diff --git a/api/_auth.php b/api/_auth.php index f83bd7c..3a47c82 100644 --- a/api/_auth.php +++ b/api/_auth.php @@ -1,4 +1,7 @@ bind_param("s", $_SESSION["userid"]); $s->execute(); if (!(bool)$s->get_result()->fetch_assoc()) { // If not, then destroy session - EndSession(); - echo "user id does not exist"; + AUTH_EndSession(); die("user id used in session does not exist"); } $LOGGED_IN = true; @@ -48,7 +50,7 @@ if (session_status() === PHP_SESSION_ACTIVE && isset($_SESSION["userid"])) { // if ($Config["debug"] && isset($_REQUEST["debug"])) { // If there are not any session and debug mode is on // ATTENTION: FOR DEBUG PURPOSES ONLY! if ($_REQUEST["debug"] == "drop") { - EndSession(); + AUTH_EndSession(); die("session discarded"); } $_SESSION["userid"] = intval($_REQUEST["debug"]); diff --git a/api/_config.php b/api/_config.php index 7970844..7c94eb5 100644 --- a/api/_config.php +++ b/api/_config.php @@ -1,4 +1,7 @@ - \ No newline at end of file +?> diff --git a/api/_db.php b/api/_db.php index e773256..868e429 100644 --- a/api/_db.php +++ b/api/_db.php @@ -1,4 +1,7 @@ - $result->GetData()]); } } diff --git a/api/user/index.php b/api/user/index.php index fc1576e..a253fea 100644 --- a/api/user/index.php +++ b/api/user/index.php @@ -1,4 +1,7 @@ -GetData()) { // User himself and mods can see additional info + // User himself and mods can see additional info + if ($id === $THIS_USER) { $result["email"] = $d["email"]; $result["invite_id"] = $d["invite_id"]; + } elseif ($LOGGED_IN) { + if (User_IsMod($THIS_USER)->GetData()) { + $result["email"] = $d["email"]; + $result["invite_id"] = $d["invite_id"]; + } } return new ReturnT(data: $result); diff --git a/api/user/login.php b/api/user/login.php new file mode 100644 index 0000000..11f7417 --- /dev/null +++ b/api/user/login.php @@ -0,0 +1,89 @@ +prepare("SELECT * FROM users WHERE login = ?"); + $s->bind_param("s", $login); + $s->execute(); + $d = $s->get_result()->fetch_assoc(); + + // Wrong login + if (!(bool)$d) + return new ReturnT(err_code: E_AUT_WRONGCREDS, err_desc: "wrong login or password"); + + $suppl_pwd_hash = hash("sha256", $password . $d["salt"], true); + $real_pwd_hash = $d["password_hash"]; + + // Wrong password + if ($suppl_pwd_hash !== $real_pwd_hash) + return new ReturnT(err_code: E_AUT_WRONGCREDS, err_desc: "wrong login or password"); + + // Actions + + $_SESSION["userid"] = $d["id"]; + $THIS_USER = $d["id"]; + + return new ReturnT(data: true); +} + + + +if (Utils_ThisFileIsRequested(__FILE__)) { + require_once("../_json.php"); + + // HACK: for debugging purposes. Will be removed later + if ($Config["debug"]) + $_POST = $_REQUEST; + + // Log into account + $result = User_Login_Method($_POST); + + // Checking result + if ($result->IsError()) + $result->ThrowJSONError(); + else + JSON_ReturnData(["success" => $result->GetData()]); +} + +?> \ No newline at end of file diff --git a/front/footer.php b/front/footer.php index 265cc07..eba89fb 100644 --- a/front/footer.php +++ b/front/footer.php @@ -1,9 +1,9 @@