Various platform tweaks (#14832)

* platform tweaks

* prevent failing if loaded twice

* Update Config.php

* Update PluginList.php

* Update Config.php

* Update IniFileChain.php

* Update Config.php

* Update Config.php

* allow configure different path for custom logo

* only show install plugin button when activated

* allow disable users and sites management

* do not allow calling set super user access

* Update PluginList.php

* Update Config.php

* Update global.ini.php

* Update Config.php

* Update global.ini.php

5 files changed, 38 insertions, 7 deletions

diff --git a/plugins/UsersManager/API.php b/plugins/UsersManager/API.php
index fac5b6178d..d2614f581d 100644
--- a/plugins/UsersManager/API.php
+++ b/plugins/UsersManager/API.php
@@ -651,6 +651,7 @@ class API extends \Piwik\Plugin\API
     public function addUser($userLogin, $password, $email, $alias = false, $_isPasswordHashed = false, $initialIdSite = null)
     {
         Piwik::checkUserHasSomeAdminAccess();
+        UsersManager::dieIfUsersAdminIsDisabled();
 
         if (!Piwik::hasUserSuperUserAccess()) {
             if (empty($initialIdSite)) {
@@ -709,6 +710,7 @@ class API extends \Piwik\Plugin\API
     {
         Piwik::checkUserHasSuperUserAccess();
         $this->checkUserIsNotAnonymous($userLogin);
+        UsersManager::dieIfUsersAdminIsDisabled();
 
         $requirePasswordConfirmation = self::$SET_SUPERUSER_ACCESS_REQUIRE_PASSWORD_CONFIRMATION;
         self::$SET_SUPERUSER_ACCESS_REQUIRE_PASSWORD_CONFIRMATION = true;
@@ -874,6 +876,7 @@ class API extends \Piwik\Plugin\API
         $isEmailNotificationOnInConfig = Config::getInstance()->General['enable_update_users_email'];
 
         Piwik::checkUserHasSuperUserAccessOrIsTheUser($userLogin);
+        UsersManager::dieIfUsersAdminIsDisabled();
         $this->checkUserIsNotAnonymous($userLogin);
         $this->checkUserExists($userLogin);
 
@@ -957,6 +960,7 @@ class API extends \Piwik\Plugin\API
     public function deleteUser($userLogin)
     {
         Piwik::checkUserHasSuperUserAccess();
+        UsersManager::dieIfUsersAdminIsDisabled();
         $this->checkUserIsNotAnonymous($userLogin);
 
         $this->checkUserExist($userLogin);
@@ -1049,6 +1053,8 @@ class API extends \Piwik\Plugin\API
      */
     public function setUserAccess($userLogin, $access, $idSites)
     {
+        UsersManager::dieIfUsersAdminIsDisabled();
+
         if ($access != 'noaccess') {
             $this->checkAccessType($access);
         }
diff --git a/plugins/UsersManager/Controller.php b/plugins/UsersManager/Controller.php
index a9e2ffcf5b..3d67327469 100644
--- a/plugins/UsersManager/Controller.php
+++ b/plugins/UsersManager/Controller.php
@@ -15,6 +15,7 @@ use Piwik\Common;
 use Piwik\Container\StaticContainer;
 use Piwik\Option;
 use Piwik\Piwik;
+use Piwik\Plugin;
 use Piwik\Plugin\ControllerAdmin;
 use Piwik\Plugins\LanguagesManager\API as APILanguagesManager;
 use Piwik\Plugins\LanguagesManager\LanguagesManager;
@@ -53,6 +54,7 @@ class Controller extends ControllerAdmin
     {
         Piwik::checkUserIsNotAnonymous();
         Piwik::checkUserHasSomeAdminAccess();
+        UsersManager::dieIfUsersAdminIsDisabled();
 
         $view = new View('@UsersManager/index');
 
@@ -183,6 +185,7 @@ class Controller extends ControllerAdmin
         $view->userEmail = $user['email'];
         $view->userTokenAuth = Piwik::getCurrentUserTokenAuth();
         $view->ignoreSalt = $this->getIgnoreCookieSalt();
+        $view->isUsersAdminEnabled = UsersManager::isUsersAdminEnabled();
 
         $newsletterSignupOptionKey = NewsletterSignup::NEWSLETTER_SIGNUP_OPTION . $userLogin;
         $view->showNewsletterSignup = Option::get($newsletterSignupOptionKey) === false
@@ -210,11 +213,14 @@ class Controller extends ControllerAdmin
             $view->defaultReportSiteName = Site::getNameFor($defaultReport);
         }
 
-        $view->defaultReportOptions = array(
-            array('key' => 'MultiSites', 'value' => Piwik::translate('General_AllWebsitesDashboard')),
-            array('key' => $reportOptionsValue, 'value' => Piwik::translate('General_DashboardForASpecificWebsite')),
-        );
+        $defaultReportOptions = array();
+        if (Plugin\Manager::getInstance()->isPluginActivated('MultiSites')) {
+            $defaultReportOptions[] = array('key' => 'MultiSites', 'value' => Piwik::translate('General_AllWebsitesDashboard'));
+        }
 
+        $defaultReportOptions[] = array('key' => $reportOptionsValue, 'value' => Piwik::translate('General_DashboardForASpecificWebsite'));
+
+        $view->defaultReportOptions = $defaultReportOptions;
         $view->defaultDate = $this->getDefaultDateForUser($userLogin);
         $view->availableDefaultDates = $this->getDefaultDates();
 
@@ -383,7 +389,9 @@ class Controller extends ControllerAdmin
 
             Piwik::checkUserHasSuperUserAccessOrIsTheUser($userLogin);
 
-            $this->processPasswordChange($userLogin);
+            if (UsersManager::isUsersAdminEnabled()) {
+                $this->processPasswordChange($userLogin);
+            }
 
             LanguagesManager::setLanguageForSession($language);
 
diff --git a/plugins/UsersManager/Menu.php b/plugins/UsersManager/Menu.php
index 77fc8ced04..7945480d4e 100644
--- a/plugins/UsersManager/Menu.php
+++ b/plugins/UsersManager/Menu.php
@@ -15,7 +15,7 @@ class Menu extends \Piwik\Plugin\Menu
 {
     public function configureAdminMenu(MenuAdmin $menu)
     {
-        if (Piwik::isUserHasSomeAdminAccess()) {
+        if (Piwik::isUserHasSomeAdminAccess() && UsersManager::isUsersAdminEnabled()) {
             $menu->addSystemItem('UsersManager_MenuUsers', $this->urlForAction('index'), $order = 15);
         }
 
diff --git a/plugins/UsersManager/UsersManager.php b/plugins/UsersManager/UsersManager.php
index 7e3f6de428..ede90bea93 100644
--- a/plugins/UsersManager/UsersManager.php
+++ b/plugins/UsersManager/UsersManager.php
@@ -14,9 +14,11 @@ use Piwik\Access\Role\Write;
 use Piwik\API\Request;
 use Piwik\Auth\Password;
 use Piwik\Common;
+use Piwik\Config;
 use Piwik\Option;
 use Piwik\Piwik;
 use Piwik\Plugins\CoreHome\SystemSummary;
+use Piwik\Plugins\CorePluginsAdmin\CorePluginsAdmin;
 use Piwik\SettingsPiwik;
 
 /**
@@ -45,6 +47,19 @@ class UsersManager extends \Piwik\Plugin
         );
     }
 
+    public static function isUsersAdminEnabled()
+    {
+        return (bool) Config::getInstance()->General['enable_users_admin'];
+    }
+
+    public static function dieIfUsersAdminIsDisabled()
+    {
+        Piwik::checkUserIsNotAnonymous();
+        if (!self::isUsersAdminEnabled()) {
+            throw new \Exception('Creating, updating, and deleting users has been disabled.');
+        }
+    }
+
     public function addSystemSummaryItems(&$systemSummary)
     {
         $userLogins = Request::processRequest('UsersManager.getUsersLogin', array('filter_limit' => '-1'));
diff --git a/plugins/UsersManager/templates/userSettings.twig b/plugins/UsersManager/templates/userSettings.twig
index 567cac4984..22c9a58ccb 100644
--- a/plugins/UsersManager/templates/userSettings.twig
+++ b/plugins/UsersManager/templates/userSettings.twig
@@ -20,6 +20,7 @@
              inline-help="{{ 'UsersManager_YourUsernameCannotBeChanged'|translate|e('html_attr') }}">
         </div>
 
+        {% if isUsersAdminEnabled %}
         <div piwik-field uicontrol="text" name="email"
              ng-model="personalSettings.email"
              ng-change="personalSettings.requirePasswordConfirmation()"
@@ -27,6 +28,7 @@
              data-title="{{ 'UsersManager_Email'|translate|e('html_attr') }}"
              value="{{ userEmail }}">
         </div>
+        {% endif %}
 
         <div id="languageHelp" class="inline-help-node">
             <a target="_blank" rel="noreferrer noopener" href="https://matomo.org/translations/">
@@ -72,7 +74,7 @@
              value="{{ defaultDate }}" options="{{ availableDefaultDates|json_encode }}">
         </div>
 
-        {% if isValidHost is defined and isValidHost %}
+        {% if isValidHost is defined and isValidHost and isUsersAdminEnabled %}
 
             <div piwik-field uicontrol="password" name="password" autocomplete="off"
                  ng-model="personalSettings.password"