Browse code

Changed majority of files.

DoubleBastionAdmin authored on 30/11/2024 06:56:40
Showing 1 changed files
src/save-update-user-role-and-groups.php
History View file @ e8a619c
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,88 @@
1 
+<?php
2 
+/**
3 
+ *  Copyright (C) 2021  Double Bastion LLC
4 
+ *
5 
+ *  This file is part of Roundpin, which is licensed under the
6 
+ *  GNU Affero General Public License Version 3.0. The license terms
7 
+ *  are detailed in the "LICENSE.txt" file located in the root directory.
8 
+ */
9 
+
10 
+session_start();
11 
+
12 
+ // header('Set-Cookie: PHPSESSID= ' . session_id() . '; SameSite=strict; Secure=true; HttpOnly=true;');
13 
+
14 
+if (isset($_POST['s_ajax_call']) && ($_POST['s_ajax_call'] == $_SESSION['validate_s_access'])) {
15 
+
16 
+    define('ACCESSCONST', TRUE);
17 
+
18 
+    require('db-connect.php');
19 
+
20 
+    $sipUsername = $_POST['sip_username'];
21 
+    $username = $_POST['username'];
22 
+    $newrole = $_POST['newrole'];
23 
+    $usergroups = $_POST['usergroups'];
24 
+
25 
+    // Get the role of the user who performs the update, from the 'app_users' table
26 
+    $queryprm = $mysqli->prepare("SELECT id, userrole, username FROM app_users WHERE username = ?");
27 
+    $queryprm->bind_param("s", $username);
28 
+    $queryprm->execute();
29 
+    $queryprmres = $queryprm->get_result()->fetch_assoc();
30 
+    $cruserrole = $queryprmres["userrole"];
31 
+
32 
+    if ($cruserrole == 'admin' || $cruserrole == 'superadmin') {
33 
+
34 
+        // Get the role of the user whose role is being updated, from the 'app_users' table
35 
+        $queryusr = $mysqli->prepare("SELECT id, userrole, sip_username FROM app_users WHERE sip_username = ?");
36 
+        $queryusr->bind_param("s", $sipUsername);
37 
+        $queryusr->execute();
38 
+        $queryusrres = $queryusr->get_result()->fetch_assoc();
39 
+        $rolefromdb = $queryusrres["userrole"];
40 
+
41 
+        if ($cruserrole == 'superadmin') {
42 
+
43 
+            $query = $mysqli->prepare("UPDATE `app_users` SET `userrole`=?, `user_groups`=? WHERE `sip_username`=?");
44 
+            $query->bind_param("sss", $newrole, $usergroups, $sipUsername);
45 
+
46 
+            if ($query->execute()) { $messagetosend = 'success'; } else { $messagetosend = 'An error occurred while attempting to save user data to the database!'; }
47 
+
48 
+        } elseif ($cruserrole == 'admin' && $newrole == 'superadmin') {
49 
+
50 
+                  $messagetosend = 'Admins cannot make other users Superadmins.';
51 
+
52 
+        } elseif ($cruserrole == 'admin' && $newrole == 'regular_user' && $rolefromdb != 'regular_user') {
53 
+
54 
+                  $messagetosend = 'Admins cannot assign the role of Regular User to Admins or Superadmins.';
55 
+
56 
+        } elseif ($cruserrole == 'admin' && $newrole == 'regular_user' && $rolefromdb == 'regular_user') {
57 
+
58 
+                  $query = $mysqli->prepare("UPDATE `app_users` SET `userrole`=?, `user_groups`=? WHERE `sip_username`=?");
59 
+                  $query->bind_param("sss", $newrole, $usergroups, $sipUsername);
60 
+
61 
+                  if ($query->execute()) { $messagetosend = 'success'; } else { $messagetosend = 'An error occurred while attempting to save user data to the database!'; }
62 
+
63 
+        } elseif ($cruserrole == 'admin' && $newrole == 'admin' && $rolefromdb == 'regular_user') {
64 
+
65 
+                  $query = $mysqli->prepare("UPDATE `app_users` SET `userrole`=?, `user_groups`=? WHERE `sip_username`=?");
66 
+                  $query->bind_param("sss", $newrole, $usergroups, $sipUsername);
67 
+
68 
+                  if ($query->execute()) { $messagetosend = 'success'; } else { $messagetosend = 'An error occurred while attempting to save user data to the database!'; }
69 
+
70 
+        } elseif ($cruserrole == 'admin' && $newrole == 'admin' && $rolefromdb == 'admin') {
71 
+
72 
+                  $messagetosend = 'Admins cannot change the user groups of other Admins.';
73 
+
74 
+        } elseif ($cruserrole == 'admin' && $newrole == 'admin' && $rolefromdb == 'superadmin') {
75 
+
76 
+                  $messagetosend = 'Admins cannot assign the role of Admin to Superadmins.';
77 
+        }
78 
+
79 
+    } else { $messagetosend = 'Only Admins and Superadmins can change the role and user groups of Roundpin users.'; }
80 
+
81 
+    $response = array('result' => $messagetosend);
82 
+    echo json_encode($response);
83 
+
84 
+} else {
85 
+     header("Location: ../login.php");
86 
+}
87 
+
88 
+?>