From d8055192991ac8504e48c137038879790c762d2d Mon Sep 17 00:00:00 2001 From: Camil Staps Date: Tue, 26 Jul 2016 14:27:14 +0200 Subject: Adding and deleting users --- classes/user.php | 19 +++++ include/clients-overview.php | 2 +- include/settings.php | 170 ++++++++++++++++++++++++++++++++++++------- include/users-new.php | 42 +++++++++++ index.php | 73 ++++++++++--------- install/index.php | 2 +- login-ajax.php | 7 +- login.php | 11 +++ 8 files changed, 262 insertions(+), 64 deletions(-) create mode 100644 include/users-new.php diff --git a/classes/user.php b/classes/user.php index e50f773..750e8bb 100644 --- a/classes/user.php +++ b/classes/user.php @@ -33,6 +33,16 @@ class user { */ protected $pdo, $id, $username, $password; + /** + * Generate a random password + * + * @return string The password + */ + public static function generateRandomPassword() { + return preg_replace('/[^\w]/', '', + base64_encode(bin2hex(openssl_random_pseudo_bytes(4)))); + } + /** * Hash a password * @@ -140,6 +150,15 @@ class user { // Other functions //------------------------------------------------------------------------------ + /** + * Check if a user has administrator rights + * + * @return bool True iff the user has administrator rights + */ + public function isAdmin() { + return $this->getId() == 1; + } + /** * Verify a password * diff --git a/include/clients-overview.php b/include/clients-overview.php index 7ce45a6..fc2c3a0 100644 --- a/include/clients-overview.php +++ b/include/clients-overview.php @@ -70,7 +70,7 @@ require_once('./login.php');
diff --git a/include/settings.php b/include/settings.php index 7dfbbc3..896152c 100644 --- a/include/settings.php +++ b/include/settings.php @@ -35,43 +35,163 @@ require('./header.php'); + isAdmin()) { + try { + $user = new user($_pdo, $_GET['delete_user']); + if ($user->delete()) { + echo "
The user with username {$user->getUsername()} has been removed.
"; + } else { + echo "
The user with username {$user->getUsername()} could not be removed.
"; + } + } catch (PDOException $e) { + echo "
The user with username {$user->getUsername()} could not be removed due to a PDO error.
"; + } catch (Exception $e) { + echo "
The user with id {$_GET['delete_user']} could not be found.
"; + } + } + ?> +
Password
-
- The passwords don\'t match.
'; - } else if (!$_user->verifyPassword($_POST['password_current'])) { - echo '
The current password was incorrect.
'; - } else { - try { - $_user->setPassword($_POST['password_update']); - echo '
Password successfully changed.
'; - } catch (PDOException $e) { - echo '
An unknown error occurred.
'; - } +
+ The passwords don\'t match.
'; + } else if (!$_user->verifyPassword($_POST['password_current'])) { + echo '
The current password was incorrect.
'; + } else { + try { + $_user->setPassword($_POST['password_update']); + echo '
Password successfully changed.
'; + } catch (PDOException $e) { + echo '
An unknown error occurred.
'; } } - ?> -
-
- -
-
- -
+ } + ?> + +
+ +
+
+ +
+
+ +
+ +
+
+
+
+ +
+
+
Users
+
+ + + + + + isAdmin()) echo ''; ?> + + + + getId()}' + data-mixer-order-username='{$user->getUsername()}'> + + "; + if ($_user->isAdmin()) { + if ($user->getId() == $_user->getId()) { + echo ""; + } else { + echo ""; + } + } + echo ""; + } + ?> + +
#UsernameTools
{$user->getId()}{$user->getUsername()} + + + +
+
+
+
+ + isAdmin()) : ?> +
+
+
Create new
+
+
+
- + +
- +
+
- + diff --git a/include/users-new.php b/include/users-new.php new file mode 100644 index 0000000..5d86a83 --- /dev/null +++ b/include/users-new.php @@ -0,0 +1,42 @@ +. + */ + +define('REQUIRE_ADMIN', true); + +require_once('./conf.php'); +require_once('./login-ajax.php'); + +$response = new response(); + +try { + $pass = user::generateRandomPassword(); + $user = BusinessAdmin::createUser($_pdo, $_REQUEST['username'], $pass); + + if ($user === false) { + $response->success = false; + $response->message = "The user could not be created due to an error."; + } else { + $response->success = true; + $response->message = "User '{$user->getUsername()}' has been created with password $pass. Refresh the page."; + } +} catch (PDOException $e) { + $response->success = false; + $response->message = "The user could not be created due to a PDO error ({$e->getMessage()})."; +} +echo $response->getJson(); diff --git a/index.php b/index.php index 3c8d842..a689f7e 100644 --- a/index.php +++ b/index.php @@ -1,31 +1,31 @@ . + * along with this program. If not, see . */ -/** - * Load the basic configuration (sessions, database, class autoloading, etc.) +/** + * Load the basic configuration (sessions, database, class autoloading, etc.) */ require_once('./conf.php'); @@ -36,38 +36,39 @@ $_request = str_replace(constants::url_internal, '', $_request); // This is the REQUEST_URI switch // The default shows a 404 page $pages = array( - '/' => './include/home.php', - '/clients' => './include/clients.php', - '/clients/new' => './include/clients-new.php', - '/clients/edit' => './include/clients-edit.php', - '/contacts' => './include/contacts.php', - '/contacts/new' => './include/contacts-new.php', - '/contacts/edit' => './include/contacts-edit.php', - '/offers' => './include/offers.php', - '/offers/new' => './include/offers-new.php', - '/offers/edit' => './include/offers-edit.php', - '/assignments' => './include/assignments.php', - '/assignments/new' => './include/assignments-new.php', - '/assignments/edit' => './include/assignments-edit.php', - '/discounts' => './include/discounts.php', - '/discounts/new' => './include/discounts-new.php', - '/discounts/edit' => './include/discounts-edit.php', - '/about' => './include/about.php', - '/settings' => './include/settings.php', - '/ajax/collapse' => './include/ajax-collapse.php' + '/' => './include/home.php', + '/clients' => './include/clients.php', + '/clients/new' => './include/clients-new.php', + '/clients/edit' => './include/clients-edit.php', + '/contacts' => './include/contacts.php', + '/contacts/new' => './include/contacts-new.php', + '/contacts/edit' => './include/contacts-edit.php', + '/offers' => './include/offers.php', + '/offers/new' => './include/offers-new.php', + '/offers/edit' => './include/offers-edit.php', + '/assignments' => './include/assignments.php', + '/assignments/new' => './include/assignments-new.php', + '/assignments/edit' => './include/assignments-edit.php', + '/discounts' => './include/discounts.php', + '/discounts/new' => './include/discounts-new.php', + '/discounts/edit' => './include/discounts-edit.php', + '/about' => './include/about.php', + '/settings' => './include/settings.php', + '/users/new' => './include/users-new.php', + '/ajax/collapse' => './include/ajax-collapse.php' ); $_page = null; foreach ($pages as $uri => $path) { - if ($_request == $uri && file_exists($path)) { - $_page = $uri; - require($path); - break; - } + if ($_request == $uri && file_exists($path)) { + $_page = $uri; + require($path); + break; + } } if ($_page === null) { - $_page = '/404'; - http_response_code(404); - require('./include/404.php'); + $_page = '/404'; + http_response_code(404); + require('./include/404.php'); } diff --git a/install/index.php b/install/index.php index 878fe38..213eec7 100644 --- a/install/index.php +++ b/install/index.php @@ -131,7 +131,7 @@ if (isset($_GET['create_folders'])) { if (isset($_GET['create_user'])) { $username = 'admin'; try { - $password = bin2hex(openssl_random_pseudo_bytes(8)); + $password = user::generateRandomPassword(); $user = BusinessAdmin::createUser($_pdo, $username, $password); if ($user !== false) { echo "Created user '$username' ({$user->getId()}) with password '$password'."; diff --git a/login-ajax.php b/login-ajax.php index f8e1424..beb2f66 100644 --- a/login-ajax.php +++ b/login-ajax.php @@ -30,8 +30,13 @@ require_once('./conf.php'); if (!isset($_SESSION['login']) || $_SESSION['login'] === false) { - print(json_encode(['error' => 'You need to be logged in.'])); + print(json_encode(['success' => false, 'message' => 'You need to be logged in.'])); die(); } $_user = new user($_pdo, $_SESSION['login']); + +if (defined('REQUIRE_ADMIN') && REQUIRE_ADMIN && !$_user->isAdmin()) { + print(json_encode(['success' => false, 'message' => 'You need to be an administrator.'])); + die(); +} diff --git a/login.php b/login.php index e60b7ed..d21fe79 100644 --- a/login.php +++ b/login.php @@ -87,3 +87,14 @@ if (!isset($_SESSION['login']) || $_SESSION['login'] === false) { } $_user = new user($_pdo, $_SESSION['login']); + +if (defined('REQUIRE_ADMIN') && REQUIRE_ADMIN && !$_user->isAdmin()) { + include('./header.php'); + include('./nav.php'); + ?> +

Access denied

+

You need to be an administrator to access this page.

+