From 2a64aa0e847e960c3828f98e1cc67a2790bc3b73 Mon Sep 17 00:00:00 2001 From: Jepp9350 <2jepp9350@gmail.com> Date: Fri, 10 Jan 2025 11:50:28 +0100 Subject: [PATCH] Refactor user handling and improve data validation. Reorganized class properties for better accessibility and added a `nullify` method for handling null values in the database. Enhanced customer handling logic to prevent duplicate records and ensure password nullification. Improved password validation and user authentication checks for stricter input handling. --- classes/authentication.php | 4 +++ classes/object_property.php | 19 +++++++++--- objects/users_o.php | 59 ++++++++++++++++++++----------------- routes/authRoute.php | 2 +- 4 files changed, 52 insertions(+), 32 deletions(-) diff --git a/classes/authentication.php b/classes/authentication.php index 2da14864..83e77492 100644 --- a/classes/authentication.php +++ b/classes/authentication.php @@ -19,6 +19,10 @@ class authentication implements authentication_i if (!$customer->exists()) { return false; } + // Check if the customer has a password + if (!$customer->password->value()) { + return false; + } // Check if the password is correct if (!$this->match_passwords($password, $customer->password->value())) { return false; diff --git a/classes/object_property.php b/classes/object_property.php index 7892642a..01cf3211 100644 --- a/classes/object_property.php +++ b/classes/object_property.php @@ -4,8 +4,8 @@ namespace classes; class object_property { - private string $table; // The table of the objects in the database (e.g. users) - public int $id; // The id of the object in the database + public int $id; // The table of the objects in the database (e.g. users) + private string $table; // The id of the object in the database private string $column; // The column name of the field in the database table (e.g. id, name, email) private string $type; // The data type of the field in the database table (e.g. int, varchar, text) private bool $required; // Whether the field is required or not @@ -53,12 +53,23 @@ class object_property // If the value is null, set it to null if ($value === null) { $sql = "UPDATE $this->table SET $this->column = NULL WHERE id = $this->id"; - } - // If the value is a string, escape it + } // If the value is a string, escape it else { $value = $db->escape_string($value); $sql = "UPDATE $this->table SET $this->column = '$value' WHERE id = $this->id"; } $db->query($sql); } + + /** + * Nullify the value of the field in the database table + */ + public function nullify(): void + { + // Set the value of the field in the database table to null + global /** @var db $db */ + $db; + $sql = "UPDATE $this->table SET $this->column = NULL WHERE id = $this->id"; + $db->query($sql); + } } \ No newline at end of file diff --git a/objects/users_o.php b/objects/users_o.php index 514648ef..26a57331 100644 --- a/objects/users_o.php +++ b/objects/users_o.php @@ -106,18 +106,43 @@ class users_o extends db if (isset($customer_data[0])) { // Avoid SQL injection $customer_number = $db->escape_string($customer_data[0]->customerNumber); - // Create a new record in the database - $sql = "INSERT INTO $this->table (customer_number) VALUES ('$customer_number')"; - $db->query($sql); - // Get the id of the new record - $this->id = $db->insert_id(); - // Set the values of the object properties - $this->getObjectProperties(); + // Double check if the customer exists + $sql = "SELECT * FROM $this->table WHERE customer_number = '$customer_number'"; + $result = $db->query($sql); + if ($result->num_rows > 0) { + $this->id = $result->fetch_assoc()['id']; + $this->getObjectProperties(); + } else { + // Import the customer + $this->add($customer_number, '', 0); + // Nullify the password + $this->password->nullify(); + } } // Else return false return false; } + public function add(string $customer_number, mixed $password, int $role = 0): void + { + global $db; + // Avoid SQL injection + $customer_number = $db->escape_string($customer_number); + $role = $db->escape_string($role); + // Hash the password + $password = password_hash($password, PASSWORD_DEFAULT); + $password = $db->escape_string($password); + // Create a new record in the database + $sql = "INSERT INTO $this->table (customer_number, password, group_id) VALUES ('$customer_number', '$password', $role)"; + $db->query($sql); + + // Get the id of the new record + $this->id = $db->insert_id(); + + // Set the values of the object properties + $this->getObjectProperties(); + } + public function automaticGetTargetUserFromRequest(): users_o { // Get the data from the request @@ -212,26 +237,6 @@ class users_o extends db $customer_notes->add($customer_id, $note, $cashier_id); } - public function add(string $customer_number, mixed $password, int $role = 0): void - { - global $db; - // Avoid SQL injection - $customer_number = $db->escape_string($customer_number); - $role = $db->escape_string($role); - // Hash the password - $password = password_hash($password, PASSWORD_DEFAULT); - $password = $db->escape_string($password); - // Create a new record in the database - $sql = "INSERT INTO $this->table (customer_number, password, group_id) VALUES ('$customer_number', '$password', $role)"; - $db->query($sql); - - // Get the id of the new record - $this->id = $db->insert_id(); - - // Set the values of the object properties - $this->getObjectProperties(); - } - public function deleteNote(int $note_id): void { global $db; diff --git a/routes/authRoute.php b/routes/authRoute.php index 449eb373..4373e202 100644 --- a/routes/authRoute.php +++ b/routes/authRoute.php @@ -21,7 +21,7 @@ class authRoute if (!isset($data['customer_number']) || empty($data['customer_number']) || !is_numeric($data['customer_number']) || $data['customer_number'] < 1) { $response->error('Customer number is required', 400); } - if (!isset($data['password'])) { + if (!isset($data['password']) || empty($data['password']) || strlen($data['password']) < 1) { $response->error('Password is required', 400); } // Try to log the user in