micalis/USB-RAID-Array
1
0
Fork 0
mirror of https://github.com/michalcz10/USB-RAID-Array.git synced 2026-11-11 07:59:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

revise backend

Browse Source
This commit is contained in:
Michal Sedlák
2026-10-18 15:55:34 +02:00
parent dc452059f3
commit 99b1c96f4b
23 changed files with 681 additions and 720 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Web/content/adminpanel.php
+69 -128
View File
@@ -1,139 +1,80 @@
<?php
session_start();
if (empty($_SESSION['admin']) || $_SESSION['admin'] !== true) {
session_destroy();
header("location: ../index.php");
exit();
}
ini_set('display_errors', 1);
error_reporting(E_ALL);
require_once __DIR__ . '/../includes/auth.php';
requireLogin('../index.php');
requirePermission('admin', 'You do not have permission to manage users.');
require_once __DIR__ . '/../config/config.php';
require_once __DIR__ . '/../includes/workspace.php';
// $username = "UNAME";
// $password = "PSWD";
// $db = "usbraidlogin";
$conn = getDatabaseConnection();
// charset already set in getDatabaseConnection()
if ($conn->connect_error) {
die("Database connection failed: " . $conn->connect_error);
}
$database = getDatabaseConnection();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (isset($_POST['uname']) && isset($_POST['pswd'])) {
$uname = trim($_POST['uname']);
$pswd = trim($_POST['pswd']);
$is_admin = isset($_POST['admin']) ? 1 : 0;
$defPath = isset($_POST['defPath']) ? trim($_POST['defPath']) : '';
$delPer = isset($_POST['delPer']) ? (int)$_POST['delPer'] : 0;
$dowPer = isset($_POST['downPer']) ? (int)$_POST['downPer'] : 0;
$upPer = isset($_POST['upPer']) ? (int)$_POST['upPer'] : 0;
$username = is_string($_POST['uname'] ?? null) ? trim($_POST['uname']) : '';
$password = is_string($_POST['pswd'] ?? null) ? $_POST['pswd'] : '';
$defaultPath = is_string($_POST['defPath'] ?? null) ? normalizePath(trim($_POST['defPath'])) : '/';
$isAdmin = isset($_POST['admin']) ? 1 : 0;
$canDelete = isset($_POST['delPer']) ? 1 : 0;
$canDownload = isset($_POST['downPer']) ? 1 : 0;
$canUpload = isset($_POST['upPer']) ? 1 : 0;
$_SESSION['message_type'] = 'error';
if (empty($uname) || empty($pswd)) {
$_SESSION['message'] = 'Error: Username and password are required!';
$_SESSION['message_type'] = 'error';
} else if (!CheckPassword($pswd)) {
$_SESSION['message'] = 'Error: Password must be at least 8 characters long, contain at least one number and one uppercase letter!';
$_SESSION['message_type'] = 'error';
} else {
$sql_check = "SELECT * FROM users WHERE uname = ?";
$stmt_check = $conn->prepare($sql_check);
if (!$stmt_check) {
$_SESSION['message'] = 'Error: Database preparation failed.';
$_SESSION['message_type'] = 'error';
if ($username === '' || $password === '') {
$_SESSION['message'] = 'Error: Username and password are required!';
} elseif (!isPasswordValid($password)) {
$_SESSION['message'] = 'Error: Password must be at least 8 characters long, contain at least one number and one uppercase letter!';
} else {
try {
$statement = $database->prepare('SELECT uname FROM users WHERE uname = ?');
$statement->bind_param('s', $username);
$statement->execute();
$result = $statement->get_result();
$userExists = $result->num_rows > 0;
$result->free();
$statement->close();
if ($userExists) {
$_SESSION['message'] = 'Error: Username already exists!';
} else {
$stmt_check->bind_param("s", $uname);
$stmt_check->execute();
$result_check = $stmt_check->get_result();
if ($result_check->num_rows > 0) {
$_SESSION['message'] = 'Error: Username already exists!';
$_SESSION['message_type'] = 'error';
} else {
$sql_insert = "INSERT INTO users (uname, pswd, admin, defPath, delPer, downPer, upPer) VALUES (?, ?, ?, ?, ?, ?, ?)";
$stmt_insert = $conn->prepare($sql_insert);
if (!$stmt_insert) {
$_SESSION['message'] = 'Error: Database preparation failed.';
$_SESSION['message_type'] = 'error';
} else {
$hash = password_hash($pswd, PASSWORD_BCRYPT);
if (!$hash) {
$_SESSION['message'] = 'Error: Password hashing failed.';
$_SESSION['message_type'] = 'error';
} else {
$stmt_insert->bind_param("ssisiii", $uname, $hash, $is_admin, $defPath, $delPer, $dowPer, $upPer);
if ($stmt_insert->execute()) {
$_SESSION['message'] = 'User added successfully!';
$_SESSION['message_type'] = 'success';
} else {
$_SESSION['message'] = 'Error: Failed to add user. Please try again later.';
$_SESSION['message_type'] = 'error';
}
}
}
}
$stmt_check->close();
if (isset($stmt_insert)) {
$stmt_insert->close();
}
$passwordHash = password_hash($password, PASSWORD_BCRYPT);
$statement = $database->prepare('INSERT INTO users (uname, pswd, admin, defPath, delPer, downPer, upPer) VALUES (?, ?, ?, ?, ?, ?, ?)');
$statement->bind_param('ssisiii', $username, $passwordHash, $isAdmin, $defaultPath, $canDelete, $canDownload, $canUpload);
$statement->execute();
$statement->close();
$_SESSION['message'] = 'User added successfully!';
$_SESSION['message_type'] = 'success';
}
} catch (mysqli_sql_exception $exception) {
error_log($exception->getMessage());
$_SESSION['message'] = 'Error: Failed to add user. Please try again later.';
}
header("Location: adminpanel.php");
exit();
} else {
$_SESSION['message'] = 'Error: Missing form data!';
$_SESSION['message_type'] = 'error';
header("Location: adminpanel.php");
exit();
}
$database->close();
header('Location: adminpanel.php');
exit;
}
if (isset($_GET['delete'])) {
$delete_uname = htmlspecialchars($_GET['delete']);
$sql = "DELETE FROM users WHERE uname=?";
$stmt = $conn->prepare($sql);
if ($stmt) {
$stmt->bind_param("s", $delete_uname);
if ($stmt->execute()) {
$_SESSION['message'] = 'User deleted successfully!';
$_SESSION['message_type'] = 'success';
} else {
$_SESSION['message'] = 'Error: Failed to delete user.';
$_SESSION['message_type'] = 'error';
}
$stmt->close();
} else {
$_SESSION['message'] = 'Error: Database preparation failed.';
if (isset($_GET['delete']) && is_string($_GET['delete'])) {
$usernameToDelete = $_GET['delete'];
try {
$statement = $database->prepare('DELETE FROM users WHERE uname = ?');
$statement->bind_param('s', $usernameToDelete);
$statement->execute();
$statement->close();
$_SESSION['message'] = 'User deleted successfully!';
$_SESSION['message_type'] = 'success';
} catch (mysqli_sql_exception $exception) {
error_log($exception->getMessage());
$_SESSION['message'] = 'Error: Failed to delete user.';
$_SESSION['message_type'] = 'error';
}
header("Location: adminpanel.php");
exit();
$database->close();
header('Location: adminpanel.php');
exit;
}
$result = $conn->query("SELECT uname, admin, defPath, delPer, downPer, upPer FROM users");
$result = $database->query('SELECT uname, admin, defPath, delPer, downPer, upPer FROM users');
$message = $_SESSION['message'] ?? '';
$message_type = $_SESSION['message_type'] ?? '';
unset($_SESSION['message']);
unset($_SESSION['message_type']);
function CheckPassword($password) {
if (strlen($password) < 8) {
return false;
}
if (!preg_match('/[0-9]/', $password)) {
return false;
}
if (!preg_match('/[A-Z]/', $password)) {
return false;
}
return true;
}
$messageType = $_SESSION['message_type'] ?? '';
unset($_SESSION['message'], $_SESSION['message_type']);
?>
<!DOCTYPE html>
@@ -169,7 +110,7 @@ function CheckPassword($password) {
<section class="users-layout">
<?php if ($message): ?>
<div class="alert alert-<?php echo $message_type === 'success' ? 'success' : 'danger'; ?>">
<div class="alert alert-<?php echo $messageType === 'success' ? 'success' : 'danger'; ?>">
<?php echo htmlspecialchars($message); ?>
</div>
<?php endif; ?>
@@ -223,16 +164,16 @@ function CheckPassword($password) {
</tr>
</thead>
<tbody>
<?php while ($row = $result->fetch_assoc()) { ?>
<?php while ($user = $result->fetch_assoc()) { ?>
<tr>
<td><?php echo htmlspecialchars($row['uname']); ?></td>
<td><?php echo $row['admin'] ? 'Yes' : 'No'; ?></td>
<td><?php echo htmlspecialchars($row['defPath']); ?></td>
<td><?php echo $row['delPer'] ? 'Yes' : 'No'; ?></td>
<td><?php echo $row['downPer'] ? 'Yes' : 'No'; ?></td>
<td><?php echo $row['upPer'] ? 'Yes' : 'No'; ?></td>
<td><?php echo htmlspecialchars($user['uname']); ?></td>
<td><?php echo $user['admin'] ? 'Yes' : 'No'; ?></td>
<td><?php echo htmlspecialchars($user['defPath']); ?></td>
<td><?php echo $user['delPer'] ? 'Yes' : 'No'; ?></td>
<td><?php echo $user['downPer'] ? 'Yes' : 'No'; ?></td>
<td><?php echo $user['upPer'] ? 'Yes' : 'No'; ?></td>
<td>
<button class="btn btn-danger btn-sm" onclick="confirmDelete('<?php echo htmlspecialchars($row['uname']); ?>')">Delete</button>
<button class="btn btn-danger btn-sm" onclick="confirmDelete(<?= workspaceEscape(json_encode($user['uname'])) ?>)">Delete</button>
</td>
</tr>
<?php } ?>
@@ -244,5 +185,5 @@ function CheckPassword($password) {
</body>
</html>
<?php
$conn->close();
$database->close();
?>