From 3c79d86abde871fd8c3df02eb06c30f53b9d9827 Mon Sep 17 00:00:00 2001 From: Hendrik Date: Wed, 1 Feb 2017 11:33:34 +0100 Subject: [PATCH 01/12] add admin search by role --- website/public/styles/adminpanel.css | 2 +- website/queries/group_page.php | 22 ++++++++++++++-------- website/queries/user.php | 22 ++++++++++++++-------- 3 files changed, 29 insertions(+), 17 deletions(-) diff --git a/website/public/styles/adminpanel.css b/website/public/styles/adminpanel.css index 0648118..39d823f 100644 --- a/website/public/styles/adminpanel.css +++ b/website/public/styles/adminpanel.css @@ -56,5 +56,5 @@ } .bancommentform input[type="text"] { - width: 100%; + width: 80%; } \ No newline at end of file diff --git a/website/queries/group_page.php b/website/queries/group_page.php index 83911f8..12e6ff7 100644 --- a/website/queries/group_page.php +++ b/website/queries/group_page.php @@ -176,7 +176,9 @@ function search20GroupsFromNByStatus($n, $keyword, $status) { return $q; } -function searchSomeGroupsByStatus($n, $m, $keyword, $status) { +function searchSomeGroupsByStatus($n, $m, $search, $status) { +// parentheses not needed in where clause, for clarity as +// role search should override status filter. $q = prepareQuery(" SELECT `groupID`, @@ -186,16 +188,18 @@ function searchSomeGroupsByStatus($n, $m, $keyword, $status) { FROM `group_page` WHERE - `name` LIKE :keyword AND - FIND_IN_SET (`status`, :statuses) + (`name` LIKE :keyword AND + FIND_IN_SET (`status`, :statuses)) OR + `status` = :search ORDER BY `name` LIMIT :n, :m "); - $keyword = "%$keyword%"; + $keyword = "%$search%"; $q->bindParam(':keyword', $keyword); + $q->bindParam(':search', $search); $q->bindParam(':n', $n, PDO::PARAM_INT); $q->bindParam(':m', $m, PDO::PARAM_INT); $statuses = implode(',', $status); @@ -204,21 +208,23 @@ function searchSomeGroupsByStatus($n, $m, $keyword, $status) { return $q; } -function countSomeGroupsByStatus($keyword, $status) { +function countSomeGroupsByStatus($search, $status) { $q = prepareQuery(" SELECT COUNT(*) FROM `group_page` WHERE - `name` LIKE :keyword AND - FIND_IN_SET (`status`, :statuses) + (`name` LIKE :keyword AND + FIND_IN_SET (`status`, :statuses)) OR + `status` = :search ORDER BY `name` "); - $keyword = "%$keyword%"; + $keyword = "%$search%"; $q->bindParam(':keyword', $keyword); + $q->bindParam(':search', $search); $statuses = implode(',', $status); $q->bindParam(':statuses', $statuses); $q->execute(); diff --git a/website/queries/user.php b/website/queries/user.php index e712a6c..7b32004 100644 --- a/website/queries/user.php +++ b/website/queries/user.php @@ -193,7 +193,9 @@ function search20UsersFromNByStatus($n, $keyword, $status) { return $q; } -function searchSomeUsersByStatus($n, $m, $keyword, $status) { +function searchSomeUsersByStatus($n, $m, $search, $status) { +// parentheses not needed in where clause, for clarity as +// role search should override status filter. $q = prepareQuery(" SELECT `userID`, @@ -203,8 +205,9 @@ function searchSomeUsersByStatus($n, $m, $keyword, $status) { FROM `user` WHERE - `username` LIKE :keyword AND - FIND_IN_SET (`role`, :statuses) + (`username` LIKE :keyword AND + FIND_IN_SET (`role`, :statuses)) OR + `role` = :search ORDER BY `role`, `username` @@ -212,8 +215,9 @@ function searchSomeUsersByStatus($n, $m, $keyword, $status) { :n, :m "); - $keyword = "%$keyword%"; + $keyword = "%$search%"; $q->bindParam(':keyword', $keyword); + $q->bindParam(':search', $search); $q->bindParam(':n', $n, PDO::PARAM_INT); $q->bindParam(':m', $m, PDO::PARAM_INT); $statuses = implode(',', $status); @@ -222,22 +226,24 @@ function searchSomeUsersByStatus($n, $m, $keyword, $status) { return $q; } -function countSomeUsersByStatus($keyword, $status) { +function countSomeUsersByStatus($search, $status) { $q = prepareQuery(" SELECT COUNT(*) FROM `user` WHERE - `username` LIKE :keyword AND - FIND_IN_SET (`role`, :statuses) + (`username` LIKE :keyword AND + FIND_IN_SET (`role`, :statuses)) OR + `role` = :search ORDER BY `role`, `username` "); - $keyword = "%$keyword%"; + $keyword = "%$search%"; $q->bindParam(':keyword', $keyword); + $q->bindParam(':search', $search); $statuses = implode(',', $status); $q->bindParam(':statuses', $statuses); $q->execute(); From d87d0b7295ec2f7f35c46fb55010516f5e14cc42 Mon Sep 17 00:00:00 2001 From: Marijn Jansen Date: Wed, 1 Feb 2017 14:13:22 +0100 Subject: [PATCH 02/12] Backend for delete post --- website/public/API/deletePost.php | 20 ++++++++++++ website/public/js/post.js | 14 ++++++++ website/queries/post.php | 53 +++++++++++++++++++++++++++++++ website/views/post-view.php | 4 ++- 4 files changed, 90 insertions(+), 1 deletion(-) create mode 100644 website/public/API/deletePost.php diff --git a/website/public/API/deletePost.php b/website/public/API/deletePost.php new file mode 100644 index 0000000..fffadf5 --- /dev/null +++ b/website/public/API/deletePost.php @@ -0,0 +1,20 @@ +execute(); return $stmt->rowCount(); } + +function deletePost(int $postID, int $userID) { + if (checkPermissionOnPost($postID, $userID)) { + $stmt = prepareQuery(" + DELETE FROM + `post` + WHERE + `postID` = :postID + "); + $stmt->bindParam(":postID", $postID); + $stmt->execute(); + } +} + +function checkPermissionOnPost(int $postID, int $userID) : bool { + $getGroupID = prepareQuery(" + SELECT + `author`, + `groupID` + FROM + `post` + WHERE + `postID` = :postID + "); + $getGroupID->bindParam(":postID", $postID); + $getGroupID->execute(); + $postinfo = $getGroupID->fetch(); + + if ($postinfo["groupID"] == null) { + // User post + return ($userID == $postinfo["author"]); + } else { + // Group post + $roleInGroup = getRoleInGroup($userID, $postinfo["groupID"]); + return ($roleInGroup == "mod" or $roleInGroup == "admin"); + } +} + +function getRoleInGroup(int $userID, int $groupID) { + $stmt = prepareQuery(" + SELECT + `role` + FROM + `group_member` + WHERE + `userID` = :userID AND + `groupID` = :groupID + "); + $stmt->bindParam(":userID", $userID); + $stmt->bindParam(":groupID", $groupID); + $stmt->execute(); + return $stmt->fetch()["role"]; +} diff --git a/website/views/post-view.php b/website/views/post-view.php index 11a985a..0844224 100644 --- a/website/views/post-view.php +++ b/website/views/post-view.php @@ -6,7 +6,9 @@ session_start(); ?>

-
verwijder post
+
+ +