-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #61 from PurdueIEEE/realv2
Realv2
- Loading branch information
Showing
81 changed files
with
1,519 additions
and
12,277 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,14 @@ | ||
| # boilerbooks | ||
| The ultimate IEEE record keeping system! | ||
|
|
||
| This program is written using PHP. The website is displayed using the bootstrap framework. It is currently hosted at money.krakos.net. | ||
| This program is written using PHP. The website is displayed using the bootstrap framework. It is currently hosted at money.pieee.org. | ||
|
|
||
| In order to properly develop code you will likely need access to the database. | ||
|
|
||
| It is also important to setup a mysqldump cron job for database backups (I suggest removing backups after 30 days to save space) | ||
|
|
||
| Also use rsync (or a better solution) to make remote backups of the mysqldump's, certs, and the uploaded receipts | ||
|
|
||
| Also auto renew the ssl cert | ||
|
|
||
| Also setup ssmtp (http://www.havetheknowhow.com/Configure-the-server/Install-ssmtp.html) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| <?php | ||
| include '../../dbinfo.php'; | ||
|
|
||
|
|
||
| $email = $items = ""; | ||
| $email = test_input($_POST["email"]); | ||
| $usrn = test_input($_POST["usrn"]); | ||
| //echo $email . '<br>'; | ||
| try { | ||
| $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password); | ||
| // set the PDO error mode to exception | ||
| $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); | ||
| // anyone with approval status in a committee for any amount can view the entire committee | ||
| $sql = "SELECT U.username AS usrn FROM Users U WHERE email = '$email' AND U.username = '$usrn'"; | ||
|
|
||
| foreach ($conn->query($sql) as $row) { | ||
| $items .= $row['usrn'] . ', '; | ||
|
|
||
| } | ||
| $items = rtrim($items,', '); | ||
| } | ||
| catch(PDOException $e) | ||
| { | ||
| $returnStat = "Error"; | ||
| } | ||
|
|
||
| $conn = null; | ||
| //echo '<br>The users are:<br>' . $items . '<br>'; | ||
|
|
||
|
|
||
| if ($items != '') { | ||
| echo "Hello " . $usrn . ". You're random string is: <br>"; | ||
| $randNum = base64_encode(random_bytes(64)); | ||
| echo $randNum . "<br>and the updated random string is: <br>"; | ||
| // string replace because I'm sturgling with URL encoding | ||
| $randNum = str_replace('+','_',$randNum); | ||
| $randNum = str_replace('/','-',$randNum); | ||
| $randNum = str_replace('=','-',$randNum); | ||
| echo $randNum . "<br>and the hashed/updated random string is: <br>"; | ||
| $randNumEn = password_hash($randNum,PASSWORD_DEFAULT); | ||
| echo $randNumEn . "<br>"; | ||
|
|
||
| try { | ||
| $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password); | ||
| // set the PDO error mode to exception | ||
| $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); | ||
| $sql = "UPDATE Users SET resettime = NOW(), passwordreset='$randNumEn', modifydate=NOW() WHERE username = '$usrn'"; | ||
| $conn->exec($sql); | ||
| echo "New updated created successfully"; | ||
| } | ||
| catch(PDOException $e) | ||
| { | ||
| echo $sql . "<br>" . $e->getMessage(); | ||
| } | ||
|
|
||
| $conn = null; | ||
|
|
||
|
|
||
| /*** Send email ***/ | ||
| $to = $email; | ||
| $subject = "Boiler Books Password Reset"; | ||
|
|
||
| $user = $_SESSION['user']; | ||
| $message = "<p>Hello! A password reset was requested for " . $usrn . ". Please go to the following URL to reset your password:<br>" . $_SERVER[HTTP_HOST] . "/user/newpasswordreset.php?usrn=" . $usrn . "&rstlink=" . $randNum; | ||
|
|
||
| $header = "From:ieeeboilerbooks@gmail.com \r\n"; | ||
| $header .= "MIME-Version: 1.0\r\n"; | ||
| $header .= "Content-type: text/html\r\n"; | ||
|
|
||
| $retval = mail ($to,$subject,$message,$header); | ||
|
|
||
| if( $retval == true ) { | ||
| //echo "Message sent successfully..."; | ||
| }else { | ||
| //echo "Message could not be sent..."; | ||
| } | ||
| $header = 'Location: /user/forgotpassword.php?found=1&email=' . $email . '&usrn=' . $usrn; | ||
| header($header); | ||
|
|
||
| } | ||
| else { | ||
| $header = 'Location: /user/forgotpassword.php?found=0&email=' . $email . '&usrn=' . $usrn; | ||
| header($header); | ||
| } | ||
|
|
||
|
|
||
| ?> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,59 @@ | ||
| <?php | ||
| include '../../dbinfo.php'; | ||
| include '../../header.php'; | ||
|
|
||
|
|
||
| $email = $items = ""; | ||
| $email = test_input($_POST["email"]); //change back to POST | ||
| //echo $email . '<br>'; | ||
| try { | ||
| $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password); | ||
| // set the PDO error mode to exception | ||
| $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); | ||
| // anyone with approval status in a committee for any amount can view the entire committee | ||
| $sql = "SELECT U.username AS usrn FROM Users U WHERE email = '$email'"; | ||
|
|
||
| foreach ($conn->query($sql) as $row) { | ||
| $items .= $row['usrn'] . ', '; | ||
|
|
||
| } | ||
| $items = rtrim($items,', '); | ||
| } | ||
| catch(PDOException $e) | ||
| { | ||
| $returnStat = "Error"; | ||
| } | ||
|
|
||
| $conn = null; | ||
| //echo '<br>The users are:<br>' . $items . '<br>'; | ||
|
|
||
|
|
||
| if ($items != '') { | ||
| /*** Send email ***/ | ||
| $to = $email; | ||
| $subject = "Boiler Books Username"; | ||
|
|
||
| $user = $_SESSION['user']; | ||
| $message = "<p>Hello! A remainder of your username was requested. The following username(s) are associated with this email:<br>" . $items . ". <br><br>Please visit <a href='https://" . $_SERVER[HTTP_HOST] . "'>https://" . $_SERVER[HTTP_HOST] . "</a> to login with your username. You can also request a password reset on the Boiler Books homepage.<br><br>Thanks,<br>Boiler Books Team"; | ||
|
|
||
| $header = "From:ieeeboilerbooks@gmail.com \r\n"; | ||
| $header .= "MIME-Version: 1.0\r\n"; | ||
| $header .= "Content-type: text/html\r\n"; | ||
|
|
||
| $retval = mail ($to,$subject,$message,$header); | ||
|
|
||
| if( $retval == true ) { | ||
| //echo "Message sent successfully..."; | ||
| }else { | ||
| //echo "Message could not be sent..."; | ||
| } | ||
| $header = 'Location: /user/forgotusername.php?found=1&email=' . $email; | ||
| header($header); | ||
| } | ||
| else { | ||
| $header = 'Location: /user/forgotusername.php?found=0&email=' . $email; | ||
| header($header); | ||
| } | ||
|
|
||
|
|
||
| ?> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| <?php | ||
| /* This file is included before beginning other API calls in order to ensure the user is properly logged in. | ||
| * Variables are passed using GET. There is no response, as the user is redirected to the login page if they | ||
| * do not have the appropriate permissions | ||
| * Required: | ||
| * apikey: The api key that is generated upon login for each user | ||
| * user: The currently logged in user. This will be verified against the API key | ||
| * Optional: | ||
| * role1: If you would like to verify the user has a certain role you may pass this variable (eg. | ||
| * treasurer) | ||
| * role2: If you would like to verify the user has another certain role you may pass this variable (eg. | ||
| * president). Options will be successfully returned if either role1 OR role2 are fulfilled | ||
| */ | ||
|
|
||
|
|
||
| include '../../dbinfo.php'; | ||
|
|
||
| // define variables and set to empty values | ||
| $apikey = $user = $role1 = $role2 = ""; | ||
|
|
||
| $apikey = test_input($_GET["apikey"]); | ||
| $user = test_input($_GET["user"]); | ||
| $role1 = test_input($_GET["role1"]); | ||
| $role2 = test_input($_GET["role2"]); | ||
|
|
||
|
|
||
| try { | ||
| $conn = new PDO("mysql:host=$servername;dbname=$dbname", $username, $password); | ||
| // set the PDO error mode to exception | ||
| $conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); | ||
| $sql = "SELECT apikey, apikeygentime | ||
| FROM Users U | ||
| WHERE U.username = '$user' | ||
| AND U.username in ( | ||
| SELECT A.username | ||
| FROM approval A | ||
| WHERE A.username = U.username | ||
| AND (A.role = '$role1' OR A.role = '$role2' OR ('$role1'='' AND '$role2'='')) | ||
| ) | ||
| "; | ||
| $stmt = $conn->prepare($sql); | ||
| $stmt->execute(); | ||
|
|
||
| $results = $stmt->fetchAll(); | ||
| foreach ($results as $pswd) { | ||
| $dbpsw = $pswd['apikey']; | ||
| $dbtime = $pswd['apikeygentime']; | ||
| } | ||
| $now = date('Y-m-d H:i:s'); | ||
|
|
||
| $datetime1 = new DateTime($dbtime); | ||
| $datetime2 = new DateTime($now); | ||
| $interval = $datetime1->diff($datetime2); | ||
| //echo $interval->format('%i minutes'); | ||
| $timediff = $interval->format('%i'); | ||
|
|
||
| if (!(password_verify($apikey,$dbpsw) && ($timediff<=120))) | ||
| { | ||
|
|
||
| $headerinfo = "Location: /index.php?returnto=" . $_SERVER['REQUEST_URI']; | ||
| header($headerinfo); | ||
| die(); | ||
| } | ||
|
|
||
|
|
||
| } | ||
| catch(PDOException $e) | ||
| { | ||
| echo $sql . "<br>" . $e->getMessage(); | ||
| $headerinfo = "Location: /index.php?returnto=" . $_SERVER['REQUEST_URI']; | ||
| header($headerinfo); | ||
| die(); | ||
| } | ||
|
|
||
| $conn = null; | ||
|
|
||
| ?> | ||
|
|
||
|
|
Oops, something went wrong.