diff --git a/controllers/d.users.php b/controllers/d.users.php index d11b996..90434d5 100755 --- a/controllers/d.users.php +++ b/controllers/d.users.php @@ -12,11 +12,10 @@ if(isset($controller->splitted_url[1])) { if (isset($_POST['submit'])) { // PROCESS DATA FROM FORM $user = new User(); - $user->login($_POST['login'], $_POST['password']); - if($user->id != 0) { + if($user->login($_POST['login'], $_POST['password'])) { // SUCESSFULL LOGIN - $_SESSION['userid'] = $user->id; + $_SESSION['userid'] = $user->get_id(); header('Location: '.$_SERVER['HTTP_REFERER']); } else { diff --git a/controllers/d.wiki.php b/controllers/d.wiki.php index 7ec0ef3..f574418 100755 --- a/controllers/d.wiki.php +++ b/controllers/d.wiki.php @@ -6,8 +6,8 @@ $head['css'] = "d.index.css;d.wiki.css"; $wikiPage = new WikiPage(); // Page doesn't exists -if(isset($controller->splitted_url[1]) && !$wikiPage->checkUrl($controller->splitted_url[1],$user->role >= 600) && $controller->splitted_url[1]!="") { - if($user->role >= 800) { +if(isset($controller->splitted_url[1]) && !$wikiPage->checkUrl($controller->splitted_url[1],$user->rank_is_higher('premium')) && $controller->splitted_url[1]!="") { + if($user->rank_is_higher('moderator')) { // Create new page if(isset($_POST['submit'])) { $wikiPage->content = $_POST['content']; @@ -27,8 +27,8 @@ if(isset($controller->splitted_url[1]) && !$wikiPage->checkUrl($controller->spli } } // Page exists -else if(isset($controller->splitted_url[1]) && $wikiPage->checkUrl($controller->splitted_url[1],$user->role >= 600)) { - if (isset($controller->splitted_url[2]) && $controller->splitted_url[2]=="edit" && $user->role >= 800) { +else if(isset($controller->splitted_url[1]) && $wikiPage->checkUrl($controller->splitted_url[1],$user->rank_is_higher('premium'))) { + if (isset($controller->splitted_url[2]) && $controller->splitted_url[2]=="edit" && $user->rank_is_higher('administrator')) { // Edit page if(isset($_POST['submit'])) { $wikiPage->content = $_POST['content']; @@ -43,13 +43,13 @@ else if(isset($controller->splitted_url[1]) && $wikiPage->checkUrl($controller-> $head['title'] = $wikiPage->title; include ($config['views_folder']."d.wiki.edit.html"); } - } else if (isset($controller->splitted_url[2]) && $controller->splitted_url[2]=="delete" && $user->role >= 800) { + } else if (isset($controller->splitted_url[2]) && $controller->splitted_url[2]=="delete" && $user->rank_is_higher('moderator')) { // Delete page $wikiPage->delete(); header('Location: '.$config['rel_root_folder']."wiki/".$wikiPage->url); } else { // Display page - if($user->role >= 600) { + if($user->rank_is_higher('premium')) { $wikiHistory = new WikiPages(); $wikiHistory->getHistory($controller->splitted_url[1]); @@ -62,7 +62,7 @@ else if(isset($controller->splitted_url[1]) && $wikiPage->checkUrl($controller-> } } if (isset($controller->splitted_url[2]) && is_numeric($controller->splitted_url[2])) - $wikiPage->checkUrl($controller->splitted_url[1],$user->role>=600, $controller->splitted_url[2]); + $wikiPage->checkUrl($controller->splitted_url[1], $user->rank_is_higher('premium'), $controller->splitted_url[2]); $wikiPage->md2html(); $head['title'] = $wikiPage->title; diff --git a/includes/session.php b/includes/session.php index e14642b..69a4f7f 100755 --- a/includes/session.php +++ b/includes/session.php @@ -6,11 +6,11 @@ ini_set("session.cookie_lifetime",60*60*24*30); session_start(); $user = new User(); -$user->role == 0; // All users are visitors +$user->rank == 'visitor'; // All users are visitors if(isset($_SESSION['userid'])) { $user->checkID($_SESSION['userid']); - if ($user->id != 0) { + if ($user->get_id() != 0) { $user->updateLoginDate(); $user->populate(); setlocale(LC_ALL, $config['locales'][$user->locale][4]); diff --git a/models/d.users.php b/models/d.users.php index bc742e4..ec03d75 100755 --- a/models/d.users.php +++ b/models/d.users.php @@ -10,16 +10,19 @@ class User { - public $id = 0; - public $name = NULL; - public $avatar = NULL; - public $locale = NULL; - public $role = NULL; - public $lastlogin = NULL; - public $mail = NULL; - public $website = NULL; - public $password = NULL; - public $registered = NULL; + private $id = 0; + public $name = NULL; + private $version = NULL; + public $email = NULL; + private $password = NULL; + public $website = NULL; + private $is_avatar_present = NULL; + private $is_archive = NULL; + public $rank = NULL; + private $locale = NULL; + private $timezone = NULL; + private $visit_date = NULL; + private $register_date = NULL; /***** ** Connect to correct account using ID and stores its ID @@ -30,7 +33,7 @@ class User $con = pg_connect("host=".$config['SQL_host']." dbname=".$config['SQL_db']." user=".$config['SQL_user']." password=".$config['SQL_pass']) or die ("Could not connect to server\n"); - $query = "SELECT id FROM users WHERE id=$1"; + $query = "SELECT * FROM users WHERE id=$1"; pg_prepare($con, "prepare1", $query) or die ("Cannot prepare statement\n"); @@ -40,13 +43,15 @@ class User pg_close($con); if(pg_num_rows($result) == 1) { - $this->id = $id; + $row = pg_fetch_assoc($result); + $this->populate($row); return 1; } else { return 0; } } + /***** ** Connect to correct account using user/pass and stores its ID *****/ @@ -56,7 +61,7 @@ class User $con = pg_connect("host=".$config['SQL_host']." dbname=".$config['SQL_db']." user=".$config['SQL_user']." password=".$config['SQL_pass']) or die ("Could not connect to server\n"); - $query = "SELECT id FROM users WHERE name=$1 AND password=$2"; + $query = "SELECT * FROM users WHERE name=$1 AND password=$2"; pg_prepare($con, "prepare1", $query) or die ("Cannot prepare statement\n"); @@ -66,44 +71,73 @@ class User pg_close($con); if(pg_num_rows($result) == 1) { - $user = pg_fetch_assoc($result); - $this->id = $user['id']; + $row = pg_fetch_assoc($result); + $this->populate($row); + return 1; } } + /***** - ** Populate the object using its ID + ** Populate the object using raw data from SQL *****/ - public function populate() { - global $config; - - if($this->id != 0) { - $con = pg_connect("host=".$config['SQL_host']." dbname=".$config['SQL_db']." user=".$config['SQL_user']." password=".$config['SQL_pass']) - or die ("Could not connect to server\n"); + private function populate($row) { + $this->name = $row['name']; + $this->version = $row['version']; + $this->email = $row['email']; + $this->password = $row['password']; + $this->website = $row['website']; + $this->is_avatar_present = $row['is_avatar_present']; + $this->is_archive = $row['is_archive']; + $this->rank = $row['rank']; + $this->locale = $row['locale']; + $this->timezone = $row['timezone']; + $this->visit_date = $row['visit_date']; + $this->register_date = $row['register_date']; + } - $query = "SELECT * FROM users WHERE id=$1"; + /***** + ** Populate the object using raw data from SQL + *****/ + public function get_id() { + return $this->id; + } - pg_prepare($con, "prepare1", $query) - or die ("Cannot prepare statement\n"); - $result = pg_execute($con, "prepare1", array($this->id)) - or die ("Cannot execute statement\n"); - - pg_close($con); - - $user = pg_fetch_assoc($result); - - $this->name = $user['name']; - $this->avatar = $user['avatar']; - $this->locale = $user['locale']; - $this->role = $user['role']; - $this->lastlogin = $user['lastlogin']; - $this->mail = $user['mail']; - $this->website = $user['website']; - $this->registered = $user['registered']; + public function rank_is_higher($rank) { + if( $rank == 'blocked' ) { + return true; + } + else if( $rank == 'visitor' ) { + if( $this->rank == 'blocked' ) + return false; + else + return true; + } + else if( $rank == 'registered' ) { + if( $this->rank == 'blocked' || $this->rank == 'visitor' ) + return false; + else + return true; + } + else if( $rank == 'premium' ) { + if( $this->rank == 'premium' || $this->rank == 'moderator' || $this->rank == 'administrator' ) + return true; + else + return false; + } + else if( $rank == 'moderator' ) { + if( $this->rank == 'moderator' || $this->rank == 'administrator' ) + return true; + else + return false; } else { - die("Cannot populate an User without ID"); + if( $this->rank == 'administrator' ) + return true; + else + return false; } } + /***** ** Checks if the user's name is available or not *****/ diff --git a/views/blocks/d.nav.html b/views/blocks/d.nav.html index 52135a2..d0b9a80 100755 --- a/views/blocks/d.nav.html +++ b/views/blocks/d.nav.html @@ -18,7 +18,7 @@