Session management for admins now includes delete capabilities

2020-01-07 13:15:03 +00:00
parent 69bb1368cb
commit 2d73384e17
3 changed files with 167 additions and 74 deletions
--- a/public/lucidAuth.login.php
+++ b/public/lucidAuth.login.php
@@ -3,7 +3,7 @@

 	include_once('../include/lucidAuth.functions.php');

-	if ($_POST['do'] == 'login') {
+	if ($_POST['do'] === 'login') {
 		$result = authenticateLDAP($_POST['username'], $_POST['password']);
 		if ($result['status'] === 'Success') {
 			// Store authentication token; in database serverside & in cookie clientside
--- a/public/lucidAuth.manage.php
+++ b/public/lucidAuth.manage.php
@@ -8,72 +8,111 @@
 	}

 	if ($validateTokenResult['status'] === "Success") {
-        if ($_REQUEST['do'] === 'retrievesessions') {
-            $storedTokens = [];
+        switch ($_REQUEST['do']) {
+            case 'retrievesessions':
+                $storedTokens = [];

-            $pdoQuery = $pdoDB->prepare('
-                SELECT SecureToken.Id, SecureToken.UserId, SecureToken.Value
-                FROM SecureToken
-                WHERE SecureToken.UserId = :userid
-            ');
-            $pdoQuery->execute([
-                ':userid'	=>	(int) $_REQUEST['userid']
-            ]);
-            foreach($pdoQuery->fetchAll(PDO::FETCH_ASSOC) as $row) {
-                try {
-                    $JWTPayload = JWT::decode($row['Value'], base64_decode($settings->JWT['PrivateKey_base64']), $settings->JWT['Algorithm']);
-                    $storedTokens[] = [
-                        'tid'   => $row['Id'],
-                        'iat'	=> $JWTPayload->iat,
-                        'iss'	=> $JWTPayload->iss,
-                        'fp'    => $JWTPayload->fp
-                    ];
-                } catch (Exception $e) {
-                    // Invalid token
-                    continue;
+                $pdoQuery = $pdoDB->prepare('
+                    SELECT SecureToken.Id, SecureToken.UserId, SecureToken.Value
+                    FROM SecureToken
+                    WHERE SecureToken.UserId = :userid
+                ');
+                $pdoQuery->execute([
+                    ':userid'	=>	(int) $_REQUEST['userid']
+                ]);
+                foreach($pdoQuery->fetchAll(PDO::FETCH_ASSOC) as $row) {
+                    try {
+                        $JWTPayload = JWT::decode($row['Value'], base64_decode($settings->JWT['PrivateKey_base64']), $settings->JWT['Algorithm']);
+                        $storedTokens[] = [
+                            'tid'   => $row['Id'],
+                            'iat'	=> $JWTPayload->iat,
+                            'iss'	=> $JWTPayload->iss,
+                            'fp'    => $JWTPayload->fp
+                        ];
+                    } catch (Exception $e) {
+                        // Invalid token
+                        continue;
+                    }
                }
-            }

-            // Return JSON object
-			header('Content-Type: application/json');
-			echo json_encode([
-				"Result"       => "Success",
-                "SessionCount" => sizeof($storedTokens),
-                "UserSessions" => json_encode($storedTokens)
-			]);
-        } else {
-            // No action requested, default action
-            include_once('../include/lucidAuth.template.php');
+                // Return JSON object
+                header('Content-Type: application/json');
+                echo json_encode([
+                    "Result"       => "Success",
+                    "SessionCount" => sizeof($storedTokens),
+                    "UserSessions" => json_encode($storedTokens)
+                ]);
+                break;
+            case 'deletesession':
+                if (isset($_REQUEST['userid']) && isset($_REQUEST['tokenid'])) {
+                    try {
+                        $pdoQuery = $pdoDB->prepare('
+                            DELETE FROM SecureToken
+                            WHERE SecureToken.UserId = :userid AND SecureToken.Id = :tokenid
+                        ');
+                        $pdoQuery->execute([
+                            ':userid'	=>	(int) $_REQUEST['userid'],
+                            ':tokenid'  =>  (int) $_REQUEST['tokenid']
+                        ]);
+                        
+                        // Return JSON object
+                        header('Content-Type: application/json');
+                        echo json_encode([
+                            "Result"			=>	"Success",
+                            "RowCount"			=>	$pdoQuery->RowCount()
+                        ]);
+                    }
+                    catch (Exception $e) {
+                        // Return JSON object
+                        header('Content-Type: application/json');
+                        echo json_encode([
+                            "Result"			=>	"Failure",
+                            "Reason"			=>	"Failed deleting tokens from database"
+                        ]);
+                        exit;
+                    }
+                } else {
+                    header('Content-Type: application/json');
+                    echo json_encode([
+                        "Result"	=>	"Failure",
+                        "Reason"	=>	"Incomplete request data"
+                    ]);
+                }
+                break;
+            default:
+                // No action requested, default action
+                include_once('../include/lucidAuth.template.php');

-            try {
-                $allUsers = $pdoDB->query('
-                    SELECT User.Id, User.Username, Role.Rolename
-                    FROM User
-                    LEFT JOIN Role
-                        ON (Role.Id = User.RoleId)
-                ')->fetchAll(PDO::FETCH_ASSOC);
-            } catch (Exception $e) {
+                try {
+                    $allUsers = $pdoDB->query('
+                        SELECT User.Id, User.Username, Role.Rolename
+                        FROM User
+                        LEFT JOIN Role
+                            ON (Role.Id = User.RoleId)
+                    ')->fetchAll(PDO::FETCH_ASSOC);
+                } catch (Exception $e) {
 // Should really do some actual errorhandling here
-                throw new Exception($e);
-            }
-            foreach($allUsers as $row) {
-                $tableRows[] = sprintf('<tr%1$s><td data-userid="%2$s">%3$s</td><td>%4$s</td><td class="immutable">%5$s</td></tr>',
-                    $validateTokenResult['uid'] === $row['Id'] ? ' class="currentuser"': null,
-                    $row['Id'],
-                    explode('\\', $row['Username'])[1],
-                    $row['Rolename'],
-                    '<button class="bttn-simple bttn-xs bttn-primary session" data-translation="button_sessions">Sessions</button>' . ($validateTokenResult['uid'] === $row['Id'] ? null : '&nbsp;<button class="bttn-simple bttn-xs bttn-primary delete" data-translation="button_delete">Delete</button>')
-                );
-            }
+                    throw new Exception($e);
+                }
+                foreach($allUsers as $row) {
+                    $tableRows[] = sprintf('<tr%1$s><td data-userid="%2$s">%3$s</td><td>%4$s</td><td class="immutable">%5$s</td></tr>',
+                        $validateTokenResult['uid'] === $row['Id'] ? ' class="currentuser"': null,
+                        $row['Id'],
+                        explode('\\', $row['Username'])[1],
+                        $row['Rolename'],
+                        '<button class="bttn-simple bttn-xs bttn-primary session" data-translation="button_sessions">Sessions</button>' . ($validateTokenResult['uid'] === $row['Id'] ? null : '&nbsp;<button class="bttn-simple bttn-xs bttn-primary delete" data-translation="button_delete">Delete</button>')
+                    );
+                }

-            echo sprintf($pageLayout['full_alt'],
-                sprintf($contentLayout['manage']['header'],
-                    $validateTokenResult['name']
-                ),
-                sprintf($contentLayout['manage']['section'],
-                    implode($tableRows)
-                )
-            );
+                echo sprintf($pageLayout['full_alt'],
+                    sprintf($contentLayout['manage']['header'],
+                        $validateTokenResult['name']
+                    ),
+                    sprintf($contentLayout['manage']['section'],
+                        implode($tableRows)
+                    )
+                );
+                break;
        }
 	} else {
 		// No cookie containing valid authentication token found;
--- a/public/misc/script.manage.js
+++ b/public/misc/script.manage.js
@@ -1,22 +1,72 @@
-jQuery.fn.inlineConfirm = function() {
-    return this.on('click', function(event) {
-        sessionID = $(this).data('sessionid');
-//        event.preventDefault();
-        $(this).off('click').parent().empty().append(
-            $('<button>', {
+jQuery.fn.ConfirmDelete = function() {
+    return this.on('click', function() {
+        var sessionID = $(this).data('sessionid');
+
+        $(this).off('click').parent().empty()
+            .append($('<button>', {
                text: locales[(localStorage.getItem('language') !== null ? localStorage.getItem('language') : 'en')]['button_yes'],
                class: 'bttn-simple bttn-xs bttn-primary sessiondeleteconfirm',
                style: 'margin-right: 3px;',
                'data-translation': 'button_yes',
                'data-sessionid': sessionID
-            })).append(
-            $('<button>', {
+            }).on('click', function() {
+                var pressedButton = $(this);
+                $(pressedButton).prop('disabled', true).css({
+                    'background':	'#999 url(data:image/gif;base64,R0lGODlhEAAQAPIAAJmZmf///7CwsOPj4////9fX18rKysPDwyH+GkNyZWF0ZWQgd2l0aCBhamF4bG9hZC5pbmZvACH5BAAKAAAAIf8LTkVUU0NBUEUyLjADAQAAACwAAAAAEAAQAAADMwi63P4wyklrE2MIOggZnAdOmGYJRbExwroUmcG2LmDEwnHQLVsYOd2mBzkYDAdKa+dIAAAh+QQACgABACwAAAAAEAAQAAADNAi63P5OjCEgG4QMu7DmikRxQlFUYDEZIGBMRVsaqHwctXXf7WEYB4Ag1xjihkMZsiUkKhIAIfkEAAoAAgAsAAAAABAAEAAAAzYIujIjK8pByJDMlFYvBoVjHA70GU7xSUJhmKtwHPAKzLO9HMaoKwJZ7Rf8AYPDDzKpZBqfvwQAIfkEAAoAAwAsAAAAABAAEAAAAzMIumIlK8oyhpHsnFZfhYumCYUhDAQxRIdhHBGqRoKw0R8DYlJd8z0fMDgsGo/IpHI5TAAAIfkEAAoABAAsAAAAABAAEAAAAzIIunInK0rnZBTwGPNMgQwmdsNgXGJUlIWEuR5oWUIpz8pAEAMe6TwfwyYsGo/IpFKSAAAh+QQACgAFACwAAAAAEAAQAAADMwi6IMKQORfjdOe82p4wGccc4CEuQradylesojEMBgsUc2G7sDX3lQGBMLAJibufbSlKAAAh+QQACgAGACwAAAAAEAAQAAADMgi63P7wCRHZnFVdmgHu2nFwlWCI3WGc3TSWhUFGxTAUkGCbtgENBMJAEJsxgMLWzpEAACH5BAAKAAcALAAAAAAQABAAAAMyCLrc/jDKSatlQtScKdceCAjDII7HcQ4EMTCpyrCuUBjCYRgHVtqlAiB1YhiCnlsRkAAAOwAAAAAAAAAAAA==) no-repeat center',
+                    'color':		'transparent',
+                    'transform':	'rotateX(180deg)',
+                    'cursor':       'default'
+                }).next().prop('disabled', true).addClass('disabled');
+
+                $.post("lucidAuth.manage.php", {
+                    do: "deletesession",
+                    tokenid: sessionID,
+                    userid: $(pressedButton).closest('tr').data('userid')
+                })
+                .done(function(data,_status) {
+                    if (data.Result === 'Success') {
+                        $(pressedButton).css({
+                            'background':	'green url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAaklEQVQ4jeXOMQ5AQBBG4T2BC4i76EWich7ncAKbqCRuodTqnMNTkFgJs3ZU4tXz/Rlj/hUQv8EpMAClFk9sjUAiHVcCnoFMwhZYgPYG575Xe46aIOyMdJx7ji9GwrEzUgOFCu8DkRp/qxU2BKCUyZR6ygAAAABJRU5ErkJggg==) no-repeat center',
+                            'transform':	'rotateX(0deg)'
+                        });
+                        setTimeout(function() {
+                            $(pressedButton).closest('tr').fadeOut(500, function() {
+                                $(this).remove()});
+                        }, 2250);
+                    } else {
+                        $(pressedButton).css({
+        					'background':	'red url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAACXBIWXMAAAsTAAALEwEAmpwYAAAAv0lEQVQ4jaWT0Q3CMAxELwh1BEag87AJ6hcLlE/KBLABrNEV2h26QaXHj4NMGgpS7sfJJXd24kQqRMiRQC3pIKk2apD0DCEMq25ABZyBmSVmW6vWxH1GmKLPmph7xJQReq5dnNmVPQE7oHOCzrhoMts9vQ1OSbYOCBb92OPkDe6ZkqMwJwa4SdJmtS1/YGsx7e9VUiPpYvPG4tHtGUsvcf+RkpI2mkHZQ3ImLd+fcpuKf32meM5R0iOEMOb2F+EF33vgCePVr8UAAAAASUVORK5CYII=) no-repeat center',
+                            'transform':	'rotateX(0deg)'
+                        });
+                        setTimeout(function() {
+                            $(pressedButton).closest('td').empty()
+                                .append(
+                                    $('<button>', {
+                                        text: locales[(localStorage.getItem('language') !== null ? localStorage.getItem('language') : 'en')]['button_delete'],
+                                        class: 'bttn-simple bttn-xs bttn-primary sessiondelete',
+                                        'data-translation': 'button_delete',
+                                        'data-sessionid': sessionID
+                                    }).ConfirmDelete())
+                        }, 2250);
+                    }
+                });
+            }))
+            .append($('<button>', {
                text: locales[(localStorage.getItem('language') !== null ? localStorage.getItem('language') : 'en')]['button_no'],
                class: 'bttn-simple bttn-xs bttn-primary sessiondeletecancel',
                'data-translation': 'button_no',
                'data-sessionid': sessionID
-            })
-        );
+            }).on('click', function() {
+                var pressedButton = $(this);
+                $(pressedButton).closest('td').empty()
+                .append(
+                    $('<button>', {
+                        text: locales[(localStorage.getItem('language') !== null ? localStorage.getItem('language') : 'en')]['button_delete'],
+                        class: 'bttn-simple bttn-xs bttn-primary sessiondelete',
+                        'data-translation': 'button_delete',
+                        'data-sessionid': sessionID
+                    }).ConfirmDelete())
+            }))
    });
 };

@@ -35,9 +85,11 @@ $(document).ready(function(){
        $('#sessions tbody').empty();
        $('#sessions').fadeToggle();

+        var userID = $(this).closest('tr').find('td:nth-child(1)').data('userid');
+
        $.post("lucidAuth.manage.php", {
 			do: "retrievesessions",
-			userid: $(this).closest('tr').find('td:nth-child(1)').data('userid')
+			userid: userID
 		})
 		.done(function(data,_status) {
 			if (data.Result === 'Success') {
@@ -51,7 +103,9 @@ $(document).ready(function(){
                    } catch(e) {
                        // Do nothing
                    } 
-                    $('#sessiontable tbody').append($('<tr>')
+                    $('#sessiontable tbody').append($('<tr>', {
+                            'data-userid': userID
+                        })
                        .append($('<td>', {
                            text: new Date(Sessions[i]['iat'] * 1000).toLocaleString('en-GB')
                        }))
@@ -70,7 +124,7 @@ $(document).ready(function(){
                        }))
                    );
                }
-                $('#sessiontable .sessiondelete').inlineConfirm();
+                $('#sessiontable .sessiondelete').ConfirmDelete();
 			} else {
 			}
 		});