From e0e723bb9f87dd9f7068239404569ca08222e9a5 Mon Sep 17 00:00:00 2001
From: root <root@pittpc-crm.localDomain>
Date: Mon, 27 May 2019 12:28:41 -0400
Subject: [PATCH] The start of client logins has begun, now can link a user
 with a client to allow client logins, clients can only view client.php there
 is more work to be done

---
 add_user_modal.php  |  6 +++---
 check_login.php     | 10 ++++++++--
 client_side_nav.php |  4 +++-
 login.php           | 10 ++++++++--
 logout.php          |  3 ---
 post.php            |  3 ++-
 test.php            | 19 +++++++++++++++++++
 users.php           |  5 +++++
 8 files changed, 48 insertions(+), 12 deletions(-)
 create mode 100644 test.php

diff --git a/add_user_modal.php b/add_user_modal.php
index a61c90b9..17dcfa00 100644
--- a/add_user_modal.php
+++ b/add_user_modal.php
@@ -16,8 +16,8 @@
               <div class="input-group-prepend">
                 <span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
               </div>
-              <select class="form-control" name="client" <?php if(isset($_GET['client_id'])){ echo "disabled"; } ?>>
-                <option value="">- Client -</option>
+              <select class="form-control" name="client">
+                <option value="0">No Client Assignment</option>
                 <?php 
                 
                 $sql = mysqli_query($mysqli,"SELECT * FROM clients"); 
@@ -25,7 +25,7 @@
                   $client_id = $row['client_id'];
                   $client_name = $row['client_name'];
                 ?>
-                  <option <?php if($_GET['client_id'] == $client_id) { echo "selected"; } ?> value="<?php echo "$client_id"; ?>"><?php echo "$client_name"; ?></option>
+                  <option value="<?php echo $client_id; ?>"><?php echo $client_name; ?></option>
                 
                 <?php
                 }
diff --git a/check_login.php b/check_login.php
index bdd2b301..981ae31e 100644
--- a/check_login.php
+++ b/check_login.php
@@ -3,9 +3,15 @@
 	session_start();
 	
 	if(!$_SESSION['logged']){
-	    header("Location: login.php");
+	    header("Location: logout.php");
 	    die;
 	}
+	
+	//Check to see if its a client if so sandbox them to just post.php or client.php.
+	if($_SESSION['client_id'] > 0 AND basename($_SERVER['PHP_SELF']) !== 'client.php' AND basename($_SERVER['PHP_SELF']) !== 'post.php'){
+    	header("Location: logout.php");
+    	die;
+	}
 
 	$session_user_id = $_SESSION['user_id'];
 
@@ -13,6 +19,7 @@
 	$row = mysqli_fetch_array($sql);
 	$session_name = $row['name'];
 	$session_avatar = $row['avatar'];
+	$session_client_id = $row['client_id'];
 
 	//Detects if using an apple device and uses apple maps instead of google
 	$iPod    = stripos($_SERVER['HTTP_USER_AGENT'],"iPod");
@@ -26,7 +33,6 @@
 	}
 
 	//Get unAcked Alert Count for the badge on the top nav
-
 	$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT COUNT('alert_id') AS num FROM alerts WHERE alert_ack_date = 0"));
   	$num_alerts = $row['num'];
 
diff --git a/client_side_nav.php b/client_side_nav.php
index c897c5e1..f7a37652 100644
--- a/client_side_nav.php
+++ b/client_side_nav.php
@@ -6,7 +6,8 @@
     <h2 class="text-white text-center"><?php echo $client_name; ?></h2>
     <h6 class="text-secondary text-center"><?php echo $client_type; ?></h6>
   </li>
-
+  
+  <?php if($session_client_id > 0){ ?>
   <li class="nav-item">
     <a class="nav-link" href="clients.php">
       <button class="btn btn-outline-light btn-block">
@@ -15,6 +16,7 @@
     </button>
     </a>
   </li>
+  <?php } ?>
 
   <li class="nav-item <?php if($_GET['tab'] == "overview") { echo "active"; } ?>">
     <a class="nav-link" 
diff --git a/login.php b/login.php
index bd948def..2d3b7618 100644
--- a/login.php
+++ b/login.php
@@ -16,8 +16,14 @@ if(isset($_POST['login'])){
     $_SESSION['logged'] = TRUE;
     $_SESSION['user_id'] = $row['user_id'];
     $_SESSION['name'] = $row['name'];
-    
-    header("Location: $config_start_page");
+    $_SESSION['client_id'] = $row['client_id'];
+    $client_id = $row['client_id'];
+
+    if($client_id > 0){
+      header("Location: client.php?client_id=$client_id");
+    }else{
+      header("Location: $config_start_page");
+    }
   }else{
     $response = "
       <div class='alert alert-danger'>
diff --git a/logout.php b/logout.php
index 23c5a5ed..1c7ddbab 100644
--- a/logout.php
+++ b/logout.php
@@ -1,7 +1,4 @@
 <?php 
-	
-	include("config.php");
-	include("check_login.php");
 
 	session_start();
 	session_destroy();
diff --git a/post.php b/post.php
index 8be670bf..d54d95e4 100644
--- a/post.php
+++ b/post.php
@@ -151,8 +151,9 @@ if(isset($_POST['add_user'])){
     $name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['name']));
     $email = strip_tags(mysqli_real_escape_string($mysqli,$_POST['email']));
     $password = md5(mysqli_real_escape_string($mysqli,$_POST['password']));
+    $client_id = intval($_POST['client']);
 
-    mysqli_query($mysqli,"INSERT INTO users SET name = '$name', email = '$email', password = '$password', created_at = NOW()");
+    mysqli_query($mysqli,"INSERT INTO users SET name = '$name', email = '$email', password = '$password', created_at = NOW(), client_id = $client_id");
 
     $user_id = mysqli_insert_id($mysqli);
 
diff --git a/test.php b/test.php
new file mode 100644
index 00000000..fb4c8d13
--- /dev/null
+++ b/test.php
@@ -0,0 +1,19 @@
+<?php include("header.php"); ?>
+
+<!-- Breadcrumbs-->
+<ol class="breadcrumb">
+  <li class="breadcrumb-item">
+    <a href="index.html">Dashboard</a>
+  </li>
+  <li class="breadcrumb-item active">Blank Page</li>
+</ol>
+
+<!-- Page Content -->
+<h1>PHP SELF: <?php echo basename($_SERVER['PHP_SELF']); ?></h1>
+<hr>
+<h3>PHP URI: <?php echo $_SERVER['REQUEST_URI']; ?></h1>
+<h1>basename _FILE_ : <?php echo basename(__FILE__); ?></h1>
+<h1>User Agent: <?php echo $_SERVER['HTTP_USER_AGENT']; ?>
+<p>This is a great starting point for new custom pages.</p>
+
+<?php include("footer.php"); ?>
\ No newline at end of file
diff --git a/users.php b/users.php
index aaa4743a..6a53ca18 100644
--- a/users.php
+++ b/users.php
@@ -15,6 +15,8 @@
           <tr>
             <th class="text-center">Name</th>
             <th>Email</th>
+            <th>Type</th>
+            <th>Status</th>
             <th class="text-center">Actions</th>
           </tr>
         </thead>
@@ -27,6 +29,7 @@
             $email = $row['email'];
             $password = $row['password'];
             $avatar = $row['avatar'];
+            $client_id = $row['client_id'];
             $initials = initials($name);
       
           ?>
@@ -45,6 +48,8 @@
               <div class="text-secondary"><?php echo $name; ?></div>
             </td>
             <td><a href="mailto:<?php echo $email; ?>"><?php echo $email; ?></a></td>
+            <td>Client</td>
+            <td>Status</td>
             <td>
               <div class="dropdown dropleft text-center">
                 <button class="btn btn-secondary btn-sm" type="button" id="dropdownMenuButton" data-toggle="dropdown" aria-haspopup="true" aria-expanded="false">