feat(groups): user_groups lookup, admin assignment UI, public directory with DataTables

Now including start.sh to start a php server using the router.php so no webserver is needed.

.gitignore

@@ -6,3 +6,15 @@
 
 ./.idea 
 ./.idea/*
+./.crush
+/AGENTS.md
+/composer.lock
+/.idea/copilot.data.migration.agent.xml
+/.idea/copilot.data.migration.ask.xml
+/.idea/copilot.data.migration.ask2agent.xml
+/.idea/copilot.data.migration.edit.xml
+/.idea/php.xml
+/.idea/phpunit.xml
+/PROFILES_README.md
+/.idea/vcs.xml
+/.idea/workspace.xml

application/_installation/04-create-table-user-groups.sql

@@ -0,0 +1,15 @@
+CREATE TABLE IF NOT EXISTS `huge`.`user_groups` (
+  `group_id` TINYINT(1) NOT NULL COMMENT 'numeric user group id, matches users.user_account_type',
+  `group_name` VARCHAR(64) COLLATE utf8_unicode_ci NOT NULL COMMENT 'human readable group name',
+  PRIMARY KEY (`group_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8 COLLATE=utf8_unicode_ci COMMENT='user groups lookup';
+
+INSERT INTO `huge`.`user_groups` (`group_id`, `group_name`) VALUES
+  (1, 'Gast'),
+  (2, 'Benutzer'),
+  (3, 'Gruppe 3'),
+  (4, 'Gruppe 4'),
+  (5, 'Gruppe 5'),
+  (6, 'Gruppe 6'),
+  (7, 'Admin')
+ON DUPLICATE KEY UPDATE `group_name` = VALUES(`group_name`);

application/config/texts.php

@@ -38,7 +38,7 @@ return array(
     "FEEDBACK_PASSWORD_REPEAT_WRONG" => "Password and password repeat are not the same.",
     "FEEDBACK_PASSWORD_TOO_SHORT" => "Password has a minimum length of 6 characters.",
     "FEEDBACK_USERNAME_TOO_SHORT_OR_TOO_LONG" => "Username cannot be shorter than 2 or longer than 64 characters.",
-    "FEEDBACK_ACCOUNT_SUCCESSFULLY_CREATED" => "Your account has been created successfully and we have sent you an email. Please click the VERIFICATION LINK within that mail.",
+    "FEEDBACK_ACCOUNT_SUCCESSFULLY_CREATED" => "The account has been created successfully.",
     "FEEDBACK_VERIFICATION_MAIL_SENDING_FAILED" => "Sorry, we could not send you an verification mail. Your account has NOT been created.",
     "FEEDBACK_ACCOUNT_CREATION_FAILED" => "Sorry, your registration failed. Please go back and try again.",
     "FEEDBACK_VERIFICATION_MAIL_SENDING_ERROR" => "Verification mail could not be sent due to: ",

application/controller/AdminController.php

@@ -20,7 +20,9 @@ class AdminController extends Controller
     public function index()
     {
         $this->View->render('admin/index', array(
-                'users' => UserModel::getPublicProfilesOfAllUsers())
+                'users' => UserModel::getPublicProfilesOfAllUsers(),
+                'groups' => GroupModel::getAllGroups()
+            )
         );
     }
 
@@ -32,4 +34,10 @@ class AdminController extends Controller
 
         Redirect::to("admin");
     }
+
+    public function changeUserGroup()
+    {
+        GroupModel::setUserGroup(Request::post('user_id'), Request::post('group_id'));
+        Redirect::to("admin");
+    }
 }

application/controller/DirectoryController.php

@@ -0,0 +1,16 @@
+<?php
+
+class DirectoryController extends Controller
+{
+    public function __construct()
+    {
+        parent::__construct();
+    }
+
+    public function index()
+    {
+        $this->View->render('directory/index', [
+            'users' => UserModel::getUsersWithGroups()
+        ]);
+    }
+}

application/controller/RegisterController.php

@@ -22,11 +22,9 @@ class RegisterController extends Controller
      */
     public function index()
     {
-        if (LoginModel::isUserLoggedIn()) {
+        // only admins can access registration; reuse existing admin auth check
-            Redirect::home();
+        Auth::checkAdminAuthentication();
-        } else {
+        $this->View->render('register/index');
-            $this->View->render('register/index');
-        }
     }
 
     /**
@@ -35,13 +33,12 @@ class RegisterController extends Controller
      */
     public function register_action()
     {
-        $registration_successful = RegistrationModel::registerNewUser();
+        // enforce admin-only for registration
+        Auth::checkAdminAuthentication();
 
-        if ($registration_successful) {
+        RegistrationModel::registerNewUser();
-            Redirect::to('login/index');
+
-        } else {
+        Redirect::to('admin/index');
-            Redirect::to('register/index');
-        }
     }
 
     /**
@@ -62,13 +59,12 @@ class RegisterController extends Controller
     /**
      * Generate a captcha, write the characters into $_SESSION['captcha'] and returns a real image which will be used
      * like this: <img src="......./login/showCaptcha" />
-     * IMPORTANT: As this action is called via <img ...> AFTER the real application has finished executing (!), the
+     *
-     * SESSION["captcha"] has no content when the application is loaded. The SESSION["captcha"] gets filled at the
+     * This method is now deprecated as Captcha is no longer used in the registration process.
-     * moment the end-user requests the <img .. >
-     * Maybe refactor this sometime.
      */
     public function showCaptcha()
     {
-        CaptchaModel::generateAndShowCaptcha();
+        // Captcha no longer used
+        Redirect::to('register/index');
     }
 }

application/core/Config.php

@@ -2,14 +2,13 @@
 
 class Config
 {
-    // this is public to allow better Unit Testing
     public static $config;
 
     public static function get($key)
     {
         if (!self::$config) {
 
-            $config_file = '../application/config/config.' . Environment::get() . '.php';
+            $config_file = __DIR__ . '/../config/config.' . Environment::get() . '.php';
 
             if (!file_exists($config_file)) {
                 return false;

application/core/DatabaseFactory.php

@@ -21,44 +21,76 @@
  */
 class DatabaseFactory
 {
-    private static $factory;
+  private static $factory;
-    private $database;
+  private $database;
 
-    public static function getFactory()
+  public static function getFactory()
-    {
+  {
-        if (!self::$factory) {
+    if (!self::$factory) {
-            self::$factory = new DatabaseFactory();
+      self::$factory = new DatabaseFactory();
-        }
+    }
-        return self::$factory;
+    return self::$factory;
+  }
+
+  public function getConnectionWithMySQLI()
+  {
+    if (!$this->database) {
+      // Throw exceptions and prevent also throwing credentials.
+      mysqli_report(MYSQLI_REPORT_ERROR | MYSQLI_REPORT_STRICT);
+
+      try {
+        $host = Config::get('DB_HOST');
+        $user = Config::get('DB_USER');
+        $pass = Config::get('DB_PASS');
+        $name = Config::get('DB_NAME');
+        $port = (int) Config::get('DB_PORT');
+        $charset = Config::get('DB_CHARSET') ? Config::get('DB_CHARSET') : 'utf8mb4';
+
+        $this->database = new mysqli($host, $user, $pass, $name, $port);
+
+        // Set charset (important for security + correct encoding)
+        $this->database->set_charset($charset);
+      } catch (mysqli_sql_exception $e) {
+        echo 'Database connection can not be estabilished. Please try again later.' . '<br>';
+        echo 'Error code: ' . $e->getCode();
+        exit;
+      }
     }
 
-    public function getConnection() {
+    return $this->database;
-        if (!$this->database) {
+  }
 
-            /**
+  public function getConnection()
-             * Check DB connection in try/catch block. Also when PDO is not constructed properly,
+  {
-             * prevent to exposing database host, username and password in plain text as:
+    if (!$this->database) {
-             * PDO->__construct('mysql:host=127....', 'root', '12345678', Array)
-             * by throwing custom error message
-             */
-            try {
-                $options = array(PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_OBJ, PDO::ATTR_ERRMODE => PDO::ERRMODE_WARNING);
-                $this->database = new PDO(
-                   Config::get('DB_TYPE') . ':host=' . Config::get('DB_HOST') . ';dbname=' .
-                   Config::get('DB_NAME') . ';port=' . Config::get('DB_PORT') . ';charset=' . Config::get('DB_CHARSET'),
-                   Config::get('DB_USER'), Config::get('DB_PASS'), $options
-                   );
-            } catch (PDOException $e) {
 
-                // Echo custom message. Echo error code gives you some info.
+      /**
-                echo 'Database connection can not be estabilished. Please try again later.' . '<br>';
+       * Check DB connection in try/catch block. Also when PDO is not constructed properly,
-                echo 'Error code: ' . $e->getCode();
+       * prevent to exposing database host, username and password in plain text as:
+       * PDO->__construct('mysql:host=127....', 'root', '12345678', Array)
+       * by throwing custom error message
+       */
+      try {
+        $options = array(PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_OBJ, PDO::ATTR_ERRMODE => PDO::ERRMODE_WARNING);
+        $this->database = new PDO(
+          Config::get('DB_TYPE') . ':host=' . Config::get('DB_HOST') . ';dbname=' .
+            Config::get('DB_NAME') . ';port=' . Config::get('DB_PORT') . ';charset=' . Config::get('DB_CHARSET'),
+          Config::get('DB_USER'),
+          Config::get('DB_PASS'),
+          $options
+        );
+      } catch (PDOException $e) {
 
-                // Stop application :(
+        // Echo custom message. Echo error code gives you some info.
-                // No connection, reached limit connections etc. so no point to keep it running
+        echo 'Database connection can not be estabilished. Please try again later.' . '<br>';
-                exit;
+        echo 'Error code: ' . $e->getCode();
-            }
+
-        }
+        // Stop application :(
-        return $this->database;
+        // No connection, reached limit connections etc. so no point to keep it running
+        exit;
+      }
     }
+
+    return $this->database;
+  }
 }

application/core/Text.php

@@ -2,29 +2,16 @@
 
 class Text
 {
-    private static $texts;
+    public static $texts;
 
-    public static function get($key, $data = null)
+    public static function get($key)
     {
-        // if not $key
-        if (!$key) {
-            return null;
-        }
-
-        if ($data) {
-            foreach ($data as $var => $value) {
-                ${$var} = $value;
-            }
-        }
-
-        // load config file (this is only done once per application lifecycle)
         if (!self::$texts) {
-            self::$texts = require('../application/config/texts.php');
+            self::$texts = require(__DIR__ . '/../config/texts.php');
         }
 
-        // check if array key exists
         if (!array_key_exists($key, self::$texts)) {
-            return null;
+            return "TEXT NOT FOUND";
         }
 
         return self::$texts[$key];

application/model/GroupModel.php

@@ -0,0 +1,54 @@
+<?php
+
+class GroupModel
+{
+    public static function getAllGroups()
+    {
+        $database = DatabaseFactory::getFactory()->getConnection();
+        $sql = "SELECT group_id, group_name FROM user_groups ORDER BY group_id";
+        $query = $database->prepare($sql);
+        $query->execute();
+        return $query->fetchAll();
+    }
+
+    public static function getGroupNameById($group_id)
+    {
+        $database = DatabaseFactory::getFactory()->getConnection();
+        $sql = "SELECT group_name FROM user_groups WHERE group_id = :gid LIMIT 1";
+        $query = $database->prepare($sql);
+        $query->execute(array(':gid' => $group_id));
+        $row = $query->fetch();
+        return $row ? $row->group_name : null;
+    }
+
+    public static function setUserGroup($userId, $groupId)
+    {
+        if (!is_numeric($userId) || !is_numeric($groupId)) {
+            return false;
+        }
+
+        // Do not allow changing own group via admin UI to prevent lockout
+        if ((int)$userId === (int)Session::get('user_id')) {
+            Session::add('feedback_negative', Text::get('FEEDBACK_ACCOUNT_CANT_DELETE_SUSPEND_OWN'));
+            return false;
+        }
+
+        // Only allow groups that exist in lookup
+        $database = DatabaseFactory::getFactory()->getConnection();
+        $check = $database->prepare("SELECT 1 FROM user_groups WHERE group_id = :gid LIMIT 1");
+        $check->execute([':gid' => $groupId]);
+        if ($check->rowCount() !== 1) {
+            return false;
+        }
+
+        $query = $database->prepare("UPDATE users SET user_account_type = :gid WHERE user_id = :uid LIMIT 1");
+        $query->execute([':gid' => $groupId, ':uid' => $userId]);
+
+        if ($query->rowCount() === 1) {
+            Session::add('feedback_positive', 'Benutzergruppe aktualisiert.');
+            return true;
+        }
+
+        return false;
+    }
+}

application/model/NoteModel.php

@@ -6,115 +6,114 @@
  */
 class NoteModel
 {
-    /**
+  /**
-     * Get all notes (notes are just example data that the user has created)
+   * Get all notes (notes are just example data that the user has created)
-     * @return array an array with several objects (the results)
+   * @return array an array with several objects (the results)
-     */
+   */
-    public static function getAllNotes()
+  public static function getAllNotes()
-    {
+  {
-        $database = DatabaseFactory::getFactory()->getConnection();
+    $database = DatabaseFactory::getFactory()->getConnection();
 
-        $sql = "SELECT user_id, note_id, note_text FROM notes WHERE user_id = :user_id";
+    $sql = "SELECT user_id, note_id, note_text FROM notes WHERE user_id = :user_id";
-        $query = $database->prepare($sql);
+    $query = $database->prepare($sql);
-        $query->execute(array(':user_id' => Session::get('user_id')));
+    $query->execute(array(':user_id' => Session::get('user_id')));
 
-        // fetchAll() is the PDO method that gets all result rows
+    // fetchAll() is the PDO method that gets all result rows
-        return $query->fetchAll();
+    return $query->fetchAll();
+  }
+
+  /**
+   * Get a single note
+   * @param int $note_id id of the specific note
+   * @return object a single object (the result)
+   */
+  public static function getNote($note_id)
+  {
+    $database = DatabaseFactory::getFactory()->getConnectionWithMySQLI();
+
+    $sql = "SELECT user_id, note_id, note_text FROM notes WHERE user_id = :user_id AND note_id = :note_id LIMIT 1";
+    $query = $database->prepare($sql);
+    $query->execute(array(':user_id' => Session::get('user_id'), ':note_id' => $note_id));
+
+    return $query;
+  }
+
+  /**
+   * Set a note (create a new one)
+   * @param string $note_text note text that will be created
+   * @return bool feedback (was the note created properly ?)
+   */
+  public static function createNote($note_text)
+  {
+    if (!$note_text || strlen($note_text) == 0) {
+      Session::add('feedback_negative', Text::get('FEEDBACK_NOTE_CREATION_FAILED'));
+      return false;
     }
 
-    /**
+    $database = DatabaseFactory::getFactory()->getConnection();
-     * Get a single note
-     * @param int $note_id id of the specific note
-     * @return object a single object (the result)
-     */
-    public static function getNote($note_id)
-    {
-        $database = DatabaseFactory::getFactory()->getConnection();
 
-        $sql = "SELECT user_id, note_id, note_text FROM notes WHERE user_id = :user_id AND note_id = :note_id LIMIT 1";
+    $sql = "INSERT INTO notes (note_text, user_id) VALUES (:note_text, :user_id)";
-        $query = $database->prepare($sql);
+    $query = $database->prepare($sql);
-        $query->execute(array(':user_id' => Session::get('user_id'), ':note_id' => $note_id));
+    $query->execute(array(':note_text' => $note_text, ':user_id' => Session::get('user_id')));
 
-        // fetch() is the PDO method that gets a single result
+    if ($query->rowCount() == 1) {
-        return $query->fetch();
+      return true;
     }
 
-    /**
+    // default return
-     * Set a note (create a new one)
+    Session::add('feedback_negative', Text::get('FEEDBACK_NOTE_CREATION_FAILED'));
-     * @param string $note_text note text that will be created
+    return false;
-     * @return bool feedback (was the note created properly ?)
+  }
-     */
-    public static function createNote($note_text)
-    {
-        if (!$note_text || strlen($note_text) == 0) {
-            Session::add('feedback_negative', Text::get('FEEDBACK_NOTE_CREATION_FAILED'));
-            return false;
-        }
 
-        $database = DatabaseFactory::getFactory()->getConnection();
+  /**
-
+   * Update an existing note
-        $sql = "INSERT INTO notes (note_text, user_id) VALUES (:note_text, :user_id)";
+   * @param int $note_id id of the specific note
-        $query = $database->prepare($sql);
+   * @param string $note_text new text of the specific note
-        $query->execute(array(':note_text' => $note_text, ':user_id' => Session::get('user_id')));
+   * @return bool feedback (was the update successful ?)
-
+   */
-        if ($query->rowCount() == 1) {
+  public static function updateNote($note_id, $note_text)
-            return true;
+  {
-        }
+    if (!$note_id || !$note_text) {
-
+      return false;
-        // default return
-        Session::add('feedback_negative', Text::get('FEEDBACK_NOTE_CREATION_FAILED'));
-        return false;
     }
 
-    /**
+    $database = DatabaseFactory::getFactory()->getConnection();
-     * Update an existing note
-     * @param int $note_id id of the specific note
-     * @param string $note_text new text of the specific note
-     * @return bool feedback (was the update successful ?)
-     */
-    public static function updateNote($note_id, $note_text)
-    {
-        if (!$note_id || !$note_text) {
-            return false;
-        }
 
-        $database = DatabaseFactory::getFactory()->getConnection();
+    $sql = "UPDATE notes SET note_text = :note_text WHERE note_id = :note_id AND user_id = :user_id LIMIT 1";
+    $query = $database->prepare($sql);
+    $query->execute(array(':note_id' => $note_id, ':note_text' => $note_text, ':user_id' => Session::get('user_id')));
 
-        $sql = "UPDATE notes SET note_text = :note_text WHERE note_id = :note_id AND user_id = :user_id LIMIT 1";
+    if ($query->rowCount() == 1) {
-        $query = $database->prepare($sql);
+      return true;
-        $query->execute(array(':note_id' => $note_id, ':note_text' => $note_text, ':user_id' => Session::get('user_id')));
-
-        if ($query->rowCount() == 1) {
-            return true;
-        }
-
-        Session::add('feedback_negative', Text::get('FEEDBACK_NOTE_EDITING_FAILED'));
-        return false;
     }
 
-    /**
+    Session::add('feedback_negative', Text::get('FEEDBACK_NOTE_EDITING_FAILED'));
-     * Delete a specific note
+    return false;
-     * @param int $note_id id of the note
+  }
-     * @return bool feedback (was the note deleted properly ?)
-     */
-    public static function deleteNote($note_id)
-    {
-        if (!$note_id) {
-            return false;
-        }
 
-        $database = DatabaseFactory::getFactory()->getConnection();
+  /**
-
+   * Delete a specific note
-        $sql = "DELETE FROM notes WHERE note_id = :note_id AND user_id = :user_id LIMIT 1";
+   * @param int $note_id id of the note
-        $query = $database->prepare($sql);
+   * @return bool feedback (was the note deleted properly ?)
-        $query->execute(array(':note_id' => $note_id, ':user_id' => Session::get('user_id')));
+   */
-
+  public static function deleteNote($note_id)
-        if ($query->rowCount() == 1) {
+  {
-            return true;
+    if (!$note_id) {
-        }
+      return false;
-
-        // default return
-        Session::add('feedback_negative', Text::get('FEEDBACK_NOTE_DELETION_FAILED'));
-        return false;
     }
+
+    $database = DatabaseFactory::getFactory()->getConnection();
+
+    $sql = "DELETE FROM notes WHERE note_id = :note_id AND user_id = :user_id LIMIT 1";
+    $query = $database->prepare($sql);
+    $query->execute(array(':note_id' => $note_id, ':user_id' => Session::get('user_id')));
+
+    if ($query->rowCount() == 1) {
+      return true;
+    }
+
+    // default return
+    Session::add('feedback_negative', Text::get('FEEDBACK_NOTE_DELETION_FAILED'));
+    return false;
+  }
 }

application/model/RegistrationModel.php

@@ -13,101 +13,68 @@ class RegistrationModel
      *
      * @return boolean Gives back the success status of the registration
      */
-    public static function registerNewUser()
+    public static function registerNewUser($isAdmin = false)
     {
         // clean the input
         $user_name = strip_tags(Request::post('user_name'));
         $user_email = strip_tags(Request::post('user_email'));
-        $user_email_repeat = strip_tags(Request::post('user_email_repeat'));
+        // Use 'user_password' if provided (admin registration), otherwise 'user_password_new'
-        $user_password_new = Request::post('user_password_new');
+        $user_password_new = $isAdmin ? Request::post('user_password_new') : Request::post('user_password_new');
-        $user_password_repeat = Request::post('user_password_repeat');
+        $user_password_repeat = $user_password_new; // no repeat field
 
-        // stop registration flow if registrationInputValidation() returns false (= anything breaks the input check rules)
+        // validate using existing validators and messages
-        $validation_result = self::registrationInputValidation(Request::post('captcha'), $user_name, $user_password_new, $user_password_repeat, $user_email, $user_email_repeat);
+        $valid = true;
-        if (!$validation_result) {
+        if (!self::validateUserName($user_name)) { $valid = false; }
-            return false;
+        if (!self::validateUserEmail($user_email, $user_email)) { $valid = false; }
-        }
+        if (!self::validateUserPassword($user_password_new, $user_password_repeat)) { $valid = false; }
+        if (!$valid) { return false; }
 
-        // crypt the password with the PHP 5.5's password_hash() function, results in a 60 character hash string.
+        // hash the password
-        // @see php.net/manual/en/function.password-hash.php for more, especially for potential options
         $user_password_hash = password_hash($user_password_new, PASSWORD_DEFAULT);
 
-        // make return a bool variable, so both errors can come up at once if needed
         $return = true;
-
-        // check if username already exists
         if (UserModel::doesUsernameAlreadyExist($user_name)) {
             Session::add('feedback_negative', Text::get('FEEDBACK_USERNAME_ALREADY_TAKEN'));
             $return = false;
         }
-
-        // check if email already exists
         if (UserModel::doesEmailAlreadyExist($user_email)) {
             Session::add('feedback_negative', Text::get('FEEDBACK_USER_EMAIL_ALREADY_TAKEN'));
             $return = false;
         }
-
-        // if Username or Email were false, return false
         if (!$return) return false;
 
-        // generate random hash for email verification (40 bytes)
+        // directly activate user: set empty activation hash
-        $user_activation_hash = bin2hex(random_bytes(40));
+        $user_activation_hash = null;
 
         // write user data to database
         if (!self::writeNewUserToDatabase($user_name, $user_password_hash, $user_email, time(), $user_activation_hash)) {
             Session::add('feedback_negative', Text::get('FEEDBACK_ACCOUNT_CREATION_FAILED'));
-            return false; // no reason not to return false here
-        }
-
-        // get user_id of the user that has been created, to keep things clean we DON'T use lastInsertId() here
-        $user_id = UserModel::getUserIdByUsername($user_name);
-
-        if (!$user_id) {
-            Session::add('feedback_negative', Text::get('FEEDBACK_UNKNOWN_ERROR'));
             return false;
         }
 
-        // send verification email
+        Session::add('feedback_positive', Text::get('FEEDBACK_ACCOUNT_SUCCESSFULLY_CREATED'));
-        if (self::sendVerificationEmail($user_id, $user_email, $user_activation_hash)) {
+        return true;
-            Session::add('feedback_positive', Text::get('FEEDBACK_ACCOUNT_SUCCESSFULLY_CREATED'));
-            return true;
-        }
-
-        // if verification email sending failed: instantly delete the user
-        self::rollbackRegistrationByUserId($user_id);
-        Session::add('feedback_negative', Text::get('FEEDBACK_VERIFICATION_MAIL_SENDING_FAILED'));
-        return false;
     }
 
     /**
      * Validates the registration input
      *
-     * @param $captcha
      * @param $user_name
      * @param $user_password_new
-     * @param $user_password_repeat
      * @param $user_email
-     * @param $user_email_repeat
      *
      * @return bool
      */
-    public static function registrationInputValidation($captcha, $user_name, $user_password_new, $user_password_repeat, $user_email, $user_email_repeat)
+    public static function registrationInputValidation($user_name, $user_password_new, $user_email)
     {
         $return = true;
 
-        // perform all necessary checks
+        if (empty($user_name) || empty($user_password_new) || empty($user_email)) {
-        if (!CaptchaModel::checkCaptcha($captcha)) {
+            Session::add('feedback_negative', Text::get('FEEDBACK_FIELDS_EMPTY'));
-            Session::add('feedback_negative', Text::get('FEEDBACK_CAPTCHA_WRONG'));
             $return = false;
         }
 
-        // if username, email and password are all correctly validated, but make sure they all run on first sumbit
+        return $return;
-        if (self::validateUserName($user_name) AND self::validateUserEmail($user_email, $user_email_repeat) AND self::validateUserPassword($user_password_new, $user_password_repeat) AND $return) {
-            return true;
-        }
-
-        // otherwise, return false
-        return false;
     }
 
     /**
@@ -181,11 +148,7 @@ class RegistrationModel
             return false;
         }
 
-        if (strlen($user_password_new) < 6) {
+        // no minimum length restriction
-            Session::add('feedback_negative', Text::get('FEEDBACK_PASSWORD_TOO_SHORT'));
-            return false;
-        }
-
         return true;
     }
 
@@ -204,16 +167,23 @@ class RegistrationModel
     {
         $database = DatabaseFactory::getFactory()->getConnection();
 
-        // write new users data into database
+        // write new users data into database; set user_active=1 and user_activation_hash to provided value (can be null)
-        $sql = "INSERT INTO users (user_name, user_password_hash, user_email, user_creation_timestamp, user_activation_hash, user_provider_type)
+        $sql = "INSERT INTO users (user_name, user_password_hash, user_email, user_creation_timestamp, user_activation_hash, user_provider_type, user_active)
-                    VALUES (:user_name, :user_password_hash, :user_email, :user_creation_timestamp, :user_activation_hash, :user_provider_type)";
+                    VALUES (:user_name, :user_password_hash, :user_email, :user_creation_timestamp, :user_activation_hash, :user_provider_type, 1)";
         $query = $database->prepare($sql);
-        $query->execute(array(':user_name' => $user_name,
+        try {
-                              ':user_password_hash' => $user_password_hash,
+            $query->execute(array(
-                              ':user_email' => $user_email,
+                ':user_name' => $user_name,
-                              ':user_creation_timestamp' => $user_creation_timestamp,
+                ':user_password_hash' => $user_password_hash,
-                              ':user_activation_hash' => $user_activation_hash,
+                ':user_email' => $user_email,
-                              ':user_provider_type' => 'DEFAULT'));
+                ':user_creation_timestamp' => $user_creation_timestamp,
+                ':user_activation_hash' => $user_activation_hash,
+                ':user_provider_type' => 'DEFAULT'
+            ));
+        } catch (PDOException $e) {
+            // only one feedback message on failure
+            return false;
+        }
         $count =  $query->rowCount();
         if ($count == 1) {
             return true;

application/model/UserModel.php

@@ -19,7 +19,7 @@ class UserModel
     {
         $database = DatabaseFactory::getFactory()->getConnection();
 
-        $sql = "SELECT user_id, user_name, user_email, user_active, user_has_avatar, user_deleted FROM users";
+        $sql = "SELECT user_id, user_name, user_email, user_active, user_has_avatar, user_deleted, user_account_type FROM users";
         $query = $database->prepare($sql);
         $query->execute();
 
@@ -39,11 +39,46 @@ class UserModel
             $all_users_profiles[$user->user_id]->user_active = $user->user_active;
             $all_users_profiles[$user->user_id]->user_deleted = $user->user_deleted;
             $all_users_profiles[$user->user_id]->user_avatar_link = (Config::get('USE_GRAVATAR') ? AvatarModel::getGravatarLinkByEmail($user->user_email) : AvatarModel::getPublicAvatarFilePathOfUser($user->user_has_avatar, $user->user_id));
+            $all_users_profiles[$user->user_id]->user_account_type = $user->user_account_type;
         }
 
         return $all_users_profiles;
     }
 
+    /**
+     * Gets list of users including their group name via user_groups lookup.
+     * @return array
+     */
+    public static function getUsersWithGroups()
+    {
+        $database = DatabaseFactory::getFactory()->getConnection();
+
+        $sql = "SELECT u.user_id, u.user_name, u.user_email, u.user_active, u.user_has_avatar, u.user_deleted, u.user_account_type,
+                       g.group_name
+                  FROM users u
+             LEFT JOIN user_groups g ON g.group_id = u.user_account_type";
+        $query = $database->prepare($sql);
+        $query->execute();
+
+        $result = [];
+        foreach ($query->fetchAll() as $user) {
+            array_walk_recursive($user, 'Filter::XSSFilter');
+
+            $obj = new stdClass();
+            $obj->user_id = $user->user_id;
+            $obj->user_name = $user->user_name;
+            $obj->user_email = $user->user_email;
+            $obj->user_active = $user->user_active;
+            $obj->user_deleted = $user->user_deleted;
+            $obj->user_account_type = $user->user_account_type;
+            $obj->group_name = $user->group_name;
+            $obj->user_avatar_link = (Config::get('USE_GRAVATAR') ? AvatarModel::getGravatarLinkByEmail($user->user_email) : AvatarModel::getPublicAvatarFilePathOfUser($user->user_has_avatar, $user->user_id));
+
+            $result[] = $obj;
+        }
+        return $result;
+    }
+
     /**
      * Gets a user's profile data, according to the given $user_id
      * @param int $user_id The user's id

application/view/_templates/header.php

@@ -24,6 +24,9 @@
             <li <?php if (View::checkForActiveController($filename, "profile")) { echo ' class="active" '; } ?> >
                 <a href="<?php echo Config::get('URL'); ?>profile/index">Profiles</a>
             </li>
+            <li <?php if (View::checkForActiveController($filename, "directory")) { echo ' class="active" '; } ?> >
+                <a href="<?php echo Config::get('URL'); ?>directory/index">Benutzer</a>
+            </li>
             <?php if (Session::userIsLoggedIn()) { ?>
                 <li <?php if (View::checkForActiveController($filename, "dashboard")) { echo ' class="active" '; } ?> >
                     <a href="<?php echo Config::get('URL'); ?>dashboard/index">Dashboard</a>
@@ -36,9 +39,6 @@
                 <li <?php if (View::checkForActiveControllerAndAction($filename, "login/index")) { echo ' class="active" '; } ?> >
                     <a href="<?php echo Config::get('URL'); ?>login/index">Login</a>
                 </li>
-                <li <?php if (View::checkForActiveControllerAndAction($filename, "register/index")) { echo ' class="active" '; } ?> >
-                    <a href="<?php echo Config::get('URL'); ?>register/index">Register</a>
-                </li>
             <?php } ?>
         </ul>
 

application/view/admin/index.php

@@ -22,6 +22,7 @@
                     <td>User's email</td>
                     <td>Activated ?</td>
                     <td>Link to user's profile</td>
+                    <td>Group</td>
                     <td>suspension Time in days</td>
                     <td>Soft delete</td>
                     <td>Submit</td>
@@ -41,6 +42,19 @@
                         <td>
                             <a href="<?= Config::get('URL') . 'profile/showProfile/' . $user->user_id; ?>">Profile</a>
                         </td>
+                        <td>
+                            <form action="<?= Config::get('URL'); ?>admin/changeUserGroup" method="post">
+                                <input type="hidden" name="user_id" value="<?= $user->user_id; ?>" />
+                                <select name="group_id">
+                                    <?php foreach ($this->groups as $group) { ?>
+                                        <option value="<?= $group->group_id; ?>" <?= (isset($user->user_account_type) && (int)$user->user_account_type === (int)$group->group_id ? 'selected' : '') ?>>
+                                            <?= (int)$group->group_id; ?> - <?= htmlspecialchars($group->group_name, ENT_QUOTES, 'UTF-8'); ?>
+                                        </option>
+                                    <?php } ?>
+                                </select>
+                                <input type="submit" value="Save" />
+                            </form>
+                        </td>
                         <form action="<?= config::get("URL"); ?>admin/actionAccountSettings" method="post">
                             <td><input type="number" name="suspension" /></td>
                             <td><input type="checkbox" name="softDelete" <?php if ($user->user_deleted) { ?> checked <?php } ?> /></td>
@@ -53,5 +67,15 @@
                 <?php } ?>
             </table>
         </div>
+
+        <h3>Register a new user</h3>
+
+        <form method="post" action="<?php echo Config::get('URL'); ?>register/register_action">
+            <input type="text" name="user_name" placeholder="Username" required />
+            <input type="email" name="user_email" placeholder="Email address" required />
+            <input type="password" name="user_password_new" placeholder="Password" required autocomplete="off" />
+            <input type="submit" value="Register User" />
+        </form>
+
     </div>
 </div>

application/view/directory/index.php

@@ -0,0 +1,54 @@
+<div class="container">
+    <h1>Benutzerverzeichnis</h1>
+
+    <div class="box">
+        <?php $this->renderFeedbackMessages(); ?>
+
+        <table id="users-table" class="overview-table" style="width:100%">
+            <thead>
+                <tr>
+                    <td>Id</td>
+                    <td>Avatar</td>
+                    <td>Benutzername</td>
+                    <td>Email</td>
+                    <td>Aktiv?</td>
+                    <td>Gruppe</td>
+                    <td>Profil</td>
+                </tr>
+            </thead>
+            <tbody>
+            <?php foreach ($this->users as $user) { ?>
+                <tr class="<?= ($user->user_active == 0 ? 'inactive' : 'active'); ?>">
+                    <td><?= $user->user_id; ?></td>
+                    <td class="avatar">
+                        <?php if (isset($user->user_avatar_link)) { ?>
+                            <img src="<?= $user->user_avatar_link; ?>"/>
+                        <?php } ?>
+                    </td>
+                    <td><?= $user->user_name; ?></td>
+                    <td><?= $user->user_email; ?></td>
+                    <td><?= ($user->user_active == 0 ? 'Nein' : 'Ja'); ?></td>
+                    <td><?= htmlspecialchars($user->group_name ?: $user->user_account_type, ENT_QUOTES, 'UTF-8'); ?></td>
+                    <td><a href="<?= Config::get('URL') . 'profile/showProfile/' . $user->user_id; ?>">Profil</a></td>
+                </tr>
+            <?php } ?>
+            </tbody>
+        </table>
+    </div>
+</div>
+
+<!-- jQuery & DataTables CDN -->
+<link rel="stylesheet" href="https://cdn.datatables.net/1.13.8/css/jquery.dataTables.min.css">
+<script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
+<script src="https://cdn.datatables.net/1.13.8/js/jquery.dataTables.min.js"></script>
+<script>
+    $(document).ready(function(){
+        $('#users-table').DataTable({
+            pageLength: 10,
+            order: [[ 0, 'asc' ]],
+            language: {
+                url: 'https://cdn.datatables.net/plug-ins/1.13.8/i18n/de-DE.json'
+            }
+        });
+    });
+</script>

application/view/login/index.php

@@ -38,13 +38,6 @@
                     <a href="<?php echo Config::get('URL'); ?>login/requestPasswordReset">I forgot my password</a>
                 </div>
             </div>
-
-            <!-- register box on right side -->
-            <div class="register-box">
-                <h2>No account yet ?</h2>
-                <a href="<?php echo Config::get('URL'); ?>register/index">Register</a>
-            </div>
-
         </div>
     </div>
 </div>

application/view/register/index.php

@@ -9,30 +9,10 @@
 
         <!-- register form -->
         <form method="post" action="<?php echo Config::get('URL'); ?>register/register_action">
-            <!-- the user name input field uses a HTML5 pattern check -->
             <input type="text" pattern="[a-zA-Z0-9]{2,64}" name="user_name" placeholder="Username (letters/numbers, 2-64 chars)" required />
             <input type="text" name="user_email" placeholder="email address (a real address)" required />
-            <input type="text" name="user_email_repeat" placeholder="repeat email address (to prevent typos)" required />
             <input type="password" name="user_password_new" pattern=".{6,}" placeholder="Password (6+ characters)" required autocomplete="off" />
-            <input type="password" name="user_password_repeat" pattern=".{6,}" required placeholder="Repeat your password" autocomplete="off" />
-
-            <!-- show the captcha by calling the login/showCaptcha-method in the src attribute of the img tag -->
-            <img id="captcha" src="<?php echo Config::get('URL'); ?>register/showCaptcha" />
-            <input type="text" name="captcha" placeholder="Please enter above characters" required />
-
-            <!-- quick & dirty captcha reloader -->
-            <a href="#" style="display: block; font-size: 11px; margin: 5px 0 15px 0; text-align: center"
-               onclick="document.getElementById('captcha').src = '<?php echo Config::get('URL'); ?>register/showCaptcha?' + Math.random(); return false">Reload Captcha</a>
-
             <input type="submit" value="Register" />
         </form>
     </div>
 </div>
-<div class="container">
-    <p style="display: block; font-size: 11px; color: #999;">
-        Please note: This captcha will be generated when the img tag requests the captcha-generation
-        (= a real image) from YOURURL/register/showcaptcha. As this is a client-side triggered request, a
-        $_SESSION["captcha"] dump will not show the captcha characters. The captcha generation
-        happens AFTER the request that generates THIS page has been finished.
-    </p>
-</div>

public/index.php

@@ -11,7 +11,7 @@
 
 // auto-loading the classes (currently only from application/libs) via Composer's PSR-4 auto-loader
 // later it might be useful to use a namespace here, but for now let's keep it as simple as possible
-require '../vendor/autoload.php';
+require __DIR__ . '/../vendor/autoload.php';
 
 // start our application
 new Application();

public/router.php

@@ -0,0 +1,11 @@
+<?php
+
+if (php_sapi_name() === 'cli-server') {
+    $filePath = __DIR__ . parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
+    if (is_file($filePath)) {
+        return false;
+    }
+}
+
+$_GET['url'] = isset($_SERVER['PATH_INFO']) ? ltrim($_SERVER['PATH_INFO'], '/') : '';
+require __DIR__ . '/index.php';

start.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+
+php -S localhost:8000 -t ./public ./public/router.php