archives/FHeD
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 40 Activity

🎨 Don't use header() to redirect to /login

Browse Source 
Signed-off-by: Luke Tainton <luke@tainton.uk>
This commit is contained in:
Luke Tainton
2020-08-04 18:29:23 +01:00
parent d464fef3a8
commit b68f299021
5 changed files with 118 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
app/includes/header.php
View File

@@ -8,6 +8,11 @@
<meta charset="utf-8"> <meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<meta name="theme-color" content="#563d7c"> <meta name="theme-color" content="#563d7c">
<?php
if (!is_logged_in()) {
echo("<meta http-equiv='refresh' content='0; url=" . $_ENV['APP_URL'] . "/login' />");
}
?>
<title><?php echo( $PAGE_TITLE ); ?></title> <title><?php echo( $PAGE_TITLE ); ?></title>
<!-- Bootstrap core CSS --> <!-- Bootstrap core CSS -->

173
app/public/index.php
View File

@@ -3,32 +3,28 @@
require_once __DIR__ . "/../includes/prereqs.php"; require_once __DIR__ . "/../includes/prereqs.php";
require_once __DIR__ . "/../includes/header.php"; require_once __DIR__ . "/../includes/header.php";
if (is_signed_in()) { // Get user's own tickets
// Get user's own tickets try {
try { $user_tickets_stmt = "SELECT uuid, id, title, description, status FROM tickets WHERE created_by=:uuid";
$user_tickets_stmt = "SELECT uuid, id, title, description, status FROM tickets WHERE created_by=:uuid"; $user_tickets_sql = $db->prepare($user_tickets_stmt);
$user_tickets_sql = $db->prepare($user_tickets_stmt); $user_tickets_sql->bindParam(':uuid', $_SESSION['uuid']);
$user_tickets_sql->bindParam(':uuid', $_SESSION['uuid']); $user_tickets_sql->execute();
$user_tickets_sql->execute(); $user_tickets_sql->setFetchMode(PDO::FETCH_ASSOC);
$user_tickets_sql->setFetchMode(PDO::FETCH_ASSOC); $user_tickets_result = $user_tickets_sql->fetchAll();
$user_tickets_result = $user_tickets_sql->fetchAll(); } catch (PDOException $e) {
} catch (PDOException $e) { echo("Error: " . $e->getMessage());
echo("Error: " . $e->getMessage()); }
}
// Get tickets user has subscribed to // Get tickets user has subscribed to
try { try {
$sub_tickets_stmt = "SELECT ticket_uuid FROM ticket_subscribers WHERE user_uuid=:uuid"; $sub_tickets_stmt = "SELECT ticket_uuid FROM ticket_subscribers WHERE user_uuid=:uuid";
$sub_tickets_sql = $db->prepare($sub_tickets_stmt); $sub_tickets_sql = $db->prepare($sub_tickets_stmt);
$sub_tickets_sql->bindParam(':uuid', $_SESSION['uuid']); $sub_tickets_sql->bindParam(':uuid', $_SESSION['uuid']);
$sub_tickets_sql->execute(); $sub_tickets_sql->execute();
$sub_tickets_sql->setFetchMode(PDO::FETCH_ASSOC); $sub_tickets_sql->setFetchMode(PDO::FETCH_ASSOC);
$sub_tickets_result = $sub_tickets_sql->fetchAll(); $sub_tickets_result = $sub_tickets_sql->fetchAll();
} catch (PDOException $e) { } catch (PDOException $e) {
echo("Error: " . $e->getMessage()); echo("Error: " . $e->getMessage());
}
$user_tickets_sub = 0; // Force 'no subbed tickets' msg until the code works
} }
function get_sub_ticket($db, $ticket_uuid) { function get_sub_ticket($db, $ticket_uuid) {
@@ -77,84 +73,73 @@
is the one-stop shop for all of your IT-related needs. Let us know how we can help you by opening a request. is the one-stop shop for all of your IT-related needs. Let us know how we can help you by opening a request.
</p> </p>
<p> <p>
<?php <a href='/new' class='btn btn-primary my-2'>Create a request</a>
if (is_signed_in()) { <a href='/open' class='btn btn-secondary my-2'>View existing requests</a>
echo("
<a href='/new' class='btn btn-primary my-2'>Create a request</a>
<a href='/open' class='btn btn-secondary my-2'>View existing requests</a>
");
} else {
echo("<b>Please log in to create or view tickets.</b>");
}
?>
</p> </p>
</div> </div>
</section> </section>
<?php if (is_signed_in()) { ?> <section>
<section> <div class="card mx-auto" style="width: 80%;">
<div class="card mx-auto" style="width: 80%;"> <div class="card-header">
<div class="card-header"> <span class="mdi mdi-ticket-outline"></span> My Open Requests
<span class="mdi mdi-ticket-outline"></span> My Open Requests </div>
</div> <ul class="list-group list-group-flush">
<ul class="list-group list-group-flush"> <?php
<?php if (count($user_tickets_result) == 0) {
if (count($user_tickets_result) == 0) { echo("<center><b>No open tickets</b></center>");
echo("<center><b>No open tickets</b></center>"); } else {
} else { foreach($user_tickets_result as $tkt) {
foreach($user_tickets_result as $tkt) { ?>
?> <li class="list-group-item">
<li class="list-group-item"> <div class="container">
<div class="container"> <div class="row">
<div class="row"> <div class="col-10">
<div class="col-10"> <span style="display: inline;" class="text-muted">#<?php echo(sprintf("%'.05d\n", $tkt["id"])); ?> </span><span><b><?php echo($tkt['title']); ?></b></span>
<span style="display: inline;" class="text-muted">#<?php echo(sprintf("%'.05d\n", $tkt["id"])); ?> </span><span><b><?php echo($tkt['title']); ?></b></span> <p class="m-0"><?php echo($tkt['description']); ?></p>
<p class="m-0"><?php echo($tkt['description']); ?></p> </div>
</div> <div class="col-2">
<div class="col-2"> <a class="btn btn-success float-right" href="view?rid=<?php echo($tkt["uuid"]); ?>" role="button">Go</a>
<a class="btn btn-success float-right" href="view?rid=<?php echo($tkt["uuid"]); ?>" role="button">Go</a>
</div>
</div> </div>
</div> </div>
</li> </div>
<?php } } ?> </li>
</ul> <?php } } ?>
</div> </ul>
</section> </div>
</section>
<section style="margin-top: 1%;"> <section style="margin-top: 1%;">
<div class="card mx-auto" style="width: 80%;"> <div class="card mx-auto" style="width: 80%;">
<div class="card-header"> <div class="card-header">
<span class="mdi mdi-rss"></span> My Subscribed Requests <span class="mdi mdi-rss"></span> My Subscribed Requests
</div> </div>
<ul class="list-group list-group-flush"> <ul class="list-group list-group-flush">
<?php <?php
// if ($user_tickets_sub == 0) { if (count($sub_tickets_result) == 0) {
if (count($sub_tickets_result) == 0) { echo("<center><b>No subscribed tickets</b></center>");
echo("<center><b>No subscribed tickets</b></center>"); } else {
} else { foreach($sub_tickets_result as $sub) {
foreach($sub_tickets_result as $sub) { $tkt = get_sub_ticket($db, $sub['ticket_uuid']);
$tkt = get_sub_ticket($db, $sub['ticket_uuid']); $tkt_creator = get_user_name($db, $tkt['created_by']);
$tkt_creator = get_user_name($db, $tkt['created_by']); ?>
?> <li class="list-group-item">
<li class="list-group-item"> <div class="container">
<div class="container"> <div class="row">
<div class="row"> <div class="col-10">
<div class="col-10"> <span style="display: inline;" class="text-muted">#<?php echo sprintf("%'.05d\n", $tkt["id"]); ?> </span><span><b><?php echo($tkt['title']); ?></b></span> <span style="display: inline;" class="text-muted"><?php echo("(Creator: " . $tkt_creator . ")"); ?></span>
<span style="display: inline;" class="text-muted">#<?php echo sprintf("%'.05d\n", $tkt["id"]); ?> </span><span><b><?php echo($tkt['title']); ?></b></span> <span style="display: inline;" class="text-muted"><?php echo("(Creator: " . $tkt_creator . ")"); ?></span> <p class="m-0"><?php echo($tkt['description']); ?></p>
<p class="m-0"><?php echo($tkt['description']); ?></p> </div>
</div> <div class="col-2">
<div class="col-2"> <a class="btn btn-success float-right" href="view?rid=<?php echo($tkt["uuid"]); ?>" role="button">Go</a>
<a class="btn btn-success float-right" href="view?rid=<?php echo($tkt["uuid"]); ?>" role="button">Go</a>
</div>
</div> </div>
</div> </div>
</li> </div>
<?php } } ?> </li>
</ul> <?php } } ?>
</div> </ul>
</section> </div>
<?php } ?> </section>
</main> </main>

6
app/public/new.php
View File

@@ -3,10 +3,6 @@
require_once __DIR__ . "/../includes/prereqs.php"; require_once __DIR__ . "/../includes/prereqs.php";
require_once __DIR__ . "/../includes/header.php"; require_once __DIR__ . "/../includes/header.php";
if (!is_signed_in()) {
header('Location: /login');
}
// If form submitted, save to database // If form submitted, save to database
if($_SERVER['REQUEST_METHOD'] == 'POST') { if($_SERVER['REQUEST_METHOD'] == 'POST') {
try { try {
@@ -69,7 +65,7 @@
<section> <section>
<div class="card mx-auto" style="width: 50%;"> <div class="card mx-auto" style="width: 50%;">
<form action="/new" method="post" enctype="multipart/form-data"> <form style="padding: 2%" action="/new" method="post" enctype="multipart/form-data">
<div class="form-group"> <div class="form-group">
<label for="title">Title: </label> <label for="title">Title: </label>
<input type="text" class="form-control" id="title"> <input type="text" class="form-control" id="title">

4
app/public/open.php
View File

@@ -2,10 +2,6 @@
$PAGE_NAME = "Open requests"; $PAGE_NAME = "Open requests";
require_once __DIR__ . "/../includes/prereqs.php"; require_once __DIR__ . "/../includes/prereqs.php";
require_once __DIR__ . "/../includes/header.php"; require_once __DIR__ . "/../includes/header.php";
if (!is_signed_in()) {
header('Location: /login');
}
?> ?>

74
app/public/view.php
View File

@@ -3,42 +3,40 @@
require_once __DIR__ . "/../includes/prereqs.php"; require_once __DIR__ . "/../includes/prereqs.php";
require_once __DIR__ . "/../includes/header.php"; require_once __DIR__ . "/../includes/header.php";
if (is_signed_in()) { // Get ticket
// Get ticket try {
try { $ticket_stmt = "SELECT * FROM tickets WHERE uuid=:uuid";
$ticket_stmt = "SELECT * FROM tickets WHERE uuid=:uuid"; $ticket_sql = $db->prepare($ticket_stmt);
$ticket_sql = $db->prepare($ticket_stmt); $ticket_sql->bindParam(':uuid', $_GET['rid']);
$ticket_sql->bindParam(':uuid', $_GET['rid']); $ticket_sql->execute();
$ticket_sql->execute(); $ticket_sql->setFetchMode(PDO::FETCH_ASSOC);
$ticket_sql->setFetchMode(PDO::FETCH_ASSOC); $ticket_result = $ticket_sql->fetchAll();
$ticket_result = $ticket_sql->fetchAll(); $request = $ticket_result[0];
$request = $ticket_result[0]; } catch (PDOException $e) {
} catch (PDOException $e) { echo("Error: " . $e->getMessage());
echo("Error: " . $e->getMessage()); }
}
// Get authorised subscribers // Get authorised subscribers
try { try {
$users_stmt = "SELECT user_uuid FROM ticket_subscribers WHERE ticket_uuid=:uuid"; $users_stmt = "SELECT user_uuid FROM ticket_subscribers WHERE ticket_uuid=:uuid";
$users_sql = $db->prepare($users_stmt); $users_sql = $db->prepare($users_stmt);
$users_sql->bindParam(':uuid', $_GET['rid']); $users_sql->bindParam(':uuid', $_GET['rid']);
$users_sql->execute(); $users_sql->execute();
$users_sql->setFetchMode(PDO::FETCH_ASSOC); $users_sql->setFetchMode(PDO::FETCH_ASSOC);
$users_result = $users_sql->fetchAll(); $users_result = $users_sql->fetchAll();
} catch (PDOException $e) { } catch (PDOException $e) {
echo("Error: " . $e->getMessage()); echo("Error: " . $e->getMessage());
} }
$authorised_users = array(); $authorised_users = array();
foreach($users_result as $user) { foreach($users_result as $user) {
array_push($authorised_users, $user['user_uuid']); array_push($authorised_users, $user['user_uuid']);
} }
if (in_array($_SESSION['uuid'], $authorised_users)) { if (in_array($_SESSION['uuid'], $authorised_users)) {
$is_authorised = true; $is_authorised = true;
} else { } else {
$is_authorised = false; $is_authorised = false;
}
} }
?> ?>
@@ -48,7 +46,7 @@
<!-- Begin page content --> <!-- Begin page content -->
<main role="main" class="flex-shrink-0"> <main role="main" class="flex-shrink-0">
<?php if (is_signed_in() && $is_authorised == true) { ?> <?php if ($is_authorised == true) { ?>
<section class="jumbotron text-center"> <section class="jumbotron text-center">
<div class="container"> <div class="container">
<h1><?php echo($request['title']); ?></h1> <h1><?php echo($request['title']); ?></h1>
@@ -64,18 +62,12 @@
</p> </p>
</div> </div>
</section> </section>
<?php } else if (is_signed_in() && $is_authorised == false) { ?> <?php } else if ($is_authorised == false) { ?>
<section class="jumbotron text-center"> <section class="jumbotron text-center">
<div class="container"> <div class="container">
<h1>You are not authorised to see this page.</h1> <h1>You are not authorised to see this page.</h1>
</div> </div>
</section> </section>
<?php } else { ?>
<section class="jumbotron text-center">
<div class="container">
<h1>You need to be logged in to see this page.</h1>
</div>
</section>
<?php } ?> <?php } ?>
</main> </main>