diff --git a/website/mysql_config.xml b/website/mysql_config.xml deleted file mode 100644 index de2d929..0000000 --- a/website/mysql_config.xml +++ /dev/null @@ -1,7 +0,0 @@ - - - localhost - myhyvesbookplus - mhbp - qdtboXhCHJyL2szC - \ No newline at end of file diff --git a/website/public/.htaccess b/website/public/.htaccess new file mode 100644 index 0000000..f08898a --- /dev/null +++ b/website/public/.htaccess @@ -0,0 +1,12 @@ +Options +FollowSymLinks +RewriteEngine On + +ErrorDocument 404 /error404.jpg + +RewriteCond %{SCRIPT_FILENAME} !-d +RewriteCond %{SCRIPT_FILENAME} !-f + +# Resolve .php file for extensionless php urls +RewriteRule ^([^/.]+)$ $1.php [L] + +RewriteRule ^profile/([A-z0-9]+)$ profile.php?username=$1 [NC] \ No newline at end of file diff --git a/website/public/API/loadMessages.php b/website/public/API/loadMessages.php index fef9db7..e30acc8 100644 --- a/website/public/API/loadMessages.php +++ b/website/public/API/loadMessages.php @@ -1,13 +1,13 @@ \ +
\ + \ +
\ + \ + "); + } +} + +function loadNotifications() { + $.post( + "API/loadNotifications.php" + ).done(function(data) { + if (data && data != "[]") { + showNotifications(JSON.parse(data), "friendrequestslist"); + } + }); + + setTimeout(loadNotifications, 10000); +} + +loadNotifications(); + diff --git a/website/public/js/registerAndLogin.js b/website/public/js/registerAndLogin.js new file mode 100644 index 0000000..0452d15 --- /dev/null +++ b/website/public/js/registerAndLogin.js @@ -0,0 +1,8 @@ +function checkLoggedIn() { + if (confirm("You are already logged in!\nDo you want to logout?\nPress ok to logout.") == true) { + window.location.href = "logout.php"; + } else { + window.location.href = "profile.php"; + } + document.getElementById("demo").innerHTML = x; +} diff --git a/website/public/login.php b/website/public/login.php index f889f2f..0d07413 100644 --- a/website/public/login.php +++ b/website/public/login.php @@ -4,27 +4,34 @@ include("../views/login_head.php"); require_once("../queries/connect.php"); include_once("../queries/login.php"); + include_once("../queries/checkInput.php"); ?> + window.onload=checkLoggedIn(); + "; + } + // Define variables and set to empty values $uname = $psw =""; $loginErr =""; // Trying to login if ($_SERVER["REQUEST_METHOD"] == "POST") { - $uname=strtolower($_POST["uname"]); // Empty username or password field if (empty($_POST["uname"]) || empty($_POST["psw"])) { $loginErr = "Gebruikersnaam of wachtwoord is niet ingevuld"; } else { - $psw=$_POST["psw"]; - $hash=getUser()["password"]; - $userid=getUser()["userID"]; + $uname = strtolower(test_input($_POST["uname"])); + $psw = test_input($_POST["psw"]); + $hash = getUser()["password"]; + $userid = getUser()["userID"]; // If there's an account, go to the profile page if(password_verify($psw, $hash)) { diff --git a/website/public/profile.php b/website/public/profile.php index 562bfb8..e4f1452 100644 --- a/website/public/profile.php +++ b/website/public/profile.php @@ -1,70 +1,29 @@ - $unix_date) { - $difference = $now - $unix_date; - $tense = "geleden"; - } else { - $difference = $unix_date - $now; - $tense = "vanaf nu"; - } - - for($i = 0; $difference >= $lengths[$i] && $i < count($lengths) - 1; $i++) { - $difference /= $lengths[$i]; - } - - $difference = round($difference); - - if($difference != 1) { - $period = $multiple_periods[$i]; - } else { - $period = $single_periods[$i]; - } - - return "$difference $period $tense"; -} - -if(empty($_GET["username"])) { - echo "User does not exist!"; - return; -} - -$userID = getUserID($_GET["username"]); - -$user = selectUser($userID); -$friends = selectAllFriends($userID); -$groups = selectAllUserGroups($userID); -$posts = selectAllUserPosts($userID); - -?> - + diff --git a/website/public/search.php b/website/public/search.php index c314791..6cfadd8 100644 --- a/website/public/search.php +++ b/website/public/search.php @@ -1,7 +1,11 @@ - + diff --git a/website/public/settings.php b/website/public/settings.php index 45e50d8..b473f99 100644 --- a/website/public/settings.php +++ b/website/public/settings.php @@ -2,7 +2,7 @@ @@ -12,8 +12,6 @@ diff --git a/website/queries/friendship.php b/website/queries/friendship.php index f058c70..0deba63 100644 --- a/website/queries/friendship.php +++ b/website/queries/friendship.php @@ -7,7 +7,7 @@ function selectAllFriends($userID) { `username`, IFNULL( `profilepicture`, - 'img/notbad.jpg' + '../img/notbad.jpg' ) AS profilepicture, `onlinestatus`, `role` @@ -15,6 +15,7 @@ function selectAllFriends($userID) { `user` INNER JOIN `friendship` + WHERE (`friendship`.`user1ID` = :userID AND `friendship`.`user2ID` = `user`.`userID` OR @@ -28,4 +29,35 @@ function selectAllFriends($userID) { $stmt->execute(); return $stmt; +} + +function selectAllFriendRequests() { + $stmt = $GLOBALS["db"]->prepare(" + SELECT + `userID`, + `username`, + IFNULL( + `profilepicture`, + '../img/notbad.jpg' + ) AS profilepicture, + `onlinestatus`, + `role` + FROM + `user` + INNER JOIN + `friendship` + + WHERE + (`friendship`.`user1ID` = :userID AND + `friendship`.`user2ID` = `user`.`userID` OR + `friendship`.`user2ID` = :userID AND + `friendship`.`user1ID` = `user`.`userID`) AND + `role` != 5 AND + `status` = 0 + "); + + $stmt->bindParam(':userID', $_SESSION["userID"], PDO::PARAM_INT); + $stmt->execute(); + + return json_encode($stmt->fetchAll()); } \ No newline at end of file diff --git a/website/queries/group_page.php b/website/queries/group_page.php index 6763e3f..d704e8c 100644 --- a/website/queries/group_page.php +++ b/website/queries/group_page.php @@ -1,7 +1,7 @@ query(" + $q = $GLOBALS["db"]->prepare(" SELECT `group_page`.`name`, `group_page`.`picture`, @@ -11,12 +11,16 @@ function selectGroupById($groupID) { FROM `group_page` WHERE - `group_page`.`groupID` = $groupID + `group_page`.`groupID` = :groupID "); + + $q->bindParam(':groupID', $groupID); + $q->execute(); + return $q; } function select20GroupsFromN($n) { - return $GLOBALS["db"]->query(" + $q = $GLOBALS["db"]->prepare(" SELECT `group_page`.`groupID`, `group_page`.`name`, @@ -29,12 +33,16 @@ function select20GroupsFromN($n) { ORDER BY `group_page`.`name` ASC LIMIT - $n, 20 + :n, 20 "); + + $q->bindParam(':n', $n); + $q->execute(); + return $q; } function select20GroupsByStatusFromN($n, $status) { - return $GLOBALS["db"]->query(" + $q = $GLOBALS["db"]->prepare(" SELECT `group_page`.`groupID`, `group_page`.`name`, @@ -45,12 +53,17 @@ function select20GroupsByStatusFromN($n, $status) { FROM `group_page` WHERE - `group_page`.`status` = $status + `group_page`.`status` = :status ORDER BY `group_page`.`name` ASC LIMIT - $n, 20 + :n, 20 "); + + $q->bindParam(':status', $status); + $q->bindParam(':n', $n); + $q->execute(); + return $q; } function search20GroupsFromNByStatus($n, $keyword, $status) { @@ -80,6 +93,55 @@ function search20GroupsFromNByStatus($n, $keyword, $status) { return $q; } +function searchSomeGroupsByStatus($n, $m, $keyword, $status) { + $q = $GLOBALS['db']->prepare(" + SELECT + `groupID`, + `name`, + `status`, + `description` + FROM + `group_page` + WHERE + `name` LIKE :keyword AND + FIND_IN_SET (`status`, :statuses) + ORDER BY + `name` + LIMIT + :n, :m + "); + + $keyword = "%$keyword%"; + $q->bindParam(':keyword', $keyword); + $q->bindParam(':n', $n, PDO::PARAM_INT); + $q->bindParam(':m', $m, PDO::PARAM_INT); + $statuses = implode(',', $status); + $q->bindParam(':statuses', $statuses); + $q->execute(); + return $q; +} + +function countSomeGroupsByStatus($keyword, $status) { + $q = $GLOBALS['db']->prepare(" + SELECT + COUNT(*) + FROM + `group_page` + WHERE + `name` LIKE :keyword AND + FIND_IN_SET (`status`, :statuses) + ORDER BY + `name` + "); + + $keyword = "%$keyword%"; + $q->bindParam(':keyword', $keyword); + $statuses = implode(',', $status); + $q->bindParam(':statuses', $statuses); + $q->execute(); + return $q; +} + function changeGroupStatusByID($id, $status) { $q = $GLOBALS["db"]->query(" UPDATE @@ -92,3 +154,44 @@ function changeGroupStatusByID($id, $status) { return $q; } + +function changeMultipleGroupStatusByID($ids, $status) { + $q = $GLOBALS['db']->prepare(" + UPDATE + `group_page` + SET + `status` = :status + WHERE + FIND_IN_SET (`groupID`, :ids) + "); + + $ids = implode(',', $ids); + $q->bindParam(':ids', $ids); + $q->bindParam(':status', $status); + $q->execute(); + return $q; +} + +function searchSomeGroups($n, $m, $search) { + $stmt = $GLOBALS["db"]->prepare(" + SELECT + `name`, + `picture` + FROM + `group_page` + WHERE + `name` LIKE :keyword + ORDER BY + `name` + LIMIT + :n, :m + "); + + $search = "%$search%"; + $stmt->bindParam(':keyword', $search); + $stmt->bindParam(':n', $n, PDO::PARAM_INT); + $stmt->bindParam(':m', $m, PDO::PARAM_INT); + $stmt->execute(); + return $stmt; +} +?> \ No newline at end of file diff --git a/website/queries/nicetime.php b/website/queries/nicetime.php new file mode 100644 index 0000000..4db6cbd --- /dev/null +++ b/website/queries/nicetime.php @@ -0,0 +1,39 @@ + $unix_date) { +$difference = $now - $unix_date; +$tense = "geleden"; +} else { +$difference = $unix_date - $now; +$tense = "vanaf nu"; +} + +for($i = 0; $difference >= $lengths[$i] && $i < count($lengths) - 1; $i++) { +$difference /= $lengths[$i]; +} + +$difference = round($difference); + +if($difference != 1) { +$period = $multiple_periods[$i]; +} else { +$period = $single_periods[$i]; +} + +return "$difference $period $tense"; +} \ No newline at end of file diff --git a/website/queries/settings.php b/website/queries/settings.php index 7c92583..1a5dacf 100644 --- a/website/queries/settings.php +++ b/website/queries/settings.php @@ -87,23 +87,22 @@ function updateSettings() { `userID` = :userID "); - $stmt->bindParam(":fname", $_POST["fname"]); - $stmt->bindParam(":lname", $_POST["lname"]); - $stmt->bindParam(":location", $_POST["location"]); - $stmt->bindParam(":bday", $_POST["bday"]); - $stmt->bindParam(":bio", $_POST["bio"]); - $stmt->bindParam(":userID", $_SESSION["userID"]); - + $stmt->bindValue(":fname", test_input($_POST["fname"])); + $stmt->bindValue(":lname", test_input($_POST["lname"])); + $stmt->bindValue(":location", test_input($_POST["location"])); + $stmt->bindValue(":bday", test_input($_POST["bday"])); + $stmt->bindValue(":bio", test_input($_POST["bio"])); + $stmt->bindValue(":userID", $_SESSION["userID"]); $stmt->execute(); return new settingsMessage("happy", "Instellingen zijn opgeslagen."); } -function updatePassword() { +function changePassword() { $user = getPasswordHash(); if (password_verify($_POST["password-old"], $user["password"])) { if ($_POST["password-new"] == $_POST["password-confirm"] && (strlen($_POST["password-new"]) >= 8)) { - if (changePassword()) { + if (doChangePassword()) { return new settingsMessage("happy", "Wachtwoord gewijzigd."); } else { return new settingsMessage("angry", "Er is iets mis gegaan."); @@ -116,7 +115,7 @@ function updatePassword() { } } -function changePassword() { +function doChangePassword() { $stmt = $GLOBALS["db"]->prepare(" UPDATE `user` @@ -184,4 +183,42 @@ function doChangeEmail($email) { $stmt->bindParam(":userID", $_SESSION["userID"]); $stmt->execute(); return $stmt->rowCount(); +} + +function updateProfilePicture() { + $profilePictureDir = "/var/www/html/public/"; + $relativePath = "uploads/profilepictures/" . $_SESSION["userID"] . "_" . basename($_FILES["pp"]["name"]); + removeOldProfilePicture(); + move_uploaded_file($_FILES['pp']['tmp_name'], $profilePictureDir . $relativePath); + setProfilePictureToDatabase("../" . $relativePath); +} + +function removeOldProfilePicture() { + $stmt = $GLOBALS["db"]->prepare(" + SELECT + `profilepicture` + FROM + `user` + WHERE + `userID` = :userID + "); + $stmt->bindParam(":userID", $_SESSION["userID"]); + $stmt->execute(); + $old_avatar = $stmt->fetch()["profilepicture"]; + unlink("/var/www/html/public/uploads/" . $old_avatar); +} + +function setProfilePictureToDatabase($url) { + $stmt = $GLOBALS["db"]->prepare(" + UPDATE + `user` + SET + `profilepicture` = :profilePicture + WHERE + `userID` = :userID + "); + + $stmt->bindParam(":profilePicture", $url); + $stmt->bindParam(":userID", $_SESSION["userID"]); + $stmt->execute(); } \ No newline at end of file diff --git a/website/queries/user.php b/website/queries/user.php index d5fea1b..114d673 100644 --- a/website/queries/user.php +++ b/website/queries/user.php @@ -1,4 +1,5 @@ query(" + $q = $GLOBALS["db"]->prepare(" SELECT `userID`, `username`, @@ -99,8 +100,12 @@ function select20UsersFromN($n) { `role`, `username` LIMIT - $n, 20 + :n, 20 "); + + $q->bindParam(':n', $n); + $q->execute(); + return $q; } function search20UsersFromN($n, $keyword) { @@ -155,18 +160,144 @@ function search20UsersFromNByStatus($n, $keyword, $status) { return $q; } -function changeUserStatusByID($id, $status) { - $q = $GLOBALS["db"]->query(" - UPDATE +function searchSomeUsersByStatus($n, $m, $keyword, $status) { + $q = $GLOBALS["db"]->prepare(" + SELECT + `userID`, + `username`, + `role`, + `bancomment` + FROM `user` - SET - `role` = $status WHERE - `userID` = $id + `username` LIKE :keyword AND + FIND_IN_SET (`role`, :statuses) + ORDER BY + `role`, + `username` + LIMIT + :n, :m "); + $keyword = "%$keyword%"; + $q->bindParam(':keyword', $keyword); + $q->bindParam(':n', $n, PDO::PARAM_INT); + $q->bindParam(':m', $m, PDO::PARAM_INT); + $statuses = implode(',', $status); + $q->bindParam(':statuses', $statuses); + $q->execute(); + return $q; +} + +function countSomeUsersByStatus($keyword, $status) { + $q = $GLOBALS["db"]->prepare(" + SELECT + COUNT(*) + FROM + `user` + WHERE + `username` LIKE :keyword AND + FIND_IN_SET (`role`, :statuses) + ORDER BY + `role`, + `username` + "); + + $keyword = "%$keyword%"; + $q->bindParam(':keyword', $keyword); + $statuses = implode(',', $status); + $q->bindParam(':statuses', $statuses); + $q->execute(); return $q; } -?> +function changeUserStatusByID($id, $status) { + $q = $GLOBALS["db"]->prepare(" + UPDATE + `user` + SET + `role` = :status + WHERE + `userID` = :id + "); + + $q->bindParam(':status', $status); + $q->bindParam(':id', $id); + $q->execute(); + return $q; +} + +function changeMultipleUserStatusByID($ids, $status) { + $q = $GLOBALS["db"]->prepare(" + UPDATE + `user` + SET + `role` = :status + WHERE + FIND_IN_SET (`userID`, :ids) + "); + + $ids = implode(',', $ids); + $q->bindParam(':ids', $ids); + $q->bindParam(':status', $status); + $q->execute(); + return $q; +} + +function selectRandomNotFriendUser($userID) { + $stmt = $GLOBALS["db"]->prepare(" + SELECT + `user`.`username` + FROM + `user` + WHERE + `userID` NOT IN (SELECT + `user1ID` + FROM + `friendship` + WHERE `user1ID` = :userID) OR + `userID` NOT IN (SELECT + `user2ID` + FROM + `friendship` + WHERE `user2ID` = :userID) + ORDER BY + RAND() + LIMIT + 1 + "); + + $stmt->bindParam(':userID', $userID, PDO::PARAM_INT); + $stmt->execute(); + return $stmt->fetch(); +} + +function searchSomeUsers($n, $m, $search) { + $stmt = $GLOBALS["db"]->prepare(" + SELECT + `username`, + `profilepicture`, + `fname`, + `lname` + FROM + `user` + WHERE + `username` LIKE :keyword OR + `fname` LIKE :keyword OR + `lname` LIKE :keyword + ORDER BY + `fname`, + `lname`, + `username` + LIMIT + :n, :m + "); + + $search = "%$search%"; + $stmt->bindParam(':keyword', $search); + $stmt->bindParam(':n', $n, PDO::PARAM_INT); + $stmt->bindParam(':m', $m, PDO::PARAM_INT); + $stmt->execute(); + return $stmt; +} diff --git a/website/views/adminpanel.php b/website/views/adminpanel.php index c98c051..e53d679 100644 --- a/website/views/adminpanel.php +++ b/website/views/adminpanel.php @@ -3,32 +3,7 @@ Admin Panel - +
@@ -81,13 +69,10 @@ function test_input($data) {

User Management Panel


-
" - method="post">
" - method="post"> + method="get">

Search

-
+

Batch Actions:

- -
- -
- -

- +
+ +
+ +
+ +

+ +
+
+ +
+

Batch Actions:

+
+ +
+ +
+ +

+ +

-

Users:

- -
- - 1 / 1 - +
+
+

Users:

+
+
+ fetchColumn(); + $mincount = min($listm, $countresults); + $minlist = min($listn + 1, $countresults); + ?> +

Current page:

+
+ +
+

+ +


@@ -182,21 +221,28 @@ function test_input($data) { fetch(PDO::FETCH_ASSOC)) { $userID = $user['userID']; $username = $user['username']; $role = $user['role']; $bancomment = $user['bancomment']; - $thispage = htmlspecialchars($_SERVER['PHP_SELF']); + $thispage = htmlspecialchars(basename($_SERVER['REQUEST_URI'])); + $function = "checkCheckAll(document.getElementById('checkall'))"; echo(" @@ -218,20 +264,24 @@ function test_input($data) { "); } } else { - $q = search20GroupsFromNByStatus($listnr, $search, $groupstatus); + $q = searchSomeGroupsByStatus($listn, $listm, $search, $groupstatus); while ($group = $q->fetch(PDO::FETCH_ASSOC)) { $groupID = $group['groupID']; $name = $group['name']; $role = $group['status']; $description = $group['description']; - $thispage = htmlspecialchars($_SERVER['PHP_SELF']); + $thispage = htmlspecialchars(basename($_SERVER['REQUEST_URI'])); + $function = "checkCheckAll(document.getElementById('checkall'))"; echo(" @@ -243,7 +293,7 @@ function test_input($data) { @@ -256,10 +306,6 @@ function test_input($data) { ?>
- + User Status
+ class='checkbox-list' + value='$userID' + form='admin-batchform' + onchange=" . "$function" . "> $username $role
+ class='checkbox-list' + value='$groupID' + form='admin-groupbatchform' + onchange=" . "$function" . "> $name $role
- - 
-            
-
diff --git a/website/views/chat-view.php b/website/views/chat-view.php index 09b52ca..549a5ff 100644 --- a/website/views/chat-view.php +++ b/website/views/chat-view.php @@ -36,7 +36,7 @@ ?> -
+
diff --git a/website/views/head.php b/website/views/head.php index d9a985a..044ac83 100644 --- a/website/views/head.php +++ b/website/views/head.php @@ -4,7 +4,7 @@ - +
+ + diff --git a/website/views/login-view.php b/website/views/login-view.php index 9214a89..7a023f0 100644 --- a/website/views/login-view.php +++ b/website/views/login-view.php @@ -1,6 +1,6 @@
MyHyvesbook+
@@ -46,6 +46,6 @@
diff --git a/website/views/login_head.php b/website/views/login_head.php index a41e87e..26d439e 100644 --- a/website/views/login_head.php +++ b/website/views/login_head.php @@ -3,9 +3,10 @@ MyHyvesbook+ + href="/styles/main.css"> - + + diff --git a/website/views/menu.php b/website/views/menu.php index 775c76a..b7651bd 100644 --- a/website/views/menu.php +++ b/website/views/menu.php @@ -1,5 +1,5 @@
diff --git a/website/views/search-view.php b/website/views/search-view.php index b1418d1..0d650d4 100644 --- a/website/views/search-view.php +++ b/website/views/search-view.php @@ -1,3 +1,16 @@ + +
@@ -7,72 +20,85 @@ + value= + >
-
+

Gebruikers

-
- \ No newline at end of file +
diff --git a/website/views/settings-view.php b/website/views/settings-view.php index 6d9d660..1fa5278 100644 --- a/website/views/settings-view.php +++ b/website/views/settings-view.php @@ -68,7 +68,7 @@ $settings = getSettings(); -
+
Verander profielfoto