spaces/web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added login requirement to view articles to protect against potential data scrapping, with redirect functionality to the article the user attempts to view prior to login.

Browse Source
This commit is contained in:
jashton
2025-04-12 13:40:51 -06:00
parent f4dfaba1c6
commit 8d78a7d182
11 changed files with 102 additions and 195 deletions
Download Patch File Download Diff File Expand all files Collapse all files
articles.php
+7 -2
View File
@@ -36,7 +36,6 @@ if (!isset($_GET['article_id']) && !isset($_GET['tag']) && !isset($_GET['author_
</form> </form>
'; ';
echo ' echo '
<div class="article_cards_grid"> <div class="article_cards_grid">
<div class="article_filters"> <div class="article_filters">
@@ -50,7 +49,7 @@ if (!isset($_GET['article_id']) && !isset($_GET['tag']) && !isset($_GET['author_
</div> </div>
</div> </div>
'; ';
} else if (isset($_GET['article_id'])) { } else if (isset($_COOKIE['user_id']) && isset($_GET['article_id'])) {
increment_read_counter($_GET['article_id']); increment_read_counter($_GET['article_id']);
echo article_page_from_markdown($_GET['article_id']); echo article_page_from_markdown($_GET['article_id']);
} else if (isset($_GET['author_id'])) { } else if (isset($_GET['author_id'])) {
@@ -63,6 +62,12 @@ if (!isset($_GET['article_id']) && !isset($_GET['tag']) && !isset($_GET['author_
foreach ($ids as $id) foreach ($ids as $id)
echo article_card($id); echo article_card($id);
} else {
$redirect = (isset($_GET['article_id']) ? 'articles.php?article_id=' . $_GET['article_id'] : '');
if ($redirect)
header('Location: user.php?action=login&redirect=' . urlencode($redirect));
else
header('Location: articles.php');
} }
include_once 'components/foot.php'; include_once 'components/foot.php';
components/head.php
+6 -11
View File
@@ -4,18 +4,13 @@
<head> <head>
<link href="css/base.css" rel="stylesheet" type="text/css"> <link href="css/base.css" rel="stylesheet" type="text/css">
<link rel="stylesheet" href="https://nerdfonts.com/assets/css/webfont.css"> <link rel="stylesheet" href="https://nerdfonts.com/assets/css/webfont.css">
<link rel="icon" type="image/x-icon" href="data/vintagecoding-favicon.png"> <link rel="icon" type="image/x-icon" href="data/vintagecoding-favicon.png" </link>
<?php <?php
if ($_SESSION['theme'] == 'dark') { if (!isset($_SESSION['theme']) || $_SESSION['theme'] == 'dark')
echo ' echo '<link href="css/dark.css" rel="stylesheet" type="text/css">';
<link href="css/dark.css" rel="stylesheet" type="text/css"> else
'; echo '<link href="css/light.css" rel="stylesheet" type="text/css">';
} elseif ($_SESSION['theme'] == 'light') { ?>
echo '
<link href="css/light.css" rel="stylesheet" type="text/css">
';
}
?>
</head> </head>
components/nav.php
+1 -1
View File
@@ -41,7 +41,7 @@ else
$theme_toggle = 'dark'; $theme_toggle = 'dark';
$nav .= ' $nav .= '
<button id="theme-toggle" value="' . $theme_toggle . '" name="theme" onchange="this.form.submit()"><i class="nf ' . ($theme_toggle == 'dark' ? 'nf-oct-moon' : 'nf-oct-sun') . '"></i></button> <button id="theme_toggle" value="' . $theme_toggle . '" name="theme"><i class="nf ' . ($theme_toggle == 'dark' ? 'nf-oct-moon' : 'nf-oct-sun') . '"></i></button>
</form> </form>
'; ';
css/base.css
+1 -1
View File
@@ -305,7 +305,7 @@ i {
transition-duration: 500ms; transition-duration: 500ms;
} }
#theme-toggle { #theme_toggle {
background: none; background: none;
border: none; border: none;
} }
css/dark.css
+1 -1
View File
@@ -63,7 +63,7 @@ table tr {
color: white; color: white;
} }
#theme-toggle { #theme_toggle {
color: white; color: white;
} }
css/light.css
+1 -1
View File
@@ -63,7 +63,7 @@ table tr {
color: black; color: black;
} }
#theme-toggle { #theme_toggle {
color: black; color: black;
} }
functions/account_functions.php
+28 -82
View File
@@ -6,17 +6,15 @@ use Postmark\PostmarkClient;
function user_id_exists($user_id) function user_id_exists($user_id)
{ {
$conn = get_connection(); $result = exec_stmt('SELECT user_id FROM user WHERE user_id = ?', 'i', $user_id)->fetch_assoc();
$stmt = $conn->prepare('SELECT user_id FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
$result = $stmt->get_result()->fetch_assoc();
if ($result == null) if ($result == null)
return false; return false;
return true; return true;
} }
function username_exists($username) {}
function cookies($user, $time) function cookies($user, $time)
{ {
setcookie('user_id', $user['user_id'], $time); setcookie('user_id', $user['user_id'], $time);
@@ -72,11 +70,7 @@ function login($username, $password, $stay_logged_in)
{ {
$password_hash = hash('sha256', $password); $password_hash = hash('sha256', $password);
$conn = get_connection(); $user = exec_stmt('SELECT user_id, username, email, role_id, profile_picture FROM user WHERE username = ? OR email = ? AND password_hash = ?', 'sss', $username, $username, $password_hash)->fetch_assoc();
$stmt = $conn->prepare('SELECT user_id, username, email, role_id, profile_picture FROM user WHERE username = ? OR email = ? AND password_hash = ?');
$stmt->bind_param('sss', $username, $username, $password_hash);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user == null) { if ($user == null) {
$error_msg = ' $error_msg = '
@@ -97,9 +91,7 @@ function login($username, $password, $stay_logged_in)
// echo strlen($token); // echo strlen($token);
setcookie('remember_user', $token, time() + 60 * 60 * 24 * 30, '/', '', true, true); setcookie('remember_user', $token, time() + 60 * 60 * 24 * 30, '/', '', true, true);
$stmt = $conn->prepare('INSERT INTO remember_user (token, user_id, remote_addr, http_forward) VALUES (?, ?, ?, ?)'); exec_stmt('INSERT INTO remember_user (token, user_id, remote_addr, http_forward) VALUES (?, ?, ?, ?)', 'siss', $token, $user['user_id'], hash('sha256', $_SERVER['REMOTE_ADDR']), (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? hash('sha256', $_SERVER['HTTP_X_FORWARDED_FOR']) : null));
$stmt->bind_param('siss', $token, $user['user_id'], hash('sha256', $_SERVER['REMOTE_ADDR']), (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? hash('sha256', $_SERVER['HTTP_X_FORWARDED_FOR']) : null));
$stmt->execute();
} }
return true; return true;
@@ -177,6 +169,14 @@ function create_user($username, $email, $password, $verify_password, $role_id, $
return $error_msg; return $error_msg;
} }
if (username_exists($username)) {
$error_msg = '
<div class="error">
Username is taken!
</div>
';
}
$password_hash = hash('sha256', $password); $password_hash = hash('sha256', $password);
$id = rand(1000, 999999999); $id = rand(1000, 999999999);
@@ -188,7 +188,7 @@ function create_user($username, $email, $password, $verify_password, $role_id, $
$orig_width = $orig_size[0]; $orig_width = $orig_size[0];
$orig_height = $orig_size[1]; $orig_height = $orig_size[1];
$crop_size = min($orig_width, $orig_height) * .56; $crop_size = min($orig_width, $orig_height) * 0.56;
crop_image($upload['profile_picture']['tmp_name'], $x, $y, $crop_size, $crop_size); crop_image($upload['profile_picture']['tmp_name'], $x, $y, $crop_size, $crop_size);
$target = upload($upload['profile_picture'], $_ENV['PROFILE_IMAGES_FQ_PATH'], $id); $target = upload($upload['profile_picture'], $_ENV['PROFILE_IMAGES_FQ_PATH'], $id);
@@ -196,11 +196,7 @@ function create_user($username, $email, $password, $verify_password, $role_id, $
$target = 'default-profile.png'; $target = 'default-profile.png';
} }
$conn = get_connection(); exec_stmt('INSERT INTO user (user_id, username, email, password_hash, role_id, profile_picture) VALUES (?, ?, ?, ?, ?, ?)', 'isssis', $id, $username, $email, $password_hash, $role_id, $target);
$stmt = $conn->prepare('INSERT INTO user (user_id, username, email, password_hash, role_id, profile_picture) VALUES (?, ?, ?, ?, ?, ?)');
$stmt->bind_param('isssis', $id, $username, $email, $password_hash, $role_id, $target);
$stmt->execute();
return true; return true;
} }
@@ -263,10 +259,7 @@ function reset_password($user_id, $new_password, $verify_new_password)
} }
$password_hash = hash('sha256', $new_password); $password_hash = hash('sha256', $new_password);
$conn = get_connection(); exec_stmt('UPDATE user SET password_hash = ? WHERE user_id = ?', 'si', $password_hash, $user_id);
$stmt = $conn->prepare('UPDATE user SET password_hash = ? WHERE user_id = ?');
$stmt->bind_param('si', $password_hash, $user_id);
$stmt->execute();
} }
function update_email_form() function update_email_form()
@@ -305,10 +298,7 @@ function update_email($user_id, $new_email, $verify_new_email)
return $error_msg; return $error_msg;
} }
$conn = get_connection(); exec_stmt('UPDATE user SET email = ? WHERE user_id = ?', 'si', $new_email, $user_id);
$stmt = $conn->prepare('UPDATE user SET email = ? WHERE user_id = ?');
$stmt->bind_param('si', $new_email, $user_id);
$stmt->execute();
} }
function update_username_form() function update_username_form()
@@ -347,25 +337,10 @@ function update_username($user_id, $new_username, $verify_new_username)
return $error_msg; return $error_msg;
} }
$conn = get_connection(); if ($result = username_exists($new_username))
$stmt = $conn->prepare('SELECT username FROM user WHERE username = ?'); return $result;
$stmt->bind_param('s', $new_username);
$stmt->execute();
$result = $stmt->get_result()->fetch_assoc();
if ($result != null) { exec_stmt('UPDATE user SET username = ? WHERE user_id = ?', 'si', $new_username, $user_id);
$error_msg = '
<div class="error">
Usernames is taken!
</div>
';
return $error_msg;
}
$stmt = $conn->prepare('UPDATE user SET username = ? WHERE user_id = ?');
$stmt->bind_param('si', $new_username, $user_id);
$stmt->execute();
} }
function update_profile_picture_form() function update_profile_picture_form()
@@ -438,16 +413,8 @@ function request_role_change_form()
function request_role_change($user_id, $new_role_id) function request_role_change($user_id, $new_role_id)
{ {
$conn = get_connection(); $user = exec_stmt('SELECT user_id, username, email, roles.role, created_at FROM user INNER JOIN roles WHERE user.role_id = roles.role_id AND user_id = ?', 'i', $user_id)->fetch_assoc();
$stmt = $conn->prepare('SELECT user_id, username, email, roles.role, created_at FROM user INNER JOIN roles WHERE user.role_id = roles.role_id AND user_id = ?'); $new_role = exec_stmt('SELECT role FROM roles WHERE role_id = ?', 'i', $new_role_id)->fetch_array();
$stmt->bind_param('i', $user_id);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
$stmt = $conn->prepare('SELECT role FROM roles WHERE role_id = ?');
$stmt->bind_param('i', $new_role_id);
$stmt->execute();
$new_role = $stmt->get_result()->fetch_array();
$email_html = ' $email_html = '
<h1>User Role Change Request</h1> <h1>User Role Change Request</h1>
@@ -461,7 +428,7 @@ function request_role_change($user_id, $new_role_id)
$client = new PostmarkClient($_ENV['POSTMARK_API_TOKEN']); $client = new PostmarkClient($_ENV['POSTMARK_API_TOKEN']);
$send_result = $client->sendEmail( $client->sendEmail(
'mailer@joshashton.dev', 'mailer@joshashton.dev',
'me@joshashton.dev', 'me@joshashton.dev',
'User Role Change Request - ' . $user['user_id'], 'User Role Change Request - ' . $user['user_id'],
@@ -515,15 +482,9 @@ function delete_account($user_id, $password = null, $verify_password = null)
return $error_msg; return $error_msg;
} }
$conn = get_connection();
if ($password && $verify_password) { if ($password && $verify_password) {
$password_hash = hash('sha256', $password); $password_hash = hash('sha256', $password);
$user = exec_stmt('SELECT user_id, profile_picture FROM user WHERE user_id = ? AND password_hash = ?', 'is', $user_id, $password_hash)->fetch_assoc();
$stmt = $conn->prepare('SELECT user_id, profile_picture FROM user WHERE user_id = ? AND password_hash = ?');
$stmt->bind_param('is', $user_id, $password_hash);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user == null) { if ($user == null) {
$error_msg = ' $error_msg = '
@@ -539,16 +500,10 @@ function delete_account($user_id, $password = null, $verify_password = null)
if (!empty($user['profile_picture']) && $user['profile_picture'] != '2025.jpg') if (!empty($user['profile_picture']) && $user['profile_picture'] != '2025.jpg')
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']); delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
$stmt = 'DELETE FROM user WHERE user_id = ' . $user_id . ';'; exec_stmt('DELETE FROM user WHERE user_id = ?', 'i', $user_id);
$stmt = $conn->prepare('DELETE FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
logout(); logout();
} else if ($_COOKIE['role_id'] <= 2) { } else if ($_COOKIE['role_id'] <= 2) {
$stmt = $conn->prepare('SELECT user_id, profile_picture FROM user WHERE user_id = ?'); $user = exec_stmt('SELECT user_id, profile_picture FROM user WHERE user_id = ?', 'i', $user_id)->fetch_assoc();
$stmt->bind_param('i', $user_id);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user['user_id'] == 2025) { if ($user['user_id'] == 2025) {
$error_msg = ' $error_msg = '
@@ -564,21 +519,13 @@ function delete_account($user_id, $password = null, $verify_password = null)
if (!empty($user['profile_picture']) && $user['profile_picture'] != '2025.jpg') if (!empty($user['profile_picture']) && $user['profile_picture'] != '2025.jpg')
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']); delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
$stmt = 'DELETE FROM user WHERE user_id = ' . $user_id . ';'; exec_stmt('DELETE FROM user WHERE user_id = ?', 'i', $user_id);
$stmt = $conn->prepare('DELETE FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
} }
} }
function user_view($user_id) function user_view($user_id)
{ {
$conn = get_connection(); $user = exec_stmt('SELECT user_id, username, email, role_id, created_at, last_active, is_active, profile_picture FROM user WHERE user_id = ?', 'i', $user_id)->fetch_assoc();
$stmt = $conn->prepare('SELECT user_id, username, email, role_id, created_at, last_active, is_active, profile_picture FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user == null) if ($user == null)
header('Location: articles.php'); header('Location: articles.php');
@@ -593,7 +540,6 @@ function user_view($user_id)
<div class="line"></div> <div class="line"></div>
'; ';
// TODO: Allow user to update profile picture. // TODO: Allow user to update profile picture.
// <button id="update_profile_picture_form_button" class="modal_button underline">Update Profile Picture</button> // <button id="update_profile_picture_form_button" class="modal_button underline">Update Profile Picture</button>
// <div id="update_profile_picture_form" class="modal_form">' . update_profile_picture_form() . '</div> // <div id="update_profile_picture_form" class="modal_form">' . update_profile_picture_form() . '</div>
functions/article_functions.php
+21 -74
View File
@@ -5,7 +5,6 @@ function article_ids_by_newest()
{ {
$conn = get_connection(); $conn = get_connection();
$results = $conn->query('SELECT article_id FROM article ORDER BY published_at DESC'); $results = $conn->query('SELECT article_id FROM article ORDER BY published_at DESC');
$ids = []; $ids = [];
while ($row = $results->fetch_assoc()) while ($row = $results->fetch_assoc())
@@ -18,7 +17,6 @@ function article_ids_by_oldest()
{ {
$conn = get_connection(); $conn = get_connection();
$results = $conn->query('SELECT article_id FROM article ORDER BY published_at ASC'); $results = $conn->query('SELECT article_id FROM article ORDER BY published_at ASC');
$ids = []; $ids = [];
while ($row = $results->fetch_assoc()) while ($row = $results->fetch_assoc())
@@ -29,12 +27,7 @@ function article_ids_by_oldest()
function articles_ids_by_author($author_id) function articles_ids_by_author($author_id)
{ {
$conn = get_connection(); $results = exec_stmt('SELECT article_id FROM article WHERE author_id = ? ORDER BY published_at DESC', 'i', $author_id);
$stmt = $conn->prepare('SELECT article_id FROM article WHERE author_id = ? ORDER BY published_at DESC');
$stmt->bind_param('i', $author_id);
$stmt->execute();
$results = $stmt->get_result();
$ids = []; $ids = [];
while ($row = $results->fetch_assoc()) while ($row = $results->fetch_assoc())
@@ -57,12 +50,7 @@ function article_tags()
function article_ids_by_tag($tag) function article_ids_by_tag($tag)
{ {
$conn = get_connection(); $results = exec_stmt('SELECT article_id FROM article WHERE article.article_id IN ( SELECT article_tags.article_id FROM article_tags INNER JOIN tags ON article_tags.tag_id = tags.tag_id WHERE tag = ?) ORDER BY published_at DESC', 's', $tag);
$stmt = $conn->prepare('SELECT article_id FROM article WHERE article.article_id IN ( SELECT article_tags.article_id FROM article_tags INNER JOIN tags ON article_tags.tag_id = tags.tag_id WHERE tag = ?) ORDER BY published_at DESC');
$stmt->bind_param('s', $tag);
$stmt->execute();
$results = $stmt->get_result();
$ids = []; $ids = [];
while ($row = $results->fetch_assoc()) while ($row = $results->fetch_assoc())
@@ -76,17 +64,8 @@ function article_ids_by_tag($tag)
*/ */
function article_page_from_markdown($article_id) function article_page_from_markdown($article_id)
{ {
$conn = get_connection(); $article = exec_stmt('SELECT * FROM article WHERE article_id = ?', 'i', $article_id)->fetch_assoc();
$stmt = $conn->prepare('SELECT * FROM article WHERE article_id = ?'); $author = exec_stmt('SELECT user_id, username, profile_picture FROM user WHERE user_id = ?', 'i', $article['author_id'])->fetch_assoc();
$stmt->bind_param('i', $article_id);
$stmt->execute();
$article = $stmt->get_result()->fetch_assoc();
$stmt = $conn->prepare('SELECT user_id, username, profile_picture FROM user WHERE user_id = ?');
$stmt->bind_param('i', $article['author_id']);
$stmt->execute();
$author = $stmt->get_result()->fetch_assoc();
$markdown = read_file_one_string($_ENV['ARTICLES_FQ_PATH'] . $article_id . '/article.md'); $markdown = read_file_one_string($_ENV['ARTICLES_FQ_PATH'] . $article_id . '/article.md');
$parsedown = new Parsedown(); $parsedown = new Parsedown();
@@ -142,16 +121,9 @@ function article_filters()
*/ */
function article_card($article_id) function article_card($article_id)
{ {
$conn = get_connection(); $article = exec_stmt('SELECT * FROM article WHERE article_id = ?', 'i', $article_id)->fetch_assoc();
$stmt = $conn->prepare('SELECT * FROM article WHERE article_id = ?');
$stmt->bind_param('i', $article_id);
$stmt->execute();
$article = $stmt->get_result()->fetch_assoc();
$stmt = $conn->prepare('SELECT tag FROM article_tags INNER JOIN tags ON article_tags.tag_id = tags.tag_id WHERE article_id = ?'); $tags_results = exec_stmt('SELECT tag FROM article_tags INNER JOIN tags ON article_tags.tag_id = tags.tag_id WHERE article_id = ?', 'i', $article_id);
$stmt->bind_param('i', $article_id);
$stmt->execute();
$tags_results = $stmt->get_result();
$tags_html = ''; $tags_html = '';
if ($tags_results != null) { if ($tags_results != null) {
@@ -163,10 +135,7 @@ function article_card($article_id)
$tags_html .= '</div>'; $tags_html .= '</div>';
} }
$stmt = $conn->prepare('SELECT user_id, username, profile_picture FROM user WHERE user_id = ?'); $author = exec_stmt('SELECT user_id, username, profile_picture FROM user WHERE user_id = ?', 'i', $article['author_id'])->fetch_assoc();
$stmt->bind_param('i', $article['author_id']);
$stmt->execute();
$author = $stmt->get_result()->fetch_assoc();
$card = ' $card = '
<div class="article_card"> <div class="article_card">
@@ -197,11 +166,7 @@ function article_card($article_id)
function create_article($author_id, $title, $excerpt, $tags, $markdown_file_contents) function create_article($author_id, $title, $excerpt, $tags, $markdown_file_contents)
{ {
$conn = get_connection(); $id = exec_stmt('INSERT INTO article (author_id, title, excerpt, published_at) VALUES (?, ?, ?, CURRENT_TIMESTAMP)', 'iss', $author_id, $title, $excerpt);
$stmt = $conn->prepare('INSERT INTO article (author_id, title, excerpt, published_at) VALUES (?, ?, ?, CURRENT_TIMESTAMP)');
$stmt->bind_param('iss', $author_id, $title, $excerpt);
$stmt->execute();
$id = mysqli_insert_id($conn);
$path = $_ENV['ARTICLES_FQ_PATH'] . $id . '/'; $path = $_ENV['ARTICLES_FQ_PATH'] . $id . '/';
mkdir($path); mkdir($path);
@@ -212,16 +177,17 @@ function create_article($author_id, $title, $excerpt, $tags, $markdown_file_cont
if (count($tags) > 0) { if (count($tags) > 0) {
$tag_insert_stmt = 'INSERT INTO article_tags (article_id, tag_id) VALUES '; $tag_insert_stmt = 'INSERT INTO article_tags (article_id, tag_id) VALUES ';
$types = '';
for ($i = 0; $i < count($tags); $i++) { for ($i = 0; $i < count($tags); $i++) {
$tag_insert_stmt .= '(' . $id . ', ?)'; $tag_insert_stmt .= '(' . $id . ', ?)';
if ($i < count($tags) - 1) if ($i < count($tags) - 1)
$tag_insert_stmt .= ', '; $tag_insert_stmt .= ', ';
$types .= 'i';
} }
$stmt = $conn->prepare($tag_insert_stmt); exec_stmt($tag_insert_stmt, $types, ...$tags);
$stmt->bind_param('i', ...$tags);
$stmt->execute();
} }
return $id; return $id;
@@ -229,64 +195,45 @@ function create_article($author_id, $title, $excerpt, $tags, $markdown_file_cont
function update_article($article_id, $title, $excerpt, $tags, $markdown_file_contents) function update_article($article_id, $title, $excerpt, $tags, $markdown_file_contents)
{ {
$conn = get_connection(); exec_stmt('UPDATE article SET title = ?, excerpt = ?, updated_at = CURRENT_TIMESTAMP WHERE article_id = ?', 'ssi', $title, $excerpt, $article_id);
$stmt = $conn->prepare('UPDATE article SET title = ?, excerpt = ?, updated_at = CURRENT_TIMESTAMP WHERE article_id = ?');
$stmt->bind_param('ssi', $title, $excerpt, $article_id);
$stmt->execute();
$path = $_ENV['ARTICLES_FQ_PATH'] . $article_id . '/'; $path = $_ENV['ARTICLES_FQ_PATH'] . $article_id . '/';
$fs = fopen($path . 'article.md', 'w'); $fs = fopen($path . 'article.md', 'w');
fwrite($fs, $markdown_file_contents); fwrite($fs, $markdown_file_contents);
fclose($fs); fclose($fs);
$stmt = $conn->prepare('DELETE from article_tags WHERE article_id = ?'); exec_stmt('DELETE from article_tags WHERE article_id = ?', 'i', $article_id);
$stmt->bind_param('i', $article_id);
$stmt->execute();
if (count($tags) > 0) { if (count($tags) > 0) {
$tag_insert_stmt = 'INSERT INTO article_tags (article_id, tag_id) VALUES '; $tag_insert_stmt = 'INSERT INTO article_tags (article_id, tag_id) VALUES ';
$input = ''; $types = '';
for ($i = 0; $i < count($tags); $i++) { for ($i = 0; $i < count($tags); $i++) {
$tag_insert_stmt .= '(' . $article_id . ', ?)'; $tag_insert_stmt .= '(' . $article_id . ', ?)';
if ($i < count($tags) - 1) if ($i < count($tags) - 1)
$tag_insert_stmt .= ', '; $tag_insert_stmt .= ', ';
$input .= 'i'; $types .= 'i';
} }
$stmt = $conn->prepare($tag_insert_stmt); exec_stmt($tag_insert_stmt, $types, ...$tags);
$stmt->bind_param($input, ...$tags);
$stmt->execute();
} }
} }
function delete_article($article_id) function delete_article($article_id)
{ {
$conn = get_connection(); exec_stmt('DELETE FROM article_tags WHERE article_id = ?', 'i', $article_id);
$stmt = $conn->prepare('DELETE FROM article_tags WHERE article_id = ?'); exec_stmt('DELETE FROM article WHERE article_id = ?', 'i', $article_id);
$stmt->bind_param('i', $article_id);
$stmt->execute();
$stmt = $conn->prepare('DELETE FROM article WHERE article_id = ?');
$stmt->bind_param('i', $article_id);
$stmt->execute();
delete_dir($_ENV['ARTICLES_FQ_PATH'] . $article_id . '/'); delete_dir($_ENV['ARTICLES_FQ_PATH'] . $article_id . '/');
} }
function delete_articles_by_author($author_id) function delete_articles_by_author($author_id)
{ {
$conn = get_connection(); exec_stmt('DELETE FROM article WHERE author_id = ?', 'i', $author_id);
$stmt = $conn->prepare('DELETE FROM article WHERE author_id = ?');
$stmt->bind_param('i', $author_id);
$stmt->execute();
} }
function increment_read_counter($article_id) function increment_read_counter($article_id)
{ {
$conn = get_connection(); exec_stmt('UPDATE article SET read_count = read_count + 1 WHERE article_id = ?', 'i', $article_id);
$stmt = $conn->prepare('UPDATE article SET read_count = read_count + 1 WHERE article_id = ?');
$stmt->bind_param('i', $article_id);
$stmt->execute();
} }
functions/db_functions.php
+13
View File
@@ -22,6 +22,19 @@ if ($_SERVER['HTTP_HOST'] == 'localhost') {
define('DB', 'vintagecoding'); define('DB', 'vintagecoding');
} }
function exec_stmt($stmt, $param_types, ...$args)
{
$conn = get_connection();
$stmt = $conn->prepare($stmt);
$stmt->bind_param($param_types, ...$args);
$stmt->execute();
$result = $stmt->get_result();
if ($result)
return $result;
else
return mysqli_insert_id($conn);
}
function get_connection() function get_connection()
{ {
$conn = new mysqli(HOST, USER, PASS, DB); $conn = new mysqli(HOST, USER, PASS, DB);
functions/init.php
+2 -4
View File
@@ -15,9 +15,7 @@ $dotenv->safeLoad();
if (!isset($_SESSION['initialized'])) { if (!isset($_SESSION['initialized'])) {
$_SESSION['initialized'] = true; $_SESSION['initialized'] = true;
$_SESSION['theme'] = 'dark'; $_SESSION['theme'] = 'dark';
} } else if (isset($_POST['theme'])) {
if ($_SESSION['initialized'] && isset($_POST['theme'])) {
$_SESSION['theme'] = $_POST['theme']; $_SESSION['theme'] = $_POST['theme'];
unset($_POST['theme']); unset($_POST['theme']);
} }
@@ -49,7 +47,7 @@ if (isset($_COOKIE['user_id'])) {
if (hash('sha256', $_SERVER['REMOTE_ADDR']) != $remember['remote_addr'] || (isset($_SERVER['HTTP_X_FORWARDED_FOR']) && hash('sha256', $_SERVER['HTTP_X_FORWARDED_FOR']) != $remember['forwarded_for'])) { if (hash('sha256', $_SERVER['REMOTE_ADDR']) != $remember['remote_addr'] || (isset($_SERVER['HTTP_X_FORWARDED_FOR']) && hash('sha256', $_SERVER['HTTP_X_FORWARDED_FOR']) != $remember['forwarded_for'])) {
// TODO: Log the attempt to use a cookie from a different browser/device than the cookie was created // TODO: Log the attempt to use a cookie from a different browser/device than the cookie was created
echo 'Naughty, you are trying to use someone else\'s cookie...'; echo "Naughty, you are trying to use someone else's cookie...";
} else { } else {
$stmt = $conn->prepare('SELECT user_id, username, email, role_id, profile_picture FROM user WHERE user_id = ?'); $stmt = $conn->prepare('SELECT user_id, username, email, role_id, profile_picture FROM user WHERE user_id = ?');
$stmt->bind_param('s', $remember['user_id']); $stmt->bind_param('s', $remember['user_id']);
user.php
+3
View File
@@ -35,6 +35,9 @@ if (isset($_POST['form_id'])) {
); );
if ($msg === true) if ($msg === true)
if (isset($_GET['redirect']))
header('Location: ' . urldecode($_GET['redirect']));
else
header('Location: .'); header('Location: .');
break; break;
case 'reset_pw_form': case 'reset_pw_form':