Skip to content
This repository was archived by the owner on Jun 8, 2023. It is now read-only.

Commit fd94011

Browse files
author
Samuel Janda
committed
Needs account confirmation and forgotten password functionality
Fixes #17
1 parent e563c13 commit fd94011

File tree

7 files changed

+713
-34
lines changed

7 files changed

+713
-34
lines changed

‎controller/account.php

Lines changed: 169 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,6 @@
11
<?php
22

3+
require_once '../model/Activator.php';
34
require_once '../model/Config.php';
45
require_once '../model/DB.php';
56
require_once '../model/Location.php';
@@ -268,14 +269,56 @@
268269
exit();
269270
}
270271

272+
$activator = new Activator();
273+
$activator->setAccountID($query_id);
274+
$activator->generateActivator();
275+
276+
$query_activator = $activator->getActivator();
277+
$query = $writeDB->prepare("INSERT INTO `activators` (account_id, activator) VALUES (:id, :a)");
278+
$query->bindParam(":id", $query_id, PDO::PARAM_STR);
279+
$query->bindParam(":a", $query_activator, PDO::PARAM_STR);
280+
$query->execute();
281+
282+
$row_count = $query->rowCount();
283+
if ($row_count === 0) {
284+
$response = new Response();
285+
$response->setHttpStatusCode(500);
286+
$response->setSuccess(false);
287+
$response->addMessage("Error: database error during user creation.");
288+
$response->send();
289+
exit();
290+
}
291+
292+
$activator->setID($writeDB->lastInsertId());
293+
$verify_url = $activator->getBaseURL() . "dashboard/?id={$activator->getID()}&a={$activator->getAccountID()}&c={$activator->getActivator()}";
294+
271295
$response_data = [];
272296
$response_data['id'] = $query_id;
273297
$response_data['name'] = $query_name;
274298
$response_data['authorisedContact'] = $query_contact;
275299
$response_data['contactPhone'] = $query_phone;
276300
$response_data['contactEmail'] = $query_email;
277301

278-
include('register_mail.php');
302+
$success = Config::Mailer([
303+
"type" => "register",
304+
"email" => $query_email,
305+
"account_id" => $query_id,
306+
"contact_name" => $query_contact,
307+
"contact_phone" => $query_phone,
308+
"business_name" => $query_name,
309+
"business_address" => $location->address()->getStreetAddress(),
310+
"shortname" => $query_shortname,
311+
"verify_url" => $verify_url
312+
]);
313+
314+
if (!$success) {
315+
$response = new Response();
316+
$response->setHttpStatusCode(500);
317+
$response->setSuccess(false);
318+
$response->addMessage("Error: mailing error during user creation.");
319+
$response->send();
320+
exit();
321+
}
279322

280323
$response = new Response();
281324
$response->setHttpStatusCode(201);
@@ -332,25 +375,24 @@
332375
$query->bindParam(':id', $query_id, PDO::PARAM_STR);
333376
$query->execute();
334377

335-
$row_count = $query->rowCount();
336-
if ($row_count === 0) {
337-
$response = new Response();
338-
$response->setHttpStatusCode(404);
339-
$response->setSuccess(false);
340-
$response->addMessage("Error: venue account not found.");
341-
$response->send();
342-
Config::RegisterAPIAccess($query_id, "account");
343-
exit();
344-
}
345-
378+
$row_count = $query->rowCount();
379+
if ($row_count === 0) {
346380
$response = new Response();
347-
$response->setHttpStatusCode(200);
348-
$response->setSuccess(true);
349-
$response->addMessage("Logo successfully updated.");
381+
$response->setHttpStatusCode(404);
382+
$response->setSuccess(false);
383+
$response->addMessage("Error: venue account not found.");
350384
$response->send();
351385
Config::RegisterAPIAccess($query_id, "account");
352386
exit();
387+
}
353388

389+
$response = new Response();
390+
$response->setHttpStatusCode(200);
391+
$response->setSuccess(true);
392+
$response->addMessage("Logo successfully updated.");
393+
$response->send();
394+
Config::RegisterAPIAccess($query_id, "account");
395+
exit();
354396
} elseif ($_SERVER['REQUEST_METHOD'] === 'PATCH') {
355397

356398
if (!isset($_GET['id'])) {
@@ -362,6 +404,107 @@
362404
exit();
363405
}
364406

407+
if (isset($_GET['a'], $_GET['c'])) { //Account activation or Forgot password
408+
409+
$activator = new Activator();
410+
$activator->setID(intval($_GET['a']));
411+
$activator->setAccountID(intval($_GET['id']));
412+
$activator->setActivator($_GET['c']);
413+
414+
$query_id = $activator->getID();
415+
$query_aid = $activator->getAccountID();
416+
$query_code = $activator->getActivator();
417+
418+
$query = $writeDB->prepare("SELECT is_active FROM accounts WHERE id=:id");
419+
$query->bindParam(":id", $query_aid, PDO::PARAM_STR);
420+
$query->execute();
421+
422+
$row_count = $query->rowCount();
423+
if ($row_count === 0) {
424+
$response = new Response();
425+
$response->setHttpStatusCode(404);
426+
$response->setSuccess(false);
427+
$response->addMessage("Error: account not found.");
428+
$response->send();
429+
exit();
430+
}
431+
432+
$raw_post_data = file_get_contents('php://input');
433+
434+
if (!$json_data = json_decode($raw_post_data)) {
435+
$response = new Response();
436+
$response->setHttpStatusCode(400);
437+
$response->setSuccess(false);
438+
$response->addMessage("Error: request body is not valid JSON.");
439+
$response->send();
440+
exit();
441+
}
442+
443+
if ($query->fetch(PDO::FETCH_ASSOC)['is_active']) { //Forgot password
444+
if (!isset($json_data->password)) {
445+
$response = new Response();
446+
$response->setHttpStatusCode(400);
447+
$response->setSuccess(false);
448+
$response->addMessage("Error: new password not provided.");
449+
$response->send();
450+
exit();
451+
}
452+
453+
$passwordHash = password_hash($json_data->password, PASSWORD_DEFAULT);
454+
$query = $writeDB->prepare("UPDATE accounts SET auth=:pw WHERE id=:id");
455+
$query->bindParam(":pw", $passwordHash, PDO::PARAM_STR);
456+
$query->bindParam(":id", $query_aid, PDO::PARAM_STR);
457+
$query->execute();
458+
459+
$row_count = $query->rowCount();
460+
if ($row_count === 0) {
461+
$response = new Response();
462+
$response->setHttpStatusCode(400);
463+
$response->setSuccess(false);
464+
$response->addMessage("Error: password update failed.");
465+
$response->send();
466+
exit();
467+
}
468+
} else { //New account activation
469+
$query = $writeDB->prepare("DELETE FROM activators WHERE id=:a AND account_id=:id AND activator=:c");
470+
$query->bindParam(":a", $query_id, PDO::PARAM_STR);
471+
$query->bindParam(":id", $query_aid, PDO::PARAM_STR);
472+
$query->bindParam(":c", $query_code, PDO::PARAM_STR);
473+
$query->execute();
474+
475+
$row_count = $query->rowCount();
476+
if ($row_count === 0) {
477+
$response = new Response();
478+
$response->setHttpStatusCode(404);
479+
$response->setSuccess(false);
480+
$response->addMessage("Error: matching account activator not found.");
481+
$response->send();
482+
exit();
483+
}
484+
485+
$query = $writeDB->prepare("UPDATE accounts SET is_active=1 WHERE id=:id");
486+
$query->bindParam(":id", $query_aid, PDO::PARAM_STR);
487+
$query->execute();
488+
489+
$row_count = $query->rowCount();
490+
if ($row_count === 0) {
491+
$response = new Response();
492+
$response->setHttpStatusCode(404);
493+
$response->setSuccess(false);
494+
$response->addMessage("Error: account activation unsuccessful, contact administrator.");
495+
$response->send();
496+
exit();
497+
}
498+
499+
$response = new Response();
500+
$response->setHttpStatusCode(200);
501+
$response->setSuccess(false);
502+
$response->setData(['activator' => true]);
503+
$response->send();
504+
exit();
505+
}
506+
}
507+
365508
include('authenticate.php');
366509

367510
if ($_SERVER['CONTENT_TYPE'] === 'application/json') {
@@ -540,9 +683,8 @@
540683
$response->send();
541684
exit();
542685
}
543-
544686
} elseif ($_SERVER['REQUEST_METHOD'] === 'DELETE') {
545-
687+
546688
if (!isset($_GET['id'])) {
547689
$response = new Response();
548690
$response->setHttpStatusCode(400);
@@ -561,13 +703,22 @@
561703
$query->bindParam(':id', $query_id, PDO::PARAM_STR);
562704
$query->execute();
563705

706+
$row_count = $query->rowCount();
707+
if ($row_count === 0) {
708+
$response = new Response();
709+
$response->setHttpStatusCode(404);
710+
$response->setSuccess(false);
711+
$response->addMessage("Error: account not found.");
712+
$response->send();
713+
exit();
714+
}
715+
564716
$response = new Response();
565717
$response->setHttpStatusCode(200);
566718
$response->setSuccess(true);
567719
$response->addMessage("Account successfully deleted.");
568720
$response->send();
569721
exit();
570-
571722
} else {
572723
$response = new Response();
573724
$response->setHttpStatusCode(405);

0 commit comments

Comments
 (0)