Merge branch 'master' into usb-lock-offusb-lock-off

18 files changed, 581 insertions, 71 deletions

diff --git a/modules-available/adduser/config.json b/modules-available/adduser/config.json
index 2c63c085..110f8b67 100644
--- a/modules-available/adduser/config.json
+++ b/modules-available/adduser/config.json
@@ -1,2 +1,3 @@
 {
-}
+	"category": "main.content"
+}
\ No newline at end of file
diff --git a/modules-available/adduser/lang/de/messages.json b/modules-available/adduser/lang/de/messages.json
index 4f62dcbf..a744ae5f 100644
--- a/modules-available/adduser/lang/de/messages.json
+++ b/modules-available/adduser/lang/de/messages.json
@@ -1,5 +1,11 @@
 {
+    "adduser-success": "Benutzer erfolgreich hinzugef\u00fcgt",
+    "cannot-delete-1-self": "Sie k\u00f6nnen nicht den Benutzer mit der ID 1 oder sich selbst l\u00f6schen",
+    "db-error": "Datenbankfehler: {{0}}",
+    "password-changed": "Passwort ge\u00e4ndert",
     "password-mismatch": "Passwort und Passwortbest\u00e4tigung stimmen nicht \u00fcberein",
-    "adduser-disabled": "Keine ausreichenden Rechte, um weitere Benutzer hinzuzuf\u00fcgen",
-    "adduser-success": "Benutzer erfolgreich hinzugef\u00fcgt"
+    "roles-updated": "Rollen aktualisiert",
+    "user-deleted": "Benutzer {{0}} (ID={1}}) gel\u00f6scht",
+    "user-edited": "Benutzerdaten wurden ge\u00e4ndert",
+    "user-not-found": "Benutzer mit ID {{0}} nicht gefunden"
 }
\ No newline at end of file
diff --git a/modules-available/adduser/lang/de/module.json b/modules-available/adduser/lang/de/module.json
new file mode 100644
index 00000000..e4c785b5
--- /dev/null
+++ b/modules-available/adduser/lang/de/module.json
@@ -0,0 +1,3 @@
+{
+    "module_name": "Nutzerverwaltung"
+}
\ No newline at end of file
diff --git a/modules-available/adduser/lang/de/permissions.json b/modules-available/adduser/lang/de/permissions.json
new file mode 100644
index 00000000..8792ac14
--- /dev/null
+++ b/modules-available/adduser/lang/de/permissions.json
@@ -0,0 +1,6 @@
+{
+    "user.add": "Neuen Nutzer hinzuf\u00fcgen",
+    "user.edit": "Nutzer bearbeiten",
+    "user.remove": "Nutzer l\u00f6schen",
+    "user.view-list": "Nutzerliste anzeigen"
+}
\ No newline at end of file
diff --git a/modules-available/adduser/lang/de/template-tags.json b/modules-available/adduser/lang/de/template-tags.json
index 99d17947..419d0e1a 100644
--- a/modules-available/adduser/lang/de/template-tags.json
+++ b/modules-available/adduser/lang/de/template-tags.json
@@ -1,6 +1,25 @@
 {
+    "lang_addUser": "Nutzer hinzuf\u00fcgen",
+    "lang_assignRoles": "Rollen zuweisen",
+    "lang_changeLoginHint": "Sie k\u00f6nnen den Namen, den der Nutzer beim Login angeben muss, \u00e4ndern. Dies ist nur bei lokalen Nutzern m\u00f6glich, die nicht \u00fcber LDAP\/AD authentifiziert werden.",
+    "lang_changeOwnPasswordHint": "Ihr eigenes Passwort k\u00f6nnen Sie \u00fcber den Button \"Passwort \u00e4ndern\" im Men\u00fc \u00e4ndern.",
+    "lang_changePassword": "Neues Passwort",
+    "lang_confirmDelete": "L\u00f6schen best\u00e4tigen",
     "lang_confirmation": "Wiederholen",
     "lang_createUser": "Benutzer anlegen",
+    "lang_editUser": "Benutzer bearbeiten",
+    "lang_email": "E-Mail",
     "lang_fullName": "Vollst\u00e4ndiger Name",
-    "lang_telephone": "Telefon"
-}
+    "lang_fullnameMissing": "Kein Name angegeben",
+    "lang_login": "Login",
+    "lang_loginTooShort": "Login zu kurz",
+    "lang_name": "Name",
+    "lang_passwordTooShort": "Passwort zu kurz",
+    "lang_passwordsDontMatch": "Passworte stimmen nicht \u00fcberein",
+    "lang_phone": "Telefon",
+    "lang_role": "Rolle",
+    "lang_userDeleteConfirm": "M\u00f6chten Sie diesen Benutzer wirklich l\u00f6schen?",
+    "lang_userIdCol": "ID",
+    "lang_userManagement": "Benutzerverwaltung",
+    "lang_userlist": "Benutzerliste"
+}
\ No newline at end of file
diff --git a/modules-available/adduser/lang/en/messages.json b/modules-available/adduser/lang/en/messages.json
index 3a402278..67bca6f9 100644
--- a/modules-available/adduser/lang/en/messages.json
+++ b/modules-available/adduser/lang/en/messages.json
@@ -1,5 +1,11 @@
 {
+    "adduser-success": "User successfully added",
+    "cannot-delete-1-self": "Cannot delete user with ID 1 or yourself",
+    "db-error": "Database error: {{0}}",
+    "password-changed": "Password changed",
     "password-mismatch": "Password and password confirmation do not match",
-    "adduser-disabled": "Insufficient privileges to add more users",
-    "adduser-success": "User successfully added"
+    "roles-updated": "Roles have been updated",
+    "user-deleted": "Deleted user {{0}} (ID={{1}})",
+    "user-edited": "User data has been updated",
+    "user-not-found": "User with ID {{0}} not found"
 }
\ No newline at end of file
diff --git a/modules-available/adduser/lang/en/module.json b/modules-available/adduser/lang/en/module.json
new file mode 100644
index 00000000..f376db34
--- /dev/null
+++ b/modules-available/adduser/lang/en/module.json
@@ -0,0 +1,3 @@
+{
+    "module_name": "User management"
+}
\ No newline at end of file
diff --git a/modules-available/adduser/lang/en/permissions.json b/modules-available/adduser/lang/en/permissions.json
new file mode 100644
index 00000000..ed3d8ee3
--- /dev/null
+++ b/modules-available/adduser/lang/en/permissions.json
@@ -0,0 +1,6 @@
+{
+    "user.add": "Add new user",
+    "user.edit": "Edit user",
+    "user.remove": "Remove user",
+    "user.view-list": "Show userlist"
+}
\ No newline at end of file
diff --git a/modules-available/adduser/lang/en/template-tags.json b/modules-available/adduser/lang/en/template-tags.json
index 24f8cd42..d927964e 100644
--- a/modules-available/adduser/lang/en/template-tags.json
+++ b/modules-available/adduser/lang/en/template-tags.json
@@ -1,6 +1,25 @@
 {
+    "lang_addUser": "Add user",
+    "lang_assignRoles": "Assign roles",
+    "lang_changeLoginHint": "You can change the login identifier used for logging in. This is only enabled for local acounts that are not linked to LDAP\/AD servers.",
+    "lang_changeOwnPasswordHint": "You can change your own password by clicking the \"change password\" button in the menu.",
+    "lang_changePassword": "Change password",
+    "lang_confirmDelete": "Confirm delete",
     "lang_confirmation": "Confirm Password",
     "lang_createUser": "Create User",
+    "lang_editUser": "Edit user",
+    "lang_email": "Email",
     "lang_fullName": "Full Name",
-    "lang_telephone": "Telephone"
+    "lang_fullnameMissing": "Full name missing",
+    "lang_login": "Login",
+    "lang_loginTooShort": "Login too short",
+    "lang_name": "Name",
+    "lang_passwordTooShort": "Password too short",
+    "lang_passwordsDontMatch": "Passwords do not match",
+    "lang_phone": "Phone",
+    "lang_role": "Role",
+    "lang_userDeleteConfirm": "Do you want to delete this user?",
+    "lang_userIdCol": "ID",
+    "lang_userManagement": "User management",
+    "lang_userlist": "User list"
 }
diff --git a/modules-available/adduser/page.inc.php b/modules-available/adduser/page.inc.php
index 87aaeef1..cffe33f9 100644
--- a/modules-available/adduser/page.inc.php
+++ b/modules-available/adduser/page.inc.php
@@ -7,52 +7,220 @@ class Page_AddUser extends Page
 	{
 		User::load();
 
-		if (isset($_POST['action']) && $_POST['action'] === 'adduser') {
-			// Check required fields
-			if (empty($_POST['user']) || empty($_POST['pass1']) || empty($_POST['pass2']) || empty($_POST['fullname'])) {
-				Message::addError('main.empty-field');
-				Util::redirect('?do=AddUser');
-			} elseif ($_POST['pass1'] !== $_POST['pass2']) {
-				Message::addError('password-mismatch');
-				Util::redirect('?do=AddUser');
-			} elseif (!User::hasPermission('superadmin') && Database::queryFirst('SELECT userid FROM user LIMIT 1') !== false) {
-				Message::addError('adduser-disabled');
-				Util::redirect('?do=Session&action=login');
+		$action = Request::post(('action'), false, 'string');
+
+		if ($action === 'adduser') {
+			$this->addUser();
+		} elseif ($action === 'edituser') {
+			$this->editUser();
+		} elseif ($action === 'deleteuser') {
+			$this->deleteUser();
+		}
+		if (Request::isPost()) {
+			Util::redirect('?do=adduser');
+		}
+	}
+
+	private function addUser()
+	{
+		// Check required fields
+		$login = Request::post('login', '', 'string');
+		$pass1 = Request::post('pass1', '', 'string');
+		$pass2 = Request::post('pass2', '', 'string');
+		$fullname = Request::post('fullname', '', 'string');
+		$phone = Request::post('phone', '', 'string');
+		$email = Request::post('email', '', 'string');
+		if (empty($login) || empty($pass1) || empty($pass2) || empty($fullname)) {
+			Message::addError('main.empty-field');
+			return;
+		} elseif ($pass1 !== $pass2) {
+			Message::addError('password-mismatch');
+			return;
+		} else {
+			if (Database::queryFirst('SELECT userid FROM user LIMIT 1') !== false) {
+				User::assertPermission('user.add');
+			}
+			$data = array(
+				'login' => $login,
+				'pass' => Crypto::hash6($pass1),
+				'fullname' => $fullname,
+				'phone' => $phone,
+				'email' => $email,
+			);
+			Database::exec('INSERT INTO user SET login = :login, passwd = :pass, fullname = :fullname, phone = :phone, email = :email', $data);
+			$id = Database::lastInsertId();
+			// Make it superadmin if first user. This method sucks as it's a race condition but hey...
+			$ret = Database::queryFirst('SELECT Count(*) AS num FROM user');
+			if ($ret !== false && $ret['num'] == 1) {
+				$ret = Database::exec('UPDATE user SET permissions = 1, userid = 1 WHERE userid = :id', ['id' => $id], true);
+				if ($ret !== false) {
+					EventLog::clear();
+				}
+				// same for permissionmanager
+				Database::exec("INSERT INTO `role_x_user` (userid, roleid) VALUES (:id, 1)", ['id' => $id], true);
+				EventLog::info('Created first user ' . $login);
 			} else {
-				$data = array(
-					'user' => $_POST['user'],
-					'pass' => Crypto::hash6($_POST['pass1']),
-					'fullname' => $_POST['fullname'],
-					'phone' => $_POST['phone'],
-					'email' => $_POST['email'],
-				);
-				if (Database::exec('INSERT INTO user SET login = :user, passwd = :pass, fullname = :fullname, phone = :phone, email = :email', $data) != 1) {
-					Util::traceError('Could not create new user in DB');
+				EventLog::info(User::getName() . ' created user ' . $login);
+			}
+			Message::addInfo('adduser-success');
+			$this->saveRoles($id);
+			return;
+		}
+	}
+
+	private function editUser()
+	{
+		User::assertPermission('user.edit');
+		$userid = Request::post('userid', false, 'int');
+		if ($userid === false) {
+			Message::addError('main.parameter-missing', 'userid');
+			return;
+		}
+		$user = Database::queryFirst('SELECT userid, login, fullname, phone, email
+					FROM user WHERE userid = :userid', compact('userid'));
+		if ($user === false) {
+			Message::addError('user-not-found', $userid);
+			return;
+		}
+		// Check required fields
+		$login = Request::post('login', '', 'string');
+		$pass1 = Request::post('pass1', '', 'string');
+		$pass2 = Request::post('pass2', '', 'string');
+		$fullname = Request::post('fullname', '', 'string');
+		$phone = Request::post('phone', '', 'string');
+		$email = Request::post('email', '', 'string');
+		if (empty($login) || empty($fullname)) {
+			Message::addError('main.empty-field');
+		} elseif (!(empty($pass1) && empty($pass2)) && $pass1 !== $pass2) {
+			Message::addError('password-mismatch');
+		} else {
+			$data = array(
+				'login' => $login,
+				'fullname' => $fullname,
+				'phone' => $phone,
+				'email' => $email,
+				'userid' => $userid,
+			);
+			$ret = Database::exec('UPDATE user SET login = :login, fullname = :fullname, phone = :phone, email = :email WHERE userid = :userid', $data, true);
+			if ($ret === false) {
+				Message::addError('db-error', Database::lastError());
+			} else {
+				if ($ret > 0) {
+					Message::addSuccess('user-edited');
 				}
-				// Make it superadmin if first user. This method sucks as it's a race condition but hey...
-				$ret = Database::queryFirst('SELECT Count(*) AS num FROM user');
-				if ($ret !== false && $ret['num'] == 1) {
-					Database::exec('UPDATE user SET permissions = 1');
-					EventLog::clear();
-					EventLog::info('Created first user ' . $_POST['user']);
-				} else {
-					EventLog::info(User::getName() . ' created user ' . $_POST['user']);
+				if (!empty($pass1) && $userid !== User::getId()) {
+					$data = [
+						'pass' => Crypto::hash6($pass1),
+						'userid' => $userid,
+					];
+					Database::exec('UPDATE user SET passwd = :pass WHERE userid = :userid', $data);
+					Message::addSuccess('password-changed');
 				}
-				Message::addInfo('adduser-success');
-				Util::redirect('?do=Session&action=login');
+				$this->saveRoles($userid);
 			}
 		}
+		Util::redirect('?do=adduser&show=edituser&userid=' . $userid);
+	}
+
+	private function deleteUser()
+	{
+		User::assertPermission('user.remove');
+		$userid = Request::post('userid', false, 'int');
+		if ($userid === false) {
+			Message::addError('main.parameter-missing', 'userid');
+			return;
+		}
+		//\\
+		$user = Database::queryFirst('SELECT userid, login
+					FROM user WHERE userid = :userid', compact('userid'));
+		if ($user === false) {
+			Message::addError('user-not-found', $userid);
+			return;
+		}
+		if ($user['userid'] == 1 || $user['userid'] == User::getId()) {
+			Message::addError('cannot-delete-1-self');
+			return;
+		}
+		Database::exec('DELETE FROM user WHERE userid = :userid', compact('userid'));
+		Message::addSuccess('user-deleted', $user['login'], $userid);
+	}
+
+	private function saveRoles($userid)
+	{
+		if (!Module::isAvailable('permissionmanager'))
+			return;
+		if (!User::hasPermission('.permissionmanager.users.edit-roles'))
+			return;
+		$roles = Request::post('roles', [], 'array');
+		$ret = PermissionDbUpdate::setRolesForUser([$userid], $roles);
+		if ($ret > 0) {
+			Message::addSuccess('roles-updated');
+		}
 	}
 
 	protected function doRender()
 	{
-		// No user was added, check if current user is allowed to add a new user
-		// Currently you can only add users if there is no user yet. :)
-		if (!User::hasPermission('superadmin') && Database::queryFirst('SELECT userid FROM user LIMIT 1') !== false) {
-			Message::addError('adduser-disabled');
-		} else {
-			Render::addTemplate('page-adduser', $_POST);
+		Render::addTemplate('header');
+		$hasUsers = (Database::queryFirst('SELECT userid FROM user LIMIT 1') !== false);
+		$show = Request::get('show', ($hasUsers ? 'list' : 'adduser'), 'string');
+		if ($show === 'adduser') {
+			// Can add user if: - no user exists yet; - user has explicit permission to add users
+			if ($hasUsers) {
+				User::assertPermission('user.add');
+			}
+			Render::openTag('form', ['class' => 'form-adduser', 'action' => '?do=adduser', 'method' => 'post']);
+			Render::addTemplate('page-adduser');
+			Render::addTemplate('js-add-edit');
+			if ($hasUsers) {
+				$this->showRoles();
+			}
+			Render::closeTag('form');
+		} elseif ($show === 'edituser') {
+			User::assertPermission('user.edit');
+			$userid = Request::get('userid', false, 'int');
+			if ($userid === false) {
+				Message::addError('main.parameter-missing', 'userid');
+				Util::redirect('?do=adduser&show=list');
+			}
+			$user = Database::queryFirst('SELECT userid, login, fullname, phone, email
+					FROM user WHERE userid = :userid', compact('userid'));
+			if ($user === false) {
+				Message::addError('user-not-found', $userid);
+			} else {
+				$user['password_disabled'] = User::getId() === $userid ? 'disabled' : false;
+				// TODO: LDAP -> disallow pw change, maybe other fields too?
+				Render::openTag('form', ['class' => 'form-adduser', 'action' => '?do=adduser', 'method' => 'post']);
+				Render::addTemplate('page-edituser', $user);
+				Render::addTemplate('js-add-edit');
+				$this->showRoles($userid);
+				Render::closeTag('form');
+			}
+		} elseif ($show === 'list') {
+			User::assertPermission('user.view-list');
+			$page = new Paginate('SELECT userid, login, fullname, phone, email FROM user ORDER BY login', 50);
+			$data = ['list' => $page->exec()->fetchAll(PDO::FETCH_ASSOC)];
+			foreach ($data['list'] as &$u) {
+				// Don't allow deleting user 1 and self
+				$u['hide_delete'] = $u['userid'] == 1 || $u['userid'] == User::getId();
+				if ($u['userid'] == 1) {
+					$u['userClass'] = 'slx-bold';
+				}
+			}
+			unset($u);
+			Permission::addGlobalTags($data['perms'], null, ['user.add', 'user.edit', 'user.remove']);
+			Module::isAvailable('js_stupidtable');
+			$page->render('page-userlist', $data);
 		}
 	}
 
+	private function showRoles($userid = false)
+	{
+		if (!Module::isAvailable('permissionmanager'))
+			return;
+		if (!User::hasPermission('.permissionmanager.users.edit-roles'))
+			return;
+		$data = ['roles' => PermissionUtil::getRoles($userid, false)];
+		Render::addTemplate('user-permissions', $data);
+	}
+
 }
diff --git a/modules-available/adduser/permissions/permissions.json b/modules-available/adduser/permissions/permissions.json
new file mode 100644
index 00000000..e8fd0a5e
--- /dev/null
+++ b/modules-available/adduser/permissions/permissions.json
@@ -0,0 +1,14 @@
+{
+	"user.add": {
+		"location-aware": false
+	},
+	"user.edit": {
+		"location-aware": false
+	},
+	"user.remove": {
+		"location-aware": false
+	},
+	"user.view-list": {
+		"location-aware": false
+	}
+}
\ No newline at end of file
diff --git a/modules-available/adduser/style.css b/modules-available/adduser/style.css
new file mode 100644
index 00000000..15f04b80
--- /dev/null
+++ b/modules-available/adduser/style.css
@@ -0,0 +1,19 @@
+.form-adduser {
+    max-width: 600px;
+    padding: 10px;
+    margin: 0 auto;
+}
+
+.form-adduser .form-control {
+    position: relative;
+    font-size: 16px;
+    height: auto;
+    padding: 10px;
+    -webkit-box-sizing: border-box;
+    -moz-box-sizing: border-box;
+    box-sizing: border-box;
+}
+
+#add-msg {
+    height: 1em;
+}
\ No newline at end of file
diff --git a/modules-available/adduser/templates/header.html b/modules-available/adduser/templates/header.html
new file mode 100644
index 00000000..34011e29
--- /dev/null
+++ b/modules-available/adduser/templates/header.html
@@ -0,0 +1,3 @@
+<div class="page-header">
+	<h1>{{lang_userManagement}}</h1>
+</div>
\ No newline at end of file
diff --git a/modules-available/adduser/templates/js-add-edit.html b/modules-available/adduser/templates/js-add-edit.html
new file mode 100644
index 00000000..db8d435a
--- /dev/null
+++ b/modules-available/adduser/templates/js-add-edit.html
@@ -0,0 +1,29 @@
+<script><!--
+document.addEventListener('DOMContentLoaded', function() {
+	var $login = $('#login');
+	var $pass1 = $('#pass1');
+	var $pass2 = $('#pass2');
+	var $fullname = $('#fullname');
+	var $msg = $('#add-msg');
+	var $btn = $('.save-btn');
+	if (typeof SLX_EDITUSER === 'undefined') {
+		SLX_EDITUSER = false;
+	}
+	var ev = function() {
+		var msg = '';
+		if ($login.val().length < 2) {
+			msg = '{{lang_loginTooShort}}';
+		} else if ($pass1.val() !== $pass2.val()) {
+			msg = '{{lang_passwordsDontMatch}}';
+		} else if ((!SLX_EDITUSER || $pass1.val().length > 0) && $pass1.val().length < 2) {
+			msg = '{{lang_passwordTooShort}}';
+		} else if ($fullname.val().length < 1) {
+			msg = '{{lang_fullnameMissing}}';
+		}
+		$msg.text(msg);
+		$btn.prop('disabled', !!msg);
+	};
+	$('.event-box').change(ev).keyup(ev);
+	if (SLX_EDITUSER)	ev();
+});
+//--></script>
\ No newline at end of file
diff --git a/modules-available/adduser/templates/page-adduser.html b/modules-available/adduser/templates/page-adduser.html
index deb911c0..08587373 100644
--- a/modules-available/adduser/templates/page-adduser.html
+++ b/modules-available/adduser/templates/page-adduser.html
@@ -1,28 +1,41 @@
-<form class="form-adduser" action="?do=AddUser" method="post">
-	<input type="text" name="prevent_autofill" id="prevent_autofill" value="" style="position:absolute;top:-2000px" tabindex="-1">
-	<input type="password" name="password_fake" id="password_fake" value=""  style="position:absolute;top:-2000px" tabindex="-1">
-	<h2 class="form-signin-heading">{{lang_createUser}}</h2>
-	<div class="row">
-		<div class="col-md-4">{{lang_username}} *</div>
-		<div class="col-md-4"><input type="text" name="user" value="{{user}}" class="form-control" placeholder="{{lang_username}}" autofocus></div>
+<input type="text" name="prevent_autofill" id="prevent_autofill" value="" style="position:absolute;top:-2000px" tabindex="-1">
+<input type="password" name="password_fake" id="password_fake" value=""  style="position:absolute;top:-2000px" tabindex="-1">
+<h2>{{lang_createUser}}</h2>
+<div class="row">
+	<div class="col-md-4"><label for="login">{{lang_login}} *</label></div>
+	<div class="col-md-4"><input id="login" type="text" name="login" value="{{login}}" class="form-control event-box" placeholder="{{lang_username}}" autofocus></div>
+</div>
+<br>
+<div class="row">
+	<div class="col-md-4"><label for="pass1">{{lang_password}} *</label></div>
+	<div class="col-md-4"><input id="pass1" type="password" name="pass1" class="form-control event-box" placeholder="{{lang_password}}"></div>
+	<div class="col-md-4"><input id="pass2" type="password" name="pass2" class="form-control event-box" placeholder="{{lang_confirmation}}"></div>
+</div>
+<br>
+<div class="row">
+	<div class="col-md-4"><label for="fullname">{{lang_fullName}} *</label></div>
+	<div class="col-md-4"><input id="fullname" type="text" name="fullname" value="{{fullname}}" class="form-control event-box" placeholder="{{lang_fullName}}"></div>
+</div>
+<br>
+<div class="row">
+	<div class="col-md-4"><label for="phone">{{lang_phone}}</label></div>
+	<div class="col-md-4"><input id=phone" type="text" name="phone" value="{{phone}}" class="form-control" placeholder="{{lang_phone}}"></div>
+</div>
+<br>
+<div class="row">
+	<div class="col-md-4"><label for="email">{{lang_email}}</label></div>
+	<div class="col-md-4"><input id="email" type="text" name="email" value="{{email}}" class="form-control" placeholder="{{lang_email}}"></div>
+</div>
+<br>
+<div class="row">
+	<div class="col-md-4"></div>
+	<div class="col-md-8">
+		<button class="btn btn-lg btn-primary btn-block save-btn" type="submit" disabled>
+			<span class="glyphicon glyphicon-floppy-disk"></span>
+			{{lang_createUser}}
+		</button>
+		<div id="add-msg" class="text-danger slx-bold"></div>
 	</div>
-	<div class="row">
-		<div class="col-md-4">{{lang_password}} *</div>
-		<div class="col-md-4"><input type="password" name="pass1" class="form-control" placeholder="{{lang_password}}"></div>
-		<div class="col-md-4"><input type="password" name="pass2" class="form-control" placeholder="{{lang_confirmation}}"></div>
-	</div>
-	<div class="row">
-		<div class="col-md-4">{{lang_fullName}} *</div>
-		<div class="col-md-4"><input type="text" name="fullname" value="{{fullname}}" class="form-control" placeholder="{{lang_fullName}}"></div>
-	</div>
-	<div class="row">
-		<div class="col-md-4">{{lang_telephone}}</div>
-		<div class="col-md-4"><input type="text" name="phone" value="{{phone}}" class="form-control" placeholder="{{lang_telephone}}"></div>
-	</div>
-	<div class="row">
-		<div class="col-md-4">E-Mail</div>
-		<div class="col-md-4"><input type="text" name="email" value="{{email}}" class="form-control" placeholder="E-Mail"></div>
-	</div>
-	<button class="btn btn-lg btn-primary btn-block" type="submit">{{lang_createUser}}</button>
-	<input type="hidden" name="action" value="adduser">
-</form>
+</div>
+<input type="hidden" name="action" value="adduser">
+<input type="hidden" name="token" value="{{token}}">
\ No newline at end of file
diff --git a/modules-available/adduser/templates/page-edituser.html b/modules-available/adduser/templates/page-edituser.html
new file mode 100644
index 00000000..68376213
--- /dev/null
+++ b/modules-available/adduser/templates/page-edituser.html
@@ -0,0 +1,74 @@
+<input type="text" name="prevent_autofill" id="prevent_autofill" value="" style="position:absolute;top:-2000px" tabindex="-1">
+<input type="password" name="password_fake" id="password_fake" value="" style="position:absolute;top:-2000px" tabindex="-1">
+<h2>{{lang_editUser}}</h2>
+
+<div class="row">
+	<div class="col-md-4"><label for="login">{{lang_login}}</label></div>
+	<div class="col-md-4"><input id="login" type="text" name="login" value="{{login}}" class="form-control event-box"
+										  placeholder="{{lang_username}}" autofocus></div>
+</div>
+<div class="row">
+	<div class="col-md-4"></div>
+	<div class="col-md-8">
+		<p>
+			{{lang_changeLoginHint}}
+		</p>
+	</div>
+</div>
+
+<div class="row">
+	<div class="col-md-4"><label for="pass1">{{lang_changePassword}}</label></div>
+	<div class="col-md-4"><input id="pass1" {{password_disabled}} type="password" name="pass1" class="form-control event-box" placeholder="{{lang_password}}">
+	</div>
+	<div class="col-md-4"><input id="pass2" {{password_disabled}} type="password" name="pass2" class="form-control event-box"
+										  placeholder="{{lang_confirmation}}"></div>
+</div>
+{{#password_disabled}}
+<div class="row">
+	<div class="col-md-4"></div>
+	<div class="col-md-8">
+		<p>
+			{{lang_changeOwnPasswordHint}}
+		</p>
+	</div>
+</div>
+{{/password_disabled}}
+<br>
+
+<div class="row">
+	<div class="col-md-4"><label for="fullname">{{lang_fullName}}</label></div>
+	<div class="col-md-4"><input id="fullname" type="text" name="fullname" value="{{fullname}}" class="form-control event-box"
+										  placeholder="{{lang_fullName}}"></div>
+</div>
+<br>
+
+<div class="row">
+	<div class="col-md-4"><label for="phone">{{lang_phone}}</label></div>
+	<div class="col-md-4"><input id=phone" type="text" name="phone" value="{{phone}}" class="form-control"
+										  placeholder="{{lang_phone}}"></div>
+</div>
+<br>
+
+<div class="row">
+	<div class="col-md-4"><label for="email">{{lang_email}}</label></div>
+	<div class="col-md-4"><input id="email" type="text" name="email" value="{{email}}" class="form-control" placeholder="{{lang_email}}">
+	</div>
+</div>
+<br>
+
+<div class="row">
+	<div class="col-md-4"></div>
+	<div class="col-md-8">
+		<button class="btn btn-lg btn-primary btn-block save-btn" type="submit">
+			<span class="glyphicon glyphicon-floppy-disk"></span>
+			{{lang_save}}
+		</button>
+		<div id="add-msg" class="text-danger slx-bold"></div>
+	</div>
+</div>
+<input type="hidden" name="action" value="edituser">
+<input type="hidden" name="userid" value="{{userid}}">
+<input type="hidden" name="token" value="{{token}}">
+<script>
+	const SLX_EDITUSER = true;
+</script>
diff --git a/modules-available/adduser/templates/page-userlist.html b/modules-available/adduser/templates/page-userlist.html
new file mode 100644
index 00000000..262553f6
--- /dev/null
+++ b/modules-available/adduser/templates/page-userlist.html
@@ -0,0 +1,87 @@
+<h2>{{lang_userlist}}</h2>
+
+{{{pagenav}}}
+
+<form method="get">
+	<input type="hidden" name="do" value="adduser">
+	<input type="hidden" name="show" value="edituser">
+	<table class="table stupidtable">
+		<thead>
+		<tr>
+			<th data-sort="int" class="slx-smallcol">{{lang_userIdCol}}</th>
+			<th data-sort="string">{{lang_login}}</th>
+			<th data-sort="string">{{lang_name}}</th>
+			<th data-sort="string">{{lang_phone}}</th>
+			<th data-sort="string">{{lang_email}}</th>
+			<th width="1"></th>
+		</tr>
+		</thead>
+		<tbody>
+		{{#list}}
+			<tr>
+				<td class="text-right {{userClass}}">{{userid}}</td>
+				<td id="user-{{userid}}" class="{{userClass}}">{{login}}</td>
+				<td>{{fullname}}</td>
+				<td>{{phone}}</td>
+				<td>{{email}}</td>
+				<td class="text-nowrap">
+					<button class="btn btn-primary btn-xs" {{perms.user.edit.disabled}} type="submit" name="userid" value="{{userid}}">
+						<span class="glyphicon glyphicon-edit"></span>
+					</button>
+					{{^hide_delete}}
+					<button type="button" {{perms.user.remove.disabled}} class="btn btn-danger btn-xs del-user-btn"
+							  data-target="#delete-modal" data-toggle="modal" data-user="{{userid}}">
+						<span class="glyphicon glyphicon-trash"></span>
+					</button>
+					{{/hide_delete}}
+				</td>
+			</tr>
+		{{/list}}
+		</tbody>
+	</table>
+	<div class="text-right">
+		<a class="btn btn-success {{perms.user.add.disabled}}" href="?do=adduser&amp;show=adduser">
+			<span class="glyphicon glyphicon-plus"></span>
+			{{lang_addUser}}
+		</a>
+	</div>
+</form>
+<script>
+	document.addEventListener('DOMContentLoaded', function() {
+		$('.del-user-btn').click(function (e) {
+			var uid = $(this).data('user');
+			if (!uid) {
+				alert('ERROR');
+				return false;
+			}
+			$('#delete-userid').val(uid);
+			$('#delete-user-field').text($('#user-' + uid).text());
+		});
+	});
+</script>
+
+<!-- Modals -->
+<div class ="modal fade" id="delete-modal" tabindex="-1" role="dialog" aria-labelledby="myModalLabel">
+	<div class="modal-dialog" role="document">
+		<div class="modal-content">
+			<form method="post">
+				<div class="modal-header">
+					<button type="button" class="close" data-dismiss="modal" aria-label="Close"><span aria-hidden="true">&times;</span></button>
+					<h4 class="modal-title" id="myModalLabel">{{lang_confirmDelete}}: <span id="delete-user-field"></span></h4>
+				</div>
+				<div class="modal-body">
+					<p>{{lang_userDeleteConfirm}}</p>
+				</div>
+				<div class="modal-footer">
+					<input type="hidden" name="action" value="deleteuser">
+					<input type="hidden" name="token" value="{{token}}">
+					<button type="button" class="btn btn-default" data-dismiss="modal">{{lang_cancel}}</button>
+					<button type="submit" id="delete-userid" name="userid" value="" class="btn btn-danger">
+						<span class="glyphicon glyphicon-trash"></span>
+						{{lang_delete}}
+					</button>
+				</div>
+			</form>
+		</div>
+	</div>
+</div>
\ No newline at end of file
diff --git a/modules-available/adduser/templates/user-permissions.html b/modules-available/adduser/templates/user-permissions.html
new file mode 100644
index 00000000..11ebd77a
--- /dev/null
+++ b/modules-available/adduser/templates/user-permissions.html
@@ -0,0 +1,34 @@
+<h3>{{lang_assignRoles}}</h3>
+
+<table class="table table-condensed table-hover">
+	<thead>
+	<tr>
+		<th data-sort="string">{{lang_role}}</th>
+		<th class="text-center slx-smallcol"></th>
+	</tr>
+	</thead>
+
+	<tbody>
+	{{#roles}}
+		<tr>
+			<td class="rolename">{{rolename}}</td>
+			<td class="text-center">
+				<div class="checkbox">
+					<input type="checkbox" name="roles[]" value="{{roleid}}" {{#hasRole}}checked{{/hasRole}}>
+					<label></label>
+				</div>
+			</td>
+		</tr>
+	{{/roles}}
+	</tbody>
+</table>
+
+<div class="row">
+	<div class="col-md-4"></div>
+	<div class="col-md-8">
+		<button class="btn btn-lg btn-primary btn-block save-btn" type="submit">
+			<span class="glyphicon glyphicon-floppy-disk"></span>
+			{{lang_save}}
+		</button>
+	</div>
+</div>
\ No newline at end of file