WKVS_gitea/WKVS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Semi-stable version with old variable names

Browse Source
This commit is contained in:
Fabio Herzig
2026-07-16 18:43:30 +02:00
parent 3731183654
commit c8e7ce9174
165 changed files with 25654 additions and 9728 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/intern/scripts/logindata/ajax-update-user-information.php
+108 -79
View File
@@ -2,6 +2,8 @@
use Dotenv\Dotenv;
ini_set('display_errors', 1);
header('Content-Type: application/json');
if (!isset($baseDir)) {
@@ -28,25 +30,73 @@ if ($dbconnection['success'] !== true){
exit;
}
if (isset($_POST['field_id'])){
$id = intval($_POST['field_id']);
} else {
echo json_encode(['success' => false, 'message' => 'Invalid Input.']);
$allowed_update_types = ['all', 'no_password', 'new_user'];
$update_type = $_POST['updateType'] ?? '';
if (!in_array($update_type, $allowed_update_types)) {
echo json_encode(['success' => false, 'message' => 'Unbekannte Aktion']);
http_response_code(400);
exit;
}
$editor_id = $_SESSION['user_id_wk_leitung'];
$plain = trim($_POST['password'] ?? '');
$editor_id = (int) $_SESSION['user_id_wk_leitung'];
if (!$plain) {
echo json_encode(['success' => false, 'message' => 'Invalid Input.']);
if ($update_type === 'new_user') {
$stmt = $mysqli->prepare(
"INSERT INTO {$tableInternUsers}
(created_at, updated_at, edited_by, login_active)
VALUES (?, ?, ?, ?)"
);
$loginActive = 1;
$created_at = date('Y-m-d H:i:s');
$updated_at = $created_at;
$stmt->bind_param(
"ssis",
$created_at,
$updated_at,
$editor_id,
$loginActive
);
$updated = $stmt->execute();
$new_id = $mysqli->insert_id;
echo json_encode(['success' => true, 'message' => 'Neuer Benutzer wurde erfolgreich erstellt', 'id' => $new_id]);
http_response_code(200);
exit;
}
$id = (int) ($_POST['personId'] ?? 0);
if ($id < 1 && $update_type !== 'new_user') {
echo json_encode(['success' => false, 'message' => 'Die angegebene ID ist nicht valide']);
http_response_code(400);
exit;
}
$plain_password = trim($_POST['password'] ?? '');
if ($plain_password === '' && $update_type !== 'no_password') {
echo json_encode(['success' => false, 'message' => 'Kein Passwort angegeben']);
http_response_code(422);
exit;
}
if ($update_type !== 'no_password' && strlen($plain_password) < 6) {
echo json_encode(['success' => false, 'message' => 'Das Passwort muss mindestens 6 Zeichen enthalten']);
http_response_code(400);
exit;
}
$username = htmlspecialchars(trim($_POST['username'] ?? ''));
if (!$username) {
echo json_encode(['success' => false, 'message' => 'Invalid Input.']);
if ($username === '') {
echo json_encode(['success' => false, 'message' => 'Keinen Benutzernamen angegeben']);
http_response_code(422);
exit;
}
@@ -75,45 +125,52 @@ $array = [
// Store as proper JSON string
$freigabe_store = json_encode($array);
// Hash for login
$hash = password_hash($plain, PASSWORD_ARGON2ID);
if ($update_type !== 'no_password') {
$hash = password_hash($plain_password, PASSWORD_ARGON2ID);
require $baseDir . '/../composer/vendor/autoload.php';
require $baseDir . '/../composer/vendor/autoload.php';
$envFile = realpath($baseDir . '/../config/.env.pw-encryption-key');
$envFile = realpath($baseDir . '/../config/.env.pw-encryption-key');
if ($envFile === false) {
http_response_code(500);
echo json_encode([
'success' => false,
'message' => "Environment file not found"
]);
exit;
if ($envFile === false) {
http_response_code(500);
echo json_encode([
'success' => false,
'message' => "Environment file not found"
]);
exit;
}
try {
$envDir = dirname($envFile);
$dotenv = Dotenv::createImmutable($envDir, '.env.pw-encryption-key');
$dotenv->load();
} catch (Throwable $e) {
http_response_code(500);
echo json_encode([
'success' => false,
'message' => "Dotenv error"
]);
}
$iv_length = openssl_cipher_iv_length('aes-256-cbc');
$iv = random_bytes($iv_length);
$encrypted = openssl_encrypt($plain_password, 'aes-256-cbc', $_ENV['PW_ENCRYPTION_KEY'], 0, $iv);
$cipher_store = base64_encode($iv . $encrypted);
}
try {
$envDir = dirname($envFile);
$dotenv = Dotenv::createImmutable($envDir, '.env.pw-encryption-key');
$dotenv->load();
} catch (Throwable $e) {
http_response_code(500);
echo json_encode([
'success' => false,
'message' => "Dotenv error"
]);
}
// Encrypt for display
$iv_length = openssl_cipher_iv_length('aes-256-cbc');
$iv = random_bytes($iv_length);
$encrypted = openssl_encrypt($plain, 'aes-256-cbc', $_ENV['PW_ENCRYPTION_KEY'], 0, $iv);
$cipher_store = base64_encode($iv . $encrypted);
if ($id > 0) {
if ($update_type === 'no_password') {
$updated = db_update($mysqli, $tableInternUsers, [
'username' => $username,
'name_person' => $namePerson,
'freigabe' => $freigabe_store,
'updated_at' => date('Y-m-d H:i:s'),
'edited_by' => $editor_id
], ['id' => $id]);
} else {
$updated = db_update($mysqli, $tableInternUsers, [
'password_hash' => $hash,
'password_cipher' => $cipher_store,
@@ -123,42 +180,14 @@ if ($id > 0) {
'updated_at' => date('Y-m-d H:i:s'),
'edited_by' => $editor_id
], ['id' => $id]);
} else {
$stmt = $mysqli->prepare(
"INSERT INTO {$tableInternUsers}
(username, name_person, password_hash, password_cipher, freigabe, created_at, updated_at, edited_by, login_active)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)"
);
$loginActive = 1;
$stmt->bind_param(
"sssssssis",
$username,
$namePerson,
$hash,
$cipher_store,
$freigabe_store,
$created_at,
$updated_at,
$editor_id,
$loginActive
);
$created_at = date('Y-m-d H:i:s');
$updated_at = $created_at;
$updated = $stmt->execute();
}
if ($updated !== false) {
if ($id == 0) { // new user
$new_id = $mysqli->insert_id;
echo json_encode(['success' => true, 'message' => $username.' wurde erfolgreich erstellt.', 'id' => $new_id]);
} else {
echo json_encode(['success' => true, 'message' => $username.' wurde erfolgreich aktualisiert.']);
}
} else {
if ($updated === false) {
echo json_encode(['success' => false, 'message' => 'DB Error']);
}
http_response_code(500);
exit;
}
echo json_encode(['success' => true, 'message' => $username.' wurde erfolgreich aktualisiert.']);
http_response_code(200);
exit;