266 lines
8.1 KiB
PHP
266 lines
8.1 KiB
PHP
<?php
|
|
require_once 'db.php';
|
|
require_once 'article_functions.php';
|
|
|
|
use Postmark\PostmarkClient;
|
|
|
|
function follow_user($follower_user_id, $following_user_id, $notify)
|
|
{
|
|
exec_stmt('INSERT INTO follows (follower_user_id, following_user_id, notify_user) VALUES (?, ?, ?)', 'iii', $follower_user_id, $following_user_id, $notify);
|
|
}
|
|
|
|
function unfollow_user($follower_user_id, $following_user_id)
|
|
{
|
|
exec_stmt('DELETE FROM follows WHERE follower_user_id = ? AND following_user_id = ?', 'ii', $follower_user_id, $following_user_id);
|
|
}
|
|
|
|
function user_id_exists($user_id)
|
|
{
|
|
$result = exec_stmt('SELECT user_id FROM user WHERE user_id = ?', 'i', $user_id)->fetch_assoc();
|
|
|
|
if ($result == null)
|
|
return false;
|
|
return true;
|
|
}
|
|
|
|
function username_exists($username)
|
|
{
|
|
$result = exec_stmt('SELECT username FROM user WHERE username = ?', 'i', $username)->fetch_assoc();
|
|
|
|
if ($result == null)
|
|
return false;
|
|
return true;
|
|
}
|
|
|
|
function logout()
|
|
{
|
|
foreach (array_keys($_SESSION) as $key)
|
|
unset($_SESSION[$key]);
|
|
|
|
header('Location: .');
|
|
}
|
|
|
|
function login($username, $password, $stay_logged_in)
|
|
{
|
|
$password_hash = hash('sha256', $password);
|
|
|
|
$user = exec_stmt('SELECT user_id, username, role_id FROM user WHERE username = ? OR email = ? AND password_hash = ?', 'sss', $username, $username, $password_hash)->fetch_assoc();
|
|
|
|
if ($user == null) {
|
|
$error_msg = '
|
|
<div class="error">
|
|
Username and/or Password are invalid!
|
|
</div>
|
|
';
|
|
|
|
return $error_msg;
|
|
}
|
|
|
|
$_SESSION['user_id'] = $user['user_id'];
|
|
$_SESSION['username'] = $user['username'];
|
|
$_SESSION['role_id'] = $user['role_id'];
|
|
|
|
if ($stay_logged_in) {
|
|
$token = bin2hex(random_bytes(64));
|
|
// echo $token . '<br>';
|
|
// echo strlen($token);
|
|
setcookie('remember_user', $token, time() + 60 * 60 * 24 * 30, '/', '', true, true);
|
|
|
|
exec_stmt('INSERT INTO remember_user (token, user_id, remote_addr, http_forward) VALUES (?, ?, ?, ?)', 'siss', $token, $user['user_id'], hash('sha256', $_SERVER['REMOTE_ADDR']), (isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? hash('sha256', $_SERVER['HTTP_X_FORWARDED_FOR']) : null));
|
|
}
|
|
|
|
return true;
|
|
}
|
|
|
|
function create_user($username, $email, $password, $verify_password, $role_id, $upload = null, $x = null, $y = null, $crop_width = null, $honeypot = null)
|
|
{
|
|
if (!empty($honeypot)) {
|
|
$error_msg = '
|
|
<div class="error">
|
|
You are a bot. Leave now.
|
|
</div>
|
|
';
|
|
|
|
return $error_msg;
|
|
}
|
|
|
|
if ($password != $verify_password) {
|
|
$error_msg = '
|
|
<div class="error">
|
|
Passwords do not match!
|
|
</div>
|
|
';
|
|
|
|
return $error_msg;
|
|
}
|
|
|
|
if (username_exists($username)) {
|
|
$error_msg = '
|
|
<div class="error">
|
|
Username is taken!
|
|
</div>
|
|
';
|
|
}
|
|
|
|
$password_hash = hash('sha256', $password);
|
|
|
|
$id = rand(1000, 999999999);
|
|
while (user_id_exists($id))
|
|
$id = rand(1000, 999999999);
|
|
|
|
if (!empty($upload['profile_picture']['tmp_name'])) {
|
|
$orig_size = getimagesize($upload['profile_picture']['tmp_name']);
|
|
$orig_width = $orig_size[0];
|
|
$orig_height = $orig_size[1];
|
|
|
|
$crop_size = min($orig_width, $orig_height) * 0.56;
|
|
|
|
crop_image($upload['profile_picture']['tmp_name'], $x, $y, $crop_size, $crop_size);
|
|
$target = upload($upload['profile_picture'], $_ENV['PROFILE_IMAGES_FQ_PATH'], $id);
|
|
} else {
|
|
$target = 'default-profile.png';
|
|
}
|
|
|
|
exec_stmt('INSERT INTO user (user_id, username, email, password_hash, role_id, profile_picture) VALUES (?, ?, ?, ?, ?, ?)', 'isssis', $id, $username, $email, $password_hash, $role_id, $target);
|
|
return true;
|
|
}
|
|
|
|
function reset_password($user_id, $new_password, $verify_new_password)
|
|
{
|
|
if ($new_password != $verify_new_password) {
|
|
$error_msg = '
|
|
<div class="error">
|
|
Passwords do not match!
|
|
</div>
|
|
';
|
|
|
|
return $error_msg;
|
|
}
|
|
|
|
$password_hash = hash('sha256', $new_password);
|
|
exec_stmt('UPDATE user SET password_hash = ? WHERE user_id = ?', 'si', $password_hash, $user_id);
|
|
}
|
|
|
|
function update_email($user_id, $new_email, $verify_new_email)
|
|
{
|
|
if ($new_email != $verify_new_email) {
|
|
$error_msg = '
|
|
<div class="error">
|
|
Emails do not match!
|
|
</div>
|
|
';
|
|
|
|
return $error_msg;
|
|
}
|
|
|
|
exec_stmt('UPDATE user SET email = ? WHERE user_id = ?', 'si', $new_email, $user_id);
|
|
}
|
|
|
|
function update_username($user_id, $new_username, $verify_new_username)
|
|
{
|
|
if ($new_username != $verify_new_username) {
|
|
$error_msg = '
|
|
<div class="error">
|
|
Usernames do not match!
|
|
</div>
|
|
';
|
|
|
|
return $error_msg;
|
|
}
|
|
|
|
if ($result = username_exists($new_username))
|
|
return $result;
|
|
|
|
exec_stmt('UPDATE user SET username = ? WHERE user_id = ?', 'si', $new_username, $user_id);
|
|
}
|
|
|
|
function update_profile_picture($user_id) {}
|
|
|
|
function request_role_change($user_id, $new_role_id)
|
|
{
|
|
$user = exec_stmt('SELECT user_id, username, email, roles.role, created_at FROM user INNER JOIN roles WHERE user.role_id = roles.role_id AND user_id = ?', 'i', $user_id)->fetch_assoc();
|
|
$new_role = exec_stmt('SELECT role FROM roles WHERE role_id = ?', 'i', $new_role_id)->fetch_array();
|
|
|
|
$email_html = '
|
|
<h1>User Role Change Request</h1>
|
|
<p>The following user has requested their role on vintagecoding.net to be changed:</p>
|
|
<p><strong>User ID: </strong>' . $user['user_id'] . '</p>
|
|
<p><strong>Username: </strong>' . $user['username'] . '</p>
|
|
<p><strong>Email: </strong>' . $user['email'] . '</p>
|
|
<p><strong>Current Role: </strong>' . $user['role'] . ' -> ' . $new_role[0] . '</p>
|
|
<p><strong>Created At: </strong>' . $user['created_at'] . '</p>
|
|
';
|
|
|
|
$client = new PostmarkClient($_ENV['POSTMARK_API_TOKEN']);
|
|
|
|
$client->sendEmail(
|
|
'mailer@joshashton.dev',
|
|
'me@joshashton.dev',
|
|
'User Role Change Request - ' . $user['user_id'],
|
|
$email_html
|
|
);
|
|
}
|
|
|
|
function delete_account($user_id, $password = null, $verify_password = null)
|
|
{
|
|
if ($user_id == 2025) {
|
|
$error_msg = '
|
|
<div class="error">
|
|
I am the owner, and I cannot delete myself...
|
|
</div>
|
|
';
|
|
|
|
return $error_msg;
|
|
}
|
|
|
|
if ($password != $verify_password) {
|
|
$error_msg = '
|
|
<div class="error">
|
|
Passwords do not match!
|
|
</div>
|
|
';
|
|
|
|
return $error_msg;
|
|
}
|
|
|
|
if ($password && $verify_password) {
|
|
$password_hash = hash('sha256', $password);
|
|
$user = exec_stmt('SELECT user_id, profile_picture FROM user WHERE user_id = ? AND password_hash = ?', 'is', $user_id, $password_hash)->fetch_assoc();
|
|
|
|
if ($user == null) {
|
|
$error_msg = '
|
|
<div class="error">
|
|
Username and/or Password are invalid!
|
|
</div>
|
|
';
|
|
|
|
return $error_msg;
|
|
}
|
|
|
|
// Hardcoded prevention of deleting the owner's profile picture
|
|
if (!empty($user['profile_picture']) && $user['profile_picture'] != '2025.jpg')
|
|
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
|
|
|
|
exec_stmt('DELETE FROM user WHERE user_id = ?', 'i', $user_id);
|
|
logout();
|
|
} else if ($_SESSION['role_id'] <= admin) {
|
|
$user = exec_stmt('SELECT user_id, profile_picture FROM user WHERE user_id = ?', 'i', $user_id)->fetch_assoc();
|
|
|
|
if ($user['user_id'] == 2025) {
|
|
$error_msg = '
|
|
<div class="error">
|
|
Cannot delete the owner!
|
|
</div>
|
|
';
|
|
|
|
return $error_msg;
|
|
}
|
|
|
|
// Hardcoded prevention of deleting the owner's profile picture
|
|
if (!empty($user['profile_picture']) && $user['profile_picture'] != '2025.jpg')
|
|
delete_file($_ENV['PROFILE_IMAGES_FQ_PATH'] . $user['profile_picture']);
|
|
|
|
exec_stmt('DELETE FROM user WHERE user_id = ?', 'i', $user_id);
|
|
}
|
|
}
|