HarryZalessky · HarryZalessky · Jan 8, 2018
diff --git a/Website/GUI/FindWork.php b/Website/GUI/FindWork.php
@@ -0,0 +1,22 @@
+<?php
+require_once '../WebServices/functions.php';
+sessionManager();
+?>
+<!DOCTYPE html>
+<html>
+    <head>
+        <meta charset="UTF-8">
+        <link rel="stylesheet" type="text/css" href="../style.css">
+        <title>DevLancer - Developer jobs for freelancers</title>
+    </head>
+    <body>
+        <?php
+        if (isset($_SESSION["USER_ID"])) {
+            require_once '../includes/header_signed-in.php';
+        } else {
+            require_once '../includes/header.php';
+        }
+        ?>
+        <script type="text/javascript" src="/scripts.js"></script>
+    </body>
+</html>
diff --git a/Website/GUI/PostAProject.php b/Website/GUI/PostAProject.php
@@ -0,0 +1,28 @@
+<?php
+require_once '../WebServices/functions.php';
+sessionManager();
+?>
+<!DOCTYPE html>
+<html>
+    <head>
+        <meta charset="UTF-8">
+        <link rel="stylesheet" type="text/css" href="../style.css">
+        <title>DevLancer - Developer jobs for freelancers</title>
+    </head>
+    <body>
+        <?php
+        if (isset($_SESSION["USER_ID"])) {
+            require_once '../includes/header_signed-in.php';
+        } else {
+            require_once '../includes/header.php';
+        }
+        ?>
+        <div>
+        <form>
+            <input type="text" placeholder="project name"><br>
+            <textarea></textarea>
+        </form>
+        </div>
+        <script type="text/javascript" src="/scripts.js"></script>
+    </body>
+</html>
diff --git a/Website/GUI/index.php b/Website/GUI/index.php
@@ -1,13 +1,22 @@
+<?php
+require_once '../WebServices/functions.php';
+sessionManager();
+?>
 <!DOCTYPE html>
 <html>
     <head>
         <meta charset="UTF-8">
-        <link rel="stylesheet" type="text/css" href="/style.css">
+        <link rel="stylesheet" type="text/css" href="../style.css">
         <title>DevLancer - Developer jobs for freelancers</title>
     </head>
     <body>
-        <header>
-            this is header
-        </header>
+        <?php 
+            if(isset($_SESSION["USER_ID"])){
+                require_once '../includes/header_signed-in.php';
+            } else {
+                require_once '../includes/header.php';
+            }
+        ?>
+        <script type="text/javascript" src="/scripts.js"></script>
     </body>
-</html>
+</html>
diff --git a/Website/Media/devlancer_horizontal.png b/Website/Media/devlancer_horizontal.png
diff --git a/Website/Media/devlancer_vertical.png b/Website/Media/devlancer_vertical.png
diff --git a/Website/Media/messages_icon.png b/Website/Media/messages_icon.png
diff --git a/Website/WebServices/dbConnect.php b/Website/WebServices/dbConnect.php
@@ -1,8 +1,24 @@
 <?php
-    $dbPath="127.0.0.1";
-    $dbName="final_project";
-    $dbUser="root";
-    $dbPass="";
-    function dbConnect($dbPath, $dbName, $dbUser, $dbPass) {
-
-}
+error_reporting(E_ERROR | E_PARSE);
+require_once 'psl-config.php';
+
+
+    function openConn() {
+        $conn = new mysqli(HOST, USER, PASS, DBNAME);
+        if($conn->connect_error) {
+            die("Couldn't connect");
+            return -1;
+        }
+        return $conn;
+    }
+    function openPerConn() {
+        $conn = mysqli_connect('p:' . HOST, USER, PASS, DBNAME);
+        if($conn->connect_error) {
+            die("Couldn't connect");
+            return -1;
+        }
+        return $conn;
+    }
+    function closeConn($conn) {
+        mysqli_close($conn);
+    }
diff --git a/Website/WebServices/functions.php b/Website/WebServices/functions.php
@@ -0,0 +1,164 @@
+<?php
+require 'dbConnect.php';
+
+function sessionManager() {
+    session_start();
+
+    $link = openPerConn();
+    $results;
+    if(isset ($_SESSION['USER_ID'])) {
+        if(isset($_SESSION['USERAGENT'])) {
+            if($_SESSION['USERAGENT'] === $_SERVER['HTTP_USER_AGENT']) {
+                loginSuccessfulSetters();
+                return;
+            } else {
+                unset($_SESSION['USER_ID']);
+                unset($_SESSION['USERAGENT']);
+                $_SESSION['USERAGENT'] = $_SERVER['HTTP_USER_AGENT'];
+            }
+        } else {
+            unset($_SESSION['USER_ID']);
+            $_SESSION['USERAGENT'] = $_SERVER['HTTP_USER_AGENT'];
+        }
+    } elseif (isset ($_COOKIE['publickey'])) {
+        if(strlen($_COOKIE['publickey']) >= 33) {
+            $publickey = substr($_COOKIE['publickey'], -32);
+            $userid = substr($_COOKIE['publickey'], 0, -32);
+            if($results = $link->query("SELECT * FROM `autologin` WHERE `user_id` = ".$userid." AND `publickey` = '".$publickey."'")) {
+                $resultArr = mysqli_fetch_all($results, MYSQLI_ASSOC);
+                foreach ($resultArr as $row) {
+                    foreach($row['privatekey'] as $value) {
+                        if($value === genPrivateString($userid)) {
+                            $_SESSION["USER_ID"] = $userid;
+                            $_SESSION["USERAGENT"] = $_SERVER["HTTP_USER_AGENT"];
+                            loginSuccessfulSetters();
+                            return;
+                        }
+                    }
+                }
+                goto Guest;
+            } else {
+                goto Guest;
+            }
+        } else {
+            goto Guest;
+        }
+    } else {
+        goto Guest;
+        Guest: {
+            $result = $link->query("SELECT * FROM `groups` WHERE `group_name` LIKE 'Guest'");
+            $arr = mysqli_fetch_all($result, MYSQLI_ASSOC);
+            $groupid = intval($arr[0]['id']);
+            $_SESSION["GROUP_ID"] = $groupid;
+        }
+    }
+    closeConn($link);
+}
+function checkUserExist($username, $email, $conn) {
+    if($stmt = $conn->prepare("SELECT * FROM `users` WHERE `username` LIKE ?")) {
+        $stmt->bind_param('s', $username);
+        $stmt->execute();
+        $result = $stmt->get_result();
+        $row_cnt=$result->num_rows;
+        if($row_cnt>0) {
+            return 1;
+        }
+        $result=NULL;
+    } else {
+        $error = $conn->errno . ' ' . $conn->error;
+    echo $error; // 1054 Unknown column 'foo' in 'field list'
+    }
+    $stmt = $conn->prepare("SELECT * FROM users WHERE email LIKE ?");
+    $stmt->bind_param('s', $email);
+    if($stmt->execute()) {
+        $result = $stmt->get_result();
+        $row_cnt=$result->num_rows;
+        if($row_cnt>0) {
+            return 2;
+        }
+    } else {
+        $error = $conn->errno . ' ' . $conn->error;
+    echo $error; // 1054 Unknown column 'foo' in 'field list'
+    }
+    return 0;
+}
+function checkEmailBanned($email, $conn) {
+    if($stmt = $conn->prepare("SELECT notes FROM `banned_emails` WHERE ? LIKE `email_regex`")) {
+        $stmt->bind_param('s', $email);
+        $stmt->execute();
+        $result = $stmt->get_result();
+        $row_cnt=$result->num_rows;
+        if($row_cnt>0) {
+            $error = mysqli_fetch_assoc($result)['notes'];
+            return $error;
+        }
+    } else {
+        $error = $conn->errno . ' ' . $conn->error;
+    echo $error; // 1054 Unknown column 'foo' in 'field list'
+    }
+    return 0;
+}
+function genSalt($max) {
+        $characterList = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%&*?";
+        $i = 0;
+        $salt = "";
+        while ($i < $max) {
+            $salt .= $characterList{mt_rand(0, (strlen($characterList) - 1))};
+            $i++;
+        }
+        return $salt;
+};
+function hashPass($password) {
+    return md5($password);
+}
+function genHash($salt, $passHash) {
+    return md5($passHash.md5($salt));
+}
+function insertUser($conn, $username, $email, $salt, $passHash, $regIp) {
+    if($stmt = $conn->prepare("INSERT INTO `users`(`username`, `email`, `salt`, `passhash`, `reg_date`, `last_login_date`, `reg_ip`, `last_login_ip`, `must_validate`) VALUES (?,?,?,?,now(),now(),?,?, 1)")) {
+        $stmt->bind_param('ssssii', $username, $email, $salt, $passHash, $regIp, $regIp);
+        $result = $stmt->execute();
+        if($conn->errno===0) {
+            return 0;
+        } else {
+            return 'Couldn\'t complete the registration. please contact us at "Webmaster@devlancer.com" for further info' ;
+        }
+    } else {
+        $error = $conn->errno . ' ' . $conn->error;
+    echo $error; // 1054 Unknown column 'foo' in 'field list'
+    }
+}
+function genPrivateKey($userid) {
+    $link = openPerConn();
+    $stmt = $conn->prepare("SELECT salt FROM `users` WHERE `id` = :userid");
+    $stmt->bindParam(':userid', $userid);
+    if($result = $stmt->execute()) {
+        $result = $stmt->get_result();
+        $arr = mysqli_fetch_array($result, MYSQLI_NUM);
+        $salt = $arr[0];
+    }
+    return md5(md5($salt).md5($_SERVER['HTTP_USER_AGENT']));
+}
+function grabPofileImage($userid) {
+    $image = '../profile_images/'.$userid.'.*';
+    $res = glob($image);
+    if(!empty($res)) {
+        return $res[0];
+    } else {
+        return '../profile_images/default.jpg';
+    }
+
+}
+function loginSuccessfulSetters() {
+    $link = openPerConn();
+    $stmt = $link->prepare("SELECT * FROM users WHERE id LIKE ?");
+    $stmt->bind_param('i', $_SESSION['USER_ID']);
+    $stmt->execute();
+    $result = $stmt->get_result();
+    $arr = mysqli_fetch_all($result, MYSQLI_ASSOC);
+    $arr = $arr[0];
+
+    $_SESSION['full_name'] = $arr['full_name'];
+    closeConn($link);        
+}
+    ?>
diff --git a/Website/WebServices/login.php b/Website/WebServices/login.php
@@ -0,0 +1,84 @@
+<?php
+require 'functions.php';
+session_start();
+if(isset($_POST['submit'])) {
+    if(filter_var($_POST['username'], FILTER_VALIDATE_EMAIL)) {
+        $email = $_POST['username'];
+        $password = $_POST['password'];
+        $link = openPerConn();
+        if(checkUserExist('1', $email, $link) == 2) {
+            $stmt = $link->prepare("SELECT * FROM users WHERE email LIKE ?");
+            $stmt->bind_param('s', $email);
+            $stmt->execute();
+            $result = $stmt->get_result();
+            $arr = mysqli_fetch_all($result, MYSQLI_ASSOC);
+            $arr = $arr[0];
+            if(md5(md5($password).md5($arr['salt'])) == md5($arr['passhash'].md5($arr['salt']))) {
+                if($arr['must_validate'] == 1) {
+                    if(isset($_GET['verify'])) {
+                        if(md5() == $_GET['verify']) {
+                            $stmt = $link->prepare("UPDATE users SET must_validate=0 WHERE `id`= ?");
+                            $stmt->bind_param('i',$arr['id']);
+                            $stmt->execute();
+                            $_SESSION['USER_ID'] = $arr['id'];
+
+                        } else {
+                            header("Location: ../GUI/index.php?popup=login&username=$email&error=3");
+                        }
+                    } else {
+                        //check if login allowed, if yes login with not verified user permissions, if no show error message
+
+                    }
+                } else {
+                    $_SESSION['USER_ID'] = intval($arr['id']);
+                    //$_SESSION['USER_NAME']
+
+                    header('Location: ../GUI/index.php');
+                }
+            } else {
+                header("Location: ../GUI/index.php?popup=login&username=$email&error=2");
+            }
+        } else {
+            header("Location: ../GUI/index.php?popup=login&username=$email&error=1");
+        }
+    } else {
+        $username = $_POST['username'];
+        $password = $_POST['password'];
+        $link = openPerConn();
+        if(checkUserExist($username, '1', $link) == 1) {
+            $stmt = $link->prepare("SELECT * FROM users WHERE username LIKE ?");
+            $stmt->bind_param('s', $username);
+            $stmt->execute();
+            $result = $stmt->get_result();
+            $arr = mysqli_fetch_all($result, MYSQLI_ASSOC);
+            $arr = $arr[0];
+            if(md5(md5($password).md5($arr['salt'])) == md5($arr['passhash'].md5($arr['salt']))) {
+                if($arr['must_validate'] == 1) {
+                    if(isset($_GET['verify'])) {
+                        if(md5() == $_GET['verify']) {
+                            $stmt = $link->prepare("UPDATE users SET must_validate=0 WHERE `id`= ?");
+                            $stmt->bind_param('i',$arr['id']);
+                            $stmt->execute();
+                            $_SESSION['USER_ID'] = $arr['id'];
+                        } else {
+                            header("Location: ../GUI/index.php?popup=login&username=$username&errno=3");
+                        }
+                    } else {
+                        //check if login allowed, if yes login with not verified user permissions, if no show error message
+                    }
+                } else {
+                    $_SESSION['USER_ID'] = intval($arr['id']);
+                    $_SESSION["USERAGENT"] = $_SERVER["HTTP_USER_AGENT"];
+                    loginSuccessfulSetters();
+                    header('Location: ../GUI/index.php');
+                }
+            } else {
+                header("Location: ../GUI/index.php?popup=login&username=$username&errno=2");
+            }
+        } else {
+            header("Location: ../GUI/index.php?popup=login&username=$username&errno=1");
+        }
+    }
+}
+closeConn($link);
+?>
diff --git a/Website/WebServices/logout.php b/Website/WebServices/logout.php
@@ -0,0 +1,10 @@
+<?php
+session_start();
+if(isset($_SESSION["USER_ID"])) {
+    unset($_SESSION["USER_ID"]);
+}
+if(isset($_COOKIE["publickey"])) {
+    unset($_COOKIE["publickey"]);
+}
+header("location:../GUI");
+?>
diff --git a/Website/WebServices/psl-config.php b/Website/WebServices/psl-config.php
@@ -0,0 +1,10 @@
+<?php
+define("HOST", "localhost");
+define("USER", "WebService");
+define("PASS", "Harry&Anna1F0rever!");
+define("DBNAME", "final_project");
+
+define("CAN_REGISTER", "any");
+define("DEFAULT_ROLE", "member");
+
+define("SECURE", FALSE);