From a834ee565c72ecdfd801e9407cda3bde0f589be5 Mon Sep 17 00:00:00 2001
From: Underemployed <underemployed871@gmail.com>
Date: Fri, 29 Mar 2024 12:06:56 +0530
Subject: [PATCH] added session verification and admin check

---
 admin/add-category-logic.php  |  6 ++++-
 admin/add-category.php        |  5 ++++
 admin/add-user-logic.php      |  7 ++++--
 admin/add-user.php            |  6 ++++-
 admin/config/constants.php    |  7 ++++++
 admin/delete-category.php     |  5 ++++
 admin/edit-category-logic.php |  6 ++++-
 admin/edit-category.php       |  5 ++++
 admin/edit-post-logic.php     |  1 +
 admin/manage-categories.php   |  6 ++++-
 admin/manage-users.php        |  6 ++++-
 signin-logic.php              |  3 ++-
 signin.php                    | 43 +++++++++++------------------------
 13 files changed, 68 insertions(+), 38 deletions(-)

diff --git a/admin/add-category-logic.php b/admin/add-category-logic.php
index 6736e84..3cd5b54 100644
--- a/admin/add-category-logic.php
+++ b/admin/add-category-logic.php
@@ -1,7 +1,11 @@
 <?php
 
 require 'config/database.php';
-
+if(!isset($_SESSION['user_is_admin'])){
+    header("location: " . ROOT_URL . "logout.php");
+    //destroy all sessions and redirect user to login page
+    session_destroy();
+}
 if(isset($_POST['submit'])){
     //get form data
     $title =filter_var($_POST['title'],FILTER_SANITIZE_FULL_SPECIAL_CHARS);
diff --git a/admin/add-category.php b/admin/add-category.php
index 15299b0..b7ef60c 100644
--- a/admin/add-category.php
+++ b/admin/add-category.php
@@ -1,5 +1,10 @@
 <?php
 include "partials/header.php";
+if(!isset($_SESSION['user_is_admin'])){
+    header("location: " . ROOT_URL . "logout.php");
+    //destroy all sessions and redirect user to login page
+    session_destroy();
+}
 $title = $_SESSION["add-category-data"]['title'] ?? null;
 $description = $_SESSION["add-category-data"]['description'] ?? null;
 
diff --git a/admin/add-user-logic.php b/admin/add-user-logic.php
index 45d96ea..3d862ce 100644
--- a/admin/add-user-logic.php
+++ b/admin/add-user-logic.php
@@ -1,7 +1,10 @@
 <?php
 require "config/database.php";
-session_start();
-
+if(!isset($_SESSION['user_is_admin'])){
+    header("location: " . ROOT_URL . "logout.php");
+    //destroy all sessions and redirect user to login page
+    session_destroy();
+}
 //get add-user form data if sbmit button is clicked
 
 if(isset($_POST["submit"])){
diff --git a/admin/add-user.php b/admin/add-user.php
index 43923b6..01c8d18 100644
--- a/admin/add-user.php
+++ b/admin/add-user.php
@@ -1,6 +1,10 @@
 <?php
 include "partials/header.php";
-
+if(!isset($_SESSION['user_is_admin'])){
+    header("location: " . ROOT_URL . "logout.php");
+    //destroy all sessions and redirect user to login page
+    session_destroy();
+}
 //get beck form DATA IF THERE IS A REGISTRATION ERROR
 $firstname=$_SESSION['add-user-data']['firstname'] ?? null;
 $lastname=$_SESSION['add-user-data']['lastname'] ?? null;
diff --git a/admin/config/constants.php b/admin/config/constants.php
index 0fff81e..8363116 100644
--- a/admin/config/constants.php
+++ b/admin/config/constants.php
@@ -5,3 +5,10 @@ define('DB_HOST', 'localhost');
 define('DB_USER', 'underemployed');
 define('DB_PASS', 'admin1234');
 define('DB_NAME', 'blog');
+if (!isset($_SESSION['user-id'])) {
+    header("location: " . ROOT_URL . "logout.php");
+    //destroy all sessions and redirect user to login page
+    session_destroy();
+    die();
+    header("location: " . ROOT_URL . "signin.php");
+}
\ No newline at end of file
diff --git a/admin/delete-category.php b/admin/delete-category.php
index fafc99f..59cf9db 100644
--- a/admin/delete-category.php
+++ b/admin/delete-category.php
@@ -1,5 +1,10 @@
 <?php
 include "config/database.php";
+if(!isset($_SESSION['user_is_admin'])){
+    header("location: " . ROOT_URL . "logout.php");
+    //destroy all sessions and redirect user to login page
+    session_destroy();
+}
 if(isset($_GET['id'])){
     $id=filter_var($_GET['id'],FILTER_SANITIZE_NUMBER_INT);
 
diff --git a/admin/edit-category-logic.php b/admin/edit-category-logic.php
index a273cc9..54cb93c 100644
--- a/admin/edit-category-logic.php
+++ b/admin/edit-category-logic.php
@@ -1,6 +1,10 @@
 <?php
 require "config/database.php";
-
+if(!isset($_SESSION['user_is_admin'])){
+    header("location: " . ROOT_URL . "logout.php");
+    //destroy all sessions and redirect user to login page
+    session_destroy();
+}
 if(isset($_POST['submit'])){    
     $id = filter_var($_POST['id'], FILTER_SANITIZE_NUMBER_INT);
     $title=filter_var($_POST['title'],FILTER_SANITIZE_FULL_SPECIAL_CHARS);
diff --git a/admin/edit-category.php b/admin/edit-category.php
index 2bf59a2..4667b6e 100644
--- a/admin/edit-category.php
+++ b/admin/edit-category.php
@@ -1,5 +1,10 @@
 <?php
 include "partials/header.php";
+if(!isset($_SESSION['user_is_admin'])){
+    header("location: " . ROOT_URL . "logout.php");
+    //destroy all sessions and redirect user to login page
+    session_destroy();
+}
 if(isset($_GET['id'])){
     $id=filter_var($_GET['id'],FILTER_SANITIZE_NUMBER_INT);
 
diff --git a/admin/edit-post-logic.php b/admin/edit-post-logic.php
index e2c3100..e91c6d5 100644
--- a/admin/edit-post-logic.php
+++ b/admin/edit-post-logic.php
@@ -1,5 +1,6 @@
 <?php
 require 'config/database.php';
+
 if(isset($_POST['submit'])){
     $id=filter_var($_POST['id'],FILTER_SANITIZE_NUMBER_INT);
     $is_featured=filter_var($_POST['is_featured'],FILTER_SANITIZE_NUMBER_INT);
diff --git a/admin/manage-categories.php b/admin/manage-categories.php
index 17cf6d7..f7ffccf 100644
--- a/admin/manage-categories.php
+++ b/admin/manage-categories.php
@@ -1,6 +1,10 @@
 <?php
 include "partials/header.php";
-
+if(!isset($_SESSION['user_is_admin'])){
+    header("location: " . ROOT_URL . "logout.php");
+    //destroy all sessions and redirect user to login page
+    session_destroy();
+}
 //fetch categories from database
 $query = "SELECT * FROM categories ORDER BY title";
 $categories=mysqli_query($connection,$query)
diff --git a/admin/manage-users.php b/admin/manage-users.php
index 3cb7c5e..716963d 100644
--- a/admin/manage-users.php
+++ b/admin/manage-users.php
@@ -3,7 +3,11 @@ include "partials/header.php";
 
 
 $current_admin_id = $_SESSION['user-id'];
-
+if(!isset($_SESSION['user_is_admin'])){
+    header("location: " . ROOT_URL . "logout.php");
+    //destroy all sessions and redirect user to login page
+    session_destroy();
+}
 $query="SELECT id,firstname,lastname,username,is_admin FROM users WHERE NOT id='$current_admin_id'";
 $users=mysqli_query($connection,$query);
 ?>
diff --git a/signin-logic.php b/signin-logic.php
index 7b9adb6..8c88b9d 100644
--- a/signin-logic.php
+++ b/signin-logic.php
@@ -59,4 +59,5 @@ if(isset($_POST['submit'])){
 }else{
     header('location: ' . ROOT_URL . "signin.php");
     die();
-}
\ No newline at end of file
+}
+// error_log();
\ No newline at end of file
diff --git a/signin.php b/signin.php
index 480083e..d49e139 100644
--- a/signin.php
+++ b/signin.php
@@ -1,11 +1,10 @@
 <?php
 include 'config/constants.php';
 
-$username_email = $_SESSION['signin-data']['username_email'] ??null ;
-$password = $_SESSION['signin-data']['password'] ??  null;
+$username_email = $_SESSION['signin-data']['username_email'] ?? null;
+$password = $_SESSION['signin-data']['password'] ?? null;
 
 unset($_SESSION['signin-data']);
-
 ?>
 <!DOCTYPE html>
 <html lang="en">
@@ -22,10 +21,7 @@ unset($_SESSION['signin-data']);
     <link href="https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,300;0,400;0,500;0,600;0,800;1,700&display=swap" rel="stylesheet"> 
 </head>
 <body>
-
-
 <section class="form__section">
-
     <div class="container form__section-container">
         <h2>Sign In</h2> 
         <?php
@@ -37,36 +33,23 @@ unset($_SESSION['signin-data']);
                 unset($_SESSION['signup-success']);
                 ?>
             </p>
-            
             </div>
-        
-        
-        
         <?php elseif(isset($_SESSION['signin'])): ?>
-        
-        <div class="alert__message error">
-            <p>
-                <?=$_SESSION['signin'];
-                unset($_SESSION['signin']); 
-                ?>
-            </p>
-        </div>
-
-        <?php endif ?>
-
-
-
+            <div class="alert__message error">
+                <p>
+                    <?=$_SESSION['signin'];
+                    unset($_SESSION['signin']); 
+                    ?>
+                </p>
+            </div>
+        <?php endif; ?>
         <form action="<?= ROOT_URL ?>signin-logic.php" method="POST">
-            <input type="text"     name="username_email"  value = '<?= $username_email ?>' placeholder="Username or Email">
-            <input type="password" name="password"        value = '<?= $password ?>' placeholder=" Password">
-
-            <button type="submit" class="btn"  name ="submit"   >Sign in</button>
+            <input type="text" name="username_email" value='<?= $username_email ?>' placeholder="Username or Email">
+            <input type="password" name="password" value='<?= $password ?>' placeholder=" Password">
+            <button type="submit" class="btn" name="submit">Sign in</button>
             <small>Don't have an account? <a href="signup.php">Sign up</a></small>
         </form>
     </div>
-
 </section>
-
-
 </body>
 </html>
\ No newline at end of file