this is a mandatory password change request
$t_force_pw_reset = is_page_name('verify.php');
# Only show the update button if there is something to update.
$t_show_update_button = false;
html_page_top(lang_get('account_link'));
?>

<!-- # Edit Account Form BEGIN -->
<br />

/**
 * Allows scripts to login using a login name or ( login name + password )
 *
 * There are multiple scenarios where this is used:
 * - Anonymous login (blank username supplied).
 * - Anonymous login with anonymous user name specified.
 * - Anonymous login with account not existing or disabled.
 * - Pre-authenticated user via some secret hash from email verify or rss feed, where username
 *   is specified but password is null.
 * - Standard authentication with username and password specified.
 *
 * @param string $p_username Username.
 * @param string $p_password Password.
 * @return boolean indicates if authentication was successful
 * @access public
 */
function auth_attempt_script_login($p_username, $p_password = null)
{
    global $g_script_login_cookie;
    $t_username = $p_username;
    $t_password = $p_password;
    $t_anon_allowed = config_get('allow_anonymous_login');
    if ($t_anon_allowed == ON) {
        $t_anonymous_account = config_get('anonymous_account');
    } else {
        $t_anonymous_account = '';
    }
    # if no user name supplied, then attempt to login as anonymous user.
    if (is_blank($t_username) || strcasecmp($t_username, $t_anonymous_account) == 0) {
        if ($t_anon_allowed == OFF) {
            return false;
        }
        $t_username = $t_anonymous_account;
        # do not use password validation.
        $t_password = null;
    }
    $t_user_id = auth_get_user_id_from_login_name($t_username);
    if ($t_user_id === false) {
        $t_user_id = auth_auto_create_user($t_username, $p_password);
        if ($t_user_id === false) {
            return false;
        }
    }
    $t_user = user_get_row($t_user_id);
    # check for disabled account
    if (OFF == $t_user['enabled']) {
        return false;
    }
    # validate password if supplied
    if (null !== $t_password) {
        if (!auth_does_password_match($t_user_id, $t_password)) {
            return false;
        }
    }
    # ok, we're good to login now
    # With cases like RSS feeds and MantisConnect there is a login per operation, hence, there is no
    # real significance of incrementing login count.
    # increment login count
    # user_increment_login_count( $t_user_id );
    # set the cookies
    $g_script_login_cookie = $t_user['cookie_string'];
    # cache user id for future reference
    current_user_set($t_user_id);
    return true;
}

require_api('config_api.php');
require_api('constant_inc.php');
require_api('error_api.php');
require_api('gpc_api.php');
require_api('helper_api.php');
require_api('html_api.php');
require_api('lang_api.php');
require_api('print_api.php');
require_api('string_api.php');
require_api('user_api.php');
require_api('utility_api.php');
auth_ensure_user_authenticated();
# extracts the user information for the currently logged in user
# and prefixes it with u_
$f_user_id = gpc_get_int('id', auth_get_current_user_id());
$row = user_get_row($f_user_id);
extract($row, EXTR_PREFIX_ALL, 'u');
$t_can_manage = access_has_global_level(config_get('manage_user_threshold')) && access_has_global_level($u_access_level);
$t_can_see_realname = access_has_project_level(config_get('show_user_realname_threshold'));
$t_can_see_email = access_has_project_level(config_get('show_user_email_threshold'));
# In case we're using LDAP to get the email address... this will pull out
#  that version instead of the one in the DB
$u_email = user_get_email($u_id);
$u_realname = user_get_realname($u_id);
html_page_top();
?>

<br />
<div align="center">
<table class="width75" cellspacing="1">
	<tr>

 function getUserEmail($p_user_id)
 {
     $t_user = user_get_row($p_user_id);
     return $t_user['email'];
 }

# $Id: admin_manage_users_edit.php,v 1.8 2002/10/07 02:54:39 vboctor Exp $
# --------------------------------------------------------
require_once 'core' . DIRECTORY_SEPARATOR . 'api.php';
login_cookie_check();
access_ensure_check_action(ACTION_USERS_EDIT);
print_html_top();
print_head_top();
print_title($g_window_title);
print_css($g_css_inc_file);
print_head_bottom();
print_body_top();
print_header($g_page_title);
print_top_page($g_top_page_inc);
print_admin_menu();
$f_user_id = gpc_get('f_user_id');
$t_user_array = user_get_row($f_user_id);
extract($t_user_array, EXTR_PREFIX_ALL, 'v');
# @@@ Need to LOCALIZE text
?>
<div align="center">
<div class="small-width">
<form method="post" action="<?php 
echo $g_admin_manage_users_update;
?>
">
<input type="hidden" name="f_user_id" value="<?php 
echo $v_id;
?>
" />
<table class="box" summary="">
<tr class="title">

 public function put($request)
 {
     /**
      * 	Updates the user.
      *
      *      @param $request - The Request we're responding to
      */
     $this->user_id = User::get_mantis_id_from_url($request->url);
     if (!access_has_global_level(config_get('manage_user_threshold')) && auth_get_current_user_id() != $this->user_id) {
         throw new HTTPException(403, "Access denied to edit user {$this->user_id}'s info");
     }
     $this->populate_from_repr($request->body);
     # Do some validation on the inputs (from Mantis's user_create())
     $username = db_prepare_string($this->rsrc_data['username']);
     $realname = db_prepare_string($this->rsrc_data['realname']);
     $password = db_prepare_string($this->rsrc_data['password']);
     $email = db_prepare_string($this->rsrc_data['email']);
     $access_level = db_prepare_int(get_string_to_enum(config_get('access_levels_enum_string'), $this->rsrc_data['access_level']));
     $protected = db_prepare_bool($this->rsrc_data['protected']);
     $enabled = db_prepare_bool($this->rsrc_data['enabled']);
     user_ensure_name_valid($username);
     user_ensure_realname_valid($realname);
     user_ensure_realname_unique($username, $realname);
     email_ensure_valid($email);
     # The cookie string is based on email and username, so if either of those changed,
     # we have to change the cookie string.
     $user_row = user_get_row($this->user_id);
     $username_key = array_key_exists('username', $user_row) ? 'username' : 1;
     $email_key = array_key_exists('email', $user_row) ? 'email' : 3;
     $cookie_string_key = array_key_exists('cookie_string', $user_row) ? 'cookie_string' : 13;
     if ($user_row[$username_key] != $username || $user_row[$email_key] != $email) {
         $seed = $email . $username;
         $cookie_string = auth_generate_unique_cookie_string($seed);
     } else {
         $cookie_string = $user_row[$cookie_string_key];
     }
     $password_hash = auth_process_plain_password($password);
     $user_table = config_get('mantis_user_table');
     $query = "UPDATE  {$user_table}\n\t\t\t\tSET username = '{$username}',\n\t\t\t\t    realname = '{$realname}',\n\t\t\t\t    email = '{$email}',\n\t\t\t\t    password = '{$password_hash}',\n\t\t\t\t    enabled = {$enabled},\n\t\t\t\t    protected = {$protected},\n\t\t\t\t    access_level = {$access_level},\n\t\t\t\t    cookie_string = '{$cookie_string}'\n\t\t\t\tWHERE id = {$this->user_id};";
     db_query($query);
     $resp = new Response();
     $resp->status = 204;
     return $resp;
 }

function auth_attempt_script_login($p_username, $p_password = null)
{
    global $g_script_login_cookie, $g_cache_current_user_id;
    $t_user_id = user_get_id_by_name($p_username);
    $t_user = user_get_row($t_user_id);
    # check for disabled account
    if (OFF == $t_user['enabled']) {
        return false;
    }
    # validate password if supplied
    if (null !== $p_password) {
        if (!auth_does_password_match($t_user_id, $p_password)) {
            return false;
        }
    }
    # ok, we're good to login now
    # increment login count
    user_increment_login_count($t_user_id);
    # set the cookies
    $g_script_login_cookie = $t_user['cookie_string'];
    # cache user id for future reference
    $g_cache_current_user_id = $t_user_id;
    return true;
}

function user_update($p_user_id, $p_email, $p_password, $p_access_level, $p_enabled, $p_protected)
{
    global $g_phpWN_user_table;
    if (empty($p_password)) {
        $t_user_row = user_get_row($p_user_id);
        $c_password = $t_user_row['password'];
    } else {
        $c_password = db_prepare_string(access_encrypt_password($p_password));
    }
    $c_user_id = db_prepare_int($p_user_id);
    $c_email = db_prepare_string($p_email);
    $c_access_level = db_prepare_string($p_access_level);
    $c_enabled = db_prepare_string($p_enabled);
    $c_protected = db_prepare_string($p_protected);
    $query = "UPDATE {$g_phpWN_user_table}\r\n\t\t\t\tSET email='{$c_email}',\r\n\t\t\t\t\tpassword='{$c_password}',\r\n\t\t\t\t\taccess_level={$c_access_level},\r\n\t\t\t\t\tenabled={$c_enabled},\r\n\t\t\t\t\tprotected={$c_protected}\r\n\t\t\t\tWHERE id={$c_user_id}";
    return db_query($query);
}