USB-RAID-Array/Web/content/adminpanel.php

<?php
session_start();
if (empty($_SESSION['admin']) || $_SESSION['admin'] !== true) {
    session_destroy();
    header("location: ../index.php");
    exit();
}

ini_set('display_errors', 1);
error_reporting(E_ALL);

require_once __DIR__ . '/../config/config.php';
require_once __DIR__ . '/../includes/workspace.php';
// $username = "UNAME";
// $password = "PSWD";
// $db = "usbraidlogin";

$conn = getDatabaseConnection();
// charset already set in getDatabaseConnection()

if ($conn->connect_error) {
    die("Database connection failed: " . $conn->connect_error);
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (isset($_POST['uname']) && isset($_POST['pswd'])) {
        $uname = trim($_POST['uname']);
        $pswd = trim($_POST['pswd']);
        $is_admin = isset($_POST['admin']) ? 1 : 0;
        $defPath = isset($_POST['defPath']) ? trim($_POST['defPath']) : '';
        $delPer = isset($_POST['delPer']) ? (int)$_POST['delPer'] : 0;
        $dowPer = isset($_POST['downPer']) ? (int)$_POST['downPer'] : 0;
        $upPer = isset($_POST['upPer']) ? (int)$_POST['upPer'] : 0;

        if (empty($uname) || empty($pswd)) {
            $_SESSION['message'] = 'Error: Username and password are required!';
            $_SESSION['message_type'] = 'error';
        } else if (!CheckPassword($pswd)) {
            $_SESSION['message'] = 'Error: Password must be at least 8 characters long, contain at least one number and one uppercase letter!';
            $_SESSION['message_type'] = 'error';
        } else {
            $sql_check = "SELECT * FROM users WHERE uname = ?";
            $stmt_check = $conn->prepare($sql_check);
            if (!$stmt_check) {
                $_SESSION['message'] = 'Error: Database preparation failed.';
                $_SESSION['message_type'] = 'error';
            } else {
                $stmt_check->bind_param("s", $uname);
                $stmt_check->execute();
                $result_check = $stmt_check->get_result();

                if ($result_check->num_rows > 0) {
                    $_SESSION['message'] = 'Error: Username already exists!';
                    $_SESSION['message_type'] = 'error';
                } else {
                    $sql_insert = "INSERT INTO users (uname, pswd, admin, defPath, delPer, downPer, upPer) VALUES (?, ?, ?, ?, ?, ?, ?)";
                    $stmt_insert = $conn->prepare($sql_insert);
                    if (!$stmt_insert) {
                        $_SESSION['message'] = 'Error: Database preparation failed.';
                        $_SESSION['message_type'] = 'error';
                    } else {
                        $hash = password_hash($pswd, PASSWORD_BCRYPT);
                        if (!$hash) {
                            $_SESSION['message'] = 'Error: Password hashing failed.';
                            $_SESSION['message_type'] = 'error';
                        } else {
                            $stmt_insert->bind_param("ssisiii", $uname, $hash, $is_admin, $defPath, $delPer, $dowPer, $upPer);
                            if ($stmt_insert->execute()) {
                                $_SESSION['message'] = 'User added successfully!';
                                $_SESSION['message_type'] = 'success';
                            } else {
                                $_SESSION['message'] = 'Error: Failed to add user. Please try again later.';
                                $_SESSION['message_type'] = 'error';
                            }
                        }
                    }
                }
                $stmt_check->close();
                if (isset($stmt_insert)) {
                    $stmt_insert->close();
                }
            }
        }

        header("Location: adminpanel.php");
        exit();
    } else {
        $_SESSION['message'] = 'Error: Missing form data!';
        $_SESSION['message_type'] = 'error';
        header("Location: adminpanel.php");
        exit();
    }
}

if (isset($_GET['delete'])) {
    $delete_uname = htmlspecialchars($_GET['delete']);
    $sql = "DELETE FROM users WHERE uname=?";
    $stmt = $conn->prepare($sql);
    if ($stmt) {
        $stmt->bind_param("s", $delete_uname);
        if ($stmt->execute()) {
            $_SESSION['message'] = 'User deleted successfully!';
            $_SESSION['message_type'] = 'success';
        } else {
            $_SESSION['message'] = 'Error: Failed to delete user.';
            $_SESSION['message_type'] = 'error';
        }
        $stmt->close();
    } else {
        $_SESSION['message'] = 'Error: Database preparation failed.';
        $_SESSION['message_type'] = 'error';
    }

    header("Location: adminpanel.php");
    exit();
}

$result = $conn->query("SELECT uname, admin, defPath, delPer, downPer, upPer FROM users");

$message = $_SESSION['message'] ?? '';
$message_type = $_SESSION['message_type'] ?? '';
unset($_SESSION['message']);
unset($_SESSION['message_type']);

function CheckPassword($password) {
    if (strlen($password) < 8) {
        return false;
    }
    if (!preg_match('/[0-9]/', $password)) {
        return false;
    }
    if (!preg_match('/[A-Z]/', $password)) {
        return false;
    }
    return true;
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <title>Admin Panel</title>
    <link rel="icon" href="../img/favicon.ico" type="image/x-icon">
    <link rel="stylesheet" href="<?= workspaceAsset('../', 'css/modern.css') ?>">
    <link rel="stylesheet" href="<?= workspaceAsset('../', 'css/workspace.css') ?>">
    <link rel="stylesheet" href="<?= workspaceAsset('../', 'content/css/adminpanel.css') ?>">
    <script>
        function confirmDelete(uname) {
            if (confirm('Are you sure you want to delete this user?')) {
                window.location.href = 'adminpanel.php?delete=' + encodeURIComponent(uname);
            }
        }
    </script>
    <script src="<?= workspaceAsset('../', 'js/theme.js') ?>"></script>
    <script src="<?= workspaceAsset('../', 'js/ui.js') ?>" defer></script>
</head>
<?php renderWorkspaceStart([
    'root' => '../',
    'active' => 'users',
    'section' => 'User management',
    'eyebrow' => 'Workspace administration',
    'title' => 'User management',
    'description' => 'Manage accounts, storage locations and access permissions.',
    'class' => 'users-page',
]); ?>

    <section class="users-layout">

            <?php if ($message): ?>
                <div class="alert alert-<?php echo $message_type === 'success' ? 'success' : 'danger'; ?>">
                    <?php echo htmlspecialchars($message); ?>
                </div>
            <?php endif; ?>
<div class="content-panel user-create"><div class="panel-heading"><h2>Add a member</h2><p>Set up an account and choose its access.</p></div>
            <form method="POST" action="" class="add-user-form">
                <div class="mb-3">
                    <label class="form-label" for="memberUsername">Username</label>
                    <input type="text" name="uname" id="memberUsername" class="form-control" placeholder="Username" required>
                </div>
                <div class="mb-3">
                    <label class="form-label" for="memberPassword">Password</label>
                    <input type="password" name="pswd" id="memberPassword" class="form-control" placeholder="Password" required>
                </div>
                <div class="mb-3">
                    <label class="form-label" for="memberPath">Default path</label>
                    <input type="text" name="defPath" id="memberPath" class="form-control" placeholder="Default Path (e.g., /mnt/raid)" required>
                </div>
                <div class="d-flex flex-column align-items-center mb-3">
                    <div class="form-check mb-2">
                        <input type="checkbox" name="admin" id="adminCheck" value="1" class="form-check-input">
                        <label class="form-check-label" for="adminCheck">Admin</label>
                    </div>
                    <div class="form-check mb-2">
                        <input type="checkbox" name="delPer" id="delPerCheck" value="1" class="form-check-input">
                        <label class="form-check-label" for="delPerCheck">Delete Permission</label>
                    </div>
                    <div class="form-check mb-2">
                        <input type="checkbox" name="downPer" id="downPerCheck" value="1" class="form-check-input">
                        <label class="form-check-label" for="downPerCheck">Download Permission</label>
                    </div>
                    <div class="form-check mb-2">
                        <input type="checkbox" name="upPer" id="upPerCheck" value="1" class="form-check-input">
                        <label class="form-check-label" for="upPerCheck">Upload Permission</label>
                    </div>
                </div>
                <button type="submit" class="btn btn-primary">Add User</button>
            </form></div>
<div class="content-panel user-list"><div class="panel-heading"><h2>Workspace members</h2><p>Accounts and permissions for your storage.</p></div>


            <div class="table-scroll"><table class="table users-table">
                <thead class="table-dark">
                    <tr>
                        <th>Username</th>
                        <th>Admin</th>
                        <th>Default Path</th>
                        <th>Delete Permission</th>
                        <th>Download Permission</th>
                        <th>Upload Permission</th>
                        <th>Actions</th>
                    </tr>
                </thead>
                <tbody>
                    <?php while ($row = $result->fetch_assoc()) { ?>
                        <tr>
                            <td><?php echo htmlspecialchars($row['uname']); ?></td>
                            <td><?php echo $row['admin'] ? 'Yes' : 'No'; ?></td>
                            <td><?php echo htmlspecialchars($row['defPath']); ?></td>
                            <td><?php echo $row['delPer'] ? 'Yes' : 'No'; ?></td>
                            <td><?php echo $row['downPer'] ? 'Yes' : 'No'; ?></td>
                            <td><?php echo $row['upPer'] ? 'Yes' : 'No'; ?></td>
                            <td>
                                <button class="btn btn-danger btn-sm" onclick="confirmDelete('<?php echo htmlspecialchars($row['uname']); ?>')">Delete</button>
                            </td>
                        </tr>
                    <?php } ?>
                </tbody>
            </table></div>
        </div>
    </section>
    <?php renderWorkspaceEnd(); ?>
</body>
</html>
<?php
$conn->close();
?>