API filter per user level

website/public/API/adminChangeUser.php

@@ -3,9 +3,12 @@ session_start();
 
 require_once ("../../queries/connect.php");
 require_once ("../../queries/checkInput.php");
-require_once ("../../queries/user.php");
 require_once ("../../queries/group_page.php");
+require_once ("../../queries/user.php");
 
+if (isset($_SESSION["userID"]) &&
+    (getRoleByID($_SESSION["userID"]) == 'admin' ||
+     getRoleByID($_SESSION["userID"]) == 'owner')) {
     $userinfo = getRoleByID($_SESSION['userID']);
 
     if (isset($_POST["actions"]) && isset($_POST["userID"])) {
@@ -23,3 +26,6 @@ if (isset($_POST["actions"]) && isset($_POST["userID"])) {
     } else if (isset($_POST['bancommentuserID']) && isset($_POST['bancommenttext'])) {
         editBanCommentByID($_POST['bancommentuserID'], $_POST['bancommenttext']);
     }
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/public/API/adminPageNumber.php

@@ -7,6 +7,9 @@ require_once ("../../queries/checkInput.php");
 require_once ("../../queries/user.php");
 require_once ("../../queries/group_page.php");
 
+if (isset($_SESSION["userID"]) &&
+    (getRoleByID($_SESSION["userID"]) == 'admin' ||
+     getRoleByID($_SESSION["userID"]) == 'owner')) {
     $search = "";
     if (isset($_POST["search"])) {
         $search = test_input($_POST["search"]);
@@ -36,3 +39,6 @@ if (isset($_POST['currentpage'])) {
     $offset = (int) $currentpage * $entries - $entries;
 
     include ("../../views/adminpanel-page.php");
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/public/API/adminSearchUsers.php

@@ -7,6 +7,9 @@ require_once ("../../queries/checkInput.php");
 require_once ("../../queries/user.php");
 require_once ("../../queries/group_page.php");
 
+if (isset($_SESSION["userID"]) &&
+    (getRoleByID($_SESSION["userID"]) == 'admin' ||
+     getRoleByID($_SESSION["userID"]) == 'owner')) {
     $offset = 0;
     $entries = 20;
     if (isset($_POST["currentpage"])) {
@@ -42,3 +45,6 @@ if ($pagetype == "user") {
     } else {
         echo "Search failed!";
     }
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/public/API/editFriendship.php

@@ -3,7 +3,11 @@
 session_start();
 
 require_once ("../../queries/friendship.php");
+require_once("../../queries/user.php");
 
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'frozen' &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
     if (empty($_POST["usr"]) OR empty($_POST["action"]) OR !in_array($_POST["action"], array("request", "accept", "delete"))) {
         header('HTTP/1.1 500 Non enough arguments');
     }
@@ -25,3 +29,6 @@ if($_POST["action"] == "request" AND $friendship_status == 0) {
     } else {
         header('HTTP/1.1 500 Not the right friendship status');
     }
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/public/API/getFriendshipStatus.php

@@ -10,7 +10,10 @@
 session_start();
 
 require_once ("../../queries/friendship.php");
+require_once("../../queries/user.php");
 
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
     if (empty($_POST["usr"])) {
         header('HTTP/1.1 500 Non enough arguments');
     }
@@ -22,3 +25,6 @@ if($friendship_status == -2) {
     }
 
     echo $friendship_status;
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/public/API/getPosts.php

@@ -6,6 +6,10 @@ if(empty($_POST["usr"]) and empty($_POST["grp"])) {
 
 require_once ("../../queries/post.php");
 require_once ("../../queries/nicetime.php");
+require_once("../../queries/user.php");
+
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
 
     if (empty($_POST["usr"])) {
         $posts = selectAllPosts(0, $_POST["grp"]);
@@ -24,3 +28,6 @@ for($i = 0; $i < sizeof($results); $i++) {
     }
 
     echo json_encode($results);
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/public/API/loadChatNotifications.php

@@ -4,5 +4,11 @@ session_start();
 
 require_once ("../../queries/connect.php");
 require_once ("../../queries/private_message.php");
+require_once("../../queries/user.php");
 
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
     echo selectAllUnreadChat();
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/public/API/loadFriendRequest.php

@@ -11,5 +11,5 @@ if (isset($_SESSION["userID"]) &&
     getRoleByID($_SESSION["userID"]) != 'banned') {
     echo selectAllFriendRequests();
 } else {
-    echo "[]";
+    header('HTTP/1.0 403 Forbidden');
 }

website/public/API/loadFriends.php

@@ -5,7 +5,10 @@ session_start();
 require_once ("../../queries/connect.php");
 require_once ("../../queries/checkInput.php");
 require_once ("../../queries/friendship.php");
+require_once("../../queries/user.php");
 
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
     if (isset($_SESSION["userID"])) {
         if (isset($_POST["limit"])) {
             echo selectLimitedFriends($_SESSION["userID"], (int)test_input($_POST["limit"]));
@@ -17,4 +20,7 @@ if (isset($_SESSION["userID"])) {
     } else {
         echo "[]";
     }
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}
 

website/public/API/loadGroups.php

@@ -6,9 +6,15 @@ require_once ("../../queries/connect.php");
 require_once ("../../queries/checkInput.php");
 require_once ("../../queries/group_member.php");
 
+require_once("../../queries/user.php");
+
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
     if (isset($_POST["limit"])) {
         echo selectLimitedGroupsFromUser($_SESSION["userID"], (int)test_input($_POST["limit"]));
     } else {
         echo selectAllGroupsFromUser($_SESSION["userID"]);
     }
-
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/public/API/loadMessages.php

@@ -6,7 +6,10 @@ require_once("../../queries/connect.php");
 require_once("../../queries/private_message.php");
 require_once("../../queries/checkInput.php");
 require_once("../../queries/friendship.php");
+require_once("../../queries/user.php");
 
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
     if (isset($_POST["lastID"]) && $_POST["lastID"] != "") {
         setLastVisited(test_input($_POST["destination"]));
         echo getNewChatMessages(test_input($_POST["lastID"]), test_input($_POST["destination"]));
@@ -14,3 +17,6 @@ if (isset($_POST["lastID"]) && $_POST["lastID"] != "") {
         setLastVisited(test_input($_POST["destination"]));
         echo getOldChatMessages(test_input($_POST["destination"]));
     }
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/public/API/loadPost.php

@@ -5,8 +5,15 @@ require_once("../../queries/post.php");
 require_once("../../queries/checkInput.php");
 require_once("../../queries/nicetime.php");
 
+require_once("../../queries/user.php");
+
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
     if (isset($_GET['postID'])) {
         include("../../views/post-view.php");
     } else {
-    echo "Failed to load";
+        echo "Kan de post niet laden";
+    }
+} else {
+    header('HTTP/1.0 403 Forbidden');
 }

website/public/API/nietSlecht.php

@@ -1,41 +0,0 @@
-<?php
-
-session_start();
-require_once ("../queries/connect.php");
-require_once ("../queries/checkInput.php");
-
-function getNietSlechtCountForPost(int $postID) : int {
-    $stmt = prepareQuery("
-    SELECT 
-        `userID`
-    FROM 
-        `niet_slecht`
-    WHERE
-        `postID` = :postID
-    ");
-    $stmt->bindParam(":postID", $postID);
-    $stmt->execute();
-    return $stmt->rowCount();
-}
-
-function getNietSlechtUsersForPost(int $postID) {
-    $stmt = prepareQuery("
-    SELECT
-      `fname`,
-      `lname`,
-      CONCAT(`user`.`fname`, ' ', `user`.`lname`) as `fullname`
-    FROM
-      `user`
-    INNER JOIN
-      `niet_slecht`
-    WHERE
-      `user`.`userID` = `niet_slecht`.`userID` AND
-        `niet_slecht`.`postID` = :postID
-    ");
-    $stmt->bindParam(":postID", $postID);
-    $stmt->execute();
-    $rows = $stmt->fetchAll();
-    foreach ($rows as $row) {
-        print($row["fullname"]);
-    }
-}

website/public/API/postPost.php

@@ -6,10 +6,16 @@ require_once("../../queries/post.php");
 require_once("../../queries/group_page.php");
 require_once("../../queries/connect.php");
 require_once("../../queries/checkInput.php");
+require_once("../../queries/user.php");
+
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'frozen' &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
 
     if (empty($_POST["title"]) or
         empty($_POST["content"]) or
-    empty($_SESSION["userID"])) {
+        empty($_SESSION["userID"])
+    ) {
         header('HTTP/1.1 500 Non enough arguments');
     }
 
@@ -37,18 +43,6 @@ if (empty($_POST["group"])) {
             test_input($_POST["content"])
         );
     }
-
+} else {
-
+    echo "frozen";
-
+}
-
-
-
-//if (empty($_POST['newpost-title'])) {
-//} else {
-//    makePost($_SESSION['userID'],
-//             null,
-//             test_input($_POST['newpost-title']),
-//             test_input($_POST['newpost-content']));
-//}
-//
-//header("Location: ../profile.php");

website/public/API/searchGroups.php

@@ -7,6 +7,10 @@ require_once ("../../queries/connect.php");
 require_once ("../../queries/checkInput.php");
 require_once ("../../queries/group_member.php");
 require_once ("../../queries/group_page.php");
+require_once ("../../queries/user.php");
+
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
 
     $n = 0;
     if (isset($_POST["n"])) {
@@ -26,3 +30,6 @@ if (isset($_POST["filter"]) && $_POST["filter"] == "personal") {
     } else {
         echo searchSomeGroups($n, $m, $search);
     }
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/public/API/searchPageNumber.php

@@ -7,6 +7,9 @@ require_once ("../../queries/checkInput.php");
 require_once ("../../queries/user.php");
 require_once ("../../queries/group_page.php");
 
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
+
     $user_perpage = $group_perpage = 20;
 
     $user_currentpage = $group_currentpage = 1;
@@ -39,3 +42,6 @@ if (isset($_POST['option'])) {
     }
 
     include("../../views/searchPageNumber.php");
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/public/API/searchUsers.php

@@ -7,6 +7,9 @@ require_once ("../../queries/checkInput.php");
 require_once ("../../queries/friendship.php");
 require_once ("../../queries/user.php");
 
+if (isset($_SESSION["userID"]) &&
+    getRoleByID($_SESSION["userID"]) != 'banned') {
+
     $n = 0;
     $m = 20;
 
@@ -27,3 +30,6 @@ if (isset($_POST["filter"]) && $_POST["filter"] == "personal") {
     } else {
         echo searchSomeUsers($n, $m, $search);
     }
+} else {
+    header('HTTP/1.0 403 Forbidden');
+}

website/queries/group_member.php

@@ -1,7 +1,7 @@
 <?php
 
 function selectAllGroupsFromUser($userID) {
-    selectLimitedGroupsFromUser($userID, 9999);
+    return selectLimitedGroupsFromUser($userID, 9999);
 }
 
 function selectLimitedGroupsFromUser($userID, $limit) {