OneBot: Leantime 改造版源码（BOM/Univer 表格/AI 接管/品牌替换等）

2026-09-03 18:49:20 +08:00
commit d647428529
3501 changed files with 1988906 additions and 0 deletions
--- a/app/Domain/Users/Controllers/DelUser.php
+++ b/app/Domain/Users/Controllers/DelUser.php
@@ -0,0 +1,88 @@
+<?php
+
+namespace Leantime\Domain\Users\Controllers;
+
+use Leantime\Core\Auth\Permissions\RequiresPermission;
+use Leantime\Core\Controller\Controller;
+use Leantime\Core\Controller\Frontcontroller;
+use Leantime\Domain\Users\Permissions\UsersPermissions;
+use Leantime\Domain\Users\Services\Users;
+use Symfony\Component\HttpFoundation\Response;
+
+class DelUser extends Controller
+{
+    private Users $userService;
+
+    /**
+     * Initializes dependencies.
+     */
+    public function init(Users $userService): void
+    {
+        $this->userService = $userService;
+    }
+
+    /**
+     * Displays the delete user confirmation page.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(UsersPermissions::DELETE, global: true)]
+    public function get(array $params): Response
+    {
+        if (! isset($params['id'])) {
+            return $this->tpl->display('errors.error403', responseCode: 403);
+        }
+
+        $id = (int) $params['id'];
+        $user = $this->userService->getUser($id);
+
+        $this->generateFormTokens();
+
+        $this->tpl->assign('user', $user);
+
+        return $this->tpl->display('users.delUser');
+    }
+
+    /**
+     * Handles user deletion.
+     *
+     * @param  array  $params  Request parameters
+     */
+    #[RequiresPermission(UsersPermissions::DELETE, global: true)]
+    public function post(array $params): Response
+    {
+        if (! isset($params['id'])) {
+            return $this->tpl->display('errors.error403', responseCode: 403);
+        }
+
+        $id = (int) $params['id'];
+        $user = $this->userService->getUser($id);
+
+        if (isset($_POST['del'])) {
+            if (isset($_POST[session('formTokenName')]) && $_POST[session('formTokenName')] == session('formTokenValue')) {
+                $this->userService->deleteUser($id);
+                $this->tpl->setNotification($this->language->__('notifications.user_deleted'), 'success', 'user_deleted');
+
+                return Frontcontroller::redirect(BASE_URL.'/users/showAll');
+            }
+
+            $this->tpl->setNotification($this->language->__('notification.form_token_incorrect'), 'error');
+        }
+
+        $this->generateFormTokens();
+
+        $this->tpl->assign('user', $user);
+
+        return $this->tpl->display('users.delUser');
+    }
+
+    /**
+     * Generates CSRF form tokens for the sensitive delete form.
+     */
+    private function generateFormTokens(): void
+    {
+        $permitted_chars = '0123456789abcdefghijklmnopqrstuvwxyz';
+        session(['formTokenName' => substr(str_shuffle($permitted_chars), 0, 32)]);
+        session(['formTokenValue' => substr(str_shuffle($permitted_chars), 0, 32)]);
+    }
+}