315 lines
9.6 KiB
PHP
315 lines
9.6 KiB
PHP
<?php
|
|
/**
|
|
* Authentication and User Management Helper Functions
|
|
*/
|
|
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
session_start();
|
|
}
|
|
|
|
/**
|
|
* Check if a user is logged in.
|
|
*/
|
|
function is_logged_in() {
|
|
return isset($_SESSION['user']) && !empty($_SESSION['user']['id']);
|
|
}
|
|
|
|
/**
|
|
* Get current logged in user details.
|
|
*/
|
|
function current_user() {
|
|
return $_SESSION['user'] ?? null;
|
|
}
|
|
|
|
/**
|
|
* Check if logged in user is owner.
|
|
*/
|
|
function is_owner() {
|
|
$user = current_user();
|
|
return $user && ($user['role'] === 'owner');
|
|
}
|
|
|
|
/**
|
|
* Check if logged in user is admin (or owner).
|
|
*/
|
|
function is_admin() {
|
|
$user = current_user();
|
|
return $user && ($user['role'] === 'admin' || $user['role'] === 'owner');
|
|
}
|
|
|
|
/**
|
|
* Require login to access a page.
|
|
*/
|
|
function require_login() {
|
|
if (!is_logged_in()) {
|
|
header("Location: index.php?page=login");
|
|
exit;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Require admin role to access a page.
|
|
*/
|
|
function require_admin() {
|
|
require_login();
|
|
if (!is_admin()) {
|
|
header("Location: index.php?page=home");
|
|
exit;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Authenticate user with username and password.
|
|
*/
|
|
function login_user($username, $password) {
|
|
global $conn;
|
|
|
|
$username = trim($username);
|
|
if (empty($username) || empty($password)) {
|
|
return ['success' => false, 'message' => 'Inserisci sia username che password.'];
|
|
}
|
|
|
|
$stmt = $conn->prepare("SELECT id, username, password, role, theme_pri, theme_sec, theme_thi, language, default_blocknote FROM users WHERE username = ? LIMIT 1");
|
|
$stmt->bind_param("s", $username);
|
|
$stmt->execute();
|
|
$result = $stmt->get_result();
|
|
|
|
if ($row = $result->fetch_assoc()) {
|
|
if (password_verify($password, $row['password'])) {
|
|
$_SESSION['user'] = [
|
|
'id' => $row['id'],
|
|
'username' => $row['username'],
|
|
'role' => $row['role'],
|
|
'theme_pri' => $row['theme_pri'] ?? 98,
|
|
'theme_sec' => $row['theme_sec'] ?? 207,
|
|
'theme_thi' => $row['theme_thi'] ?? 280,
|
|
'language' => $row['language'] ?? 'it',
|
|
'default_blocknote' => $row['default_blocknote'] ?? ''
|
|
];
|
|
$stmt->close();
|
|
return ['success' => true];
|
|
}
|
|
}
|
|
$stmt->close();
|
|
return ['success' => false, 'message' => 'Username o password errati.'];
|
|
}
|
|
|
|
/**
|
|
* Logout current user.
|
|
*/
|
|
function logout_user() {
|
|
$_SESSION = array();
|
|
if (ini_get("session.use_cookies")) {
|
|
$params = session_get_cookie_params();
|
|
setcookie(session_name(), '', time() - 42000,
|
|
$params["path"], $params["domain"],
|
|
$params["secure"], $params["httponly"]
|
|
);
|
|
}
|
|
session_destroy();
|
|
}
|
|
|
|
/**
|
|
* Update user password.
|
|
*/
|
|
function update_user_password($user_id, $new_password) {
|
|
global $conn;
|
|
if (strlen($new_password) < 4) {
|
|
return ['success' => false, 'message' => 'La password deve contenere almeno 4 caratteri.'];
|
|
}
|
|
$hash = password_hash($new_password, PASSWORD_DEFAULT);
|
|
$stmt = $conn->prepare("UPDATE users SET password = ? WHERE id = ?");
|
|
$stmt->bind_param("si", $hash, $user_id);
|
|
$res = $stmt->execute();
|
|
$stmt->close();
|
|
|
|
return $res ? ['success' => true, 'message' => 'Password aggiornata con successo!'] : ['success' => false, 'message' => 'Errore durante il salvataggio della password.'];
|
|
}
|
|
|
|
/**
|
|
* Update user language preference.
|
|
*/
|
|
function update_user_language($user_id, $lang) {
|
|
global $conn;
|
|
if (!in_array($lang, ['it', 'en', 'es', 'fr'])) {
|
|
$lang = 'it';
|
|
}
|
|
|
|
$stmt = $conn->prepare("UPDATE users SET language = ? WHERE id = ?");
|
|
$stmt->bind_param("si", $lang, $user_id);
|
|
$res = $stmt->execute();
|
|
$stmt->close();
|
|
|
|
if ($res) {
|
|
if (isset($_SESSION['user']) && $_SESSION['user']['id'] == $user_id) {
|
|
$_SESSION['user']['language'] = $lang;
|
|
}
|
|
return ['success' => true, 'message' => 'Lingua aggiornata con successo!'];
|
|
}
|
|
return ['success' => false, 'message' => 'Errore durante l\'aggiornamento della lingua.'];
|
|
}
|
|
|
|
/**
|
|
* Update user default landing blocknote preference.
|
|
*/
|
|
function update_user_default_blocknote($user_id, $bn_id) {
|
|
global $conn;
|
|
$bn_id = trim($bn_id);
|
|
|
|
$stmt = $conn->prepare("UPDATE users SET default_blocknote = ? WHERE id = ?");
|
|
$stmt->bind_param("si", $bn_id, $user_id);
|
|
$res = $stmt->execute();
|
|
$stmt->close();
|
|
|
|
if ($res) {
|
|
if (isset($_SESSION['user']) && $_SESSION['user']['id'] == $user_id) {
|
|
$_SESSION['user']['default_blocknote'] = $bn_id;
|
|
}
|
|
return ['success' => true, 'message' => 'Pagina di avvio aggiornata con successo!'];
|
|
}
|
|
return ['success' => false, 'message' => 'Errore durante l\'aggiornamento della pagina di avvio.'];
|
|
}
|
|
|
|
/**
|
|
* Update user interface theme colors (HSL).
|
|
*/
|
|
function update_user_theme($user_id, $pri, $sec, $thi) {
|
|
global $conn;
|
|
$pri = max(0, min(360, (int)$pri));
|
|
$sec = max(0, min(360, (int)$sec));
|
|
$thi = max(0, min(360, (int)$thi));
|
|
|
|
$stmt = $conn->prepare("UPDATE users SET theme_pri = ?, theme_sec = ?, theme_thi = ? WHERE id = ?");
|
|
$stmt->bind_param("iiii", $pri, $sec, $thi, $user_id);
|
|
$res = $stmt->execute();
|
|
$stmt->close();
|
|
|
|
if ($res) {
|
|
if (isset($_SESSION['user']) && $_SESSION['user']['id'] == $user_id) {
|
|
$_SESSION['user']['theme_pri'] = $pri;
|
|
$_SESSION['user']['theme_sec'] = $sec;
|
|
$_SESSION['user']['theme_thi'] = $thi;
|
|
}
|
|
return ['success' => true, 'message' => 'Colori dell\'interfaccia aggiornati!'];
|
|
}
|
|
return ['success' => false, 'message' => 'Errore durante l\'aggiornamento dei colori.'];
|
|
}
|
|
|
|
/**
|
|
* Admin: Get list of all registered users.
|
|
*/
|
|
function get_all_users() {
|
|
global $conn;
|
|
$result = $conn->query("SELECT id, username, role, created_at FROM users ORDER BY id ASC");
|
|
$users = [];
|
|
while ($row = $result->fetch_assoc()) {
|
|
$users[] = $row;
|
|
}
|
|
return $users;
|
|
}
|
|
|
|
/**
|
|
* Admin: Register a new user.
|
|
*/
|
|
function admin_create_user($username, $password, $role = 'user') {
|
|
global $conn;
|
|
$username = trim($username);
|
|
if (empty($username) || empty($password)) {
|
|
return ['success' => false, 'message' => 'Username e password sono obbligatori.'];
|
|
}
|
|
if (!in_array($role, ['user', 'admin', 'owner'])) {
|
|
$role = 'user';
|
|
}
|
|
|
|
if ($role === 'owner') {
|
|
$check_owner = $conn->query("SELECT id FROM users WHERE role = 'owner'");
|
|
if ($check_owner->num_rows > 0) {
|
|
return ['success' => false, 'message' => 'Può esistere un solo account Owner nel sistema!'];
|
|
}
|
|
}
|
|
|
|
// Check if exists
|
|
$stmt = $conn->prepare("SELECT id FROM users WHERE username = ? LIMIT 1");
|
|
$stmt->bind_param("s", $username);
|
|
$stmt->execute();
|
|
if ($stmt->get_result()->num_rows > 0) {
|
|
$stmt->close();
|
|
return ['success' => false, 'message' => 'Un utente con questo username esiste già.'];
|
|
}
|
|
$stmt->close();
|
|
|
|
$hash = password_hash($password, PASSWORD_DEFAULT);
|
|
$stmt = $conn->prepare("INSERT INTO users (username, password, role) VALUES (?, ?, ?)");
|
|
$stmt->bind_param("sss", $username, $hash, $role);
|
|
$res = $stmt->execute();
|
|
$stmt->close();
|
|
|
|
return $res ? ['success' => true, 'message' => 'Utente creato con successo!'] : ['success' => false, 'message' => 'Impossibile creare l\'utente.'];
|
|
}
|
|
|
|
/**
|
|
* Admin: Delete a user by ID.
|
|
*/
|
|
function admin_delete_user($user_id) {
|
|
global $conn;
|
|
$user_id = (int)$user_id;
|
|
|
|
// Prevent self-deletion
|
|
if (current_user() && current_user()['id'] == $user_id) {
|
|
return ['success' => false, 'message' => 'Non puoi eliminare il tuo stesso account!'];
|
|
}
|
|
|
|
// Check target user role - Owner can NEVER be deleted
|
|
$stmt = $conn->prepare("SELECT role FROM users WHERE id = ? LIMIT 1");
|
|
$stmt->bind_param("i", $user_id);
|
|
$stmt->execute();
|
|
$target_user = $stmt->get_result()->fetch_assoc();
|
|
$stmt->close();
|
|
|
|
if ($target_user && $target_user['role'] === 'owner') {
|
|
return ['success' => false, 'message' => 'L\'account Owner non può essere eliminato da nessuno!'];
|
|
}
|
|
|
|
$stmt = $conn->prepare("DELETE FROM users WHERE id = ?");
|
|
$stmt->bind_param("i", $user_id);
|
|
$res = $stmt->execute();
|
|
$stmt->close();
|
|
|
|
return $res ? ['success' => true, 'message' => 'Utente eliminato.'] : ['success' => false, 'message' => 'Errore nell\'eliminazione dell\'utente.'];
|
|
}
|
|
|
|
/**
|
|
* Admin: Update user role.
|
|
*/
|
|
function admin_update_user_role($user_id, $role) {
|
|
global $conn;
|
|
$user_id = (int)$user_id;
|
|
if (!in_array($role, ['admin', 'user', 'owner'])) return ['success' => false, 'message' => 'Ruolo non valido.'];
|
|
|
|
// Check target user role - Owner role cannot be changed
|
|
$stmt = $conn->prepare("SELECT role FROM users WHERE id = ? LIMIT 1");
|
|
$stmt->bind_param("i", $user_id);
|
|
$stmt->execute();
|
|
$target_user = $stmt->get_result()->fetch_assoc();
|
|
$stmt->close();
|
|
|
|
if ($target_user && $target_user['role'] === 'owner') {
|
|
return ['success' => false, 'message' => 'Il ruolo dell\'account Owner non può essere modificato!'];
|
|
}
|
|
|
|
if ($role === 'owner') {
|
|
$check_owner = $conn->query("SELECT id FROM users WHERE role = 'owner'");
|
|
if ($check_owner->num_rows > 0) {
|
|
return ['success' => false, 'message' => 'Può esistere un solo account Owner nel sistema!'];
|
|
}
|
|
}
|
|
|
|
$stmt = $conn->prepare("UPDATE users SET role = ? WHERE id = ?");
|
|
$stmt->bind_param("si", $role, $user_id);
|
|
$res = $stmt->execute();
|
|
$stmt->close();
|
|
|
|
return $res ? ['success' => true, 'message' => 'Ruolo aggiornato.'] : ['success' => false, 'message' => 'Impossibile aggiornare il ruolo.'];
|
|
}
|
|
|