From 910545dae2e498a438d22936205cb6994de446df Mon Sep 17 00:00:00 2001 From: Diego Najar Date: Wed, 25 Jul 2018 23:42:00 +0200 Subject: [PATCH] User object, new reader role for users --- .gitignore | 1 + bl-kernel/abstract/dbjson.class.php | 66 +++---- bl-kernel/admin/controllers/edit-category.php | 4 +- bl-kernel/admin/controllers/edit-user.php | 10 +- bl-kernel/admin/controllers/login.php | 6 + bl-kernel/admin/controllers/new-content.php | 2 + bl-kernel/admin/controllers/user-password.php | 7 +- bl-kernel/admin/themes/booty/init.php | 31 ++++ bl-kernel/admin/views/edit-category.php | 35 +++- bl-kernel/admin/views/edit-content.php | 31 +++- bl-kernel/admin/views/edit-user.php | 42 ++++- bl-kernel/admin/views/new-user.php | 4 +- bl-kernel/admin/views/users.php | 39 ++-- bl-kernel/boot/site.php | 8 + bl-kernel/dbpages.class.php | 38 ++-- bl-kernel/dbusers.class.php | 174 ++++++++---------- bl-kernel/functions.php | 12 +- bl-kernel/helpers/session.class.php | 2 +- bl-kernel/helpers/text.class.php | 3 +- bl-kernel/login.class.php | 12 +- bl-kernel/pagex.class.php | 3 +- bl-kernel/user.class.php | 91 ++++++--- bl-plugins/simple-stats/plugin.php | 22 +-- 23 files changed, 394 insertions(+), 249 deletions(-) diff --git a/.gitignore b/.gitignore index c8fccc9a..d422a0e4 100644 --- a/.gitignore +++ b/.gitignore @@ -1,4 +1,5 @@ .DS_Store +dbgenerator.php bl-content/* bl-plugins/timemachine bl-plugins/timemachine-x diff --git a/bl-kernel/abstract/dbjson.class.php b/bl-kernel/abstract/dbjson.class.php index 2d713927..09251aab 100644 --- a/bl-kernel/abstract/dbjson.class.php +++ b/bl-kernel/abstract/dbjson.class.php @@ -1,14 +1,14 @@ file = $file; @@ -16,26 +16,25 @@ class dbJSON $this->dbBackup = array(); $this->firstLine = $firstLine; - if(file_exists($file)) - { - // Read JSON file. + if (file_exists($file)) { + // Read JSON file $lines = file($file); - // Remove the first line, the first line is for security reasons. - if($firstLine) { + // Remove the first line, the first line is for security reasons + if ($firstLine) { unset($lines[0]); } - // Regenerate the JSON file. + // Regenerate the JSON file $implode = implode($lines); - // Unserialize, JSON to Array. + // Unserialize, JSON to Array $array = $this->unserialize($implode); - if(empty($array)) { - //Log::set(__METHOD__.LOG_SEP.'Invalid JSON file: '.$file.', cannot be decoded. Check the file content.'); - } - else { + if (empty($array)) { + $this->db = array(); + $this->dbBackup = array(); + } else { $this->db = $array; $this->dbBackup = $array; } @@ -45,32 +44,29 @@ class dbJSON public function restoreDB() { $this->db = $this->dbBackup; - return true; } - // Returns the amount of database items. + // Returns the amount of rows in the database public function count() { return count($this->db); } - // Returns the value from the field. + // Returns the value from the field public function getField($field) { if (isset($this->db[$field])) { return $this->db[$field]; } - return $this->dbFields[$field]['value']; } - // Save the JSON file. + // Save the JSON file public function save() { $data = ''; - - if($this->firstLine) { + if ($this->firstLine) { $data = "".PHP_EOL; } @@ -81,33 +77,37 @@ class dbJSON $this->dbBackup = $this->db; // LOCK_EX flag to prevent anyone else writing to the file at the same time. - if( file_put_contents($this->file, $data, LOCK_EX) ) { + if (file_put_contents($this->file, $data, LOCK_EX)) { return true; - } - else { - Log::set(__METHOD__.LOG_SEP.'Error occurred when trying to save the database file.'); + } else { + Log::set(__METHOD__.LOG_SEP.'Error occurred when trying to save the database file.', LOG_TYPE_ERROR); return false; } } - // Returns a JSON encoded string on success or FALSE on failure. + // Returns a JSON encoded string on success or FALSE on failure private function serialize($data) { - return json_encode($data, JSON_PRETTY_PRINT); + if (DEBUG_MODE) { + return json_encode($data, JSON_PRETTY_PRINT); + } + return json_encode($data); } - // Returns the value encoded in json in appropriate PHP type. + // Returns the value encoded in json in appropriate PHP type private function unserialize($data) { - // NULL is returned if the json cannot be decoded. + // NULL is returned if the json cannot be decoded $decode = json_decode($data, true); - - // If NULL returns false. - if(empty($decode)) { + if (empty($decode)) { return false; } - return $decode; } + public function getDB() + { + return $this->db; + } + } \ No newline at end of file diff --git a/bl-kernel/admin/controllers/edit-category.php b/bl-kernel/admin/controllers/edit-category.php index 5c507aba..08034eaf 100644 --- a/bl-kernel/admin/controllers/edit-category.php +++ b/bl-kernel/admin/controllers/edit-category.php @@ -19,9 +19,9 @@ checkRole(array('admin')); // ============================================================================ if ($_SERVER['REQUEST_METHOD'] == 'POST') { - if (isset($_POST['delete'])) { + if ($_POST['action']=='delete') { deleteCategory($_POST); - } elseif (isset($_POST['edit'])) { + } elseif ($_POST['action']=='edit') { editCategory($_POST); } diff --git a/bl-kernel/admin/controllers/edit-user.php b/bl-kernel/admin/controllers/edit-user.php index f2eb865f..910c75dd 100644 --- a/bl-kernel/admin/controllers/edit-user.php +++ b/bl-kernel/admin/controllers/edit-user.php @@ -39,14 +39,16 @@ if ($_SERVER['REQUEST_METHOD'] == 'POST') { // Main after POST // ============================================================================ +$username = $layout['parameters']; + // Prevent non-administrators to change other users if ($login->role()!=='admin') { - $layout['parameters'] = $login->username(); + $username = $login->username(); } -// Get the user to edit -$user = $dbUsers->get($layout['parameters']); -if ($user===false) { +try { + $user = new User($username); +} catch (Exception $e) { Redirect::page('users'); } diff --git a/bl-kernel/admin/controllers/login.php b/bl-kernel/admin/controllers/login.php index 356ce365..a30cbc85 100644 --- a/bl-kernel/admin/controllers/login.php +++ b/bl-kernel/admin/controllers/login.php @@ -25,6 +25,12 @@ function checkLogin($args) } // Renew the token. This token will be the same inside the session for multiple forms. $security->generateTokenCSRF(); + + // Users with the role reader do not need access to dashboard + if ($login->role()=='reader') { + Redirect::home(); + } + Redirect::page('dashboard'); return true; } diff --git a/bl-kernel/admin/controllers/new-content.php b/bl-kernel/admin/controllers/new-content.php index 104561f8..739f7c41 100644 --- a/bl-kernel/admin/controllers/new-content.php +++ b/bl-kernel/admin/controllers/new-content.php @@ -4,6 +4,8 @@ // Check role // ============================================================================ +checkRole(array('admin', 'moderator', 'editor')); + // ============================================================================ // Functions // ============================================================================ diff --git a/bl-kernel/admin/controllers/user-password.php b/bl-kernel/admin/controllers/user-password.php index 326c78e0..87689e85 100644 --- a/bl-kernel/admin/controllers/user-password.php +++ b/bl-kernel/admin/controllers/user-password.php @@ -33,9 +33,10 @@ if ($login->role()!=='admin') { $layout['parameters'] = $login->username(); } -// Get the user to edit -$user = $dbUsers->get($layout['parameters']); -if ($user===false) { +try { + $username = $layout['parameters']; + $user = new User($username); +} catch (Exception $e) { Redirect::page('users'); } diff --git a/bl-kernel/admin/themes/booty/init.php b/bl-kernel/admin/themes/booty/init.php index 8e6e2acc..d481a670 100644 --- a/bl-kernel/admin/themes/booty/init.php +++ b/bl-kernel/admin/themes/booty/init.php @@ -2,6 +2,37 @@ class Bootstrap { + public static function modal($args) { + + $buttonSecondary = $args['buttonSecondary']; + $buttonSecondaryClass = $args['buttonSecondaryClass']; + + $buttonPrimary = $args['buttonPrimary']; + $buttonPrimaryClass = $args['buttonPrimaryClass']; + + $modalText = $args['modalText']; + $modalTitle = $args['modalTitle']; + $modalId = $args['modalId']; + + +return << +
+
+
+

$modalTitle

+

$modalText

+
+
+ + +
+
+
+ +EOF; + } + public static function link($args) { $options = 'href="'.$args['href'].'"'; diff --git a/bl-kernel/admin/views/edit-category.php b/bl-kernel/admin/views/edit-category.php index 79674895..6a382ebf 100644 --- a/bl-kernel/admin/views/edit-category.php +++ b/bl-kernel/admin/views/edit-category.php @@ -2,13 +2,18 @@ echo Bootstrap::pageTitle(array('title'=>$L->g('Edit Category'), 'icon'=>'tags')); -echo Bootstrap::formOpen(array()); +echo Bootstrap::formOpen(array('id'=>'jsform')); echo Bootstrap::formInputHidden(array( 'name'=>'tokenCSRF', 'value'=>$security->getTokenCSRF() )); + echo Bootstrap::formInputHidden(array( + 'name'=>'action', + 'value'=>'edit' + )); + echo Bootstrap::formInputHidden(array( 'name'=>'oldKey', 'value'=>$categoryMap['key'] @@ -44,10 +49,34 @@ echo Bootstrap::formOpen(array()); echo '
- - + '.$L->g('Cancel').' +
'; echo Bootstrap::formClose(); + +?> + + +'Delete', + 'buttonPrimaryClass'=>'jsbuttonDeleteAccept', + 'buttonSecondary'=>'Cancel', + 'buttonSecondaryClass'=>'', + 'modalTitle'=>'Delete category', + 'modalText'=>'Are you sure you want to delete the category ?', + 'modalId'=>'jsdeleteModal' + )); +?> + \ No newline at end of file diff --git a/bl-kernel/admin/views/edit-content.php b/bl-kernel/admin/views/edit-content.php index 441677af..37c1195f 100644 --- a/bl-kernel/admin/views/edit-content.php +++ b/bl-kernel/admin/views/edit-content.php @@ -88,7 +88,7 @@ g('Cancel') ?> children())===0) { - echo ''; + echo ''; } ?> @@ -249,6 +249,28 @@ ?> + + 'Delete', + 'buttonPrimaryClass'=>'jsbuttonDeleteAccept', + 'buttonSecondary'=>'Cancel', + 'buttonSecondaryClass'=>'', + 'modalTitle'=>'Delete content', + 'modalText'=>'Are you sure you want to delete: '.$page->title().'', + 'modalId'=>'jsdeletePageModal' + )); + ?> + +