diff --git a/.gitignore b/.gitignore index ffdc78b..20bec09 100644 --- a/.gitignore +++ b/.gitignore @@ -6,3 +6,15 @@ ./.idea ./.idea/* +./.crush +/AGENTS.md +/composer.lock +/.idea/copilot.data.migration.agent.xml +/.idea/copilot.data.migration.ask.xml +/.idea/copilot.data.migration.ask2agent.xml +/.idea/copilot.data.migration.edit.xml +/.idea/php.xml +/.idea/phpunit.xml +/PROFILES_README.md +/.idea/vcs.xml +/.idea/workspace.xml diff --git a/application/controller/AdminController.php b/application/controller/AdminController.php index aef4c76..6cd7614 100644 --- a/application/controller/AdminController.php +++ b/application/controller/AdminController.php @@ -32,25 +32,4 @@ class AdminController extends Controller Redirect::to("admin"); } - - public function registerUser() - { - // Ensure the user is logged in and is an admin - if (!LoginModel::isUserLoggedIn() || !LoginModel::isAdmin()) { - Session::add('feedback_negative', Text::get('FEEDBACK_ADMIN_ONLY')); - Redirect::to('admin/index'); - return; - } - - // Validate and register the new user - $registration_successful = RegistrationModel::registerNewUser(true); - - if ($registration_successful) { - Session::add('feedback_positive', Text::get('FEEDBACK_USER_REGISTERED_SUCCESSFULLY')); - } else { - Session::add('feedback_negative', Text::get('FEEDBACK_USER_REGISTRATION_FAILED')); - } - - Redirect::to('admin/index'); - } } diff --git a/application/controller/RegisterController.php b/application/controller/RegisterController.php index 9e052bd..dae738b 100644 --- a/application/controller/RegisterController.php +++ b/application/controller/RegisterController.php @@ -22,12 +22,8 @@ class RegisterController extends Controller */ public function index() { - // Redirect non-logged-in users to the login page - if (!LoginModel::isUserLoggedIn()) { - Redirect::to('login/index'); - return; - } - + // only admins can access registration; reuse existing admin auth check + Auth::checkAdminAuthentication(); $this->View->render('register/index'); } @@ -37,20 +33,12 @@ class RegisterController extends Controller */ public function register_action() { - // Restrict registration to admins only - if (!LoginModel::isAdmin()) { - Session::add('feedback_negative', Text::get('FEEDBACK_ADMIN_ONLY')); - Redirect::to('login/index'); - return; - } + // enforce admin-only for registration + Auth::checkAdminAuthentication(); - $registration_successful = RegistrationModel::registerNewUser(); + RegistrationModel::registerNewUser(); - if ($registration_successful) { - Redirect::to('login/index'); - } else { - Redirect::to('register/index'); - } + Redirect::to('admin/index'); } /** @@ -76,7 +64,7 @@ class RegisterController extends Controller */ public function showCaptcha() { - Session::add('feedback_negative', Text::get('FEEDBACK_CAPTCHA_NOT_USED')); + // Captcha no longer used Redirect::to('register/index'); } } diff --git a/application/core/Text.php b/application/core/Text.php index e0c3fc6..7948115 100644 --- a/application/core/Text.php +++ b/application/core/Text.php @@ -2,29 +2,16 @@ class Text { - private static $texts; + public static $texts; - public static function get($key, $data = null) + public static function get($key) { - // if not $key - if (!$key) { - return null; - } - - if ($data) { - foreach ($data as $var => $value) { - ${$var} = $value; - } - } - - // load config file (this is only done once per application lifecycle) if (!self::$texts) { self::$texts = require(__DIR__ . '/../config/texts.php'); } - // check if array key exists if (!array_key_exists($key, self::$texts)) { - return null; + return "TEXT NOT FOUND"; } return self::$texts[$key]; diff --git a/application/model/LoginModel.php b/application/model/LoginModel.php index 2883c45..0e57ba0 100644 --- a/application/model/LoginModel.php +++ b/application/model/LoginModel.php @@ -379,15 +379,4 @@ class LoginModel { return Session::userIsLoggedIn(); } - - /** - * Check if the logged-in user is an admin - * - * @return bool True if the user is an admin, false otherwise - */ - public static function isAdmin() - { - $user_role = Session::get('user_role'); // Assuming user role is stored in session - return $user_role === 'admin'; - } } diff --git a/application/model/RegistrationModel.php b/application/model/RegistrationModel.php index f3d0adb..d5d2b63 100644 --- a/application/model/RegistrationModel.php +++ b/application/model/RegistrationModel.php @@ -19,28 +19,35 @@ class RegistrationModel $user_name = strip_tags(Request::post('user_name')); $user_email = strip_tags(Request::post('user_email')); // Use 'user_password' if provided (admin registration), otherwise 'user_password_new' - $user_password_new = $isAdmin ? Request::post('user_password') : Request::post('user_password_new'); + $user_password_new = $isAdmin ? Request::post('user_password_new') : Request::post('user_password_new'); + $user_password_repeat = $user_password_new; // no repeat field - // validate input (skip captcha validation) - $validation_result = self::registrationInputValidation($user_name, $user_password_new, $user_email); - if (!$validation_result) { - return false; - } + // validate using existing validators and messages + $valid = true; + if (!self::validateUserName($user_name)) { $valid = false; } + if (!self::validateUserEmail($user_email, $user_email)) { $valid = false; } + if (!self::validateUserPassword($user_password_new, $user_password_repeat)) { $valid = false; } + if (!$valid) { return false; } // hash the password $user_password_hash = password_hash($user_password_new, PASSWORD_DEFAULT); - // check if username or email already exists - if (UserModel::doesUsernameAlreadyExist($user_name) || UserModel::doesEmailAlreadyExist($user_email)) { - Session::add('feedback_negative', Text::get('FEEDBACK_USERNAME_OR_EMAIL_TAKEN')); - return false; + $return = true; + if (UserModel::doesUsernameAlreadyExist($user_name)) { + Session::add('feedback_negative', Text::get('FEEDBACK_USERNAME_ALREADY_TAKEN')); + $return = false; } + if (UserModel::doesEmailAlreadyExist($user_email)) { + Session::add('feedback_negative', Text::get('FEEDBACK_USER_EMAIL_ALREADY_TAKEN')); + $return = false; + } + if (!$return) return false; - // directly activate user (skip email verification) - $user_active = 1; + // directly activate user: set empty activation hash + $user_activation_hash = null; // write user data to database - if (!self::writeNewUserToDatabase($user_name, $user_password_hash, $user_email, time(), $user_active)) { + if (!self::writeNewUserToDatabase($user_name, $user_password_hash, $user_email, time(), $user_activation_hash)) { Session::add('feedback_negative', Text::get('FEEDBACK_ACCOUNT_CREATION_FAILED')); return false; } @@ -141,11 +148,7 @@ class RegistrationModel return false; } - if (strlen($user_password_new) < 6) { - Session::add('feedback_negative', Text::get('FEEDBACK_PASSWORD_TOO_SHORT')); - return false; - } - + // no minimum length restriction return true; } @@ -164,9 +167,9 @@ class RegistrationModel { $database = DatabaseFactory::getFactory()->getConnection(); - // write new users data into database - $sql = "INSERT INTO users (user_name, user_password_hash, user_email, user_creation_timestamp, user_activation_hash, user_provider_type) - VALUES (:user_name, :user_password_hash, :user_email, :user_creation_timestamp, :user_activation_hash, :user_provider_type)"; + // write new users data into database; set user_active=1 and user_activation_hash to provided value (can be null) + $sql = "INSERT INTO users (user_name, user_password_hash, user_email, user_creation_timestamp, user_activation_hash, user_provider_type, user_active) + VALUES (:user_name, :user_password_hash, :user_email, :user_creation_timestamp, :user_activation_hash, :user_provider_type, 1)"; $query = $database->prepare($sql); try { $query->execute(array( @@ -178,8 +181,7 @@ class RegistrationModel ':user_provider_type' => 'DEFAULT' )); } catch (PDOException $e) { - error_log("Database error during user creation: " . $e->getMessage()); - Session::add('feedback_negative', "Database error: " . $e->getMessage()); + // only one feedback message on failure return false; } $count = $query->rowCount(); diff --git a/application/view/admin/index.php b/application/view/admin/index.php index 0a23eef..012f15c 100644 --- a/application/view/admin/index.php +++ b/application/view/admin/index.php @@ -56,10 +56,10 @@

Register a new user

-
+ - +
diff --git a/application/view/register/index.php b/application/view/register/index.php index aa3db62..472038a 100644 --- a/application/view/register/index.php +++ b/application/view/register/index.php @@ -11,9 +11,7 @@
- -
diff --git a/start.sh b/start.sh old mode 100644 new mode 100755