Add ability to add and delete access to the panel

Beware, at this very commit, any user you add can delete any other user including you.
In case of this, you can always add yourself back through the config or delete their stuff in the SQL database.

diff --git a/plugins/sql_auth/SQL/user.php b/plugins/sql_auth/SQL/user.php
index f9c248bbe147639718390eb7d16f2b3203fa1a2c..fbb8c3dc29a11a3978f792a1f94112fcf4f2798f 100644 (file)
--- a/plugins/sql_auth/SQL/user.php
+++ b/plugins/sql_auth/SQL/user.php
@@ -33,7 +33,7 @@ class SQLA_User
         $data = NULL;
         if ($prep)
             $data = $prep->fetchAll();
-        if ($data = $data[0])
+        if (isset($data[0]) && $data = $data[0])
         {
             $this->id = $data['user_id'];
             $this->username = $data['user_name'];
@@ -96,11 +96,12 @@ function create_new_user(array $user) : bool
     $password = password_hash($user['user_pass'], PASSWORD_ARGON2ID);
     $first_name = (isset($user['fname'])) ? $user['fname'] : NULL;
     $last_name = (isset($user['lname'])) ? $user['lname'] : NULL;
+    $user_bio = (isset($user['user_bio'])) ? $user['user_bio'] : NULL;
     
 
     $conn = sqlnew();
-    $prep = $conn->prepare("INSERT INTO " . SQL_PREFIX . "users (user_name, user_pass, user_fname, user_lname, created) VALUES (:name, :pass, :fname, :lname, :created)");
-    $prep->execute(["name" => $username, "pass" => $password, "fname" => $first_name, "lname" => $last_name, "created" => date("Y-m-d H:i:s")]);
+    $prep = $conn->prepare("INSERT INTO " . SQL_PREFIX . "users (user_name, user_pass, user_fname, user_lname, user_bio, created) VALUES (:name, :pass, :fname, :lname, :user_bio, :created)");
+    $prep->execute(["name" => $username, "pass" => $password, "fname" => $first_name, "lname" => $last_name, "user_bio" => $user_bio, "created" => date("Y-m-d H:i:s")]);
     
     return true;
 }
@@ -132,3 +133,35 @@ function current_user_can() : bool
     return false;
 }
 
+/**
+ * Delete a user and related meta
+ * @param int $id The ID of the user in the SQL database.
+ * @param array $info Optional: This will fill with a response.
+ * @return int
+ * 
+ * Return values:
+ *  1   The user was successfully deleted.
+ *  0   The user was not found
+ *  -1  The admin does not have permission to delete users [TODO]
+ */
+function delete_user(int $id, &$info = []) : int
+{
+    $user = new SQLA_User(NULL, $id);
+    if (!$user->id) {
+        $info[] = "Could not find user";
+        var_dump("return 1");
+        return 0;
+    }
+    $query = "DELETE FROM " . SQL_PREFIX . "users WHERE user_id = :id";
+    $conn = sqlnew();
+    $stmt = $conn->prepare($query);
+    $stmt->execute(["id" => $user->id]);
+    $deleted = $stmt->rowCount();
+    if ($user->id)
+    {
+        $info[] = "Successfully deleted user \"$user->username\"";
+        return 1;
+    }
+    $info[] = "Unknown error";
+    return 0;
+}
\ No newline at end of file

diff --git a/plugins/sql_auth/index.php b/plugins/sql_auth/index.php
index 97602cbc801f489d1463f4b531721c5bf3ba8499..b422230bfa3e42cf47e43e32b5c9024a88fc6fd3 100644 (file)
--- a/plugins/sql_auth/index.php
+++ b/plugins/sql_auth/index.php
@@ -8,30 +8,60 @@ require_once "SQL/user.php";
 do_log($_POST);
 
 
-$conn = sqlnew();
-$result = $conn->query("SELECT user_id FROM " . SQL_PREFIX . "users");
 
-if (!$result) // impossible
-{
-    die("Something went wrong.");
-}
 
-$userlist = [];
-while($row =  $result->fetch())
-{
-    $userlist[] = new SQLA_User(NULL, $row['user_id']);
-}
 ?>
 <h4>Panel Access Overview</h4>
 <?php
     if (isset($_POST))
     {
+               // TODO:  Validation and stuff
         $p = $_POST;
+               if (isset($p['delete_user']))
+               {
+                       $info = [];
+                       foreach ($p['userch'] as $id)
+                       {
+                               $user = new SQLA_User(NULL, $id);
+                               $deleted = delete_user($id, $info);
+                               $msg = ($deleted = 1) ? "Message::Success" : "Message::Fail";
+                       }
+                       $msg($info);
+                       unset($info);
+               }
+
         if (isset($p['do_add_user']))
         {
-
-        }        
+                       $user = [];
+                       $user['user_name'] = $p['user_add'];
+                       $user['user_pass'] = $p['password'];
+                       $user['fname'] = $p['add_first_name'];
+                       $user['lname'] = $p['add_last_name'];
+                       $user['user_bio'] = $p['user_bio'];
+                       create_new_user($user);
+                       if (($usr_obj = new SQLA_User($p['user_name'])) && !$usr_obj->id)
+                       {
+                               Message::Success("Successfully created user \"" . $user['user_name'] . "\"");
+                       }
+                       else
+                       {
+                               Message::Fail("Failed to create user \"" . $user['user_name'] . "\"");
+                       }
+               }
     }
+       $conn = sqlnew();
+       $result = $conn->query("SELECT user_id FROM " . SQL_PREFIX . "users");
+       $userlist = [];
+       while($row =  $result->fetch())
+       {
+               $userlist[] = new SQLA_User(NULL, $row['user_id']);
+       }
+
+       if (!$result) // impossible
+       {
+               die("Something went wrong.");
+       }
+
 ?>
 Click on a username to view more information.
 <br><br>
@@ -131,4 +161,4 @@ Click on a username to view more information.
        </div>
        </div></form></div></div>
 
-<?php require_once 'footer.php'; ?>
+<?php require_once '../../footer.php'; ?>