6 files changed, 92 insertions, 100 deletions

diff --git a/actions/admin/user/ban.php b/actions/admin/user/ban.php
index 1a5d9e4a9..209ece2a0 100644
--- a/actions/admin/user/ban.php
+++ b/actions/admin/user/ban.php
@@ -1,24 +1,24 @@
 <?php
 /**
- * Elgg ban user
+ * Bans a user.
  *
- * @package Elgg
- * @subpackage Core
- * @author Curverider Ltd
- * @link http://elgg.org/
+ * User entities are banned by setting the 'banned' column
+ * to 'yes' in the users_entity table.
+ *
+ * @package Elgg.Core
+ * @subpackage Administration.User
  */
 
-
-// block non-admin users
-admin_gatekeeper();
-
-// Get the user
 $guid = get_input('guid');
-$obj = get_entity($guid);
+$user = get_entity($guid);
+
+if ($guid == elgg_get_logged_in_user_guid()) {
+	register_error(elgg_echo('admin:user:self:ban:no'));
+	forward(REFERER);
+}
 
-if (($obj instanceof ElggUser) && ($obj->canEdit())) {
-	// Now actually disable it
-	if ($obj->ban('banned')) {
+if (($user instanceof ElggUser) && ($user->canEdit())) {
+	if ($user->ban('banned')) {
 		system_message(elgg_echo('admin:user:ban:yes'));
 	} else {
 		register_error(elgg_echo('admin:user:ban:no'));
@@ -27,5 +27,4 @@ if (($obj instanceof ElggUser) && ($obj->canEdit())) {
 	register_error(elgg_echo('admin:user:ban:no'));
 }
 
-forward('pg/admin/user/');
-exit;
+forward(REFERER);
\ No newline at end of file
diff --git a/actions/admin/user/delete.php b/actions/admin/user/delete.php
index c22d27e8a..7cfbd0925 100644
--- a/actions/admin/user/delete.php
+++ b/actions/admin/user/delete.php
@@ -1,24 +1,29 @@
 <?php
 /**
- * Elgg delete user
+ * Delete a user.
  *
- * @package Elgg
- * @subpackage Core
- * @author Curverider Ltd
- * @link http://elgg.org/
+ * The user will be deleted recursively, meaning all entities
+ * owned or contained by the user will also be removed.
+ *
+ * @package Elgg.Core
+ * @subpackage Administration.User
  */
 
-
-// block non-admin users
-admin_gatekeeper();
-
 // Get the user
 $guid = get_input('guid');
-$obj = get_entity($guid);
+$user = get_entity($guid);
+
+if ($guid == elgg_get_logged_in_user_guid()) {
+	register_error(elgg_echo('admin:user:self:delete:no'));
+	forward(REFERER);
+}
+
+$name = $user->name;
+$username = $user->username;
 
-if (($obj instanceof ElggUser) && ($obj->canEdit())) {
-	if ($obj->delete()) {
-		system_message(elgg_echo('admin:user:delete:yes'));
+if (($user instanceof ElggUser) && ($user->canEdit())) {
+	if ($user->delete()) {
+		system_message(elgg_echo('admin:user:delete:yes', array($name)));
 	} else {
 		register_error(elgg_echo('admin:user:delete:no'));
 	}
@@ -26,5 +31,10 @@ if (($obj instanceof ElggUser) && ($obj->canEdit())) {
 	register_error(elgg_echo('admin:user:delete:no'));
 }
 
-forward($_SERVER['HTTP_REFERER']);
-exit;
+// forward to user administration if on a user's page as it no longer exists
+$forward = REFERER;
+if (strpos($_SERVER['HTTP_REFERER'], $username) != FALSE) {
+	$forward = "admin/users/newest";
+}
+
+forward($forward);
diff --git a/actions/admin/user/makeadmin.php b/actions/admin/user/makeadmin.php
index 580e7df05..54b0b7070 100644
--- a/actions/admin/user/makeadmin.php
+++ b/actions/admin/user/makeadmin.php
@@ -1,25 +1,21 @@
 <?php
 /**
- * Make another user an admin.
+ * Grants admin privileges to a user.
  *
- * @package Elgg
- * @subpackage Core
- * @author Curverider Ltd
- * @link http://elgg.org/
+ * In >=1.7.1, admin is flagged by setting the admin
+ * column in the users_entity table.
+ *
+ * In <1.7.1, admin is a piece of metadata on the user object.
+ *
+ * @package Elgg.Core
+ * @subpackage Administration.User
  */
 
-global $CONFIG;
-
-// block non-admin users
-admin_gatekeeper();
-
-// Get the user
 $guid = get_input('guid');
-$obj = get_entity($guid);
+$user = get_entity($guid);
 
-if (($obj instanceof ElggUser) && ($obj->canEdit())) {
-	$obj->admin = 'yes';
-	if ($obj->admin) {
+if (($user instanceof ElggUser) && ($user->canEdit())) {
+	if ($user->makeAdmin()) {
 		system_message(elgg_echo('admin:user:makeadmin:yes'));
 	} else {
 		register_error(elgg_echo('admin:user:makeadmin:no'));
@@ -28,4 +24,4 @@ if (($obj instanceof ElggUser) && ($obj->canEdit())) {
 	register_error(elgg_echo('admin:user:makeadmin:no'));
 }
 
-forward($_SERVER['HTTP_REFERER']);
+forward(REFERER);
diff --git a/actions/admin/user/removeadmin.php b/actions/admin/user/removeadmin.php
index 445596331..8cebc7078 100644
--- a/actions/admin/user/removeadmin.php
+++ b/actions/admin/user/removeadmin.php
@@ -1,25 +1,21 @@
 <?php
 /**
- * Make another user an admin.
+ * Revokes admin privileges from a user.
  *
- * @package Elgg
- * @subpackage Core
- * @author Curverider Ltd
- * @link http://elgg.org/
+ * @package Elgg.Core
+ * @subpackage Administration.User
  */
 
-global $CONFIG;
-
-// block non-admin users
-admin_gatekeeper();
-
-// Get the user
 $guid = get_input('guid');
-$obj = get_entity($guid);
+$user = get_entity($guid);
+
+if ($guid == elgg_get_logged_in_user_guid()) {
+	register_error(elgg_echo('admin:user:self:removeadmin:no'));
+	forward(REFERER);
+}
 
-if (($obj instanceof ElggUser) && ($obj->canEdit())) {
-	$obj->admin = '';
-	if (!$obj->admin) {
+if (($user instanceof ElggUser) && ($user->canEdit())) {
+	if ($user->removeAdmin()) {
 		system_message(elgg_echo('admin:user:removeadmin:yes'));
 	} else {
 		register_error(elgg_echo('admin:user:removeadmin:no'));
@@ -28,4 +24,4 @@ if (($obj instanceof ElggUser) && ($obj->canEdit())) {
 	register_error(elgg_echo('admin:user:removeadmin:no'));
 }
 
-forward($_SERVER['HTTP_REFERER']);
+forward(REFERER);
diff --git a/actions/admin/user/resetpassword.php b/actions/admin/user/resetpassword.php
index aead052dd..d019a7f55 100644
--- a/actions/admin/user/resetpassword.php
+++ b/actions/admin/user/resetpassword.php
@@ -1,35 +1,36 @@
 <?php
 /**
- * Admin password reset.
+ * Reset a user's password.
  *
- * @package Elgg
- * @subpackage Core
- * @author Curverider Ltd
- * @link http://elgg.org/
+ * This is an admin action that generates a new salt and password
+ * for a user, then emails the password to the user's registered
+ * email address.
+ *
+ * NOTE: This is different to the "reset password" link users
+ * can use in that it does not first email the user asking if
+ * they want to have their password reset.
+ *
+ * @package Elgg.Core
+ * @subpackage Administration.User
  */
 
-global $CONFIG;
-
-// block non-admin users
-admin_gatekeeper();
-
-// Get the user
 $guid = get_input('guid');
-$obj = get_entity($guid);
+$user = get_entity($guid);
 
-if (($obj instanceof ElggUser) && ($obj->canEdit())) {
+if (($user instanceof ElggUser) && ($user->canEdit())) {
 	$password = generate_random_cleartext_password();
 
-	$obj->salt = generate_random_cleartext_password(); // Reset the salt
-	$obj->password = generate_user_password($obj, $password);
+	// Always reset the salt before generating the user password.
+	$user->salt = generate_random_cleartext_password();
+	$user->password = generate_user_password($user, $password);
 
-	if ($obj->save()) {
+	if ($user->save()) {
 		system_message(elgg_echo('admin:user:resetpassword:yes'));
 
-		notify_user($obj->guid,
-			$CONFIG->site->guid,
+		notify_user($user->guid,
+			elgg_get_site_entity()->guid,
 			elgg_echo('email:resetpassword:subject'),
-			sprintf(elgg_echo('email:resetpassword:body'), $obj->username, $password),
+			elgg_echo('email:resetpassword:body', array($user->username, $password)),
 			NULL,
 			'email');
 	} else {
@@ -39,5 +40,4 @@ if (($obj instanceof ElggUser) && ($obj->canEdit())) {
 	register_error(elgg_echo('admin:user:resetpassword:no'));
 }
 
-forward($_SERVER['HTTP_REFERER']);
-exit;
+forward(REFERER);
\ No newline at end of file
diff --git a/actions/admin/user/unban.php b/actions/admin/user/unban.php
index 6e04c8114..7a772a0d3 100644
--- a/actions/admin/user/unban.php
+++ b/actions/admin/user/unban.php
@@ -1,27 +1,19 @@
 <?php
 /**
- * Elgg ban user
+ * Unbans a user.
  *
- * @package Elgg
- * @subpackage Core
- * @author Curverider Ltd
- * @link http://elgg.org/
+ * @package Elgg.Core
+ * @subpackage Administration.User
  */
 
-
-// block non-admin users
-admin_gatekeeper();
-
 $access_status = access_get_show_hidden_status();
 access_show_hidden_entities(true);
 
-// Get the user
 $guid = get_input('guid');
-$obj = get_entity($guid);
+$user = get_entity($guid);
 
-if (($obj instanceof ElggUser) && ($obj->canEdit())) {
-	// Now actually disable it
-	if ($obj->unban()) {
+if (($user instanceof ElggUser) && ($user->canEdit())) {
+	if ($user->unban()) {
 		system_message(elgg_echo('admin:user:unban:yes'));
 	} else {
 		register_error(elgg_echo('admin:user:unban:no'));
@@ -32,5 +24,4 @@ if (($obj instanceof ElggUser) && ($obj->canEdit())) {
 
 access_show_hidden_entities($access_status);
 
-forward($_SERVER['HTTP_REFERER']);
-exit;
+forward(REFERER);