prepare('SELECT user_id FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
$result = $stmt->get_result()->fetch_assoc();
if ($result == null)
return false;
return true;
}
function cookies($user, $time)
{
setcookie('user_id', $user['user_id'], $time);
setcookie('username', $user['username'], $time);
setcookie('email', $user['email'], $time);
setcookie('role_id', $user['role_id'], $time);
setcookie('profile_picture', $user['profile_picture'], $time);
}
function logout()
{
foreach (array_keys($_COOKIE) as $key) {
setcookie($key, '', time() - 3600, '/');
unset($_COOKIE[$key]);
}
foreach (array_keys($_SESSION) as $key) {
unset($_SESSION[$key]);
}
header('Location: articles.php');
}
function login_form($error_msg = '')
{
$form = '
Log In
';
return $form;
}
function login($username, $password, $stay_logged_in)
{
$password_hash = hash('sha256', $password);
$conn = get_connection();
$stmt = $conn->prepare('SELECT user_id, username, email, role_id, profile_picture FROM user WHERE username = ? OR email = ? AND password_hash = ?');
$stmt->bind_param('sss', $username, $username, $password_hash);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user == null) {
$error_msg = '
Username and/or Password are invalid!
';
return $error_msg;
}
$time = time() + 60 * 60 * 1;
cookies($user, $time);
if ($stay_logged_in) {
$token = bin2hex(random_bytes(64));
// echo $token . '
';
// echo strlen($token);
setcookie('remember_user', $token, time() + 60 * 60 * 24 * 30, '/', '', true, true);
$stmt = $conn->prepare('INSERT INTO remember_user (token, user_id, remote_addr, http_forward) VALUES (?, ?, ?, ?)');
$stmt->bind_param('siss', $token, $user['user_id'], hash('sha256', $_SERVER['REMOTE_ADDR']), (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? hash('sha256', $_SERVER['HTTP_X_FORWARDED_FOR']) : null));
$stmt->execute();
}
return true;
}
function signup_form($error_msg = '')
{
$form = '
';
return $form;
}
function create_user($username, $email, $password, $verify_password, $role_id, $upload = null, $x = null, $y = null, $crop_width = null, $honeypot = null)
{
if (!empty($honeypot)) {
$error_msg = '
You are a bot. Leave now.
';
return $error_msg;
}
if ($password != $verify_password) {
$error_msg = '
Passwords do not match!
';
return $error_msg;
}
$password_hash = hash('sha256', $password);
$id = rand(1000, 999999999);
while (user_id_exists($id))
$id = rand(1000, 999999999);
if (!empty($upload['profile_picture']['tmp_name'])) {
$orig_size = getimagesize($upload['profile_picture']['tmp_name']);
$orig_width = $orig_size[0];
$orig_height = $orig_size[1];
$crop_size = min($orig_width, $orig_height) * .56;
crop_image($upload['profile_picture']['tmp_name'], $x, $y, $crop_size, $crop_size);
$target = upload($upload['profile_picture'], $_ENV['PROFILE_IMAGES_FQ_PATH'], $id);
} else {
$target = 'default-profile.png';
}
$conn = get_connection();
$stmt = $conn->prepare('INSERT INTO user (user_id, username, email, password_hash, role_id, profile_picture) VALUES (?, ?, ?, ?, ?, ?)');
$stmt->bind_param('isssis', $id, $username, $email, $password_hash, $role_id, $target);
$stmt->execute();
return true;
}
function profile_cropper()
{
$display = '
';
return $display;
}
function reset_pw_form()
{
$form = '
Reset Password
×
';
return $form;
}
function reset_password($user_id, $new_password, $verify_new_password)
{
if ($new_password != $verify_new_password) {
$error_msg = '
Passwords do not match!
';
return $error_msg;
}
$password_hash = hash('sha256', $new_password);
$conn = get_connection();
$stmt = $conn->prepare('UPDATE user SET password_hash = ? WHERE user_id = ?');
$stmt->bind_param('si', $password_hash, $user_id);
$stmt->execute();
}
function update_email_form()
{
$form = '
Update Email
×
';
return $form;
}
function update_email($user_id, $new_email, $verify_new_email)
{
if ($new_email != $verify_new_email) {
$error_msg = '
Emails do not match!
';
return $error_msg;
}
$conn = get_connection();
$stmt = $conn->prepare('UPDATE user SET email = ? WHERE user_id = ?');
$stmt->bind_param('si', $new_email, $user_id);
$stmt->execute();
}
function update_username_form()
{
$form = '
Update Username
×
';
return $form;
}
function update_username($user_id, $new_username, $verify_new_username)
{
if ($new_username != $verify_new_username) {
$error_msg = '
Usernames do not match!
';
return $error_msg;
}
$conn = get_connection();
$stmt = $conn->prepare('SELECT username FROM user WHERE username = ?');
$stmt->bind_param('s', $new_username);
$stmt->execute();
$result = $stmt->get_result()->fetch_assoc();
if ($result != null) {
$error_msg = '
Usernames is taken!
';
return $error_msg;
}
$stmt = $conn->prepare('UPDATE user SET username = ? WHERE user_id = ?');
$stmt->bind_param('si', $new_username, $user_id);
$stmt->execute();
}
function update_profile_picture_form()
{
$form = '
';
return $form;
}
function update_profile_picture($user_id) {}
function request_role_change_form()
{
$conn = get_connection();
$result = $conn->query('SELECT * FROM roles WHERE role_id <> 1');
$roles = '';
while ($row = $result->fetch_assoc()) {
$roles .= '
';
}
$roles .= '
';
$form = '
Request Role
×
';
return $form;
}
function request_role_change($user_id, $new_role_id)
{
$conn = get_connection();
$stmt = $conn->prepare('SELECT user_id, username, email, roles.role, created_at FROM user INNER JOIN roles WHERE user.role_id = roles.role_id AND user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
$stmt = $conn->prepare('SELECT role FROM roles WHERE role_id = ?');
$stmt->bind_param('i', $new_role_id);
$stmt->execute();
$new_role = $stmt->get_result()->fetch_array();
$email_html = '
User Role Change Request
The following user has requested their role on vintagecoding.net to be changed:
User ID: ' . $user['user_id'] . '
Username: ' . $user['username'] . '
Email: ' . $user['email'] . '
Current Role: ' . $user['role'] . ' -> ' . $new_role[0] . '
Created At: ' . $user['created_at'] . '
';
$client = new PostmarkClient($_ENV['POSTMARK_API_TOKEN']);
$send_result = $client->sendEmail(
'mailer@joshashton.dev',
'me@joshashton.dev',
'User Role Change Request - ' . $user['user_id'],
$email_html
);
}
function delete_account_form()
{
$form = '
Delete Account
×
';
return $form;
}
function delete_account($user_id, $password = null, $verify_password = null)
{
if ($user_id == 2025) {
$error_msg = '
I am the owner, and I cannot delete myself...
';
return $error_msg;
}
if ($password != $verify_password) {
$error_msg = '
Passwords do not match!
';
return $error_msg;
}
$conn = get_connection();
if ($password && $verify_password) {
$password_hash = hash('sha256', $password);
$stmt = $conn->prepare('SELECT user_id, profile_picture FROM user WHERE user_id = ? AND password_hash = ?');
$stmt->bind_param('is', $user_id, $password_hash);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user == null) {
$error_msg = '
Username and/or Password are invalid!
';
return $error_msg;
}
// Hardcoded prevention of deleting the owner's profile picture
if (!empty($user['profile_picture']) && $user['profile_picture'] != '2025.jpg')
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
$stmt = 'DELETE FROM user WHERE user_id = ' . $user_id . ';';
$stmt = $conn->prepare('DELETE FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
logout();
} else if ($_COOKIE['role_id'] <= 2) {
$stmt = $conn->prepare('SELECT user_id, profile_picture FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user['user_id'] == 2025) {
$error_msg = '
Cannot delete the owner!
';
return $error_msg;
}
// Hardcoded prevention of deleting the owner's profile picture
if (!empty($user['profile_picture']) && $user['profile_picture'] != '2025.jpg')
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
$stmt = 'DELETE FROM user WHERE user_id = ' . $user_id . ';';
$stmt = $conn->prepare('DELETE FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
}
}
function user_view($user_id)
{
$conn = get_connection();
$stmt = $conn->prepare('SELECT user_id, username, email, role_id, created_at, last_active, is_active, profile_picture FROM user WHERE user_id = ?');
$stmt->bind_param('i', $user_id);
$stmt->execute();
$user = $stmt->get_result()->fetch_assoc();
if ($user == null)
header('Location: articles.php');
$view = '
' . $user['username'] . '
';
// TODO: Allow user to update profile picture.
//
//
' . update_profile_picture_form() . '
if ((isset($_COOKIE['user_id']) && $_COOKIE['user_id'] == $user_id) || (isset($_COOKIE['role_id']) && $_COOKIE['role_id'] <= 2)) {
$view .= '
User Actions
' . reset_pw_form() . '
' . update_email_form() . '
' . update_username_form() . '
' . request_role_change_form() . '
' . delete_account_form() . '
';
} else {
$ids = articles_ids_by_author($_GET['user_id']);
$view .= '
';
foreach ($ids as $id)
$view .= article_card($id);
$view .= '
';
}
return $view;
}