except remember user, changed all cookies to sessions.

admin.php

@@ -8,10 +8,10 @@ foreach (glob('components/admin/*.php') as $file)
 
 include_once 'components/head.php';
 
-if (!isset($_COOKIE['role_id']))
+if (!isset($_SESSION['role_id']))
     header('Location: user.php');
-else if ($_COOKIE['role_id'] >= 3)
+else if ($_SESSION['role_id'] >= 3)
-    header('Location: user.php?action=view&user_id=' . $_COOKIE['user_id']);
+    header('Location: user.php?action=view&user_id=' . $_SESSION['user_id']);
 
 include_once 'functions/admin_functions.php';
 

articles.php

@@ -21,7 +21,7 @@ if (isset($_POST['form_id'])) {
                 update_article($_POST['article_id'], $_POST['title'], $_POST['excerpt'], $tags, $_POST['markdown']);
                 header('Location: articles.php?article_id=' . $_POST['article_id']);
             } else {
-                $id = create_article($_COOKIE['user_id'], $_POST['title'], $_POST['excerpt'], (isset($_POST['tags']) ? $_POST['tags'] : []), $_POST['markdown']);
+                $id = create_article($_SESSION['user_id'], $_POST['title'], $_POST['excerpt'], (isset($_POST['tags']) ? $_POST['tags'] : []), $_POST['markdown']);
                 header('Location: articles.php?article_id=' . $id);
             }
 
@@ -50,7 +50,7 @@ if (isset($_POST['form_id'])) {
                 echo article_list(article_ids_by_newest());
             break;
         case 'read':
-            if (isset($_COOKIE['user_id']) && isset($_GET['article_id'])) {
+            if (isset($_SESSION['user_id']) && isset($_GET['article_id'])) {
                 increment_read_counter($_GET['article_id']);
                 echo article_page_from_markdown($_GET['article_id']);
             } else {
@@ -67,7 +67,7 @@ if (isset($_POST['form_id'])) {
     }
 }
 
-if (($view == 'list' || $view == 'sort') && (isset($_COOKIE['role_id']) && $_COOKIE['role_id'] <= 3)) {
+if (($view == 'list' || $view == 'sort') && (isset($_SESSION['role_id']) && $_SESSION['role_id'] <= 3)) {
     echo '
         <div id="floating_compose">
             <a href="articles.php?view=compose"><i class="nf nf-md-note_plus"></i></a>

components/article/article.php

@@ -18,7 +18,7 @@ function article_page_from_markdown($article_id)
             
             <div class="row">
                 <h1>' . $article['title'] . '</h1>
-                ' . (isset($_COOKIE['user_id']) && $_COOKIE['user_id'] == $article['author_id'] ? '<a href="articles.php?view=compose&article_id=' . $article_id . '"><i class="nf nf-fa-edit"></i></a>' : '') . '
+                ' . (isset($_SESSION['user_id']) && $_SESSION['user_id'] == $article['author_id'] ? '<a href="articles.php?view=compose&article_id=' . $article_id . '"><i class="nf nf-fa-edit"></i></a>' : '') . '
             </div>
             <div class="row">
                 <div class="col_right">

components/nav.php

@@ -9,15 +9,15 @@ $nav = '
           <li><a href="/articles.php?view=sort&sort=newest"' . ($current_page == '/articles.php' ? ' class="underline"' : '') . '>Articles</a></li>
 ';
 
-if (isset($_COOKIE['role_id']) && $_COOKIE['role_id'] <= 2) {
+if (isset($_SESSION['role_id']) && $_SESSION['role_id'] <= 2) {
     $nav .= '
           <li><a href="/admin.php?view=users"' . ($current_page == '/admin.php' ? ' class="underline"' : '') . '>Admin</a></li>
     ';
 }
 
-if (isset($_COOKIE['user_id'])) {
+if (isset($_SESSION['user_id'])) {
     $nav .= '
-          <li><a href="/user.php?view=display&user_id=' . $_COOKIE['user_id'] . '"' . ($current_page == '/user.php' ? ' class="underline"' : '') . '>Account</a></li>
+          <li><a href="/user.php?view=display&user_id=' . $_SESSION['user_id'] . '"' . ($current_page == '/user.php' ? ' class="underline"' : '') . '>Account</a></li>
     ';
 }
 
@@ -39,7 +39,7 @@ $nav .= '
         </form>
 ';
 
-if (isset($_COOKIE['username'])) {
+if (isset($_SESSION['username'])) {
     $nav .= '
         <a href="user.php?view=logout">Log Out</a>
   ';

components/user/request_role_change.php

@@ -8,7 +8,7 @@ function request_role_change_form()
     while ($row = $result->fetch_assoc()) {
         $roles .= '
             <label class="form_checkbox_container">' . $row['role'] . '
-                <input name="requested_role" value="' . $row['role_id'] . '" type="radio"' . ($row['role_id'] == $_COOKIE['role_id'] ? ' checked' : '') . '>
+                <input name="requested_role" value="' . $row['role_id'] . '" type="radio"' . ($row['role_id'] == $_SESSION['role_id'] ? ' checked' : '') . '>
                 <span class="checkmark"></span>
             </label>
         ';

components/user/user_view.php

@@ -19,7 +19,7 @@ function user_view($user_id)
     // TODO: Allow user to update profile picture.
     // <button id="update_profile_picture_form_button" class="modal_button underline">Update Profile Picture</button>
     // <div id="update_profile_picture_form" class="modal_form">' . update_profile_picture_form() . '</div>
-    if ((isset($_COOKIE['user_id']) && $_COOKIE['user_id'] == $user_id) || (isset($_COOKIE['role_id']) && $_COOKIE['role_id'] <= 2)) {
+    if ((isset($_SESSION['user_id']) && $_SESSION['user_id'] == $user_id) || (isset($_SESSION['role_id']) && $_SESSION['role_id'] <= 2)) {
         $view .= '
             <h3>User Actions</h3>
             <div class="user_actions">

functions/account_functions.php

@@ -22,34 +22,19 @@ function username_exists($username)
     return true;
 }
 
-function cookies($user, $time)
-{
-    setcookie('user_id', $user['user_id'], $time);
-    setcookie('username', $user['username'], $time);
-    setcookie('email', $user['email'], $time);
-    setcookie('role_id', $user['role_id'], $time);
-    setcookie('profile_picture', $user['profile_picture'], $time);
-}
-
 function logout()
 {
-    foreach (array_keys($_COOKIE) as $key) {
+    foreach (array_keys($_SESSION) as $key)
-        setcookie($key, '', time() - 3600, '/');
-        unset($_COOKIE[$key]);
-    }
-
-    foreach (array_keys($_SESSION) as $key) {
         unset($_SESSION[$key]);
-    }
 
-    header('Location: articles.php');
+    header('Location: .');
 }
 
 function login($username, $password, $stay_logged_in)
 {
     $password_hash = hash('sha256', $password);
 
-    $user = exec_stmt('SELECT user_id, username, email, role_id, profile_picture FROM user WHERE username = ? OR email = ? AND password_hash = ?', 'sss', $username, $username, $password_hash)->fetch_assoc();
+    $user = exec_stmt('SELECT user_id, username, role_id FROM user WHERE username = ? OR email = ? AND password_hash = ?', 'sss', $username, $username, $password_hash)->fetch_assoc();
 
     if ($user == null) {
         $error_msg = '
@@ -61,8 +46,8 @@ function login($username, $password, $stay_logged_in)
         return $error_msg;
     }
 
-    $time = time() + 60 * 60 * 1;
+    $_SESSION['user_id'] = $user['user_id'];
-    cookies($user, $time);
+    $_SESSION['username'] = $user['role_id'];
 
     if ($stay_logged_in) {
         $token = bin2hex(random_bytes(64));
@@ -247,7 +232,7 @@ function delete_account($user_id, $password = null, $verify_password = null)
 
         exec_stmt('DELETE FROM user WHERE user_id = ?', 'i', $user_id);
         logout();
-    } else if ($_COOKIE['role_id'] <= 2) {
+    } else if ($_SESSION['role_id'] <= 2) {
         $user = exec_stmt('SELECT user_id, profile_picture FROM user WHERE user_id = ?', 'i', $user_id)->fetch_assoc();
 
         if ($user['user_id'] == 2025) {

functions/init.php

@@ -21,23 +21,15 @@ if (!isset($_SESSION['initialized'])) {
 }
 
 // Update the database and cookies to keep the user logged in.
-if (isset($_COOKIE['user_id'])) {
+if (isset($_SESSION['user_id'])) {
     $conn = get_connection();
     $stmt = $conn->prepare('UPDATE user SET is_active = true WHERE user_id = ?');
-    $stmt->bind_param('i', $_COOKIE['user_id']);
+    $stmt->bind_param('i', $_SESSION['user_id']);
     $stmt->execute();
 
     $stmt = $conn->prepare('UPDATE user SET last_active = CURRENT_TIMESTAMP WHERE user_id = ?');
-    $stmt->bind_param('i', $_COOKIE['user_id']);
+    $stmt->bind_param('i', $_SESSION['user_id']);
     $stmt->execute();
-
-    $stmt = $conn->prepare('SELECT user_id, username, email, role_id, profile_picture FROM user WHERE user_id = ?');
-    $stmt->bind_param('i', $_COOKIE['user_id']);
-    $stmt->execute();
-    $user = $stmt->get_result()->fetch_assoc();
-
-    $time = time() + 60 * 15;
-    cookies($user, $time);
 } else if (isset($_COOKIE['remember_user'])) {
     $conn = get_connection();
     $stmt = $conn->prepare('SELECT * FROM remember_user WHERE token = ?');
@@ -49,21 +41,21 @@ if (isset($_COOKIE['user_id'])) {
         // TODO: Log the attempt to use a cookie from a different browser/device than the cookie was created
         echo "Naughty, you are trying to use someone else's cookie...";
     } else {
-        $stmt = $conn->prepare('SELECT user_id, username, email, role_id, profile_picture FROM user WHERE user_id = ?');
+        $stmt = $conn->prepare('SELECT user_id, username, role_id FROM user WHERE user_id = ?');
         $stmt->bind_param('s', $remember['user_id']);
         $stmt->execute();
         $user = $stmt->get_result()->fetch_assoc();
 
-        $conn = get_connection();
+        $_SESSION['user_id'] = $user['user_id'];
+        $_SESSION['username'] = $user['username'];
+        $_SESSION['role_id'] = $user['role_id'];
+
         $stmt = $conn->prepare('UPDATE user SET is_active = true WHERE user_id = ?');
-        $stmt->bind_param('i', $_COOKIE['user_id']);
+        $stmt->bind_param('i', $_SESSION['user_id']);
         $stmt->execute();
 
         $stmt = $conn->prepare('UPDATE user SET last_active = CURRENT_TIMESTAMP WHERE user_id = ?');
-        $stmt->bind_param('i', $_COOKIE['user_id']);
+        $stmt->bind_param('i', $_SESSION['user_id']);
         $stmt->execute();
-
-        $time = time() + 60 * 15;
-        cookies($user, $time);
     }
 }

resources/LICENSE.md

@@ -1,45 +0,0 @@
-The work in the Hack project is Copyright 2018 Source Foundry Authors and licensed under the MIT License
-
-The work in the DejaVu project was committed to the public domain.
-
-Bitstream Vera Sans Mono Copyright 2003 Bitstream Inc. and licensed under the Bitstream Vera License with Reserved Font Names "Bitstream" and "Vera"
-
-### MIT License
-
-Copyright (c) 2018 Source Foundry Authors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
-
-### BITSTREAM VERA LICENSE
-
-Copyright (c) 2003 by Bitstream, Inc. All Rights Reserved. Bitstream Vera is a trademark of Bitstream, Inc.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of the fonts accompanying this license ("Fonts") and associated documentation files (the "Font Software"), to reproduce and distribute the Font Software, including without limitation the rights to use, copy, merge, publish, distribute, and/or sell copies of the Font Software, and to permit persons to whom the Font Software is furnished to do so, subject to the following conditions:
-
-The above copyright and trademark notices and this permission notice shall be included in all copies of one or more of the Font Software typefaces.
-
-The Font Software may be modified, altered, or added to, and in particular the designs of glyphs or characters in the Fonts may be modified and additional glyphs or characters may be added to the Fonts, only if the fonts are renamed to names not containing either the words "Bitstream" or the word "Vera".
-
-This License becomes null and void to the extent applicable to Fonts or Font Software that has been modified and is distributed under the "Bitstream Vera" names.
-
-The Font Software may be sold as part of a larger software package but no copy of one or more of the Font Software typefaces may be sold by itself.
-
-THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL BITSTREAM OR THE GNOME FOUNDATION BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM OTHER DEALINGS IN THE FONT SOFTWARE.
-
-Except as contained in this notice, the names of Gnome, the Gnome Foundation, and Bitstream Inc., shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Font Software without prior written authorization from the Gnome Foundation or Bitstream Inc., respectively. For further information, contact: fonts at gnome dot org.

resources/README.md

@@ -1,48 +0,0 @@
-# Nerd Fonts
-
-This is an archived font from the Nerd Fonts release v3.3.0.
-
-For more information see:
-* https://github.com/ryanoasis/nerd-fonts/
-* https://github.com/ryanoasis/nerd-fonts/releases/latest/
-
-# Hack
-
-A typeface designed for source code.
-
-For more information have a look at the upstream website: https://github.com/source-foundry/Hack
-
-Version: 3.003
-
-## Which font?
-
-### TL;DR
-
-* Pick your font family:
-  * If you are limited to monospaced fonts (because of your terminal, etc) then pick a font with `Nerd Font Mono` (or `NFM`).
-  * If you want to have bigger icons (usually around 1.5 normal letters wide) pick a font without `Mono` i.e. `Nerd Font` (or `NF`). Most terminals support this, but ymmv.
-  * If you work in a proportional context (GUI elements or edit a presentation etc) pick a font with `Nerd Font Propo` (or `NFP`).
-
-### Ligatures
-
-Ligatures are generally preserved in the patched fonts.
-Nerd Fonts `v2.0.0` had no ligatures in the `Nerd Font Mono` fonts, this has been dropped with `v2.1.0`.
-If you have a ligature-aware terminal and don't want ligatures you can (usually) disable them in the terminal settings.
-
-### Explanation
-
-Once you narrow down your font choice of family (`Droid Sans`, `Inconsolata`, etc) and style (`bold`, `italic`, etc) you have 2 main choices:
-
-#### `Option 1: Download already patched font`
-
- * For a stable version download a font package from the [release page](https://github.com/ryanoasis/nerd-fonts/releases)
- * Or download the development version from the folders here
-
-#### `Option 2: Patch your own font`
-
- * Patch your own variations with the various options provided by the font patcher (i.e. not include all symbols for smaller font size)
-
-For more information see: [The FAQ](https://github.com/ryanoasis/nerd-fonts/wiki/FAQ-and-Troubleshooting#which-font)
-
-[SIL-RFN]:http://scripts.sil.org/cms/scripts/page.php?item_id=OFL_web_fonts_and_RFNs#14cbfd4a
-

user.php

@@ -27,7 +27,7 @@ if (isset($_POST['form_id'])) {
 
             if ($msg === true) {
                 login($_POST['username'], $_POST['password'], false);
-                header('Location: user.php?action=view&user_id=' . $_COOKIE['user_id']);
+                header('Location: user.php?action=view&user_id=' . $_SESSION['user_id']);
             }
             break;
         case 'login_form':
@@ -45,7 +45,7 @@ if (isset($_POST['form_id'])) {
             break;
         case 'reset_pw_form':
             $msg = reset_password(
-                ($_COOKIE['role_id'] <= 2 && $_COOKIE['user_id'] != $_POST['user_id'] ? $_POST['user_id'] : $_COOKIE['user_id']),
+                ($_SESSION['role_id'] <= 2 && $_SESSION['user_id'] != $_POST['user_id'] ? $_POST['user_id'] : $_SESSION['user_id']),
                 $_POST['new_pw'],
                 $_POST['verify_new_pw']
             );
@@ -53,7 +53,7 @@ if (isset($_POST['form_id'])) {
             break;
         case 'update_email_form':
             $msg = update_email(
-                ($_COOKIE['role_id'] <= 2 && $_COOKIE['user_id'] != $_POST['user_id'] ? $_POST['user_id'] : $_COOKIE['user_id']),
+                ($_SESSION['role_id'] <= 2 && $_SESSION['user_id'] != $_POST['user_id'] ? $_POST['user_id'] : $_SESSION['user_id']),
                 $_POST['new_email'],
                 $_POST['verify_new_email']
             );
@@ -61,23 +61,23 @@ if (isset($_POST['form_id'])) {
             break;
         case 'update_username_form':
             $msg = update_username(
-                ($_COOKIE['role_id'] <= 2 && $_COOKIE['user_id'] != $_POST['user_id'] ? $_POST['user_id'] : $_COOKIE['user_id']),
+                ($_SESSION['role_id'] <= 2 && $_SESSION['user_id'] != $_POST['user_id'] ? $_POST['user_id'] : $_SESSION['user_id']),
                 $_POST['new_username'],
                 $_POST['verify_new_username']
             );
             break;
         case 'update_profile_picture_form':
-            update_profile_picture();
+            update_profile_picture($_SESSION['user_id']);
             break;
         case 'request_role_change_form':
             request_role_change(
-                $_COOKIE['user_id'],
+                $_SESSION['user_id'],
                 $_POST['requested_role']
             );
             break;
         case 'delete_account_form':
             $msg = delete_account(
-                ($_COOKIE['role_id'] <= 2 && $_COOKIE['user_id'] != $_POST['user_id'] ? $_POST['user_id'] : $_COOKIE['user_id']),
+                ($_SESSION['role_id'] <= 2 && $_SESSION['user_id'] != $_POST['user_id'] ? $_POST['user_id'] : $_SESSION['user_id']),
                 $_POST['delete_password'],
                 $_POST['delete_verify_password']
             );