diff --git a/inc_all_user.php b/inc_all_user.php new file mode 100644 index 00000000..614bfc4d --- /dev/null +++ b/inc_all_user.php @@ -0,0 +1,21 @@ +
Your $config_app_name account has been updated, details below:

$details

If you did not perform this change, contact your $config_app_name administrator immediately.

Thanks,
ITFlow
$session_company_name"; @@ -61,15 +50,15 @@ if (isset($_POST['edit_profile'])) { $file_tmp_path = $_FILES['file']['tmp_name']; // directory in which the uploaded file will be moved - $upload_file_dir = "uploads/users/$user_id/"; + $upload_file_dir = "uploads/users/$session_user_id/"; $dest_path = $upload_file_dir . $new_file_name; move_uploaded_file($file_tmp_path, $dest_path); // Delete old file - unlink("uploads/users/$user_id/$existing_file_name"); + unlink("uploads/users/$session_user_id/$existing_file_name"); // Set Avatar - mysqli_query($mysqli,"UPDATE users SET user_avatar = '$new_file_name' WHERE user_id = $user_id"); + mysqli_query($mysqli,"UPDATE users SET user_avatar = '$new_file_name' WHERE user_id = $session_user_id"); // Extended Logging $extended_log_description .= ", profile picture updated"; @@ -81,38 +70,12 @@ if (isset($_POST['edit_profile'])) { } } - if (!empty($new_password)) { - $new_password = password_hash($new_password, PASSWORD_DEFAULT); - $user_specific_encryption_ciphertext = encryptUserSpecificKey($_POST['new_password']); - mysqli_query($mysqli,"UPDATE users SET user_password = '$new_password', user_specific_encryption_ciphertext = '$user_specific_encryption_ciphertext' WHERE user_id = $user_id"); - - $extended_log_description .= ", password changed"; - $logout = true; - } - - // Enable extension access, only if it isn't already setup (user doesn't have cookie) - if (isset($_POST['extension']) && $_POST['extension'] == 'Yes') { - if (!isset($_COOKIE['user_extension_key'])) { - $extension_key = randomString(156); - mysqli_query($mysqli, "UPDATE users SET user_extension_key = '$extension_key' WHERE user_id = $user_id"); - - $extended_log_description .= ", extension access enabled"; - $logout = true; - } - } - - // Disable extension access - if (!isset($_POST['extension'])) { - mysqli_query($mysqli, "UPDATE users SET user_extension_key = '' WHERE user_id = $user_id"); - $extended_log_description .= ", extension access disabled"; - } - - mysqli_query($mysqli,"UPDATE users SET user_name = '$name', user_email = '$email' WHERE user_id = $user_id"); + mysqli_query($mysqli,"UPDATE users SET user_name = '$name', user_email = '$email' WHERE user_id = $session_user_id"); //Logging - mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'User Preferences', log_action = 'Modify', log_description = '$session_name modified their preferences$extended_log_description', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'User Details', log_action = 'Modify', log_description = '$session_name modified their details $extended_log_description', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); - $_SESSION['alert_message'] = "User preferences updated"; + $_SESSION['alert_message'] = "User details updated"; if ($logout) { header('Location: post.php?logout'); @@ -122,6 +85,80 @@ if (isset($_POST['edit_profile'])) { } } +if (isset($_POST['edit_your_user_password'])) { + + // CSRF Check + validateCSRFToken($_POST['csrf_token']); + + $new_password = trim($_POST['new_password']); + + // Email notification when password or email is changed + $user_sql = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT user_name, user_email FROM users WHERE user_id = $session_user_id")); + $name = $user_sql['user_name']; + $user_email = $user_sql['user_email']; + + if (!empty($config_smtp_host)){ + + $details = "Your password was changed."; + + $subject = "$config_app_name account update confirmation for $name"; + $body = "Hi $name,

Your $config_app_name account has been updated, details below:

$details

If you did not perform this change, contact your $config_app_name administrator immediately.

Thanks,
ITFlow
$session_company_name"; + + $data = [ + [ + 'from' => $config_mail_from_email, + 'from_name' => $config_mail_from_name, + 'recipient' => $user_email, + 'recipient_name' => $name, + 'subject' => $subject, + 'body' => $body + ] + ]; + $mail = addToMailQueue($mysqli, $data); + } + + $new_password = password_hash($new_password, PASSWORD_DEFAULT); + $user_specific_encryption_ciphertext = encryptUserSpecificKey($_POST['new_password']); + mysqli_query($mysqli,"UPDATE users SET user_password = '$new_password', user_specific_encryption_ciphertext = '$user_specific_encryption_ciphertext' WHERE user_id = $session_user_id"); + + //Logging + mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'User Preferences', log_action = 'Modify', log_description = '$session_name changed their password', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + + $_SESSION['alert_message'] = "Your password was updated"; + + header('Location: post.php?logout'); +} + +if (isset($_POST['edit_your_user_browser_extention'])) { + + // CSRF Check + validateCSRFToken($_POST['csrf_token']); + + // Enable extension access, only if it isn't already setup (user doesn't have cookie) + if (isset($_POST['extension']) && $_POST['extension'] == 'Yes') { + if (!isset($_COOKIE['user_extension_key'])) { + $extension_key = randomString(156); + mysqli_query($mysqli, "UPDATE users SET user_extension_key = '$extension_key' WHERE user_id = $session_user_id"); + + $extended_log_description .= "enabled browser extension access"; + $logout = true; + } + } + + // Disable extension access + if (!isset($_POST['extension'])) { + mysqli_query($mysqli, "UPDATE users SET user_extension_key = '' WHERE user_id = $session_user_id"); + $extended_log_description .= "disabled browser extension access"; + } + + //Logging + mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'User Preferences', log_action = 'Modify', log_description = '$session_name $extended_log_description', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_user_id = $session_user_id"); + + $_SESSION['alert_message'] = "User preferences updated"; + + header("Location: " . $_SERVER["HTTP_REFERER"]); +} + if (isset($_POST['verify'])) { diff --git a/top_nav.php b/top_nav.php index d8f88455..77f95ee3 100644 --- a/top_nav.php +++ b/top_nav.php @@ -153,10 +153,10 @@
  • - Profile + Account Sign out + class="fas fa-sign-out-alt mr-2">Logout
    • diff --git a/user_activity.php b/user_activity.php new file mode 100644 index 00000000..12a4144e --- /dev/null +++ b/user_activity.php @@ -0,0 +1,95 @@ + + +
    +
    +

    Your Recent Sign ins

    +
    + + + + + + + + + + + + +
    +
    + ">See More... +
    +
    + +
    +
    +

    Your Recent Activity

    +
    + + + + + + + + + + + + + + +
    +
    + See More... +
    +
    + + + +
    +
    +

    Browser Extension

    +
    +
    + +
    + + + 1) { ?> + +
    +
    + > + +

    Note: You must log out and back in again for these changes take effect.

    +
    +
    + + + + + +
    + +
    +
    + + + +
    +
    +

    Your User Details

    +
    +
    + +
    + + +
    + + + + User avatar" class="img-fluid"> + +

    +
    + +
    + +
    + +
    +
    + +
    + +
    +
    + +
    + +
    +
    + +
    + +
    +
    + +
    + + +
    + + + + +
    + +
    + +
    + + + +
    +
    +

    Browser Extension

    +
    +
    + +
    + + + 1) { ?> + +
    +
    + > + +

    Note: You must log out and back in again for these changes take effect.

    +
    +
    + + + + + +
    + +
    +
    + + - -
    -
    -
    -
    -

    Your User Details

    -
    -
    - -
    - - -
    - - - - User avatar" class="img-fluid"> - -

    -
    - -
    - -
    - -
    -
    - -
    - -
    -
    - -
    - -
    -
    - -
    - -
    -
    - -
    - -
    -
    - -
    - -
    - -
    -
    -
    - -
    - - -
    - - 1) { ?> - -
    -
    - > - -

    Note: You must log out and back in again for these changes take effect.

    -
    -
    - - - - - - -
    - -
    - -
    - - - - - -

    You have set up 2FA. Your QR code is below.

    - - - -
    - ', TokenAuth6238::getBarCodeUrl($session_name, ' ', $session_token, $_SERVER['SERVER_NAME'])); - - echo "

    $session_token

    "; - } - - ?> -
    - - - -
    - - -
    -
    -
    -
    - -
    - -
    - -
    -
    -
    - -
    - -
    -
    -
    - -
    - -
    -
    -

    Your Recent Sign ins

    -
    - - - - - - - - - - - - -
    -
    - ">See More... -
    -
    - -
    -
    -

    Your Recent Activity

    -
    - - - - - - - - - - - - - - -
    -
    - See More... -
    -
    -
    - -
    - - + +
    +
    +

    Your Password

    +
    +
    +
    + + +
    + +
    +
    + +
    + +
    + +
    +
    +
    + + + +
    +
    +
    + +
    +
    +

    Mult-Factor Authentication

    +
    +
    +
    + + + + + +

    You have set up 2FA. Your QR code is below.

    + + + +
    + ', TokenAuth6238::getBarCodeUrl($session_name, ' ', $session_token, $_SERVER['SERVER_NAME'])); + + echo "

    $session_token

    "; + } + + ?> +
    + + + +
    + + +
    +
    +
    +
    + +
    + +
    + +
    +
    +
    + +
    + +
    + + +