Implement remaining security models #19
|
@ -9,7 +9,7 @@ class Data {
|
||||||
* @return SQLite3 A new connection to the database
|
* @return SQLite3 A new connection to the database
|
||||||
*/
|
*/
|
||||||
public static function getConnection(): SQLite3 {
|
public static function getConnection(): SQLite3 {
|
||||||
$db = new SQLite3('../data/' . DATABASE_NAME);
|
$db = new SQLite3(implode(DIRECTORY_SEPARATOR, [__DIR__, '..', 'data', DATABASE_NAME]));
|
||||||
$db->exec('PRAGMA foreign_keys = ON;');
|
$db->exec('PRAGMA foreign_keys = ON;');
|
||||||
return $db;
|
return $db;
|
||||||
}
|
}
|
||||||
|
@ -65,47 +65,6 @@ class Data {
|
||||||
$db->close();
|
$db->close();
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
|
||||||
* Find a user by their ID
|
|
||||||
*
|
|
||||||
* @param string $email The e-mail address of the user to retrieve
|
|
||||||
* @return array|null The user information, or null if the user is not found
|
|
||||||
*/
|
|
||||||
public static function findUserByEmail(string $email): ?array {
|
|
||||||
$db = self::getConnection();
|
|
||||||
try {
|
|
||||||
$query = $db->prepare('SELECT * FROM frc_user WHERE email = :email');
|
|
||||||
$query->bindValue(':email', $email);
|
|
||||||
$result = $query->execute();
|
|
||||||
if ($result) {
|
|
||||||
$user = $result->fetchArray(SQLITE3_ASSOC);
|
|
||||||
if ($user) return $user;
|
|
||||||
return null;
|
|
||||||
}
|
|
||||||
return null;
|
|
||||||
} finally {
|
|
||||||
$db->close();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Add a user
|
|
||||||
*
|
|
||||||
* @param string $email The e-mail address for the user
|
|
||||||
* @param string $password The user's password
|
|
||||||
*/
|
|
||||||
public static function addUser(string $email, string $password): void {
|
|
||||||
$db = self::getConnection();
|
|
||||||
try {
|
|
||||||
$query = $db->prepare('INSERT INTO frc_user (email, password) VALUES (:email, :password)');
|
|
||||||
$query->bindValue(':email', $email);
|
|
||||||
$query->bindValue(':password', password_hash($password, PASSWORD_DEFAULT));
|
|
||||||
$query->execute();
|
|
||||||
} finally {
|
|
||||||
$db->close();
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Parse/format a date/time from a string
|
* Parse/format a date/time from a string
|
||||||
*
|
*
|
||||||
|
@ -132,7 +91,7 @@ class Data {
|
||||||
try {
|
try {
|
||||||
$query = $db->prepare('SELECT * FROM feed WHERE id = :id AND user_id = :user');
|
$query = $db->prepare('SELECT * FROM feed WHERE id = :id AND user_id = :user');
|
||||||
$query->bindValue(':id', $feedId);
|
$query->bindValue(':id', $feedId);
|
||||||
$query->bindValue(':user', $_REQUEST[Key::USER_ID]);
|
$query->bindValue(':user', $_SESSION[Key::USER_ID]);
|
||||||
$result = $query->execute();
|
$result = $query->execute();
|
||||||
return $result ? $result->fetchArray(SQLITE3_ASSOC) : false;
|
return $result ? $result->fetchArray(SQLITE3_ASSOC) : false;
|
||||||
} finally {
|
} finally {
|
||||||
|
|
|
@ -229,7 +229,7 @@ class Feed {
|
||||||
private static function refreshFeed(string $url, SQLite3 $db): array {
|
private static function refreshFeed(string $url, SQLite3 $db): array {
|
||||||
$feedQuery = $db->prepare('SELECT id FROM feed WHERE url = :url AND user_id = :user');
|
$feedQuery = $db->prepare('SELECT id FROM feed WHERE url = :url AND user_id = :user');
|
||||||
$feedQuery->bindValue(':url', $url);
|
$feedQuery->bindValue(':url', $url);
|
||||||
$feedQuery->bindValue(':user', $_REQUEST[Key::USER_ID]);
|
$feedQuery->bindValue(':user', $_SESSION[Key::USER_ID]);
|
||||||
$feedResult = $feedQuery->execute();
|
$feedResult = $feedQuery->execute();
|
||||||
$feedId = $feedResult ? $feedResult->fetchArray(SQLITE3_NUM)[0] : -1;
|
$feedId = $feedResult ? $feedResult->fetchArray(SQLITE3_NUM)[0] : -1;
|
||||||
if ($feedId < 0) return ['error' => "No feed for URL $url found"];
|
if ($feedId < 0) return ['error' => "No feed for URL $url found"];
|
||||||
|
@ -273,7 +273,7 @@ class Feed {
|
||||||
INSERT INTO feed (user_id, url, title, updated_on, checked_on)
|
INSERT INTO feed (user_id, url, title, updated_on, checked_on)
|
||||||
VALUES (:user, :url, :title, :updated, :checked)
|
VALUES (:user, :url, :title, :updated, :checked)
|
||||||
SQL);
|
SQL);
|
||||||
$query->bindValue(':user', $_REQUEST[Key::USER_ID]);
|
$query->bindValue(':user', $_SESSION[Key::USER_ID]);
|
||||||
$query->bindValue(':url', $feed['url']);
|
$query->bindValue(':url', $feed['url']);
|
||||||
$query->bindValue(':title', self::eltValue($feed['channel'], 'title'));
|
$query->bindValue(':title', self::eltValue($feed['channel'], 'title'));
|
||||||
$query->bindValue(':updated', $feed['updated']);
|
$query->bindValue(':updated', $feed['updated']);
|
||||||
|
@ -300,7 +300,7 @@ class Feed {
|
||||||
$query = $db->prepare('UPDATE feed SET url = :url WHERE id = :id AND user_id = :user');
|
$query = $db->prepare('UPDATE feed SET url = :url WHERE id = :id AND user_id = :user');
|
||||||
$query->bindValue(':url', $url);
|
$query->bindValue(':url', $url);
|
||||||
$query->bindValue(':id', $existing['id']);
|
$query->bindValue(':id', $existing['id']);
|
||||||
$query->bindValue(':user', $_REQUEST[Key::USER_ID]);
|
$query->bindValue(':user', $_SESSION[Key::USER_ID]);
|
||||||
$query->execute();
|
$query->execute();
|
||||||
|
|
||||||
return self::refreshFeed($url, $db);
|
return self::refreshFeed($url, $db);
|
||||||
|
@ -312,7 +312,7 @@ class Feed {
|
||||||
*/
|
*/
|
||||||
public static function refreshAll(SQLite3 $db): array {
|
public static function refreshAll(SQLite3 $db): array {
|
||||||
$query = $db->prepare('SELECT url FROM feed WHERE user_id = :user');
|
$query = $db->prepare('SELECT url FROM feed WHERE user_id = :user');
|
||||||
$query->bindValue(':user', $_REQUEST[Key::USER_ID]);
|
$query->bindValue(':user', $_SESSION[Key::USER_ID]);
|
||||||
$result = $query->execute();
|
$result = $query->execute();
|
||||||
$url = $result ? $result->fetchArray(SQLITE3_NUM) : false;
|
$url = $result ? $result->fetchArray(SQLITE3_NUM) : false;
|
||||||
if ($url) {
|
if ($url) {
|
||||||
|
|
|
@ -2,10 +2,10 @@
|
||||||
|
|
||||||
class Key {
|
class Key {
|
||||||
|
|
||||||
/** @var string The $_REQUEST key for teh current user's e-mail address */
|
/** @var string The $_SESSION key for the current user's e-mail address */
|
||||||
public const string USER_EMAIL = 'FRC_USER_EMAIL';
|
public const string USER_EMAIL = 'FRC_USER_EMAIL';
|
||||||
|
|
||||||
/** @var string The $_REQUEST key for the current user's ID */
|
/** @var string The $_SESSION key for the current user's ID */
|
||||||
public const string USER_ID = 'FRC_USER_ID';
|
public const string USER_ID = 'FRC_USER_ID';
|
||||||
|
|
||||||
/** @var string The $_REQUEST key for the array of user messages to display */
|
/** @var string The $_REQUEST key for the array of user messages to display */
|
||||||
|
|
|
@ -14,38 +14,108 @@ class Security {
|
||||||
/** @var int Require users to provide e-mail address and password */
|
/** @var int Require users to provide e-mail address and password */
|
||||||
public const int MULTI_USER = 2;
|
public const int MULTI_USER = 2;
|
||||||
|
|
||||||
|
/** @var string The e-mail address for the single user */
|
||||||
|
public const string SINGLE_USER_EMAIL = 'solouser@example.com';
|
||||||
|
|
||||||
|
/** @var string The password for the single user with no password */
|
||||||
|
private const string SINGLE_USER_PASSWORD = 'no-password-required';
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Verify that user is logged on
|
* Find a user by their ID
|
||||||
* @param bool $redirectIfAnonymous Whether to redirect the request if there is no user logged on
|
*
|
||||||
|
* @param string $email The e-mail address of the user to retrieve
|
||||||
|
* @param SQLite3 $db The data connection to use to retrieve the user
|
||||||
|
* @return array|false The user information, or null if the user is not found
|
||||||
*/
|
*/
|
||||||
public static function verifyUser(bool $redirectIfAnonymous = true): void {
|
private static function findUserByEmail(string $email, SQLite3 $db): array|false {
|
||||||
switch (SECURITY_MODEL) {
|
$query = $db->prepare('SELECT * FROM frc_user WHERE email = :email');
|
||||||
case self::SINGLE_USER:
|
$query->bindValue(':email', $email);
|
||||||
$user = self::retrieveSingleUser();
|
$result = $query->execute();
|
||||||
break;
|
return $result ? $result->fetchArray(SQLITE3_ASSOC) : false;
|
||||||
case self::SINGLE_USER_WITH_PASSWORD:
|
|
||||||
die('Single User w/ Password has not yet been implemented');
|
|
||||||
case self::MULTI_USER:
|
|
||||||
die('Multi-User Mode has not yet been implemented');
|
|
||||||
default:
|
|
||||||
die('Unrecognized security model (' . SECURITY_MODEL . ')');
|
|
||||||
}
|
|
||||||
if (!$user && $redirectIfAnonymous) {
|
|
||||||
header('/logon?returnTo=' . $_SERVER['REQUEST_URI'], true, HTTP_REDIRECT_TEMP);
|
|
||||||
die();
|
|
||||||
}
|
|
||||||
$_REQUEST[Key::USER_ID] = $user['id'];
|
|
||||||
$_REQUEST[Key::USER_EMAIL] = $user['email'];
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Retrieve the single user
|
* Add a user
|
||||||
* @return array The user information for the single user
|
*
|
||||||
|
* @param string $email The e-mail address for the user
|
||||||
|
* @param string $password The user's password
|
||||||
|
* @param SQLite3 $db The data connection to use to add the user
|
||||||
*/
|
*/
|
||||||
private static function retrieveSingleUser(): array {
|
public static function addUser(string $email, string $password, SQLite3 $db): void {
|
||||||
$user = Data::findUserByEmail('solouser@example.com');
|
$query = $db->prepare('INSERT INTO frc_user (email, password) VALUES (:email, :password)');
|
||||||
if ($user) return $user;
|
$query->bindValue(':email', $email);
|
||||||
Data::addUser('solouser@example.com', 'no-password-required');
|
$query->bindValue(':password', password_hash($password, PASSWORD_DEFAULT));
|
||||||
return Data::findUserByEmail('solouser@example.com');
|
$query->execute();
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Verify a user's password
|
||||||
|
*
|
||||||
|
* @param array $user The user information retrieved from the database
|
||||||
|
* @param string $password The password provided by the user
|
||||||
|
* @param string|null $returnTo The URL to which the user should be redirected
|
||||||
|
* @param SQLite3 $db The database connection to use to verify the user's credentials
|
||||||
|
*/
|
||||||
|
private static function verifyPassword(array $user, string $password, ?string $returnTo, SQLite3 $db): void {
|
||||||
|
if (password_verify($password, $user['password'])) {
|
||||||
|
if (password_needs_rehash($user['password'], PASSWORD_DEFAULT)) {
|
||||||
|
$rehash = $db->prepare('UPDATE frc_user SET password = :hash WHERE id = :id');
|
||||||
|
$rehash->bindValue(':hash', password_hash($password, PASSWORD_DEFAULT));
|
||||||
|
$rehash->bindValue(':id', $user['id']);
|
||||||
|
$rehash->execute();
|
||||||
|
}
|
||||||
|
$_SESSION[Key::USER_ID] = $user['id'];
|
||||||
|
$_SESSION[Key::USER_EMAIL] = $user['email'];
|
||||||
|
frc_redirect($returnTo ?? '/');
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Log on a user with e-mail address and password
|
||||||
|
*
|
||||||
|
* @param string $email The e-mail address for the user
|
||||||
|
* @param string $password The password provided by the user
|
||||||
|
* @param string|null $returnTo The URL to which the user should be redirected
|
||||||
|
* @param SQLite3 $db The database connection to use to verify the user's credentials
|
||||||
|
*/
|
||||||
|
public static function logOnUser(string $email, string $password, ?string $returnTo, SQLite3 $db): void {
|
||||||
|
$user = self::findUserByEmail($email, $db);
|
||||||
|
if ($user) self::verifyPassword($user, $password, $returnTo, $db);
|
||||||
|
add_error('Invalid credentials; log on unsuccessful');
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Log on the single user
|
||||||
|
*
|
||||||
|
* @param SQLite3 $db The data connection to use to retrieve the user
|
||||||
|
*/
|
||||||
|
private static function logOnSingleUser(SQLite3 $db): void {
|
||||||
|
$user = self::findUserByEmail(self::SINGLE_USER_EMAIL, $db);
|
||||||
|
if (!$user) {
|
||||||
|
self::addUser(self::SINGLE_USER_EMAIL, self::SINGLE_USER_PASSWORD, $db);
|
||||||
|
$user = self::findUserByEmail(self::SINGLE_USER_EMAIL, $db);
|
||||||
|
}
|
||||||
|
self::verifyPassword($user, self::SINGLE_USER_PASSWORD, $_GET['returnTo'], $db);
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Verify that user is logged on
|
||||||
|
*
|
||||||
|
* @param SQLite3 $db The data connection to use if required
|
||||||
|
* @param bool $redirectIfAnonymous Whether to redirect the request if there is no user logged on
|
||||||
|
*/
|
||||||
|
public static function verifyUser(SQLite3 $db, bool $redirectIfAnonymous = true): void {
|
||||||
|
if (array_key_exists(Key::USER_ID, $_SESSION)) return;
|
||||||
|
|
||||||
|
if (SECURITY_MODEL == self::SINGLE_USER) self::logOnSingleUser($db);
|
||||||
|
|
||||||
|
if (SECURITY_MODEL != self::SINGLE_USER_WITH_PASSWORD && SECURITY_MODEL != self::MULTI_USER) {
|
||||||
|
die('Unrecognized security model (' . SECURITY_MODEL . ')');
|
||||||
|
}
|
||||||
|
|
||||||
|
if ($redirectIfAnonymous) {
|
||||||
|
header("Location: /user/log-on?returnTo={$_SERVER['REQUEST_URI']}", true, 307);
|
||||||
|
die();
|
||||||
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
|
@ -57,7 +57,10 @@ article {
|
||||||
padding: .5rem;
|
padding: .5rem;
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
input[type=url], input[type=text] {
|
input[type=url],
|
||||||
|
input[type=text],
|
||||||
|
input[type=email],
|
||||||
|
input[type=password] {
|
||||||
width: 50%;
|
width: 50%;
|
||||||
font-size: 1rem;
|
font-size: 1rem;
|
||||||
padding: .25rem;
|
padding: .25rem;
|
||||||
|
|
|
@ -7,10 +7,10 @@
|
||||||
|
|
||||||
include '../start.php';
|
include '../start.php';
|
||||||
|
|
||||||
Security::verifyUser();
|
$db = Data::getConnection();
|
||||||
|
Security::verifyUser($db);
|
||||||
|
|
||||||
$feedId = array_key_exists('id', $_GET) ? $_GET['id'] : '';
|
$feedId = $_GET['id'] ?? '';
|
||||||
$db = Data::getConnection();
|
|
||||||
|
|
||||||
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
|
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
|
||||||
$isNew = $_POST['id'] == 'new';
|
$isNew = $_POST['id'] == 'new';
|
||||||
|
@ -31,7 +31,7 @@ if ($_SERVER['REQUEST_METHOD'] == 'POST') {
|
||||||
|
|
||||||
if ($feedId == 'new') {
|
if ($feedId == 'new') {
|
||||||
$title = 'Add RSS Feed';
|
$title = 'Add RSS Feed';
|
||||||
$feed = [ 'id' => $_GET['id'], 'url' => '' ];
|
$feed = [ 'id' => $_GET['id'], 'url' => ''];
|
||||||
} else {
|
} else {
|
||||||
$title = 'Edit RSS Feed';
|
$title = 'Edit RSS Feed';
|
||||||
if ($feedId == 'error') {
|
if ($feedId == 'error') {
|
||||||
|
|
|
@ -7,9 +7,8 @@
|
||||||
|
|
||||||
include '../start.php';
|
include '../start.php';
|
||||||
|
|
||||||
Security::verifyUser();
|
|
||||||
|
|
||||||
$db = Data::getConnection();
|
$db = Data::getConnection();
|
||||||
|
Security::verifyUser($db);
|
||||||
|
|
||||||
if (array_key_exists('refresh', $_GET)) {
|
if (array_key_exists('refresh', $_GET)) {
|
||||||
$refreshResult = Feed::refreshAll($db);
|
$refreshResult = Feed::refreshAll($db);
|
||||||
|
|
|
@ -8,9 +8,8 @@
|
||||||
|
|
||||||
include '../start.php';
|
include '../start.php';
|
||||||
|
|
||||||
Security::verifyUser();
|
|
||||||
|
|
||||||
$db = Data::getConnection();
|
$db = Data::getConnection();
|
||||||
|
Security::verifyUser($db);
|
||||||
|
|
||||||
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
|
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
|
||||||
// "Keep as New" button sends a POST request to reset the is_read flag before going back to the list of unread items
|
// "Keep as New" button sends a POST request to reset the is_read flag before going back to the list of unread items
|
||||||
|
@ -20,7 +19,7 @@ if ($_SERVER['REQUEST_METHOD'] == 'POST') {
|
||||||
WHERE item.id = :id AND feed.user_id = :user
|
WHERE item.id = :id AND feed.user_id = :user
|
||||||
SQL);
|
SQL);
|
||||||
$isValidQuery->bindValue(':id', $_POST['id']);
|
$isValidQuery->bindValue(':id', $_POST['id']);
|
||||||
$isValidQuery->bindValue(':user', $_REQUEST[Key::USER_ID]);
|
$isValidQuery->bindValue(':user', $_SESSION[Key::USER_ID]);
|
||||||
$isValidResult = $isValidQuery->execute();
|
$isValidResult = $isValidQuery->execute();
|
||||||
if ($isValidResult && $isValidResult->fetchArray(SQLITE3_NUM)[0] == 1) {
|
if ($isValidResult && $isValidResult->fetchArray(SQLITE3_NUM)[0] == 1) {
|
||||||
$keepUnread = $db->prepare('UPDATE item SET is_read = 0 WHERE id = :id');
|
$keepUnread = $db->prepare('UPDATE item SET is_read = 0 WHERE id = :id');
|
||||||
|
@ -39,7 +38,7 @@ $query = $db->prepare(<<<'SQL'
|
||||||
AND feed.user_id = :user
|
AND feed.user_id = :user
|
||||||
SQL);
|
SQL);
|
||||||
$query->bindValue(':id', $_GET['id']);
|
$query->bindValue(':id', $_GET['id']);
|
||||||
$query->bindValue(':user', $_REQUEST[Key::USER_ID]);
|
$query->bindValue(':user', $_SESSION[Key::USER_ID]);
|
||||||
$result = $query->execute();
|
$result = $query->execute();
|
||||||
$item = $result ? $result->fetchArray(SQLITE3_ASSOC) : false;
|
$item = $result ? $result->fetchArray(SQLITE3_ASSOC) : false;
|
||||||
|
|
||||||
|
|
10
src/public/user/log-off.php
Normal file
10
src/public/user/log-off.php
Normal file
|
@ -0,0 +1,10 @@
|
||||||
|
<?php
|
||||||
|
/**
|
||||||
|
* User Log Off Page
|
||||||
|
*/
|
||||||
|
|
||||||
|
include '../../start.php';
|
||||||
|
|
||||||
|
if (array_key_exists(Key::USER_ID, $_SESSION)) session_destroy();
|
||||||
|
|
||||||
|
frc_redirect('/');
|
39
src/public/user/log-on.php
Normal file
39
src/public/user/log-on.php
Normal file
|
@ -0,0 +1,39 @@
|
||||||
|
<?php
|
||||||
|
include '../../start.php';
|
||||||
|
|
||||||
|
$db = Data::getConnection();
|
||||||
|
Security::verifyUser($db, redirectIfAnonymous: false);
|
||||||
|
|
||||||
|
// Users already logged on have no need of this page
|
||||||
|
if (array_key_exists(Key::USER_ID, $_SESSION)) frc_redirect('/');
|
||||||
|
|
||||||
|
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
|
||||||
|
Security::logOnUser($_POST['email'] ?? '', $_POST['password'], $_POST['returnTo'], $db);
|
||||||
|
// If we're still here, something didn't work; preserve the returnTo parameter
|
||||||
|
$_GET['returnTo'] = $_POST['returnTo'];
|
||||||
|
}
|
||||||
|
|
||||||
|
$isSingle = SECURITY_MODEL == Security::SINGLE_USER_WITH_PASSWORD;
|
||||||
|
|
||||||
|
page_head('Log On'); ?>
|
||||||
|
<h1>Log On</h1>
|
||||||
|
<article>
|
||||||
|
<form method=POST action=/user/log-on hx-post=/user/log-on><?php
|
||||||
|
if (($_GET['returnTo'] ?? '') != '') { ?>
|
||||||
|
<input type=hidden name=returnTo value="<?=$_GET['returnTo']?>"><?php
|
||||||
|
}
|
||||||
|
if (!$isSingle) { ?>
|
||||||
|
<label>
|
||||||
|
E-mail Address
|
||||||
|
<input type=email name=email required autofocus>
|
||||||
|
</label><br><?php
|
||||||
|
} ?>
|
||||||
|
<label>
|
||||||
|
Password
|
||||||
|
<input type=password name=password required<?=$isSingle ? ' autofocus' : ''?>>
|
||||||
|
</label><br>
|
||||||
|
<button type=submit>Log On</button>
|
||||||
|
</form>
|
||||||
|
</article><?php
|
||||||
|
page_foot();
|
||||||
|
$db->close();
|
|
@ -14,6 +14,12 @@ require 'user-config.php';
|
||||||
|
|
||||||
Data::ensureDb();
|
Data::ensureDb();
|
||||||
|
|
||||||
|
session_start([
|
||||||
|
'name' => 'FRCSESSION',
|
||||||
|
'use_strict_mode' => true,
|
||||||
|
'cookie_httponly' => true,
|
||||||
|
'cookie_samesite' => 'Strict']);
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Add a message to be displayed at the top of the page
|
* Add a message to be displayed at the top of the page
|
||||||
*
|
*
|
||||||
|
@ -59,20 +65,20 @@ function page_head(string $title): void {
|
||||||
<header>
|
<header>
|
||||||
<a class=title href="/">Feed Reader Central</a>
|
<a class=title href="/">Feed Reader Central</a>
|
||||||
<div><?php
|
<div><?php
|
||||||
if (array_key_exists(Key::USER_ID, $_REQUEST)) {
|
if (array_key_exists(Key::USER_ID, $_SESSION)) {
|
||||||
echo '<a href=/feed?id=new>Add Feed</a>';
|
echo '<a href=/feed?id=new>Add Feed</a> | <a href=/user/log-off>Log Off</a>';
|
||||||
if ($_REQUEST[Key::USER_EMAIL] != 'solouser@example.com') echo " | {$_REQUEST[Key::USER_EMAIL]}";
|
if ($_SESSION[Key::USER_EMAIL] != Security::SINGLE_USER_EMAIL) echo " | {$_SESSION[Key::USER_EMAIL]}";
|
||||||
|
} else {
|
||||||
|
echo '<a href=/user/log-on>Log On</a>';
|
||||||
} ?>
|
} ?>
|
||||||
</div>
|
</div>
|
||||||
</header>
|
</header>
|
||||||
<main hx-target=this><?php
|
<main hx-target=this><?php
|
||||||
if (array_key_exists(Key::USER_MSG, $_REQUEST)) {
|
foreach ($_REQUEST[Key::USER_MSG] ?? [] as $msg) { ?>
|
||||||
foreach ($_REQUEST[Key::USER_MSG] as $msg) { ?>
|
<div>
|
||||||
<div>
|
<?=$msg['level'] == 'INFO' ? '' : "<strong>{$msg['level']}</strong><br>"?>
|
||||||
<?=$msg['level'] == 'INFO' ? '' : "<strong>{$msg['level']}</strong><br>"?>
|
<?=$msg['message']?>
|
||||||
<?=$msg['message']?>
|
</div><?php
|
||||||
</div><?php
|
|
||||||
}
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -81,6 +87,7 @@ function page_head(string $title): void {
|
||||||
*/
|
*/
|
||||||
function page_foot(): void {
|
function page_foot(): void {
|
||||||
?></main></body></html><?php
|
?></main></body></html><?php
|
||||||
|
session_commit();
|
||||||
}
|
}
|
||||||
|
|
||||||
/**
|
/**
|
||||||
|
@ -94,8 +101,8 @@ function frc_redirect(string $value): void {
|
||||||
http_response_code(400);
|
http_response_code(400);
|
||||||
die();
|
die();
|
||||||
}
|
}
|
||||||
header("Location: $value");
|
session_commit();
|
||||||
http_response_code(303);
|
header("Location: $value", true, 303);
|
||||||
die();
|
die();
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
|
@ -11,8 +11,6 @@
|
||||||
* - Security::SINGLE_USER (no e-mail required, does not require a password)
|
* - Security::SINGLE_USER (no e-mail required, does not require a password)
|
||||||
* - Security::SINGLE_USER_WITH_PASSWORD (no e-mail required, does require a password)
|
* - Security::SINGLE_USER_WITH_PASSWORD (no e-mail required, does require a password)
|
||||||
* - Security::MULTI_USER (e-mail and password required for all users)
|
* - Security::MULTI_USER (e-mail and password required for all users)
|
||||||
*
|
|
||||||
* (NOTE THAT ONLY SINGLE_USER IS CURRENTLY IMPLEMENTED)
|
|
||||||
*/
|
*/
|
||||||
const SECURITY_MODEL = Security::SINGLE_USER;
|
const SECURITY_MODEL = Security::SINGLE_USER;
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue
Block a user