diff --git a/public/lucidAuth.login.php b/public/lucidAuth.login.php index 4af3a1c..837bed7 100644 --- a/public/lucidAuth.login.php +++ b/public/lucidAuth.login.php @@ -3,7 +3,7 @@ include_once('../include/lucidAuth.functions.php'); - if ($_POST['do'] == 'login') { + if ($_POST['do'] === 'login') { $result = authenticateLDAP($_POST['username'], $_POST['password']); if ($result['status'] === 'Success') { // Store authentication token; in database serverside & in cookie clientside diff --git a/public/lucidAuth.manage.php b/public/lucidAuth.manage.php index 263dc02..22653d3 100644 --- a/public/lucidAuth.manage.php +++ b/public/lucidAuth.manage.php @@ -8,72 +8,111 @@ } if ($validateTokenResult['status'] === "Success") { - if ($_REQUEST['do'] === 'retrievesessions') { - $storedTokens = []; + switch ($_REQUEST['do']) { + case 'retrievesessions': + $storedTokens = []; - $pdoQuery = $pdoDB->prepare(' - SELECT SecureToken.Id, SecureToken.UserId, SecureToken.Value - FROM SecureToken - WHERE SecureToken.UserId = :userid - '); - $pdoQuery->execute([ - ':userid' => (int) $_REQUEST['userid'] - ]); - foreach($pdoQuery->fetchAll(PDO::FETCH_ASSOC) as $row) { - try { - $JWTPayload = JWT::decode($row['Value'], base64_decode($settings->JWT['PrivateKey_base64']), $settings->JWT['Algorithm']); - $storedTokens[] = [ - 'tid' => $row['Id'], - 'iat' => $JWTPayload->iat, - 'iss' => $JWTPayload->iss, - 'fp' => $JWTPayload->fp - ]; - } catch (Exception $e) { - // Invalid token - continue; + $pdoQuery = $pdoDB->prepare(' + SELECT SecureToken.Id, SecureToken.UserId, SecureToken.Value + FROM SecureToken + WHERE SecureToken.UserId = :userid + '); + $pdoQuery->execute([ + ':userid' => (int) $_REQUEST['userid'] + ]); + foreach($pdoQuery->fetchAll(PDO::FETCH_ASSOC) as $row) { + try { + $JWTPayload = JWT::decode($row['Value'], base64_decode($settings->JWT['PrivateKey_base64']), $settings->JWT['Algorithm']); + $storedTokens[] = [ + 'tid' => $row['Id'], + 'iat' => $JWTPayload->iat, + 'iss' => $JWTPayload->iss, + 'fp' => $JWTPayload->fp + ]; + } catch (Exception $e) { + // Invalid token + continue; + } } - } - // Return JSON object - header('Content-Type: application/json'); - echo json_encode([ - "Result" => "Success", - "SessionCount" => sizeof($storedTokens), - "UserSessions" => json_encode($storedTokens) - ]); - } else { - // No action requested, default action - include_once('../include/lucidAuth.template.php'); + // Return JSON object + header('Content-Type: application/json'); + echo json_encode([ + "Result" => "Success", + "SessionCount" => sizeof($storedTokens), + "UserSessions" => json_encode($storedTokens) + ]); + break; + case 'deletesession': + if (isset($_REQUEST['userid']) && isset($_REQUEST['tokenid'])) { + try { + $pdoQuery = $pdoDB->prepare(' + DELETE FROM SecureToken + WHERE SecureToken.UserId = :userid AND SecureToken.Id = :tokenid + '); + $pdoQuery->execute([ + ':userid' => (int) $_REQUEST['userid'], + ':tokenid' => (int) $_REQUEST['tokenid'] + ]); + + // Return JSON object + header('Content-Type: application/json'); + echo json_encode([ + "Result" => "Success", + "RowCount" => $pdoQuery->RowCount() + ]); + } + catch (Exception $e) { + // Return JSON object + header('Content-Type: application/json'); + echo json_encode([ + "Result" => "Failure", + "Reason" => "Failed deleting tokens from database" + ]); + exit; + } + } else { + header('Content-Type: application/json'); + echo json_encode([ + "Result" => "Failure", + "Reason" => "Incomplete request data" + ]); + } + break; + default: + // No action requested, default action + include_once('../include/lucidAuth.template.php'); - try { - $allUsers = $pdoDB->query(' - SELECT User.Id, User.Username, Role.Rolename - FROM User - LEFT JOIN Role - ON (Role.Id = User.RoleId) - ')->fetchAll(PDO::FETCH_ASSOC); - } catch (Exception $e) { + try { + $allUsers = $pdoDB->query(' + SELECT User.Id, User.Username, Role.Rolename + FROM User + LEFT JOIN Role + ON (Role.Id = User.RoleId) + ')->fetchAll(PDO::FETCH_ASSOC); + } catch (Exception $e) { // Should really do some actual errorhandling here - throw new Exception($e); - } - foreach($allUsers as $row) { - $tableRows[] = sprintf('%3$s%4$s%5$s', - $validateTokenResult['uid'] === $row['Id'] ? ' class="currentuser"': null, - $row['Id'], - explode('\\', $row['Username'])[1], - $row['Rolename'], - '' . ($validateTokenResult['uid'] === $row['Id'] ? null : ' ') - ); - } + throw new Exception($e); + } + foreach($allUsers as $row) { + $tableRows[] = sprintf('%3$s%4$s%5$s', + $validateTokenResult['uid'] === $row['Id'] ? ' class="currentuser"': null, + $row['Id'], + explode('\\', $row['Username'])[1], + $row['Rolename'], + '' . ($validateTokenResult['uid'] === $row['Id'] ? null : ' ') + ); + } - echo sprintf($pageLayout['full_alt'], - sprintf($contentLayout['manage']['header'], - $validateTokenResult['name'] - ), - sprintf($contentLayout['manage']['section'], - implode($tableRows) - ) - ); + echo sprintf($pageLayout['full_alt'], + sprintf($contentLayout['manage']['header'], + $validateTokenResult['name'] + ), + sprintf($contentLayout['manage']['section'], + implode($tableRows) + ) + ); + break; } } else { // No cookie containing valid authentication token found; diff --git a/public/misc/script.manage.js b/public/misc/script.manage.js index 8c77255..175d13c 100644 --- a/public/misc/script.manage.js +++ b/public/misc/script.manage.js @@ -1,22 +1,72 @@ -jQuery.fn.inlineConfirm = function() { - return this.on('click', function(event) { - sessionID = $(this).data('sessionid'); -// event.preventDefault(); - $(this).off('click').parent().empty().append( - $('