glm94/mock-estorefront
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Just archiving this project from my Open Source Software class.

Browse Source
This commit is contained in:
glm94
2021-01-26 16:41:13 -06:00
commit d1bac9a520
50 changed files with 19232 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
classes/Login.php
+159
View File
@@ -0,0 +1,159 @@
<?php
/**
* Class login
*
* handles the user login/logout/session
* @author Panique
* @link http://www.php-login.net
* @link https://github.com/panique/php-login/
* @license http://opensource.org/licenses/MIT MIT License
*/
class Login
{
/**
* @var object The database connection
*/
private $db_connection = null;
/**
* @var string The user's name
*/
private $user_name = "";
/**
* @var string The user's mail
*/
private $user_email = "";
/**
* @var string The user's password hash
*/
private $user_password_hash = "";
/**
* @var boolean The user's login status
*/
private $user_is_logged_in = false;
/**
* @var array Collection of error messages
*/
public $errors = array();
/**
* @var array Collection of success / neutral messages
*/
public $messages = array();
/**
* the function "__construct()" automatically starts whenever an object of this class is created,
* you know, when you do "$login = new Login();"
*/
public function __construct()
{
// TODO: adapt the minimum check like in 0-one-file version
// create/read session
session_start();
// check the possible login actions:
// 1. logout (happen when user clicks logout button)
// 2. login via session data (happens each time user opens a page on your php project AFTER he has sucessfully logged in via the login form)
// 3. login via post data, which means simply logging in via the login form. after the user has submit his login/password successfully, his
// logged-in-status is written into his session data on the server. this is the typical behaviour of common login scripts.
// if user tried to log out
if (isset($_GET["logout"])) {
$this->doLogout();
}
// if user has an active session on the server
elseif (!empty($_SESSION['user_name']) && ($_SESSION['user_logged_in'] == 1)) {
$this->loginWithSessionData();
}
// if user just submitted a login form
elseif (isset($_POST["login"])) {
$this->loginWithPostData();
}
}
/**
* log in with session data
*/
private function loginWithSessionData()
{
// set logged in status to true, because we just checked for this:
// !empty($_SESSION['user_name']) && ($_SESSION['user_logged_in'] == 1)
// when we called this method (in the constructor)
$this->user_is_logged_in = true;
}
/**
* log in with post data
*/
private function loginWithPostData()
{
// if POST data (from login form) contains non-empty user_name and non-empty user_password
if (!empty($_POST['user_name']) && !empty($_POST['user_password'])) {
// create a database connection, using the constants from config/db.php (which we loaded in index.php)
$this->db_connection = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
// if no connection errors (= working database connection)
if (!$this->db_connection->connect_errno) {
// escape the POST stuff
$this->user_name = $this->db_connection->real_escape_string($_POST['user_name']);
// database query, getting all the info of the selected user
$checklogin = $this->db_connection->query("SELECT user_name, user_email, user_password_hash FROM users WHERE user_name = '" . $this->user_name . "';");
// if this user exists
if ($checklogin->num_rows == 1) {
// get result row (as an object)
$result_row = $checklogin->fetch_object();
// using PHP 5.5's password_verify() function to check if the provided passwords fits to the hash of that user's password
if (password_verify($_POST['user_password'], $result_row->user_password_hash)) {
// write user data into PHP SESSION [a file on your server]
$_SESSION['user_name'] = $result_row->user_name;
$_SESSION['user_email'] = $result_row->user_email;
$_SESSION['user_logged_in'] = 1;
// set the login status to true
$this->user_is_logged_in = true;
} else {
$this->errors[] = "Wrong password. Try again.";
}
} else {
$this->errors[] = "This user does not exist.";
}
} else {
$this->errors[] = "Database connection problem.";
}
} elseif (empty($_POST['user_name'])) {
$this->errors[] = "Username field was empty.";
} elseif (empty($_POST['user_password'])) {
$this->errors[] = "Password field was empty.";
}
}
/**
* perform the logout
*/
public function doLogout()
{
$_SESSION = array();
session_destroy();
$this->user_is_logged_in = false;
$this->messages[] = "You have been logged out.";
header('location:home.php');
}
/**
* simply return the current state of the user's login
* @return boolean user's login status
*/
public function isUserLoggedIn()
{
return $this->user_is_logged_in;
}
}
classes/Registration.php
+137
View File
@@ -0,0 +1,137 @@
<?php
/**
* Class registration
*
* handles the user registration
* @author Panique
* @link http://www.php-login.net
* @link https://github.com/panique/php-login/
* @license http://opensource.org/licenses/MIT MIT License
*/
class Registration
{
/**
* @var object $db_connection The database connection
*/
private $db_connection = null;
/**
* @var string $user_name The user's name
*/
private $user_name = "";
/**
* @var string $user_email The user's mail
*/
private $user_email = "";
/**
* @var string $user_password The user's password
*/
private $user_password = "";
/**
* @var string $user_password_hash The user's password hash
*/
private $user_password_hash = "";
/**
* @var boolean $registration_successful The user's registration success status
*/
public $registration_successful = false;
/**
* @var array $errors Collection of error messages
*/
public $errors = array();
/**
* @var array $messages Collection of success / neutral messages
*/
public $messages = array();
/**
* the function "__construct()" automatically starts whenever an object of this class is created,
* you know, when you do "$login = new Login();"
*/
public function __construct()
{
if (isset($_POST["register"])) {
$this->registerNewUser();
}
}
/**
* handles the entire registration process. checks all error possibilities, and creates a new user in the database if
* everything is fine
*/
private function registerNewUser()
{
if (empty($_POST['user_name'])) {
$this->errors[] = "Empty Username";
} elseif (empty($_POST['user_password_new']) || empty($_POST['user_password_repeat'])) {
$this->errors[] = "Empty Password";
} elseif ($_POST['user_password_new'] !== $_POST['user_password_repeat']) {
$this->errors[] = "Password and password repeat are not the same";
} elseif (strlen($_POST['user_password_new']) < 6) {
$this->errors[] = "Password has a minimum length of 6 characters";
} elseif (strlen($_POST['user_name']) > 64 || strlen($_POST['user_name']) < 2) {
$this->errors[] = "Username cannot be shorter than 2 or longer than 64 characters";
} elseif (!preg_match('/^[a-z\d]{2,64}$/i', $_POST['user_name'])) {
$this->errors[] = "Username does not fit the name scheme: only a-Z and numbers are allowed, 2 to 64 characters";
} elseif (empty($_POST['user_email'])) {
$this->errors[] = "Email cannot be empty";
} elseif (strlen($_POST['user_email']) > 64) {
$this->errors[] = "Email cannot be longer than 64 characters";
} elseif (!filter_var($_POST['user_email'], FILTER_VALIDATE_EMAIL)) {
$this->errors[] = "Your email address is not in a valid email format";
} elseif (!empty($_POST['user_name'])
&& strlen($_POST['user_name']) <= 64
&& strlen($_POST['user_name']) >= 2
&& preg_match('/^[a-z\d]{2,64}$/i', $_POST['user_name'])
&& !empty($_POST['user_email'])
&& strlen($_POST['user_email']) <= 64
&& filter_var($_POST['user_email'], FILTER_VALIDATE_EMAIL)
&& !empty($_POST['user_password_new'])
&& !empty($_POST['user_password_repeat'])
&& ($_POST['user_password_new'] === $_POST['user_password_repeat'])
) {
// TODO: the above check is redundant, but from a developer's perspective it makes clear
// what exactly we want to reach to go into this if-block
// creating a database connection
$this->db_connection = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
// if no connection errors (= working database connection)
if (!$this->db_connection->connect_errno) {
// escapin' this, additionally removing everything that could be (html/javascript-) code
$this->user_name = $this->db_connection->real_escape_string(htmlentities($_POST['user_name'], ENT_QUOTES));
$this->user_email = $this->db_connection->real_escape_string(htmlentities($_POST['user_email'], ENT_QUOTES));
$this->user_password = $_POST['user_password_new'];
// crypt the user's password with the PHP 5.5's password_hash() function, results in a 60 character hash string
// the PASSWORD_DEFAULT constant is defined by the PHP 5.5, or if you are using PHP 5.3/5.4, by the password hashing
// compatibility library
$this->user_password_hash = password_hash($this->user_password, PASSWORD_DEFAULT);
// check if user already exists
$query_check_user_name = $this->db_connection->query("SELECT * FROM users WHERE user_name = '" . $this->user_name . "';");
if ($query_check_user_name->num_rows == 1) {
$this->errors[] = "Sorry, that user name is already taken. Please choose another one.";
} else {
// write new users data into database
$query_new_user_insert = $this->db_connection->query("INSERT INTO users (user_name, user_password_hash, user_email) VALUES('" . $this->user_name . "', '" . $this->user_password_hash . "', '" . $this->user_email . "');");
if ($query_new_user_insert) {
$this->registration_successful = true;
$this->messages[] = "Registration successful! Click here to <a href='index.php'>login</a>.";
} else {
$this->errors[] = "Sorry, your registration failed. Please go back and try again.";
}
}
} else {
$this->errors[] = "An error has occured trying to connect to the database.";
}
} else {
$this->errors[] = "An unknown error occurred.";
}
}
}