Ensembia/QRForge-selfhosted
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactoring of table database, added script for upgrading to versions >= 2.0, added multi-user support

Browse Source 
Signed-off-by: giandonato.inverso@edempg.it <giandonato.inverso@studenti.unimi.it>
This commit is contained in:
Giandonato Inverso
2023-10-16 13:10:57 +02:00
committed by giandonato.inverso@edempg.it
parent e36c26a37a
commit 876b6736b6
27 changed files with 363 additions and 158 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/DynamicQrcode/DynamicQrcode.php
+26 -3
View File
@@ -26,6 +26,7 @@ class DynamicQrcode {
{
$ordering = [
'id' => 'ID',
'id_owner' => 'Owner',
'filename' => 'File Name',
'identifier' => 'Identifier',
'link' => 'Link',
@@ -48,6 +49,11 @@ class DynamicQrcode {
* We save into db the url of qrcode image
*/
public function addQrcode($input_data) {
if($input_data['id_owner'] != "")
$data_to_db['id_owner'] = $input_data['id_owner'];
else
$data_to_db['id_owner'] = NULL;
$data_to_db['filename'] = htmlspecialchars($input_data['filename'], ENT_QUOTES, 'UTF-8');
$data_to_db['created_at'] = date('Y-m-d H:i:s');
$data_to_db['link'] = htmlspecialchars($input_data['link'], ENT_QUOTES, 'UTF-8');
@@ -66,6 +72,10 @@ class DynamicQrcode {
*
*/
public function editQrcode($input_data) {
if($input_data['id_owner'] != "")
$data_to_db['id_owner'] = $input_data['id_owner'];
else
$data_to_db['id_owner'] = NULL;
$data_to_db['filename'] = htmlspecialchars($input_data['filename'], ENT_QUOTES, 'UTF-8');
$data_to_db['created_at'] = date('Y-m-d H:i:s');
$data_to_db['link'] = htmlspecialchars($input_data['link'], ENT_QUOTES, 'UTF-8');
@@ -80,10 +90,23 @@ class DynamicQrcode {
*
*/
public function deleteQrcode($id) {
if($_SESSION['admin_type'] !== 'super')
$this->failure("You don't have permission to perform this action");
if($_SESSION['type'] === "super") {
$this->qrcode_instance->deleteQrcode($id);
} else if ($_SESSION['type'] === "admin") {
$qrcode = $this->getQrcode($id);
$this->qrcode_instance->deleteQrcode($id);
if(!isset($qrcode["id_owner"]))
$this->failure("You cannot delete this qrcode");
require_once BASE_PATH . '/lib/users/Users.php';
$users = new Users();
$user = $users->getUser($_SESSION['user_id']);
if($user["id"] === $qrcode["id_owner"])
$this->qrcode_instance->deleteQrcode($id);
else
$this->failure("You cannot delete this qrcode because it's of another user");
}
}
src/lib/Qrcode/Qrcode.php
-3
View File
@@ -156,9 +156,6 @@ class Qrcode {
*
*/
public function deleteQrcode($id) {
if($_SESSION['admin_type'] !== 'super')
$this->failure("You don't have permission to perform this action");
$db = getDbInstance();
$qrcode = $this->getQrcode($id);
src/lib/StaticQrcode/StaticQrcode.php
+25 -3
View File
@@ -29,6 +29,7 @@ class StaticQrcode {
{
$ordering = [
'id' => 'ID',
'id_owner' => 'Owner',
'filename' => 'File Name',
'type' => 'Type',
'content' => 'Content',
@@ -343,6 +344,10 @@ class StaticQrcode {
* We save into db the url of qrcode image
*/
private function addQrcode($type) {
if($_POST['id_owner'] != "")
$data_to_db['id_owner'] = $_POST['id_owner'];
else
$data_to_db['id_owner'] = NULL;
$data_to_db['created_at'] = date('Y-m-d H:i:s');
$data_to_db['created_by'] = $_SESSION['user_id'];
$data_to_db['filename'] = htmlspecialchars($_POST['filename'], ENT_QUOTES, 'UTF-8');
@@ -371,6 +376,10 @@ class StaticQrcode {
*
*/
public function editQrcode($input_data) {
if($input_data['id_owner'] != "")
$data_to_db['id_owner'] = $input_data['id_owner'];
else
$data_to_db['id_owner'] = NULL;
$data_to_db['filename'] = htmlspecialchars($input_data['filename'], ENT_QUOTES, 'UTF-8');
$data_to_db['created_at'] = date('Y-m-d H:i:s');
@@ -382,10 +391,23 @@ class StaticQrcode {
*
*/
public function deleteQrcode($id) {
if($_SESSION['admin_type'] !== 'super')
$this->failure("You don't have permission to perform this action");
if($_SESSION['type'] === "super") {
$this->qrcode_instance->deleteQrcode($id);
} else if ($_SESSION['type'] === "admin") {
$qrcode = $this->getQrcode($id);
$this->qrcode_instance->deleteQrcode($id);
if(!isset($qrcode["id_owner"]))
$this->failure("You cannot delete this qrcode");
require_once BASE_PATH . '/lib/users/Users.php';
$users = new Users();
$user = $users->getUser($_SESSION['user_id']);
if($user["id"] === $qrcode["id_owner"])
$this->qrcode_instance->deleteQrcode($id);
else
$this->failure("You cannot delete this qrcode because it's of another user");
}
}
/**
src/lib/Users/Users.php
+26 -23
View File
@@ -7,9 +7,7 @@ class Users
*
*/
public function __construct()
{
if ($_SESSION['admin_type'] !== 'super')
$this->failure('Only a "super admin" account can access the admin listing page', 'Location: index.php');
{
}
/**
@@ -26,18 +24,23 @@ class Users
{
$ordering = [
'id' => 'ID',
'user_name' => 'Username',
'admin_type' => 'Admin Type'
'username' => 'Username',
'type' => 'Type'
];
return $ordering;
}
public function getAllUsers() {
$db = getDbInstance();
return $db->get(DATABASE_PREFIX.'users');
}
public function getUser($id) {
$db = getDbInstance();
$db->where('id', $id);
$result = $db->getOne(DATABASE_PREFIX.'admin_accounts');
$result = $db->getOne(DATABASE_PREFIX.'users');
if($result !== NULL)
return $result;
@@ -51,17 +54,17 @@ class Users
public function addUser($input_data) {
$db = getDbInstance();
$data_to_db["user_name"] = $input_data["user_name"];
$data_to_db["username"] = $input_data["username"];
$data_to_db['password'] = password_hash($input_data['password'], PASSWORD_DEFAULT);
$data_to_db["admin_type"] = $input_data["admin_type"];
$data_to_db["type"] = $input_data["type"];
$db->where('user_name', $data_to_db['user_name']);
$db->get('admin_accounts');
$db->where('username', $data_to_db['username']);
$db->get('users');
if ($db->count >= 1)
$this->failure('Username already exists');
$last_id = $db->insert('admin_accounts', $data_to_db);
$last_id = $db->insert('users', $data_to_db);
if ($last_id)
$this->success('User added successfully');
@@ -74,24 +77,24 @@ class Users
public function editUser($input_data) {
$db = getDbInstance();
$db->where('user_name', $input_data['user_name']);
$db->where('username', $input_data['username']);
$db->where('id', $input_data["id"], '!=');
$row = $db->getOne('admin_accounts');
$row = $db->getOne('users');
if (!empty($row['user_name'])) {
if (!empty($row['username'])) {
$query_string = http_build_query(array(
'id' => $input_data["id"],
'edit' => "true",
));
$this->failure('Username already exists', 'Location: admin_user.php?'.$query_string);
$this->failure('Username already exists', 'Location: user.php?'.$query_string);
}
$data_to_db["user_name"] = $input_data["user_name"];
$data_to_db["username"] = $input_data["username"];
$data_to_db['password'] = password_hash($input_data['password'], PASSWORD_DEFAULT);
$data_to_db["admin_type"] = $input_data["admin_type"];
$data_to_db["type"] = $input_data["type"];
$db->where('id', $input_data["id"]);
$stat = $db->update('admin_accounts', $data_to_db);
$stat = $db->update('users', $data_to_db);
if ($stat)
$this->success('User updated successfully!');
@@ -104,14 +107,14 @@ class Users
*
*/
public function deleteUser($id) {
if($_SESSION['admin_type']!='super'){
if($_SESSION['type']!='super'){
header('HTTP/1.1 401 Unauthorized', true, 401);
exit("401 Unauthorized");
}
$db = getDbInstance();
$db->where('id', $id);
$stat = $db->delete('admin_accounts');
$stat = $db->delete('users');
if ($stat)
$this->info('User deleted successfully!');
@@ -122,7 +125,7 @@ class Users
/**
* Flash message Failure process
*/
public function failure($message, $location = 'Location: admin_users.php') {
public function failure($message, $location = 'Location: users.php') {
$_SESSION['failure'] = $message;
header($location);
exit();
@@ -133,7 +136,7 @@ class Users
*/
public function success($message) {
$_SESSION['success'] = $message;
header('Location: admin_users.php');
header('Location: users.php');
exit();
}
@@ -142,7 +145,7 @@ class Users
*/
public function info($message) {
$_SESSION['info'] = $message;
header('Location: admin_users.php');
header('Location: users.php');
exit();
}
}