Delete	Permission Name
	".$v1['name']."

UserCake

Admin User

"; - -include("left-nav.php"); +echo notificationBlock($errors,$successes); echo " -

"; - -echo resultBlock($errors,$successes); + -

- -"; +"; + +finishPage(); ?> diff --git a/testing/MCTXWeb/public_html/users/admin_users.php b/testing/MCTXWeb/public_html/users/admin_users.php index e0ec8e0..c46ab8c 100644 --- a/testing/MCTXWeb/public_html/users/admin_users.php +++ b/testing/MCTXWeb/public_html/users/admin_users.php @@ -22,26 +22,15 @@ if(!empty($_POST)) $userData = fetchAllUsers(); //Fetch information for all users require_once("models/header.php"); -echo " - -

UserCake

Admin Users

"; - -include("left-nav.php"); +startPage(); +echo notificationBlock($errors,$successes); echo " -

"; - -echo resultBlock($errors,$successes); + -

- -"; +

"; + +finishPage(); ?> diff --git a/testing/MCTXWeb/public_html/users/forgot-password.php b/testing/MCTXWeb/public_html/users/forgot-password.php index fa68835..77fec13 100644 --- a/testing/MCTXWeb/public_html/users/forgot-password.php +++ b/testing/MCTXWeb/public_html/users/forgot-password.php @@ -6,6 +6,7 @@ http://usercake.com require_once("models/config.php"); if (!securePage($_SERVER['PHP_SELF'])){die();} +if (isUserLoggedIn()){header("Location: index.php"); die();} //User has confirmed they want their password changed if(!empty($_GET["confirm"])) @@ -174,22 +175,13 @@ if(!empty($_POST)) } require_once("models/header.php"); -echo " - -

UserCake

Forgot Password

"; +startPage(); -include("left-nav.php"); +//echo notificationBlock($errors,$successes); echo " -

"; - -echo resultBlock($errors,$successes); + - -"; +

"; + +finishPage(); ?> diff --git a/testing/MCTXWeb/public_html/users/index.php b/testing/MCTXWeb/public_html/users/index.php index 63d11fb..9cec83c 100644 --- a/testing/MCTXWeb/public_html/users/index.php +++ b/testing/MCTXWeb/public_html/users/index.php @@ -5,43 +5,23 @@ http://usercake.com */ require_once("models/config.php"); -if (!securePage($_SERVER['PHP_SELF'])){die();} -require_once("models/header.php"); +if (!isUserLoggedIn()) { header("Location: login.php"); die();} -echo " - -

UserCake

2.00

"; -include("left-nav.php"); +require_once("models/header.php"); +startPage(); +echo ' + +'; -echo " -

Thank you for downloading UserCake. 100% Free and Opensource.

Permission is hereby granted, free of charge, to any person obtaining a copy -of this software and associated documentation files (the 'Software'), to deal -in the Software without restriction, including without limitation the rights -to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -copies of the Software, and to permit persons to whom the Software is -furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in -all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -THE SOFTWARE.

- -"; +finishPage(); ?> diff --git a/testing/MCTXWeb/public_html/users/left-nav.php b/testing/MCTXWeb/public_html/users/left-nav.php index b6f053e..addc4c4 100644 --- a/testing/MCTXWeb/public_html/users/left-nav.php +++ b/testing/MCTXWeb/public_html/users/left-nav.php @@ -4,41 +4,36 @@ UserCake Version: 2.0.2 http://usercake.com */ -if (!securePage($_SERVER['PHP_SELF'])){die();} +if (isUserLoggedIn()) { -//Links for logged in user -if(isUserLoggedIn()) { - echo " -

"; - - //Links for permission level 2 (default admin) - if ($loggedInUser->checkPermission(array(2))){ - echo " -

"; - } -} -//Links for users not logged in -else { - echo " -

Home
Login
Register
Forgot Password
Resend Activation Email

"; +echo ' + + +'; + +} ?> diff --git a/testing/MCTXWeb/public_html/users/login.php b/testing/MCTXWeb/public_html/users/login.php index 2c45d1f..7d2ba20 100644 --- a/testing/MCTXWeb/public_html/users/login.php +++ b/testing/MCTXWeb/public_html/users/login.php @@ -8,7 +8,7 @@ require_once("models/config.php"); if (!securePage($_SERVER['PHP_SELF'])){die();} //Prevent the user visiting the logged in page if he/she is already logged in -if(isUserLoggedIn()) { header("Location: account.php"); die(); } +if(isUserLoggedIn()) { header("Location: index.php"); die(); } //Forms posted if(!empty($_POST)) @@ -48,7 +48,7 @@ if(!empty($_POST)) //Hash the password and use the salt from the database to compare the password. $entered_pass = generateHash($password,$userdetails["password"]); - echo "".$userdetails["password"]; + //echo "".$userdetails["password"]; //Wut is dis if($entered_pass != $userdetails["password"]) { @@ -69,13 +69,22 @@ if(!empty($_POST)) $loggedInUser->displayname = $userdetails["display_name"]; $loggedInUser->username = $userdetails["user_name"]; - //Update last sign in - $loggedInUser->updateLastSignIn(); - $_SESSION["userCakeUser"] = $loggedInUser; - - //Redirect to user account page - header("Location: account.php"); - die(); + //Only allow login to admins + if ($loggedInUser->checkPermission(array(2))) + { + //Update last sign in + $loggedInUser->updateLastSignIn(); + + $_SESSION["userCakeUser"] = $loggedInUser; + + //Redirect to user account page + header("Location: index.php"); + die(); + } + else + { + $errors[] = ("You are no admin :("); + } } } } @@ -83,45 +92,44 @@ if(!empty($_POST)) } require_once("models/header.php"); +startPage(); -echo " - -

UserCake

Login

"; - -include("left-nav.php"); - -echo " -

"; - +echo ' +

+ + +

+ '; -echo " -

- -

- -"; +finishPage(); ?> diff --git a/testing/MCTXWeb/public_html/users/logout.php b/testing/MCTXWeb/public_html/users/logout.php index 728a294..e722ba7 100644 --- a/testing/MCTXWeb/public_html/users/logout.php +++ b/testing/MCTXWeb/public_html/users/logout.php @@ -13,6 +13,7 @@ if(isUserLoggedIn()) $loggedInUser->userLogOut(); } +/* if(!empty($websiteUrl)) { $add_http = ""; @@ -26,10 +27,10 @@ if(!empty($websiteUrl)) die(); } else -{ - header("Location: http://".$_SERVER['HTTP_HOST']); +{*/ + header("Location: login.php");//http://".$_SERVER['HTTP_HOST']); die(); -} +/*}*/ ?> diff --git a/testing/MCTXWeb/public_html/users/models/funcs.php b/testing/MCTXWeb/public_html/users/models/funcs.php index b1afc72..a3a9928 100644 --- a/testing/MCTXWeb/public_html/users/models/funcs.php +++ b/testing/MCTXWeb/public_html/users/models/funcs.php @@ -154,31 +154,59 @@ function resultBlock($errors,$successes){ //Error block if(count($errors) > 0) { - echo "

- [X] -

"; + foreach($errors as $error) { - echo "

".$error."

"; + echo "

".$error."

"; } - echo "

"; echo "

"; } //Success block if(count($successes) > 0) { - echo "

- [X] -

"; foreach($successes as $success) { - echo "

".$success."

"; + echo "

".$success.""; } - echo "

"; echo "

"; } } +function notificationBlock($errors, $successes) { + if (count($errors) > 0 || count($successes) > 0) + { + echo ' + + + '; + } +} + //Completely sanitizes text function sanitize($str) { @@ -285,6 +313,70 @@ function emailUsernameLinked($email,$username) } } +function permissionNameToId($permission) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT id + FROM ".$db_table_prefix."permissions + WHERE + name = ? + LIMIT 1"); + $stmt->bind_param("s", $permission); + $stmt->execute(); + $stmt->bind_result($id); + + while ($stmt->fetch()){ + $perm_id = $id; + } + $stmt->close(); + + return $perm_id; +} + +function fetchAllUsersWithPerm($perm_name) +{ + global $mysqli,$db_table_prefix; + + $perm_id = permissionNameToId($perm_name); + $stmt = $mysqli->prepare("SELECT + p1.id + FROM ".$db_table_prefix."users p1 + WHERE EXISTS (SELECT * FROM ".$db_table_prefix."user_permission_matches + WHERE user_id=p1.id AND permission_id=?)" + ); + $stmt->bind_param("i", $perm_id); + $stmt->execute(); + $stmt->bind_result($id); + + while ($stmt->fetch()){ + $row[] = $id; + } + $stmt->close(); + return ($row); +} + +function fetchAllUsersWithoutPerm($perm_name) +{ + global $mysqli,$db_table_prefix; + + $perm_id = permissionNameToId($perm_name); + $stmt = $mysqli->prepare("SELECT + p1.id + FROM ".$db_table_prefix."users p1 + WHERE NOT EXISTS (SELECT * FROM ".$db_table_prefix."user_permission_matches + WHERE user_id=p1.id AND permission_id=?)" + ); + $stmt->bind_param("i", $perm_id); + $stmt->execute(); + $stmt->bind_result($id); + + while ($stmt->fetch()){ + $row[] = $id; + } + $stmt->close(); + return ($row); +} + //Retrieve information for all users function fetchAllUsers() { @@ -313,6 +405,27 @@ function fetchAllUsers() return ($row); } +//Yeah usercake... Fetches the user id from username +function fetchUserId($username) +{ + global $mysqli,$db_table_prefix; + $stmt = $mysqli->prepare("SELECT + id + FROM ".$db_table_prefix."users + WHERE + user_name = ? + LIMIT 1"); + $stmt->bind_param("s", $username); + + $stmt->execute(); + $stmt->bind_result($id); + while ($stmt->fetch()){ + $user_id = $id; + } + $stmt->close(); + return $user_id; +} + //Retrieve complete user information by username, token or ID function fetchUserDetails($username=NULL,$token=NULL, $id=NULL) { @@ -1185,7 +1298,7 @@ function securePage($uri){ return true; } else { - header("Location: account.php"); + header("Location: index.php"); return false; } } diff --git a/testing/MCTXWeb/public_html/users/models/header.php b/testing/MCTXWeb/public_html/users/models/header.php index 239a10a..d74c600 100644 --- a/testing/MCTXWeb/public_html/users/models/header.php +++ b/testing/MCTXWeb/public_html/users/models/header.php @@ -3,36 +3,108 @@ UserCake Version: 2.0.2 http://usercake.com */ -echo " - - + +//Variables to set: +//$custom_header_scripts +//$custom_sidebar + +function startPage() { +global $loggedInUser; + +echo ' + + - - ".$websiteName." - - + MCTX3420 Web Interface + + + + + + + '.$custom_header_scripts.' - "; - -/** - * Make the remainder of the page - */ -function createPage($title) -{ - echo " -

User Managment

$title

"; - - include("left-nav.php"); - - echo " -

"; + + + + + +

JavaScript required

+ This website requires JavaScript to function correctly. + Please enable JavaScript to use this site. +

+ +

+ '; + + require_once("left-nav.php"); + if (isUserLoggedIn()) { + echo ' +

+'; } +} //function startPage() + + +function finishPage() { +if (isUserLoggedIn()) { +echo ' +

+ +'; +} + +echo ' +

+ + +'; +} + + ?> diff --git a/testing/MCTXWeb/public_html/users/register.php b/testing/MCTXWeb/public_html/users/register.php index 32f1ae1..8a0d6e6 100644 --- a/testing/MCTXWeb/public_html/users/register.php +++ b/testing/MCTXWeb/public_html/users/register.php @@ -40,9 +40,9 @@ if(!empty($_POST)) if(!ctype_alnum($displayname)){ $errors[] = lang("ACCOUNT_DISPLAY_INVALID_CHARACTERS"); } - if(minMaxRange(8,50,$password) && minMaxRange(8,50,$confirm_pass)) + if(minMaxRange(6,50,$password) && minMaxRange(6,50,$confirm_pass)) { - $errors[] = lang("ACCOUNT_PASS_CHAR_LIMIT",array(8,50)); + $errors[] = lang("ACCOUNT_PASS_CHAR_LIMIT",array(6,50)); } else if($password != $confirm_pass) { @@ -81,25 +81,13 @@ if(!empty($_POST)) } require_once("models/header.php"); -echo " - -

UserCake

Register

+startPage(); -

"; -include("left-nav.php"); echo " -

- -

"; - -echo resultBlock($errors,$successes); + - -"; +

"; + +finishPage(); ?> diff --git a/testing/MCTXWeb/public_html/users/resend-activation.php b/testing/MCTXWeb/public_html/users/resend-activation.php deleted file mode 100644 index acbee1b..0000000 --- a/testing/MCTXWeb/public_html/users/resend-activation.php +++ /dev/null @@ -1,166 +0,0 @@ - array("#ACTIVATION-URL","#USERNAME#"), - "subjectStrs" => array($activation_url,$userdetails["display_name"]) - ); - - if(!$mail->newTemplateMsg("resend-activation.txt",$hooks)) - { - $errors[] = lang("MAIL_TEMPLATE_BUILD_ERROR"); - } - else - { - if(!$mail->sendMail($userdetails["email"],"Activate your ".$websiteName." Account")) - { - $errors[] = lang("MAIL_ERROR"); - } - else - { - //Success, user details have been updated in the db now mail this information out. - $successes[] = lang("ACCOUNT_NEW_ACTIVATION_SENT"); - } - } - } - } - } - } - } -} - -//Prevent the user visiting the logged in page if he/she is already logged in -if(isUserLoggedIn()) { header("Location: account.php"); die(); } - -require_once("models/header.php"); - -echo " - -

UserCake

Resend Activation

"; - -include("left-nav.php"); - -echo " -

"; - -echo resultBlock($errors,$successes); - -echo "

"; - -//Show disabled if email activation not required -if(!$emailActivation) -{ - echo lang("FEATURE_DISABLED"); -} -else -{ - echo ""; -} - -echo " -

- -"; - -?> diff --git a/testing/MCTXWeb/public_html/users/user_change_details.php b/testing/MCTXWeb/public_html/users/user_change_details.php new file mode 100644 index 0000000..16c4532 --- /dev/null +++ b/testing/MCTXWeb/public_html/users/user_change_details.php @@ -0,0 +1,169 @@ +email = $userdetails["email"]; + $loggedInUser->user_id = $userdetails["id"]; + $loggedInUser->hash_pw = $userdetails["password"]; + $loggedInUser->title = $userdetails["title"]; + $loggedInUser->displayname = $userdetails["display_name"]; + $loggedInUser->username = $userdetails["user_name"]; + + if(trim($password_new) == "") + { + $errors[] = lang("ACCOUNT_SPECIFY_NEW_PASSWORD"); + } + else if(trim($password_confirm) == "") + { + $errors[] = lang("ACCOUNT_SPECIFY_CONFIRM_PASSWORD"); + } + else if(minMaxRange(6,50,$password_new)) + { + $errors[] = lang("ACCOUNT_NEW_PASSWORD_LENGTH",array(6,50)); + } + else if($password_new != $password_confirm) + { + $errors[] = lang("ACCOUNT_PASS_MISMATCH"); + } + + //End data validation + if(count($errors) == 0) + { + //Also prevent updating if someone attempts to update with the same password + $entered_pass_new = generateHash($password_new,$loggedInUser->hash_pw); + + if($entered_pass_new == $loggedInUser->hash_pw) + { + //Don't update, this fool is trying to update with the same password ÃÂ¬ÃÂ¬ + $errors[] = lang("ACCOUNT_PASSWORD_NOTHING_TO_UPDATE"); + } + else + { + //This function will create the new hash and update the hash_pw property. + $loggedInUser->updatePassword($password_new); + $successes[] = lang("ACCOUNT_PASSWORD_UPDATED"); + } + } + } + } + } + } +} + +if (isUserLoggedIn()) +{ + //If not admin, log them out after pw change + if (!$loggedInUser->checkPermission(array(2))) + { + $loggedInUser->userLogOut(); + } +} + +require_once("models/header.php"); +startPage(); + +echo ' +

Change of password

+ '; + +echo resultBlock($errors,$successes); +echo ' +

+ '; + +finishPage(); + +?> diff --git a/testing/MCTXWeb/public_html/users/user_settings.php b/testing/MCTXWeb/public_html/users/user_settings.php deleted file mode 100644 index 12603d0..0000000 --- a/testing/MCTXWeb/public_html/users/user_settings.php +++ /dev/null @@ -1,152 +0,0 @@ -hash_pw); - - if (trim($password) == ""){ - $errors[] = lang("ACCOUNT_SPECIFY_PASSWORD"); - } - else if($entered_pass != $loggedInUser->hash_pw) - { - //No match - $errors[] = lang("ACCOUNT_PASSWORD_INVALID"); - } - if($email != $loggedInUser->email) - { - if(trim($email) == "") - { - $errors[] = lang("ACCOUNT_SPECIFY_EMAIL"); - } - else if(!isValidEmail($email)) - { - $errors[] = lang("ACCOUNT_INVALID_EMAIL"); - } - else if(emailExists($email)) - { - $errors[] = lang("ACCOUNT_EMAIL_IN_USE", array($email)); - } - - //End data validation - if(count($errors) == 0) - { - $loggedInUser->updateEmail($email); - $successes[] = lang("ACCOUNT_EMAIL_UPDATED"); - } - } - - if ($password_new != "" OR $password_confirm != "") - { - if(trim($password_new) == "") - { - $errors[] = lang("ACCOUNT_SPECIFY_NEW_PASSWORD"); - } - else if(trim($password_confirm) == "") - { - $errors[] = lang("ACCOUNT_SPECIFY_CONFIRM_PASSWORD"); - } - else if(minMaxRange(8,50,$password_new)) - { - $errors[] = lang("ACCOUNT_NEW_PASSWORD_LENGTH",array(8,50)); - } - else if($password_new != $password_confirm) - { - $errors[] = lang("ACCOUNT_PASS_MISMATCH"); - } - - //End data validation - if(count($errors) == 0) - { - //Also prevent updating if someone attempts to update with the same password - $entered_pass_new = generateHash($password_new,$loggedInUser->hash_pw); - - if($entered_pass_new == $loggedInUser->hash_pw) - { - //Don't update, this fool is trying to update with the same password ÃÂ¬ÃÂ¬ - $errors[] = lang("ACCOUNT_PASSWORD_NOTHING_TO_UPDATE"); - } - else - { - //This function will create the new hash and update the hash_pw property. - $loggedInUser->updatePassword($password_new); - $successes[] = lang("ACCOUNT_PASSWORD_UPDATED"); - } - } - } - if(count($errors) == 0 AND count($successes) == 0){ - $errors[] = lang("NOTHING_TO_UPDATE"); - } -} - -require_once("models/header.php"); -echo " - -

UserCake

User Settings

"; -include("left-nav.php"); - -echo " -

"; - -echo resultBlock($errors,$successes); - -echo " -

- -

- -"; - -?>

UserCake

Account

UserCake

Activate Account

UserCake

Admin Configuration

UserCake

Admin Page

Page Information

Page Access

UserCake

Admin Pages

UserCake

Admin Permissions

Permission Information

Permission Membership

Permission Access

UserCake

Admin Permissions

UserCake

Admin User

User Information

UserCake

Admin Users

UserCake

Forgot Password

UserCake

2.00

UserCake

Login

User Managment

$title

UserCake

Register

UserCake

Resend Activation

UserCake

User Settings