ikan Uploader :
Directory : /var/www/new-ppid-app/admin/
Upload File : |
| Current File : /var/www/new-ppid-app/admin/users.php |
<?php
/**
* Admin (superadmin): manajemen user CMS, termasuk admin per-UPD.
*/
require_once dirname(__DIR__) . '/config/config.php';
require_once dirname(__DIR__) . '/includes/auth.php';
require_once dirname(__DIR__) . '/includes/queries.php';
require_superadmin();
$updList = get_upd_list();
$roles = ['superadmin' => 'Super Administrator', 'admin' => 'Administrator (PPID Utama)', 'upd' => 'Admin UPD (PPID Pembantu)'];
$errors = [];
$form = ['id' => 0, 'nama' => '', 'username' => '', 'email' => '', 'role' => 'upd', 'upd_id' => 0];
$countSuperadmin = static fn (): int => (int) db()->query("SELECT COUNT(*) FROM admin_users WHERE role = 'superadmin'")->fetchColumn();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_verify();
$action = post_param('action');
$meId = (int) current_admin()['id'];
if ($action === 'delete') {
$id = (int) post_param('id');
$target = db()->prepare('SELECT * FROM admin_users WHERE id = ?');
$target->execute([$id]);
$t = $target->fetch();
if (!$t) {
set_flash('error', 'User tidak ditemukan.');
} elseif ($id === $meId) {
set_flash('error', 'Anda tidak dapat menghapus akun Anda sendiri.');
} elseif ($t['role'] === 'superadmin' && $countSuperadmin() <= 1) {
set_flash('error', 'Tidak dapat menghapus Super Administrator terakhir.');
} else {
db()->prepare('DELETE FROM admin_users WHERE id = ?')->execute([$id]);
set_flash('success', 'User berhasil dihapus.');
}
redirect('admin/users.php');
}
// Simpan (tambah / ubah).
$form = [
'id' => (int) post_param('id'),
'nama' => post_param('nama'),
'username' => post_param('username'),
'email' => post_param('email'),
'role' => post_param('role', 'upd'),
'upd_id' => (int) post_param('upd_id'),
];
$password = (string) ($_POST['password'] ?? '');
$isEdit = $form['id'] > 0;
if ($form['nama'] === '') $errors['nama'] = 'Nama wajib diisi.';
if ($form['username'] === '') $errors['username'] = 'Username wajib diisi.';
if (!is_valid_email($form['email'])) $errors['email'] = 'Email tidak valid.';
if (!array_key_exists($form['role'], $roles)) $form['role'] = 'upd';
if ($form['role'] === 'upd' && !get_upd($form['upd_id'])) {
$errors['upd_id'] = 'Pilih UPD untuk Admin UPD.';
}
if (!$isEdit && strlen($password) < 6) {
$errors['password'] = 'Password minimal 6 karakter.';
} elseif ($isEdit && $password !== '' && strlen($password) < 6) {
$errors['password'] = 'Password minimal 6 karakter.';
}
// Username/email unik.
if (!isset($errors['username'])) {
$c = db()->prepare('SELECT COUNT(*) FROM admin_users WHERE username = ? AND id <> ?');
$c->execute([$form['username'], $form['id']]);
if ((int) $c->fetchColumn() > 0) $errors['username'] = 'Username sudah dipakai.';
}
if (!isset($errors['email'])) {
$c = db()->prepare('SELECT COUNT(*) FROM admin_users WHERE email = ? AND id <> ?');
$c->execute([$form['email'], $form['id']]);
if ((int) $c->fetchColumn() > 0) $errors['email'] = 'Email sudah dipakai.';
}
// Jaga minimal satu superadmin saat menurunkan peran.
if ($isEdit && $form['role'] !== 'superadmin') {
$cur = db()->prepare('SELECT role FROM admin_users WHERE id = ?');
$cur->execute([$form['id']]);
if ($cur->fetchColumn() === 'superadmin' && $countSuperadmin() <= 1) {
$errors['role'] = 'Minimal harus ada satu Super Administrator.';
}
}
$updId = $form['role'] === 'upd' ? $form['upd_id'] : null;
if (empty($errors)) {
if ($isEdit) {
if ($password !== '') {
$hash = password_hash($password, PASSWORD_DEFAULT);
db()->prepare('UPDATE admin_users SET nama=?, username=?, email=?, role=?, upd_id=?, password=? WHERE id=?')
->execute([$form['nama'], $form['username'], $form['email'], $form['role'], $updId, $hash, $form['id']]);
} else {
db()->prepare('UPDATE admin_users SET nama=?, username=?, email=?, role=?, upd_id=? WHERE id=?')
->execute([$form['nama'], $form['username'], $form['email'], $form['role'], $updId, $form['id']]);
}
set_flash('success', 'User berhasil diperbarui.');
} else {
$hash = password_hash($password, PASSWORD_DEFAULT);
db()->prepare('INSERT INTO admin_users (nama, username, email, password, role, upd_id) VALUES (?,?,?,?,?,?)')
->execute([$form['nama'], $form['username'], $form['email'], $hash, $form['role'], $updId]);
set_flash('success', 'User baru berhasil ditambahkan.');
}
redirect('admin/users.php');
}
}
// Mode edit.
$editId = (int) get_param('edit');
if ($editId > 0 && empty($errors)) {
$u = db()->prepare('SELECT * FROM admin_users WHERE id = ?');
$u->execute([$editId]);
if ($row = $u->fetch()) {
$form = ['id' => (int) $row['id'], 'nama' => $row['nama'], 'username' => $row['username'], 'email' => $row['email'], 'role' => $row['role'], 'upd_id' => (int) ($row['upd_id'] ?? 0)];
}
}
$rows = db()->query(
'SELECT a.*, u.nama AS upd_nama, u.singkatan AS upd_singkatan
FROM admin_users a LEFT JOIN upd u ON u.id = a.upd_id
ORDER BY a.role ASC, a.nama ASC'
)->fetchAll();
$isEdit = $form['id'] > 0;
$pageTitle = 'Manajemen User — CMS PPID';
$activeMenu = 'users';
require __DIR__ . '/partials/head.php';
$val = static fn (string $k) => e((string) ($form[$k] ?? ''));
$roleBadge = ['superadmin' => 'bg-mateng-green/10 text-mateng-green', 'admin' => 'bg-blue-50 text-mateng-blue', 'upd' => 'bg-amber-50 text-mateng-gold', 'verifikator' => 'bg-slate-100 text-slate-600'];
?>
<div class="mb-6">
<h2 class="text-2xl font-bold text-slate-900">Manajemen User</h2>
<p class="text-sm text-slate-500 mt-1">Kelola akun CMS. Admin UPD hanya dapat mengelola dokumen unitnya.</p>
</div>
<div class="grid grid-cols-1 lg:grid-cols-3 gap-6">
<!-- Form -->
<div class="lg:col-span-1">
<div class="bg-white border <?= $isEdit ? 'border-mateng-blue/40' : 'border-slate-100' ?> rounded-xl shadow-sm p-6 sticky top-6">
<h3 class="font-bold text-slate-800 mb-4 flex items-center gap-2"><i class="fas <?= $isEdit ? 'fa-user-pen' : 'fa-user-plus' ?> text-mateng-blue"></i> <?= $isEdit ? 'Edit User' : 'Tambah User' ?></h3>
<form method="post" class="space-y-4">
<?= csrf_field() ?>
<input type="hidden" name="action" value="save">
<input type="hidden" name="id" value="<?= (int) $form['id'] ?>">
<div>
<label class="block text-sm font-medium text-slate-700 mb-1.5">Nama Lengkap <span class="text-red-500">*</span></label>
<input type="text" name="nama" value="<?= $val('nama') ?>" class="w-full rounded-lg border px-3 py-2.5 outline-none focus:ring-4 <?= isset($errors['nama']) ? 'border-red-300 focus:ring-red-100' : 'border-slate-300 focus:border-mateng-green focus:ring-green-100' ?>">
<?php if (isset($errors['nama'])): ?><p class="text-xs text-red-500 mt-1"><?= e($errors['nama']) ?></p><?php endif; ?>
</div>
<div class="grid grid-cols-2 gap-3">
<div>
<label class="block text-sm font-medium text-slate-700 mb-1.5">Username <span class="text-red-500">*</span></label>
<input type="text" name="username" value="<?= $val('username') ?>" class="w-full rounded-lg border px-3 py-2.5 outline-none focus:ring-4 <?= isset($errors['username']) ? 'border-red-300 focus:ring-red-100' : 'border-slate-300 focus:border-mateng-green focus:ring-green-100' ?>">
<?php if (isset($errors['username'])): ?><p class="text-xs text-red-500 mt-1"><?= e($errors['username']) ?></p><?php endif; ?>
</div>
<div>
<label class="block text-sm font-medium text-slate-700 mb-1.5">Email <span class="text-red-500">*</span></label>
<input type="email" name="email" value="<?= $val('email') ?>" class="w-full rounded-lg border px-3 py-2.5 outline-none focus:ring-4 <?= isset($errors['email']) ? 'border-red-300 focus:ring-red-100' : 'border-slate-300 focus:border-mateng-green focus:ring-green-100' ?>">
<?php if (isset($errors['email'])): ?><p class="text-xs text-red-500 mt-1"><?= e($errors['email']) ?></p><?php endif; ?>
</div>
</div>
<div>
<label class="block text-sm font-medium text-slate-700 mb-1.5">Password <?= $isEdit ? '<span class="text-xs text-slate-400">(kosongkan jika tidak diubah)</span>' : '<span class="text-red-500">*</span>' ?></label>
<input type="text" name="password" autocomplete="new-password" placeholder="<?= $isEdit ? '••••••' : 'Minimal 6 karakter' ?>" class="w-full rounded-lg border px-3 py-2.5 outline-none focus:ring-4 <?= isset($errors['password']) ? 'border-red-300 focus:ring-red-100' : 'border-slate-300 focus:border-mateng-green focus:ring-green-100' ?>">
<?php if (isset($errors['password'])): ?><p class="text-xs text-red-500 mt-1"><?= e($errors['password']) ?></p><?php endif; ?>
</div>
<div>
<label class="block text-sm font-medium text-slate-700 mb-1.5">Peran <span class="text-red-500">*</span></label>
<select name="role" id="roleSelect" class="w-full rounded-lg border border-slate-300 px-3 py-2.5 outline-none focus:border-mateng-green focus:ring-4 focus:ring-green-100 bg-white">
<?php foreach ($roles as $key => $label): ?>
<option value="<?= e($key) ?>" <?= $form['role'] === $key ? 'selected' : '' ?>><?= e($label) ?></option>
<?php endforeach; ?>
</select>
<?php if (isset($errors['role'])): ?><p class="text-xs text-red-500 mt-1"><?= e($errors['role']) ?></p><?php endif; ?>
</div>
<div id="updWrap" class="<?= $form['role'] === 'upd' ? '' : 'hidden' ?>">
<label class="block text-sm font-medium text-slate-700 mb-1.5">Unit Perangkat Daerah <span class="text-red-500">*</span></label>
<select name="upd_id" class="w-full rounded-lg border px-3 py-2.5 outline-none focus:ring-4 bg-white <?= isset($errors['upd_id']) ? 'border-red-300 focus:ring-red-100' : 'border-slate-300 focus:border-mateng-green focus:ring-green-100' ?>">
<option value="">— Pilih UPD —</option>
<?php foreach ($updList as $u): ?>
<option value="<?= (int) $u['id'] ?>" <?= $form['upd_id'] === (int) $u['id'] ? 'selected' : '' ?>><?= e($u['nama']) ?></option>
<?php endforeach; ?>
</select>
<?php if (isset($errors['upd_id'])): ?><p class="text-xs text-red-500 mt-1"><?= e($errors['upd_id']) ?></p><?php endif; ?>
</div>
<div class="flex gap-2 pt-1">
<button type="submit" class="bg-mateng-green hover:bg-green-700 text-white font-semibold px-5 py-2.5 rounded-lg transition-colors flex items-center gap-2"><i class="fas fa-save"></i> <?= $isEdit ? 'Perbarui' : 'Simpan' ?></button>
<?php if ($isEdit): ?><a href="<?= e(url('admin/users.php')) ?>" class="bg-slate-100 hover:bg-slate-200 text-slate-700 font-semibold px-5 py-2.5 rounded-lg transition-colors">Batal</a><?php endif; ?>
</div>
</form>
</div>
</div>
<!-- Daftar user -->
<div class="lg:col-span-2">
<div class="bg-white border border-slate-100 rounded-xl shadow-sm overflow-hidden">
<div class="overflow-x-auto">
<table class="w-full text-left border-collapse">
<thead>
<tr class="bg-slate-50 text-slate-500 text-xs uppercase tracking-wider">
<th class="px-5 py-4 font-semibold">User</th>
<th class="px-5 py-4 font-semibold">Peran</th>
<th class="px-5 py-4 font-semibold">UPD</th>
<th class="px-5 py-4 font-semibold text-center">Aksi</th>
</tr>
</thead>
<tbody class="text-sm divide-y divide-slate-100 text-slate-700">
<?php foreach ($rows as $r): ?>
<tr class="hover:bg-slate-50/50">
<td class="px-5 py-3.5">
<div class="font-medium text-slate-800"><?= e($r['nama']) ?></div>
<div class="text-xs text-slate-400">@<?= e($r['username']) ?> · <?= e($r['email']) ?></div>
</td>
<td class="px-5 py-3.5"><span class="text-xs font-semibold px-2.5 py-1 rounded-full <?= $roleBadge[$r['role']] ?? 'bg-slate-100 text-slate-600' ?>"><?= e(role_label($r['role'])) ?></span></td>
<td class="px-5 py-3.5 text-slate-500"><?= $r['upd_nama'] ? e($r['upd_singkatan'] ?: $r['upd_nama']) : '<span class="text-slate-300">—</span>' ?></td>
<td class="px-5 py-3.5">
<div class="flex items-center justify-center gap-1">
<a href="<?= e(url('admin/users.php?edit=' . $r['id'])) ?>" class="p-2 text-mateng-blue hover:bg-blue-50 rounded-lg" title="Edit"><i class="fas fa-pen"></i></a>
<?php if ((int) $r['id'] !== (int) current_admin()['id']): ?>
<form method="post" class="inline" onsubmit="return confirm('Hapus user ini?');">
<?= csrf_field() ?>
<input type="hidden" name="action" value="delete">
<input type="hidden" name="id" value="<?= (int) $r['id'] ?>">
<button type="submit" class="p-2 text-red-500 hover:bg-red-50 rounded-lg" title="Hapus"><i class="fas fa-trash"></i></button>
</form>
<?php else: ?>
<span class="p-2 text-slate-300" title="Akun Anda"><i class="fas fa-user-check"></i></span>
<?php endif; ?>
</div>
</td>
</tr>
<?php endforeach; ?>
</tbody>
</table>
</div>
</div>
</div>
</div>
<script>
// Tampilkan pilihan UPD hanya saat peran = Admin UPD.
(function () {
var role = document.getElementById('roleSelect');
var wrap = document.getElementById('updWrap');
if (role && wrap) {
role.addEventListener('change', function () {
wrap.classList.toggle('hidden', role.value !== 'upd');
});
}
})();
</script>
<?php require __DIR__ . '/partials/foot.php'; ?>
Kontol Shell Bypass