diff options
Diffstat (limited to 'user')
| -rw-r--r-- | user/delete.php | 2 | ||||
| -rw-r--r-- | user/login.php | 9 | ||||
| -rw-r--r-- | user/logout.php | 2 |
3 files changed, 11 insertions, 2 deletions
diff --git a/user/delete.php b/user/delete.php index b46cdce..80740e7 100644 --- a/user/delete.php +++ b/user/delete.php @@ -13,6 +13,8 @@ if($query->execute()) { echo '<h2>Account successfully deleted</h2>'; unset($_SESSION['user_name']); unset($_SESSION['user_id']); + unset($_SESSION['user_can_edit_bugs']); + unset($_SESSION['user_can_edit_reports']); } else { echo '<h2>Account deletion failed</h2>'; } diff --git a/user/login.php b/user/login.php index a927d02..7a25d38 100644 --- a/user/login.php +++ b/user/login.php @@ -4,13 +4,18 @@ require_once(TEMPLATES_PATH . "/header.php"); session_start(); $conn = new PDO($config['db']['dsn'], $config['db']['username'], $config['db']['password']); -$query = "SELECT id, username, password FROM users WHERE username = '$_POST[username]'"; -$result = $conn->query($query)->fetch(); +$query = $conn->prepare("SELECT id, username, password, can_edit_bugs, can_edit_reports + FROM users WHERE username=:username"); +$query->bindParam(':username', $_POST['username']); +$query->execute(); +$result = $query->fetch(); if(password_verify($_POST['password'], $result['password'])) { echo 'password verified'; $_SESSION['user_name'] = $result['username']; $_SESSION['user_id'] = $result['id']; + $_SESSION['user_can_edit_bugs'] = $result['can_edit_bugs']; + $_SESSION['user_can_edit_reports'] = $result['can_edit_reports']; } else { echo 'wrong password'; } diff --git a/user/logout.php b/user/logout.php index 26bbfa0..319a43a 100644 --- a/user/logout.php +++ b/user/logout.php @@ -5,6 +5,8 @@ require_once(TEMPLATES_PATH . "/header.php"); session_start(); unset($_SESSION['user_name']); unset($_SESSION['user_id']); +unset($_SESSION['user_can_edit_bugs']); +unset($_SESSION['user_can_edit_reports']); echo 'Session cleared'; header("Refresh: 2; URL=$_SERVER[HTTP_REFERER]"); |