369 lines
13 KiB
PHP
369 lines
13 KiB
PHP
<?php
|
|
/*
|
|
profile.php
|
|
OpenDRS Online Discrepancy Reporting System
|
|
Copyright (C) 2026 Rod Wright
|
|
|
|
SPDX-License-Identifier: GPL-2.0
|
|
*/
|
|
|
|
include("common.php");
|
|
if (array_key_exists('print',$_REQUEST)) {
|
|
$print=true;
|
|
} else {
|
|
$print=false;
|
|
}
|
|
|
|
// redirect to login page if access_mode is untrusted and user is
|
|
// not logged in
|
|
if ($access_mode == "untrusted" && ! isset($_SESSION['userid'])) {
|
|
header("Cache-Control:no-cache, must-revalidate");
|
|
header("Pragma:no-cache");
|
|
header("Location:login.php");
|
|
exit();
|
|
}
|
|
|
|
// redirect to index.php on cancel button press
|
|
if (array_key_exists('cancel',$_REQUEST)) {
|
|
header("Cache-Control:no-cache, must-revalidate");
|
|
header("Pragma:no-cache");
|
|
header("Location:index.php");
|
|
exit();
|
|
}
|
|
|
|
// import session variables
|
|
if (isset($_SESSION['userid'])) $userid=$_SESSION['userid'];
|
|
|
|
// if not logged in, redirect to login.php
|
|
$role=dblookup($drs_db,"users","id","role",$userid);
|
|
if (!$role) {
|
|
header("Cache-Control:no-cache, must-revalidate");
|
|
header("Pragma:no-cache");
|
|
header("Location:login.php");
|
|
exit();
|
|
}
|
|
|
|
// import incoming arrays
|
|
if ($print) {
|
|
// if printer friendly was clicked, values will be passed in serialized
|
|
// form as "all_parameters" so we need to load those into $incoming[]
|
|
$incoming=unserialize($_REQUEST['all_parameters']);
|
|
} else {
|
|
// copy $_REQUEST[] to $incoming[]
|
|
$incoming=arrayCopy($_REQUEST);
|
|
}
|
|
|
|
// extract incoming array keys into variables
|
|
extract($incoming, EXTR_SKIP);
|
|
/*
|
|
* possible keys are:
|
|
* update_colors
|
|
* reset_colors
|
|
* newbgc
|
|
* newmbgc
|
|
* newtc
|
|
* newlc
|
|
* newvlc
|
|
* newhc
|
|
* edit_user
|
|
* update_user
|
|
* user_id
|
|
* user_fname
|
|
* user_lname
|
|
* user_login
|
|
* user_pass
|
|
* user_passconf
|
|
*/
|
|
|
|
$user_id=$userid; // ensures that I can only change my own profile
|
|
|
|
if (!isset($update_colors)) $update_colors=false;
|
|
if (!isset($reset_colors)) $reset_colors=false;
|
|
if (!isset($edit_user)) $edit_user=false;
|
|
if (!isset($update_user)) $update_user=false;
|
|
|
|
// define local functions
|
|
|
|
|
|
// assign variables from constants
|
|
$appname=APP_NAME;
|
|
|
|
if ($print) {
|
|
$mbgcolor=P_MENUBG_COLOR;
|
|
} else {
|
|
$mbgcolor=MENUBG_COLOR;
|
|
}
|
|
|
|
|
|
framework("begin","$appname","User Profile",$print);
|
|
|
|
//echo "_REQUEST array <br>";
|
|
//var_dump($_REQUEST);
|
|
//echo "<br><hr> incoming array <br>";
|
|
//var_dump($incoming);
|
|
|
|
// ******** begin database manipulation ********
|
|
if ($update_colors) {
|
|
if ($newbgc) putsetting("background_color",$newbgc,$user_id);
|
|
if ($newmbgc) putsetting("menubg_color",$newmbgc,$user_id);
|
|
if ($newtc) putsetting("text_color",$newtc,$user_id);
|
|
if ($newlc) putsetting("link_color",$newlc,$user_id);
|
|
if ($newvlc) putsetting("vlink_color",$newvlc,$user_id);
|
|
if ($newhc) putsetting("heading_color",$newhc,$user_id);
|
|
echo "<meta http-equiv='refresh' content='0'>";
|
|
}
|
|
if ($reset_colors) {
|
|
mysqli_query($drs_db,"delete from profile where name like \"%_color\" and user=\"$user_id\"");
|
|
echo "<meta http-equiv='refresh' content='0'>";
|
|
}
|
|
|
|
$usernameunique_err=$fnamesuppld_err=$lnamesuppld_err=$loginsuppld_err=false;
|
|
$loginunique_err=$passcomplex_err=$passmatch_err=false;
|
|
|
|
if ($edit_user) {
|
|
if ($update_user) {
|
|
// do error checking
|
|
// remove html tags from user name
|
|
$user_fname=strip_tags($user_fname);
|
|
$user_lname=strip_tags($user_lname);
|
|
$user_login=strip_tags($user_login);
|
|
// test for first name supplied
|
|
if (strlen(trim($user_fname))) {
|
|
$fnamesuppld=true;
|
|
$fnamesuppld_err=false;
|
|
} else {
|
|
$fnamesuppld=false;
|
|
$fnamesuppld_err=true;
|
|
}
|
|
// test for last name supplied
|
|
if (strlen(trim($user_lname))) {
|
|
$lnamesuppld=true;
|
|
$lnamesuppld_err=false;
|
|
} else {
|
|
$lnamesuppld=false;
|
|
$lnamesuppld_err=true;
|
|
}
|
|
// test for name unique
|
|
if (mysqli_num_rows(mysqli_query($drs_db,"select id from users where firstname=\"$user_fname\" and lastname=\"$user_lname\" and id!=\"$user_id\""))) {
|
|
if (mysqli_num_rows(mysqli_query($drs_db,"select id from users where firstname=\"$user_fname\" and lastname=\"$user_lname\""))) {
|
|
$nameunique=false;
|
|
$nameunique_err=true;
|
|
} else {
|
|
$nameunique=true;
|
|
$nameunique_err=false;
|
|
}
|
|
} else {
|
|
$nameunique=true;
|
|
$nameunique_err=false;
|
|
}
|
|
// test for login supplied
|
|
if (strlen(trim($user_login))) {
|
|
$loginsuppld=true;
|
|
$loginsuppld_err=false;
|
|
} else {
|
|
$loginsuppld=false;
|
|
$loginsuppld_err=true;
|
|
}
|
|
// test for login unique
|
|
if (mysqli_num_rows(mysqli_query($drs_db,"select id from users where login=\"$user_login\" and id!=\"$user_id\""))) {
|
|
if (mysqli_num_rows(mysqli_query($drs_db,"select id from users where login=\"$user_login\""))) {
|
|
$loginunique=false;
|
|
$loginunique_err=true;
|
|
} else {
|
|
$loginunique=true;
|
|
$loginunique_err=false;
|
|
}
|
|
} else {
|
|
$loginunique=true;
|
|
$loginunique_err=false;
|
|
}
|
|
// sanitize first name, last name, login
|
|
$clean_fname=mysqli_real_escape_string($drs_db,$user_fname);
|
|
$clean_lname=mysqli_real_escape_string($drs_db,$user_lname);
|
|
$clean_login=mysqli_real_escape_string($drs_db,$user_login);
|
|
|
|
if ($user_pass!="password_is_unchanged") {
|
|
// test passwords
|
|
$passresults=validate_password($user_pass,$user_passconf);
|
|
if ($passresults['match']) {
|
|
$passmatch=true;
|
|
$passmatch_err=false;
|
|
} else {
|
|
$passmatch=false;
|
|
$passmatch_err=true;
|
|
}
|
|
if ($passresults['complex']) {
|
|
$passcomplex=true;
|
|
$passcomplex_err=false;
|
|
} else {
|
|
$passcomplex=false;
|
|
$passcomplex_err=true;
|
|
}
|
|
if ($passmatch && $passcomplex) {
|
|
$passhash=password_hash($user_pass,PASSWORD_DEFAULT);
|
|
$updqry="update users set firstname=\"$clean_fname\",lastname=\"$clean_lname\",login=\"$clean_login\",password_hash=\"$passhash\" where id=\"$user_id\"";
|
|
}
|
|
} else {
|
|
$passmatch=true;
|
|
$passcomplex=true;
|
|
$updqry="update users set firstname=\"$clean_fname\",lastname=\"$clean_lname\",login=\"$clean_login\" where id=\"$user_id\"";
|
|
}
|
|
if ($fnamesuppld && $lnamesuppld && $nameunique && $loginsuppld && $loginunique && $passcomplex && $passmatch) {
|
|
// modify the table
|
|
mysqli_query($drs_db,$updqry);
|
|
}
|
|
}
|
|
}
|
|
// ******** end database manipulation ********
|
|
|
|
pagetable("begin");
|
|
if (!$print) {
|
|
pageblock("left","begin");
|
|
sidemenu();
|
|
pageblock("left","end");
|
|
}
|
|
pageblock("right","begin");
|
|
banner($print);
|
|
echo "<br>";
|
|
echo "
|
|
<div id=\"profiletabs\">
|
|
<ul>
|
|
<li><a href=\"#account\">Account Settings</a></li>
|
|
<li><a href=\"#page_colors\">Page Colors</a></li>
|
|
</ul>
|
|
|
|
<div id=\"account\">
|
|
";
|
|
if ($usernameunique_err) format_message(1,"User name already exists.");
|
|
if ($fnamesuppld_err) format_message(1,"First name cannot be blank.");
|
|
if ($lnamesuppld_err) format_message(1,"Last name cannot be blank.");
|
|
if ($loginsuppld_err) format_message(1,"Login cannot be blank.");
|
|
if ($loginunique_err) format_message(1,"Login already exists.");
|
|
if ($passcomplex_err) format_message(1,"Password doesn't meet complexity requirements.");
|
|
if ($passmatch_err) format_message(1,"The supplied passwords don't match.");
|
|
|
|
|
|
// set form options for editing
|
|
$sectiontitle="<b><font size=\"+1\">Modify Account</font></b><br><br>";
|
|
$formtag="<form method=\"post\" action=\"profile.php?edit_user=1#account\">";
|
|
$buttontags="
|
|
<input type=\"hidden\" name=\"user_id\" value=\"$user_id\">
|
|
<input type=\"submit\" name=\"update_user\" value=\"Update Info\">
|
|
<input type=\"submit\" name=\"reset\" value=\"Reset\"><br>
|
|
";
|
|
// pull current values from database
|
|
$currentvalues=mysqli_fetch_assoc(mysqli_query($drs_db,"select * from users where id=$user_id"));
|
|
$user_fname=$currentvalues["firstname"];
|
|
$user_lname=$currentvalues["lastname"];
|
|
$user_login=$currentvalues["login"];
|
|
$user_pass=$user_passconf="password_is_unchanged";
|
|
$password_help="Password must be at least 8 characters in length and contain at least one upper case letter, one lower case letter, one number, and one special character.";
|
|
echo "
|
|
$sectiontitle
|
|
$formtag
|
|
<table border=\"0\">
|
|
<tr><td>
|
|
First Name: <input type=\"text\" name=\"user_fname\" size=\"40\" value=\"$user_fname\"><br><br>
|
|
Last Name: <input type=\"text\" name=\"user_lname\" size=\"40\" value=\"$user_lname\"><br><br>
|
|
Login: <input type=\"text\" name=\"user_login\" size=\"40\" value=\"$user_login\"><br><br>
|
|
Password: <input type=\"password\" name=\"user_pass\" size=\"40\" id=\"pass\" title=\"$password_help\" value=\"$user_pass\"><br><br>
|
|
Repeat Password: <input type=\"password\" name=\"user_passconf\" size=\"40\" id=\"passconf\" title=\"$password_help\" value=\"$user_passconf\"><br><br>
|
|
<font size=\"-1\">Need a random password? </font>
|
|
";
|
|
$rpwok=false;
|
|
while (!$rpwok) {
|
|
$rpw=substr(str_shuffle(password_hash(microtime(),PASSWORD_DEFAULT)), 10, 12);
|
|
$rpwtst=validate_password($rpw,$rpw);
|
|
if ($rpwtst['complex']) $rpwok=true;
|
|
}
|
|
echo " $rpw<br><br>
|
|
<br><br>
|
|
</td></tr>
|
|
</table>
|
|
$buttontags
|
|
</form>
|
|
<br><hr>
|
|
";
|
|
echo "
|
|
</div>
|
|
|
|
<div id=\"page_colors\">
|
|
";
|
|
$curbgc=getsetting("background_color",$user_id);
|
|
$curmbgc=getsetting("menubg_color",$user_id);
|
|
$curtc=getsetting("text_color",$user_id);
|
|
$curlc=getsetting("link_color",$user_id);
|
|
$curvlc=getsetting("vlink_color",$user_id);
|
|
$curhc=getsetting("heading_color",$user_id);
|
|
|
|
echo "
|
|
<font size=\"+1\"><b>Color Configuration Parameters</b></font><br><br>
|
|
<table border=\"0\"><tr>
|
|
<td>
|
|
<form method=\"post\" action=\"profile.php#page_colors\">
|
|
<b>Select the color you'd like to change then use the color picker to select a new color</b><br><br>
|
|
<table border=\"0\" cellpadding=\"10\">
|
|
<tr><td>Page background color</td><td>#<input type=\"text\" name=\"newbgc\" value=\"$curbgc\" id=\"bgcfield\" onFocus=\"ddcolorposter.echocolor(this, 'bgcbox')\"> <span id=\"bgcbox\" class=\"colorbox\">____</span></td></tr>
|
|
<tr><td>Menu background color</td><td>#<input type=\"text\" name=\"newmbgc\" value=\"$curmbgc\" id=\"mbgcfield\" onFocus=\"ddcolorposter.echocolor(this, 'mbgcbox')\"> <span id=\"mbgcbox\" class=\"colorbox\">____</span></td></tr>
|
|
<tr><td>Normal text color</td><td>#<input type=\"text\" name=\"newtc\" value=\"$curtc\" id=\"tcfield\" onFocus=\"ddcolorposter.echocolor(this, 'tcbox')\"> <span id=\"tcbox\" class=\"colorbox\">____</span></td></tr>
|
|
<tr><td>Link color</td><td>#<input type=\"text\" name=\"newlc\" value=\"$curlc\" id=\"lcfield\" onFocus=\"ddcolorposter.echocolor(this, 'lcbox')\"> <span id=\"lcbox\" class=\"colorbox\">____</span></td></tr>
|
|
<tr><td>Visited link color</td><td>#<input type=\"text\" name=\"newvlc\" value=\"$curvlc\" id=\"vlcfield\" onFocus=\"ddcolorposter.echocolor(this, 'vlcbox')\"> <span id=\"vlcbox\" class=\"colorbox\">____</span></td></tr>
|
|
<tr><td>Heading color</td><td>#<input type=\"text\" name=\"newhc\" value=\"$curhc\" id=\"hcfield\" onFocus=\"ddcolorposter.echocolor(this, 'hcbox')\"> <span id=\"hcbox\" class=\"colorbox\">____</span></td></tr>
|
|
</table>
|
|
<br><br>
|
|
<input type=\"submit\" name=\"update_colors\" value=\"Update Colors\">
|
|
<input type=\"submit\" name=\"reset_colors\" value=\"Reset Colors to Defaults\">
|
|
</td>
|
|
<td>
|
|
<div id=\"pickerPanel\" class=\"dragPanel\">
|
|
<h4 id=\"pickerHandle\"> </h4>
|
|
<div id=\"pickerDiv\">
|
|
<img id=\"pickerbg\" src=\"colorpicker/img/pickerbg.png\" alt=\"\">
|
|
<div id=\"selector\"><img src=\"colorpicker/img/select.gif\"></div>
|
|
</div>
|
|
|
|
<div id=\"hueBg\">
|
|
<div id=\"hueThumb\"><img src=\"colorpicker/img/hline.png\"></div>
|
|
</div>
|
|
|
|
<div id=\"pickervaldiv\">
|
|
<form name=\"pickerform\" onsubmit=\"return pickerUpdate()\">
|
|
<font size=\"-3\">
|
|
<br />
|
|
R <input name=\"pickerrval\" id=\"pickerrval\" type=\"text\" value=\"0\" size=\"3\" maxlength=\"3\" />
|
|
H <input name=\"pickerhval\" id=\"pickerhval\" type=\"text\" value=\"0\" size=\"3\" maxlength=\"3\" />
|
|
<br />
|
|
G <input name=\"pickergval\" id=\"pickergval\" type=\"text\" value=\"0\" size=\"3\" maxlength=\"3\" />
|
|
S <input name=\"pickergsal\" id=\"pickersval\" type=\"text\" value=\"0\" size=\"3\" maxlength=\"3\" />
|
|
<br />
|
|
B <input name=\"pickerbval\" id=\"pickerbval\" type=\"text\" value=\"0\" size=\"3\" maxlength=\"3\" />
|
|
V <input name=\"pickervval\" id=\"pickervval\" type=\"text\" value=\"0\" size=\"3\" maxlength=\"3\" />
|
|
<br />
|
|
<br />
|
|
# <input name=\"pickerhexval\" id=\"pickerhexval\" type=\"text\" value=\"0\" size=\"6\" maxlength=\"6\" />
|
|
<br />
|
|
</font>
|
|
</form>
|
|
</div>
|
|
|
|
<div id=\"pickerSwatch\"> </div>
|
|
</div>
|
|
</td>
|
|
</tr></table>
|
|
";
|
|
|
|
echo "
|
|
</form>
|
|
</div>
|
|
</div>
|
|
";
|
|
|
|
echo "<br>";
|
|
banner($print);
|
|
pageblock("right","end");
|
|
pagetable("end");
|
|
|
|
framework("end","","",$print);
|
|
|
|
?>
|