feat: security section in /account

3 files changed, 77 insertions, 29 deletions

diff --git a/public/account/index.php b/public/account/index.php
index 80af380..7bb19f5 100644
--- a/public/account/index.php
+++ b/public/account/index.php
@@ -13,9 +13,9 @@ if (!isset($_SESSION["user_id"], $_SESSION["user_name"])) {
     exit;
 }
 
-if ($_SERVER['REQUEST_METHOD'] == "POST") {
-    $db = new PDO(DB_URL, DB_USER, DB_PASS);
+$db = new PDO(DB_URL, DB_USER, DB_PASS);
 
+if ($_SERVER['REQUEST_METHOD'] == "POST") {
     $username = str_safe($_POST["username"] ?? "", ACCOUNT_USERNAME_LENGTH[1]);
 
     if (!empty($username) && $username != $_SESSION["user_name"]) {
@@ -135,9 +135,30 @@ if ($_SERVER['REQUEST_METHOD'] == "POST") {
 
                     <hr>
 
-                    <form action="/account/signout.php">
-                        <h2>Security</h2>
-                        <button type="submit">Sign out everywhere</button>
+                    <form action="/account/security.php" method="post">
+                        <h2>Security & Privacy</h2>
+                        <div>
+                            <label for="password-current">Current password:</label>
+                            <input type="password" name="password-current" id="form-password-current">
+                            <label for="password-new">New password:</label>
+                            <input type="password" name="password-new" id="form-password-new">
+                        </div>
+                        <div>
+                            <input type="checkbox" name="hide-actions" value="1" id="form-hide-actions" <?php
+                            $stmt = $db->prepare("SELECT hide_actions FROM user_preferences WHERE id = ?");
+                            $stmt->execute([$_SESSION["user_id"]]);
+                            if (intval($stmt->fetch()[0]) == 1) {
+                                echo 'checked';
+                            }
+                            ?>>
+                            <label for="hide-actions" class="inline">Hide actions</label>
+                        </div>
+                        <div>
+                            <input type="checkbox" name="signout-everywhere" value="1" id="form-signout-everywhere">
+                            <label for="signout-everywhere" class="inline">Sign out everywhere</label>
+                        </div>
+
+                        <button type="submit">Apply</button>
                     </form>
 
                     <form action="/account/delete.php">
diff --git a/public/account/security.php b/public/account/security.php
new file mode 100644
index 0000000..5110f71
--- /dev/null
+++ b/public/account/security.php
@@ -0,0 +1,51 @@
+<?php
+
+include_once "../../src/accounts.php";
+include_once "../../src/alert.php";
+include_once "../../src/config.php";
+
+if ($_SERVER["REQUEST_METHOD"] != "POST" || !authorize_user(true)) {
+    header("Location: /account");
+    exit;
+}
+
+$db = new PDO(DB_URL, DB_USER, DB_PASS);
+
+$stmt = $db->prepare("SELECT * FROM users WHERE id = ?");
+$stmt->execute([$_SESSION["user_id"]]);
+
+$user = $stmt->fetch();
+$current_password = $_POST["password-current"] ?? "";
+
+if ($user["password"] != null && !password_verify($current_password, $user["password"])) {
+    generate_alert("/account", "Password is required to apply changes in 'Security' section");
+    exit;
+}
+
+if (!empty($_POST["password-new"])) {
+    $password = $_POST["password-new"];
+    if (ACCOUNT_PASSWORD_MIN_LENGTH > strlen($password)) {
+        generate_alert("/account", "Your password must be at least " . ACCOUNT_PASSWORD_MIN_LENGTH . " characters");
+        exit;
+    }
+
+    $db->prepare("UPDATE users SET password = ? WHERE id = ?")
+        ->execute([password_hash($password, PASSWORD_DEFAULT), $user["id"]]);
+}
+
+$hide_actions = (int) (intval($_POST["hide-actions"] ?? "0") == 1);
+
+$db->prepare("UPDATE user_preferences SET hide_actions = ? WHERE id = ?")
+    ->execute([$hide_actions, $user["id"]]);
+
+if (intval($_POST["signout-everywhere"] ?? "0") == 1) {
+    $db->prepare("UPDATE users SET secret_key = ? WHERE id = ?")
+        ->execute([generate_random_string(ACCOUNT_SECRET_KEY_LENGTH), $_SESSION["user_id"]]);
+
+    session_unset();
+    session_destroy();
+
+    setcookie("secret_key", "", time() - 1000);
+}
+
+generate_alert("/account", "Your changes have been applied!", 200);
\ No newline at end of file
diff --git a/public/account/signout.php b/public/account/signout.php
deleted file mode 100644
index 66a0cac..0000000
--- a/public/account/signout.php
+++ /dev/null
@@ -1,24 +0,0 @@
-<?php
-include "../../src/utils.php";
-include_once "../../src/config.php";
-
-session_start();
-
-if (!isset($_SESSION["user_id"])) {
-    header("Location: /account");
-    exit;
-}
-
-$db = new PDO(DB_URL, DB_USER, DB_PASS);
-
-$stmt = $db->prepare("UPDATE users SET secret_key = ? WHERE id = ?");
-$stmt->execute([generate_random_string(32), $_SESSION["user_id"]]);
-
-session_unset();
-session_destroy();
-
-setcookie("secret_key", "", time() - 1000);
-
-$db = null;
-
-header("Location: /account");
\ No newline at end of file