failure('Only "super admin" and "admin" accounts can access the user management page', 'Location: index.php');
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_verify_or_die();
}
$edit = false;
if($_SERVER["REQUEST_METHOD"] === "GET" && isset($_GET["edit"]) && $_GET["edit"] == "true" && isset($_GET["id"])) {
$edit = true;
$user = $user_instance->getUser($_GET["id"]);
// An admin may only open the edit form for their own 'user' accounts.
if ($_SESSION['type'] === 'admin' && (
$user['type'] !== 'user' || (int) $user['owner_admin_id'] !== (int) $_SESSION['user_id']
)) {
$user_instance->failure('You are not allowed to edit this user', 'Location: users.php');
}
}
if($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST["del_id"])) {
$user_instance->deleteUser($_POST["del_id"]);
}
if($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST["edit"])) {
if(
isset($_POST["username"]) &&
isset($_POST["password"]) &&
isset($_POST["type"]) &&
isset($_POST["id"])
)
$user_instance->editUser($_POST);
}
if($_SERVER["REQUEST_METHOD"] === "POST" && !isset($_POST["edit"])) {
if(
isset($_POST["username"]) &&
isset($_POST["password"]) &&
isset($_POST["type"])
)
$user_instance->addUser($_POST);
}
?>
QRForge