ARCHIVED-IZYIM/includes/func.class/login.func.php

<?php

/*
 *  The SQL Injection Prevention are handled by BINDING
 *  $db->bind(something)
 * 
 */

global $app;
global $csrf;
global $twilio;

use Symfony\Component\HttpFoundation\Request;
use Symfony\Component\HttpFoundation\Response;
use Twilio\Rest\Client;

$sid = 'ACf33c135ae826f004d380c8ef3e437eae'; 
$token = '3b0fcbf497d12ce4a13c99020046a880'; 
$twilio = new Client($sid, $token);


function get_client_ip() {
    $ipaddress = '';
    if (isset($_SERVER['HTTP_CLIENT_IP']))
        $ipaddress = $_SERVER['HTTP_CLIENT_IP'];
    else if (isset($_SERVER['HTTP_X_FORWARDED_FOR']))
        $ipaddress = $_SERVER['HTTP_X_FORWARDED_FOR'];
    else if (isset($_SERVER['HTTP_X_FORWARDED']))
        $ipaddress = $_SERVER['HTTP_X_FORWARDED'];
    else if (isset($_SERVER['HTTP_FORWARDED_FOR']))
        $ipaddress = $_SERVER['HTTP_FORWARDED_FOR'];
    else if (isset($_SERVER['HTTP_FORWARDED']))
        $ipaddress = $_SERVER['HTTP_FORWARDED'];
    else if (isset($_SERVER['REMOTE_ADDR']))
        $ipaddress = $_SERVER['REMOTE_ADDR'];
    else
        $ipaddress = 'UNKNOWN';
    return $ipaddress;
}

function loginLog($user_id, $status) {
    global $db;
    $ip = get_client_ip();
    // Prevent SQL Injection
    $db->bind("user_id", $user_id);
    $db->bind("ip", $ip);
    $db->bind("status", $status);
    // Execute
    $db->query("INSERT INTO login_log(user_id,date,ip_address,status) VALUES(:user_id,CURRENT_TIMESTAMP,:ip,:status)");
}

$app->post('/login/auth', function (Request $request)  {
    global $db;
    $username = $request->get('username');
    $password = $request->get('password');
    // Prevent SQL Injection
    $db->bind("username", $username);
    $db->bind("password", $password);
    // Execute
    $users = $db->query("SELECT * FROM users WHERE username= :username && password= :password && status = 1");
    if (count($users) > 0) {
        $_SESSION["username"] = $username;
        $_SESSION["user_id"] = $users[0]["user_id"];
        $_SESSION["role"] = $users[0]["role"];
        $_SESSION["group_id"] = $users[0]["group_id"];
		if($users[0]["role"] > 0){
			$_SESSION["company_id"] = getCompany($users[0]["user_id"]);
			$_SESSION["branch_id"] = getBranch($users[0]["user_id"]);
		}else{
			$_SESSION["company_id"] = 0;
			$_SESSION["branch_id"] = 0;
		}
        loginLog($_SESSION["user_id"], "SUCCESS");
		
        return new Response('Success', 200);
    } else {
        loginLog($_SESSION["user_id"], "FAILED");
        return new Response('Failed', 401);
    }
});
$app->post('/forgot-password/reset', function (Request $request)  {
    global $db;
	global $global_env;
    $username = $request->get('username');
    $db->bind("username", $username);
   $users = $db->query("SELECT * FROM users WHERE username= :username  && status = 1");
    if (count($users) > 0) {
        $newPwd = xToken(6);
		$encrypt = $newPwd;
        // SETELAH DAPAT PASSWORD UPDATE DULU
        $db->bind('password', $encrypt);
        $db->bind('username', $username);
        $update = $db->query("UPDATE users SET password = :password WHERE username = :username");
        if ($update) {			
            return new Response('Success', 200);
        } else {
            return new Response('Failed', 201);
        }
    } else {

        return new Response('Failed', 201);
    }
});

$app->post('/register/check', function(Request $request) {
        global $db;
        $username = $request->get('username');
        $db->bind('username', $username);
        $row = $db->query("SELECT user_id FROM users WHERE username = :username");
        if (count($row) > 0) {
            $status = 'false';
        } else {
            $status = 'true';
        }
        echo $status;
        return '';
    });
$app->post('/register/check-verification', function(Request $request) {
        global $db;
        $verification_no = $request->get('verification_no');
        $username = $request->get('username');
        $db->bind('verification_no', $verification_no);
        $db->bind('username', $username);
        $row = $db->query("SELECT * FROM mobile_verifications WHERE mobile = :username and verification_code = :verification_no");
        if (count($row) > 0) {
            $status = 'true';
        } else {
            
			$status = 'false';
        }
        echo $status;
        return '';
    });
$app->post('/register/send-verification', function(Request $request) {
        global $db;
		
		global $twilio;
		$username = $request->get('username');
		$verification_code = mt_rand(100000,999999);
		
        $db->bind('mobile', $username);
        $db->bind('verification_code', $verification_code);
		$userReg = $db->query("INSERT INTO mobile_verifications(mobile,verification_code) VALUES(:mobile,:verification_code)");
		
        if ($userReg) {
			$twilio->messages->create(
				$username,
				array(
					'from' => '+601130115722',
					'body' => 'Your 6 digit verification number is : ' .$verification_code . ' '
				)
			);
			return new Response("SUCCESS", 200);
        } else {
			return new Response("FAILED", 400);
        }
    });
$app->post('/register/submit', function(Request $request) {
        global $db;
        global $global_env;
        // Catch the GET
        $username = $request->get('username');
        $password = $request->get('password');    
        $group_id = $request->get('role');    
		$created_on = date("Y-m-d H:i:s");
		
        // END
        // Check if the request match the conditional
        if (!userExist($username) && groupExist($group_id) && is_numeric($group_id)) {
            // PREPARE
			
			$db->bind("username", $username);
            $db->bind("password", $password);
            $db->bind("group_id", $group_id);
            $db->bind("created_on", $created_on);
			
			
            // Record to users to get the user id
            $userReg = $db->query("INSERT INTO users(username,password,created_on,role,group_id) VALUES(:username,:password,:created_on,'1',:group_id)");
            $user_id = $db->lastInsertId();
            if ($userReg && $user_id) {
                // Record User Detail
                // PREPARE
                $db->bind("user_id", $user_id);
				
                // EXECUTE
                $userDetRec = $db->query("INSERT INTO user_detail(user_id) VALUES(:user_id)");
                                
                if ($userDetRec) {
					// action_log($_SESSION['user_id'], "User Registration " . $first_name . " " . $last_name ." (" .$username . ")", "SUCCESS");
                    return new Response("SUCCESS", 200);
                } else {
					// action_log($_SESSION['user_id'], "User Registration " . $first_name . " " . $last_name ." (" .$username . ")", "FAILED");
                    return new Response('FAILED', 200);
                }
            }
        }
    });
$app->get('/login', function() {
    global $app;
    $title = "IZYIM - Login";
    if (is_login()) {
		return $app->redirect('/dashboard');
    } else {
        require_once __DIR__ . '/../tpl/login.php';
        return "";
    }
});
$app->get('/forgot-password', function()  {
    global $app;
    $title = "IZYIM - Reset Password";
    if (is_login()) {
        return $app->redirect('/dashboard');
    } else {
        require_once __DIR__ . '/../tpl/resetpwd.php';
        return "";
    }
});
$app->get('/register', function()  {
    global $app;
    $title = "IZYIM - Registration";
    if (is_login()) {
        return $app->redirect('/dashboard');
    } else {
        require_once __DIR__ . '/../tpl/register.php';
        return "";
    }
});
$app->get('/logout', function() {
    global $app;
    echo "Successfully logged out. </br>";
    session_destroy();
    return $app->redirect('/login');
});