diff --git a/website/.htaccess b/website/public/.htaccess similarity index 69% rename from website/.htaccess rename to website/public/.htaccess index 5c0147b..f08898a 100644 --- a/website/.htaccess +++ b/website/public/.htaccess @@ -9,6 +9,4 @@ RewriteCond %{SCRIPT_FILENAME} !-f # Resolve .php file for extensionless php urls RewriteRule ^([^/.]+)$ $1.php [L] -RewriteRule ^([^/.]+)\/$ $1.php [L] - -RewriteRule ^profile/([A-z0-9]+)\/?$ profile.php?username=$1 [NC] \ No newline at end of file +RewriteRule ^profile/([A-z0-9]+)$ profile.php?username=$1 [NC] \ No newline at end of file diff --git a/website/public/API/loadMessages.php b/website/public/API/loadMessages.php index fef9db7..1c6b942 100644 --- a/website/public/API/loadMessages.php +++ b/website/public/API/loadMessages.php @@ -3,11 +3,10 @@ session_start(); require_once("../../queries/connect.php"); require_once("../../queries/private_message.php"); +require_once("../../queries/checkInput.php"); if (isset($_POST["lastID"]) && $_POST["lastID"] != "") { - - echo getNewChatMessages($_POST["lastID"], $_POST["destination"]); - + echo getNewChatMessages(test_input($_POST["lastID"]), test_input($_POST["destination"])); } else { - echo getOldChatMessages($_POST["destination"]); + echo getOldChatMessages(test_input($_POST["destination"])); } \ No newline at end of file diff --git a/website/public/API/sendMessage.php b/website/public/API/sendMessage.php index d1bc758..c5d47d1 100644 --- a/website/public/API/sendMessage.php +++ b/website/public/API/sendMessage.php @@ -3,16 +3,15 @@ session_start(); require_once("../../queries/connect.php"); require_once("../../queries/private_message.php"); +require_once("../../queries/checkInput.php"); -if (isset($_POST["destination"]) && - isset($_POST["content"])) { - - if (sendMessage($_POST["destination"], $_POST["content"])) { - echo $_POST["content"] . " is naar " . $_POST["destination"] . " gestuurd"; +if (!empty(test_input($_POST["destination"])) && + !empty(test_input($_POST["content"]))) { + if (sendMessage(test_input($_POST["destination"]), test_input($_POST["content"]))) { + echo 1; } else { - echo "YOU FAILED!!!"; + echo 0; } - } else { - echo "maybe dont try to hax the system?"; + echo 0; } \ No newline at end of file diff --git a/website/public/js/admin.js b/website/public/js/admin.js new file mode 100644 index 0000000..2055123 --- /dev/null +++ b/website/public/js/admin.js @@ -0,0 +1,44 @@ +window.onload = function() { + changeFilter(); +}; + +function checkAll(allbox) { + var checkboxes = document.getElementsByClassName('checkbox-list'); + + for (var i = 0; i < checkboxes.length; i++) { + if (checkboxes[i].type == 'checkbox') { + checkboxes[i].checked = allbox.checked; + } + } +} + +function checkCheckAll(allbox) { + var checkboxes = document.getElementsByClassName('checkbox-list'); + var checked = true; + + for (var i = 0; i < checkboxes.length; i++) { + if (checkboxes[i].type == 'checkbox') { + if (checkboxes[i].checked == false) { + checked = false; + break; + } + } + } + allbox.checked = checked; +} + +function changeFilter() { + if (document.getElementById('group').checked) { + document.getElementById('admin-filter').style.display = 'none'; + document.getElementById('admin-groupfilter').style.display = 'inline-block'; + + document.getElementById('admin-batchactions').style.display = 'none'; + document.getElementById('admin-groupbatchactions').style.display = 'inline-block'; + } else { + document.getElementById('admin-filter').style.display = 'inline-block'; + document.getElementById('admin-groupfilter').style.display = 'none'; + + document.getElementById('admin-batchactions').style.display = 'inline-block'; + document.getElementById('admin-groupbatchactions').style.display = 'none'; + } +} diff --git a/website/public/js/chat.js b/website/public/js/chat.js index 75eb32e..6c420a1 100644 --- a/website/public/js/chat.js +++ b/website/public/js/chat.js @@ -10,7 +10,6 @@ function loadMessages() { $("#lastIDForm").serialize() ).done(function(data) { if (data && data != "[]") { - console.log(data); messages = JSON.parse(data); addMessages(messages); $("#lastID").val(messages[messages.length - 1].messageID); @@ -23,13 +22,10 @@ function loadMessages() { function sendMessage() { - console.log($("#sendMessageForm").serialize()); $.post( "API/sendMessage.php", $("#sendMessageForm").serialize() - ).done(function( data ) { - console.log(data); - }); + ); $("#newContent").val(""); } diff --git a/website/public/login.php b/website/public/login.php index 65babdf..b3da203 100644 --- a/website/public/login.php +++ b/website/public/login.php @@ -7,6 +7,17 @@ include_once("../queries/checkInput.php") ?> + + - - - diff --git a/website/public/profile.php b/website/public/profile.php index f3f499b..6ede201 100644 --- a/website/public/profile.php +++ b/website/public/profile.php @@ -1,45 +1,17 @@ + + + + + + + + $unix_date) { - $difference = $now - $unix_date; - $tense = "geleden"; - } else { - $difference = $unix_date - $now; - $tense = "vanaf nu"; - } - - for($i = 0; $difference >= $lengths[$i] && $i < count($lengths) - 1; $i++) { - $difference /= $lengths[$i]; - } - - $difference = round($difference); - - if($difference != 1) { - $period = $multiple_periods[$i]; - } else { - $period = $single_periods[$i]; - } - - return "$difference $period $tense"; -} +include("../queries/nicetime.php"); if(empty($_GET["username"])) { $userID = $_SESSION["userID"]; @@ -52,18 +24,6 @@ $profile_friends = selectAllFriends($userID); $profile_groups = selectAllUserGroups($userID); $posts = selectAllUserPosts($userID); -?> - - - - - - - - -query(" + $q = $GLOBALS["db"]->prepare(" SELECT `group_page`.`name`, `group_page`.`picture`, @@ -11,12 +11,16 @@ function selectGroupById($groupID) { FROM `group_page` WHERE - `group_page`.`groupID` = $groupID + `group_page`.`groupID` = :groupID "); + + $q->bindParam(':groupID', $groupID); + $q->execute(); + return $q; } function select20GroupsFromN($n) { - return $GLOBALS["db"]->query(" + $q = $GLOBALS["db"]->prepare(" SELECT `group_page`.`groupID`, `group_page`.`name`, @@ -29,12 +33,16 @@ function select20GroupsFromN($n) { ORDER BY `group_page`.`name` ASC LIMIT - $n, 20 + :n, 20 "); + + $q->bindParam(':n', $n); + $q->execute(); + return $q; } function select20GroupsByStatusFromN($n, $status) { - return $GLOBALS["db"]->query(" + $q = $GLOBALS["db"]->prepare(" SELECT `group_page`.`groupID`, `group_page`.`name`, @@ -45,12 +53,17 @@ function select20GroupsByStatusFromN($n, $status) { FROM `group_page` WHERE - `group_page`.`status` = $status + `group_page`.`status` = :status ORDER BY `group_page`.`name` ASC LIMIT - $n, 20 + :n, 20 "); + + $q->bindParam(':status', $status); + $q->bindParam(':n', $n); + $q->execute(); + return $q; } function search20GroupsFromNByStatus($n, $keyword, $status) { @@ -80,6 +93,55 @@ function search20GroupsFromNByStatus($n, $keyword, $status) { return $q; } +function searchSomeGroupsByStatus($n, $m, $keyword, $status) { + $q = $GLOBALS['db']->prepare(" + SELECT + `groupID`, + `name`, + `status`, + `description` + FROM + `group_page` + WHERE + `name` LIKE :keyword AND + FIND_IN_SET (`status`, :statuses) + ORDER BY + `name` + LIMIT + :n, :m + "); + + $keyword = "%$keyword%"; + $q->bindParam(':keyword', $keyword); + $q->bindParam(':n', $n, PDO::PARAM_INT); + $q->bindParam(':m', $m, PDO::PARAM_INT); + $statuses = implode(',', $status); + $q->bindParam(':statuses', $statuses); + $q->execute(); + return $q; +} + +function countSomeGroupsByStatus($keyword, $status) { + $q = $GLOBALS['db']->prepare(" + SELECT + COUNT(*) + FROM + `group_page` + WHERE + `name` LIKE :keyword AND + FIND_IN_SET (`status`, :statuses) + ORDER BY + `name` + "); + + $keyword = "%$keyword%"; + $q->bindParam(':keyword', $keyword); + $statuses = implode(',', $status); + $q->bindParam(':statuses', $statuses); + $q->execute(); + return $q; +} + function changeGroupStatusByID($id, $status) { $q = $GLOBALS["db"]->query(" UPDATE @@ -92,3 +154,23 @@ function changeGroupStatusByID($id, $status) { return $q; } + +function changeMultipleGroupStatusByID($ids, $status) { + $q = $GLOBALS['db']->prepare(" + UPDATE + `group_page` + SET + `status` = :status + WHERE + FIND_IN_SET (`groupID`, :ids) + "); + + $ids = implode(',', $ids); + $q->bindParam(':ids', $ids); + $q->bindParam(':status', $status); + $q->execute(); + return $q; +} + + +?> diff --git a/website/queries/nicetime.php b/website/queries/nicetime.php new file mode 100644 index 0000000..4db6cbd --- /dev/null +++ b/website/queries/nicetime.php @@ -0,0 +1,39 @@ + $unix_date) { +$difference = $now - $unix_date; +$tense = "geleden"; +} else { +$difference = $unix_date - $now; +$tense = "vanaf nu"; +} + +for($i = 0; $difference >= $lengths[$i] && $i < count($lengths) - 1; $i++) { +$difference /= $lengths[$i]; +} + +$difference = round($difference); + +if($difference != 1) { +$period = $multiple_periods[$i]; +} else { +$period = $single_periods[$i]; +} + +return "$difference $period $tense"; +} \ No newline at end of file diff --git a/website/queries/user.php b/website/queries/user.php index 97ddbc2..398e2e4 100644 --- a/website/queries/user.php +++ b/website/queries/user.php @@ -88,7 +88,7 @@ function selectAllUserPosts($userID) { } function select20UsersFromN($n) { - return $GLOBALS["db"]->query(" + $q = $GLOBALS["db"]->prepare(" SELECT `userID`, `username`, @@ -100,8 +100,12 @@ function select20UsersFromN($n) { `role`, `username` LIMIT - $n, 20 + :n, 20 "); + + $q->bindParam(':n', $n); + $q->execute(); + return $q; } function search20UsersFromN($n, $keyword) { @@ -156,19 +160,90 @@ function search20UsersFromNByStatus($n, $keyword, $status) { return $q; } -function changeUserStatusByID($id, $status) { - $q = $GLOBALS["db"]->query(" - UPDATE +function searchSomeUsersByStatus($n, $m, $keyword, $status) { + $q = $GLOBALS["db"]->prepare(" + SELECT + `userID`, + `username`, + `role`, + `bancomment` + FROM `user` - SET - `role` = $status WHERE - `userID` = $id + `username` LIKE :keyword AND + FIND_IN_SET (`role`, :statuses) + ORDER BY + `role`, + `username` + LIMIT + :n, :m "); + $keyword = "%$keyword%"; + $q->bindParam(':keyword', $keyword); + $q->bindParam(':n', $n, PDO::PARAM_INT); + $q->bindParam(':m', $m, PDO::PARAM_INT); + $statuses = implode(',', $status); + $q->bindParam(':statuses', $statuses); + $q->execute(); return $q; } +function countSomeUsersByStatus($keyword, $status) { + $q = $GLOBALS["db"]->prepare(" + SELECT + COUNT(*) + FROM + `user` + WHERE + `username` LIKE :keyword AND + FIND_IN_SET (`role`, :statuses) + ORDER BY + `role`, + `username` + "); + + $keyword = "%$keyword%"; + $q->bindParam(':keyword', $keyword); + $statuses = implode(',', $status); + $q->bindParam(':statuses', $statuses); + $q->execute(); + return $q; +} + + +function changeUserStatusByID($id, $status) { + $q = $GLOBALS["db"]->prepare(" + UPDATE + `user` + SET + `role` = :status + WHERE + `userID` = :id + "); + + $q->bindParam(':status', $status); + $q->bindParam(':id', $id); + $q->execute(); + return $q; +} + +function changeMultipleUserStatusByID($ids, $status) { + $q = $GLOBALS["db"]->prepare(" + UPDATE + `user` + SET + `role` = :status + WHERE + FIND_IN_SET (`userID`, :ids) + "); + + $ids = implode(',', $ids); + $q->bindParam(':ids', $ids); + $q->bindParam(':status', $status); + $q->execute(); + return $q; +} function selectRandomNotFriendUser($userID) { $stmt = $GLOBALS["db"]->prepare(" diff --git a/website/views/adminpanel.php b/website/views/adminpanel.php index c98c051..e8efe6f 100644 --- a/website/views/adminpanel.php +++ b/website/views/adminpanel.php @@ -3,32 +3,7 @@ Admin Panel - +

User Management Panel


-
" - method="post">
" - method="post"> + method="get">

Search

-
+

Batch Actions:

- -
- -
- -

- +
+ +
+ +
+ +

+ +
+
+ +
+

Batch Actions:

+
+ +
+ +
+ +

+ +

-

Users:

- -
- - 1 / 1 - +
+
+

Users:

+
+
+ fetchColumn(); + $mincount = min($listm, $countresults); + $minlist = min($listn + 1, $countresults); + ?> +

Current page:

+
+ +
+

+ +


@@ -182,21 +227,28 @@ function test_input($data) { fetch(PDO::FETCH_ASSOC)) { $userID = $user['userID']; $username = $user['username']; $role = $user['role']; $bancomment = $user['bancomment']; - $thispage = htmlspecialchars($_SERVER['PHP_SELF']); + $thispage = htmlspecialchars(basename($_SERVER['REQUEST_URI'])); + $function = "checkCheckAll(document.getElementById('checkall'))"; echo(" @@ -218,20 +270,24 @@ function test_input($data) { "); } } else { - $q = search20GroupsFromNByStatus($listnr, $search, $groupstatus); + $q = searchSomeGroupsByStatus($listn, $listm, $search, $groupstatus); while ($group = $q->fetch(PDO::FETCH_ASSOC)) { $groupID = $group['groupID']; $name = $group['name']; $role = $group['status']; $description = $group['description']; - $thispage = htmlspecialchars($_SERVER['PHP_SELF']); + $thispage = htmlspecialchars(basename($_SERVER['REQUEST_URI'])); + $function = "checkCheckAll(document.getElementById('checkall'))"; echo(" @@ -243,7 +299,7 @@ function test_input($data) { @@ -256,10 +312,6 @@ function test_input($data) { ?>
- + User Status
+ class='checkbox-list' + value='$userID' + form='admin-batchform' + onchange=" . "$function" . "> $username $role
+ class='checkbox-list' + value='$groupID' + form='admin-groupbatchform' + onchange=" . "$function" . "> $name $role
- - 
-            
-
diff --git a/website/views/head.php b/website/views/head.php index bb6eec4..4347650 100644 --- a/website/views/head.php +++ b/website/views/head.php @@ -1,17 +1,16 @@ MyHyvesbook+ - - - - + + +
diff --git a/website/views/login-view.php b/website/views/login-view.php index 33fa7e9..7a023f0 100644 --- a/website/views/login-view.php +++ b/website/views/login-view.php @@ -1,6 +1,6 @@
MyHyvesbook+
@@ -46,6 +46,6 @@
diff --git a/website/views/login_head.php b/website/views/login_head.php index a41e87e..645f919 100644 --- a/website/views/login_head.php +++ b/website/views/login_head.php @@ -3,9 +3,9 @@ MyHyvesbook+ + href="/styles/main.css"> - + href="/styles/index.css"> + diff --git a/website/views/menu.php b/website/views/menu.php index 88ae076..c6b030a 100644 --- a/website/views/menu.php +++ b/website/views/menu.php @@ -51,7 +51,7 @@ echo "
  • -
    +
    • - -
    - Login met een account + + Login