diff --git a/public/include/topbar.php b/public/include/topbar.php index 2818f2c..2b03ece 100644 --- a/public/include/topbar.php +++ b/public/include/topbar.php @@ -65,7 +65,7 @@
  • - + diff --git a/public/userprofile.php b/public/userprofile.php new file mode 100644 index 0000000..881b764 --- /dev/null +++ b/public/userprofile.php @@ -0,0 +1,605 @@ + 'My profile', + 'section_general' => 'Personal data', + 'section_password' => 'Change password', + 'section_info' => 'Account information', + 'first_name' => 'First name', + 'last_name' => 'Last name', + 'username' => 'Username', + 'email' => 'Email', + 'phone' => 'Phone', + 'birthday' => 'Birthday', + 'signaturecode' => 'Signature code', + 'privacyaccepted' => 'Privacy accepted on', + 'termuseaccepted' => 'Terms of use accepted on', + 'current_password' => 'Current password', + 'new_password' => 'New password', + 'confirm_password' => 'Confirm new password', + 'save' => 'Save changes', + 'update_password' => 'Update password', + 'not_available' => 'Not available', + 'pwd_hint' => 'At least 8 characters, with letters and numbers.', + 'ok_profile' => 'Profile updated successfully.', + 'ok_password' => 'Password updated successfully.', + 'err_csrf' => 'Session expired. Please reload the page and try again.', + 'err_required' => 'Email is required.', + 'err_email' => 'Invalid email address.', + 'err_email_taken' => 'This email is already used by another account.', + 'err_birthday' => 'Invalid birthday date.', + 'err_current_pwd' => 'Current password is not correct.', + 'err_pwd_length' => 'The new password must be at least 8 characters and contain letters and numbers.', + 'err_pwd_match' => 'The new password and confirmation do not match.', + 'err_generic' => 'An error occurred while saving. Please try again.', +]; + +function h($v) +{ + return htmlspecialchars((string)$v, ENT_QUOTES, 'UTF-8'); +} + +function fmtDate($d, $fallback) +{ + if (empty($d) || $d === '0000-00-00') { + return $fallback; + } + $dt = DateTime::createFromFormat('Y-m-d', substr($d, 0, 10)); + return $dt ? $dt->format('d/m/Y') : $fallback; +} + +/* ------------------------------------------------------------------ + * Connessione e utente loggato + * $cmctrfdb รจ la connessione mysqli usata nelle altre pagine. + * ------------------------------------------------------------------ */ +$db = $cmctrfdb; +$userId = (int)$iduserlogin; + +if ($userId <= 0) { + header('Location: index.php'); + exit; +} + +/* CSRF token */ +if (empty($_SESSION['profile_csrf'])) { + $_SESSION['profile_csrf'] = bin2hex(random_bytes(32)); +} +$csrf = $_SESSION['profile_csrf']; + +$errorsGeneral = []; +$errorsPassword = []; +$successMsg = ''; +$activeTab = 'general'; + +/* Messaggio flash dopo redirect (pattern Post/Redirect/Get) */ +if (!empty($_SESSION['profile_flash'])) { + $successMsg = $_SESSION['profile_flash']['msg']; + $activeTab = $_SESSION['profile_flash']['tab']; + unset($_SESSION['profile_flash']); +} + +/* ------------------------------------------------------------------ + * Gestione POST + * ------------------------------------------------------------------ */ +if ($_SERVER['REQUEST_METHOD'] === 'POST') { + $action = $_POST['action'] ?? ''; + $activeTab = ($action === 'password') ? 'password' : 'general'; + $validCsrf = isset($_POST['csrf']) && hash_equals($csrf, $_POST['csrf']); + + /* ---------- Dati generali ---------- */ + if ($action === 'general') { + $firstName = trim($_POST['first_name'] ?? ''); + $lastName = trim($_POST['last_name'] ?? ''); + $username = trim($_POST['username'] ?? ''); + $email = trim($_POST['email'] ?? ''); + $phone = trim($_POST['phone'] ?? ''); + $birthday = trim($_POST['birthday'] ?? ''); + + if (!$validCsrf) { + $errorsGeneral[] = $t['err_csrf']; + } else { + if ($email === '') { + $errorsGeneral[] = $t['err_required']; + } elseif (!filter_var($email, FILTER_VALIDATE_EMAIL)) { + $errorsGeneral[] = $t['err_email']; + } else { + $stmt = $db->prepare('SELECT id FROM auth_users WHERE email = ? AND id <> ? LIMIT 1'); + $stmt->bind_param('si', $email, $userId); + $stmt->execute(); + $stmt->store_result(); + if ($stmt->num_rows > 0) { + $errorsGeneral[] = $t['err_email_taken']; + } + $stmt->close(); + } + + if ($birthday !== '') { + $bd = DateTime::createFromFormat('Y-m-d', $birthday); + if (!$bd || $bd->format('Y-m-d') !== $birthday || $bd > new DateTime()) { + $errorsGeneral[] = $t['err_birthday']; + } + } + } + + if (empty($errorsGeneral)) { + $firstNameDb = ($firstName !== '') ? $firstName : null; + $lastNameDb = ($lastName !== '') ? $lastName : null; + $usernameDb = ($username !== '') ? $username : null; + $phoneDb = ($phone !== '') ? $phone : null; + $birthdayDb = ($birthday !== '') ? $birthday : null; + + $stmt = $db->prepare( + 'UPDATE auth_users + SET first_name = ?, last_name = ?, username = ?, email = ?, + phone = ?, birthday = ?, updated_at = NOW() + WHERE id = ?' + ); + $stmt->bind_param('ssssssi', $firstNameDb, $lastNameDb, $usernameDb, $emailDb, $phoneDb, $birthdayDb, $userId); + $emailDb = $email; + + if ($stmt->execute()) { + $stmt->close(); + $_SESSION['profile_flash'] = ['msg' => $t['ok_profile'], 'tab' => 'general']; + header('Location: ' . basename(__FILE__)); + exit; + } + $stmt->close(); + $errorsGeneral[] = $t['err_generic']; + } + } + + /* ---------- Password ---------- */ + if ($action === 'password') { + $currentPwd = $_POST['current_password'] ?? ''; + $newPwd = $_POST['new_password'] ?? ''; + $confirmPwd = $_POST['confirm_password'] ?? ''; + + if (!$validCsrf) { + $errorsPassword[] = $t['err_csrf']; + } else { + $stmt = $db->prepare('SELECT password FROM auth_users WHERE id = ? LIMIT 1'); + $stmt->bind_param('i', $userId); + $stmt->execute(); + $stmt->bind_result($storedHash); + $stmt->fetch(); + $stmt->close(); + + if (!password_verify($currentPwd, (string)$storedHash)) { + $errorsPassword[] = $t['err_current_pwd']; + } + if (strlen($newPwd) < 8 || !preg_match('/[A-Za-z]/', $newPwd) || !preg_match('/\d/', $newPwd)) { + $errorsPassword[] = $t['err_pwd_length']; + } + if ($newPwd !== $confirmPwd) { + $errorsPassword[] = $t['err_pwd_match']; + } + } + + if (empty($errorsPassword)) { + /* bcrypt $2y$ compatibile con Laravel/Vanguard */ + $newHash = password_hash($newPwd, PASSWORD_BCRYPT); + + $stmt = $db->prepare('UPDATE auth_users SET password = ?, remember_token = NULL, updated_at = NOW() WHERE id = ?'); + $stmt->bind_param('si', $newHash, $userId); + + if ($stmt->execute()) { + $stmt->close(); + session_regenerate_id(true); + $_SESSION['profile_flash'] = ['msg' => $t['ok_password'], 'tab' => 'password']; + header('Location: ' . basename(__FILE__)); + exit; + } + $stmt->close(); + $errorsPassword[] = $t['err_generic']; + } + } +} + +/* ------------------------------------------------------------------ + * Lettura dati utente + * ------------------------------------------------------------------ */ +$stmt = $db->prepare( + 'SELECT first_name, last_name, username, email, phone, birthday, + avatar, signaturecode, privacyaccepted, termuseaccepted + FROM auth_users + WHERE id = ? LIMIT 1' +); +$stmt->bind_param('i', $userId); +$stmt->execute(); +$userData = $stmt->get_result()->fetch_assoc(); +$stmt->close(); + +if (!$userData) { + header('Location: index.php'); + exit; +} + +/* In caso di errore ripropongo i valori inviati */ +if (!empty($errorsGeneral)) { + foreach (['first_name', 'last_name', 'username', 'email', 'phone', 'birthday'] as $f) { + $userData[$f] = trim($_POST[$f] ?? ''); + } +} + +$avatarProfile = !empty($userData['avatar']) ? $userData['avatar'] : $avatarname; +$fullName = trim(($userData['first_name'] ?? '') . ' ' . ($userData['last_name'] ?? '')); +?> + + + + + + <?php echo $titlepage; ?> - <?php echo h($t['page_title']); ?> + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    + +
    + +
    + +
    +
    +
    +
    +
      +
      2. +
      3. +
    +
    +

    +
    +
    +
    + + +
    +
    +
    +
    +
    + +
    +

    +

    +
    +
    +
    +
    +
    +
    + + + + + +
    + +
    + + +
    +
    +
    + + +
    + +
    + +
    + + +
    + + + +
    +
    + + +
    +
    + + +
    +
    + +
    +
    + + +
    +
    + + +
    +
    + +
    +
    + + +
    +
    + + +
    +
    + +
    + +
    +
    +
    +
    + + +
    +
    +
    + + +
    + +
    + +
    + + +
    + + + +
    + +
    + +
    + +
    +
    +
    + +
    +
    + +
    + +
    + +
    +
    +
    + +
    +
    + +
    + +
    + +
    +
    +
    +
    +
    + +
    + +
    +
    +
    +
    +
    + + +
    +
    +
    +
    + +
    +
    +
    + ' . h($t['not_available']) . ''; ?> +
    +
    + +
    +
    +
    + +
    +
    + +
    +
    +
    + +
    +
    +
    +
    +
    +
    +
    + + + + +
    + +
    + + + + + + + + + + + + + + + + + + \ No newline at end of file