spaces/web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented admin control panel with the ability to delete articles/users in bulk, and open user panels with the standard options to reset passwords, change email/usernames, or delete. additionally, updated SQL schema, created dummy data, and fixed some bugs.

Browse Source
This commit is contained in:
Joshua Ashton
2025-03-30 17:01:29 -06:00
parent 86823cbd3e
commit e6735a9a20
18 changed files with 414 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
functions/account_functions.php
+36 -18
View File
@@ -1,5 +1,5 @@
<?php
require 'db_functions.php';
require_once 'db_functions.php';
function user_id_exists($user_id)
{
@@ -220,6 +220,7 @@ function reset_pw_form()
<span class="modal_close">&times;</span>
<form method="post">
<input type="hidden" name="form_id" value="reset_pw_form">
<input type="hidden" name="user_id" value="' . $_GET['user_id'] . '">
<label for="new_pw">New Password</label>
<input id="new_pw" name="new_pw" type="password" required>
@@ -260,6 +261,7 @@ function update_email_form()
<span class="modal_close">&times;</span>
<form method="post">
<input type="hidden" name="form_id" value="update_email_form">
<input type="hidden" name="user_id" value="' . $_GET['user_id'] . '">
<label for="new_email">New Email</label>
<input id="new_email" name="new_email" required>
@@ -299,6 +301,7 @@ function update_username_form()
<span class="modal_close">&times;</span>
<form method="post">
<input type="hidden" name="form_id" value="update_username_form">
<input type="hidden" name="user_id" value="' . $_GET['user_id'] . '">
<label for="new_username">New Username</label>
<input id="new_username" name="new_username" required>
@@ -387,6 +390,7 @@ function delete_account_form()
<span class="modal_close">&times;</span>
<form method="post">
<input type="hidden" name="form_id" value="delete_account_form">
<input type="hidden" name="user_id" value="' . $_GET['user_id'] . '">
<label for="delete_password">Password</label>
<input id="delete_password" name="delete_password" type="password" required>
@@ -402,7 +406,7 @@ function delete_account_form()
return $form;
}
function delete_account($user_id, $password, $verify_password)
function delete_account($user_id, $password = null, $verify_password = null)
{
if ($user_id == 2025) {
$error_msg = '
@@ -424,23 +428,43 @@ function delete_account($user_id, $password, $verify_password)
return $error_msg;
}
$password_hash = hash('sha256', $password);
$query = 'SELECT user_id FROM user WHERE user_id = ' . $user_id . ' AND password_hash = "' . $password_hash . '";';
$user = query_one_result($query);
if ($password && $verify_password) {
$password_hash = hash('sha256', $password);
$query = 'SELECT user_id, profile_picture FROM user WHERE user_id = ' . $user_id . ' AND password_hash = "' . $password_hash . '";';
$user = query_one_result($query);
if ($user == null) {
$error_msg = '
if ($user == null) {
$error_msg = '
<div class="error">
Username and/or Password are invalid!
</div>
';
return $error_msg;
}
return $error_msg;
}
$stmt = 'DELETE FROM user WHERE user_id = ' . $user_id . ';';
exec_statement($stmt, 1);
logout();
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
$stmt = 'DELETE FROM user WHERE user_id = ' . $user_id . ';';
exec_statement($stmt, 1);
logout();
} else if ($_COOKIE['role_id'] < 3) {
$query = 'SELECT user_id FROM user WHERE user_id = ' . $user_id . ';';
$user = query_one_result($query);
if ($user['user_id'] == 2025) {
$error_msg = '
<div class="error">
Cannot delete the owner!
</div>
';
return $error_msg;
}
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
$stmt = 'DELETE FROM user WHERE user_id = ' . $user_id . ';';
exec_statement($stmt, 1);
}
}
function user_view($user_id)
@@ -492,9 +516,3 @@ function user_view($user_id)
return $view;
}
function admin_user_view($user_id)
{
$query = 'SELECT user_id, username, email, role_id, created_at, last_active, is_active, profile_picture FROM user WHERE user_id = ' . $user_id . ';';
$user = query_one_result($query);
}