FM / includes

/home/techb158/immovalet.ca/includes

Name	Size	Mode	Actions
db_connect.php	7824	0666	edit dl rm
db_connects.php	292	0666	edit dl rm
forgetpassword.php	4105	0666	edit dl rm
functions.php	16866	0666	edit dl rm
functions1.php	12247	0666	edit dl rm
logout.php	722	0666	edit dl rm
process_login.php	2203	0666	edit dl rm
psl-config.php	2196	0666	edit dl rm
psl-config 1.php	2107	0666	edit dl rm
psl-config3.php	2107	0666	edit dl rm
psl-configs.php	1674	0666	edit dl rm
register-client.php	7543	0666	edit dl rm
register.inc.php	3390	0666	edit dl rm
register.php	27274	0666	edit dl rm
registerclient.php	8859	0666	edit dl rm
requestsubmission.php	23523	0666	edit dl rm
reset.php	3984	0666	edit dl rm

Edit: /home/techb158/immovalet.ca/includes/register.php (27274B)

<?php

include_once 'db_connect.php';
include_once 'psl-config.php';
sec_session_start();

$error_msg = "";

if(isset($_POST["submitassist"]) && $_POST["submitassist"]!="") {
	 	
if (isset ($_POST['username'], $_POST['email'], $_POST['p'], $_POST['initiale'], $_POST['Fullname'], $_POST['Familyname'], $_POST['cellphone'], $_POST['Personnaladdressd'])) {
    // Sanitize and validate the data passed in

$initiales = filter_input(INPUT_POST, 'initiale', FILTER_SANITIZE_STRING);
 $Companynames = $_POST['Companyname'];
 $FName = $_POST['Fullname'];
 $LName = $_POST['Familyname'];
 $Address = $_POST['Personnaladdressd'];
 $Phone = $_POST['cellphone']; 
 $username = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_STRING);
 $email = filter_input(INPUT_POST, 'email', FILTER_SANITIZE_EMAIL);
 
 $email = filter_var($email, FILTER_VALIDATE_EMAIL);
 if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
 // Not a valid email
 $error_msg .= 'The email address you entered is not valid';
 }
 
 $password = filter_input(INPUT_POST, 'p', FILTER_SANITIZE_STRING);
 if (strlen($password) != 128) {
 // The hashed pwd should be 128 characters long.
 // If it's not, something really odd has happened
 $error_msg .= 'Invalid password configuration.';
 }

// Username validity and password validity have been checked client side.
 // This should should be adequate as nobody gains any advantage from
 // breaking these rules.
 //
 $prep_stmt = "SELECT ID FROM Admin WHERE Username = ? LIMIT 1";
 
 $stmt = $mysqli->prepare($prep_stmt);
 
 if ($stmt) {
 $stmt->bind_param('s', $username);
 $stmt->execute();
 $stmt->store_result();
 
 if ($stmt->num_rows == 1) {
 // A user with this email address already exists
 $error_msg .= 'A user with this user name already exists.';
 }
 } else {
 $error_msg .= 'Database error';
 }
 $prep_stmt = "SELECT ID FROM Master WHERE Username = ? LIMIT 1";
 
 $stmt = $mysqli->prepare($prep_stmt);
 
 if ($stmt) {
 $stmt->bind_param('s', $username);
 $stmt->execute();
 $stmt->store_result();
 
 if ($stmt->num_rows == 1) {
 // A user with this email address already exists
 $error_msg .= 'A user with this user name already exists.';
 }
 } else {
 $error_msg .= 'Database error';
 }
 
 $prep_stmt = "SELECT ID FROM Assist WHERE Username = ? LIMIT 1";
 
 $stmt = $mysqli->prepare($prep_stmt);
 
 if ($stmt) {
 $stmt->bind_param('s', $username);
 $stmt->execute();
 $stmt->store_result();
 
 if ($stmt->num_rows == 1) {
 // A user with this email address already exists
 $error_msg .= 'A user with this user name already exists.';
 }
 } else {
 $error_msg .= 'Database error';
 }
 
	 $prep_stmt = "SELECT ID FROM Sales WHERE Username = ? LIMIT 1";
 
 $stmt = $mysqli->prepare($prep_stmt);
 
 if ($stmt) {
 $stmt->bind_param('s', $username);
 $stmt->execute();
 $stmt->store_result();
 
 if ($stmt->num_rows == 1) {
 // A user with this email address already exists
 $error_msg .= 'A user with this user name already exists.';
 }
 } else {
 $error_msg .= 'Database error';
 }

$prep_stmt = "SELECT ID FROM Users WHERE Username = ? LIMIT 1";
 
 $stmt = $mysqli->prepare($prep_stmt);
 
 if ($stmt) {
 $stmt->bind_param('s', $username);
 $stmt->execute();
 $stmt->store_result();
 
 if ($stmt->num_rows == 1) {
 // A user with this email address already exists
 $error_msg .= 'A user with this user name already exists.';
 }
 } else {
 $error_msg .= 'Database error';
 }

// TODO: 
    // We'll also have to account for the situation where the user doesn't have
    // rights to do registration, by checking what type of user is attempting to
    // perform the operation.
   
//$error_msg .= $username .' '. $FName .' '. $LName .' '. $email .' '. $Phone  .' '. $Address  .' '. $random_salt  .' '. $datetime .' '. $Managers_ID;
    if (empty($error_msg)) {
        // Create a random salt
        $random_salt = hash('sha512', uniqid(openssl_random_pseudo_bytes(16), TRUE));

// Create salted password 
        $password = hash('sha512', $password . $random_salt); 
	$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
	
	$Managers_ID= $_SESSION['username'];
	$query = "SELECT * FROM Master Where Username ='".$Managers_ID."'";	
	$result = $mysqli->query($query);	
	$Admin = $result->fetch_assoc();	
	$ManagerID = $Admin['ID'];	
	$Company_names = $Admin['Company_Name'];	
	if(($Company_names == $Companynames) && ($Companynames == ""))
	{
	$CompanynamesID = $Company_names;
	}else{
	$CompanynamesID = $_POST['Companyname'];
	}
        // Insert the new user into the database 
      //if ($insert_stmt = $mysqli->prepare("INSERT INTO $User_Type (Username, Email, Password, salt) VALUES (?, ?, ?, ?)")) {
	//$insert_stmt->bind_param('ssss', $username, $email, $password, $random_salt);
        if ($insert_stmt = $mysqli->prepare("INSERT INTO Assist (Manager_ID, Initial, Username, First_Name, Last_name, Company_Name, Email, Phone, Address, Password, salt, Register_Time) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")) {
           $insert_stmt->bind_param('ssssssssssss',$ManagerID,$initiales,$username,$FName,$LName,$CompanynamesID,$email,$Phone,$Address,$password,$random_salt,$datetime);
           
            // Execute the prepared query.
            if (! $insert_stmt->execute()) {
		header('Location: addassist.php?error=Registration failure!');
                //header('Location: addassist.php?error='.$Managers_ID.'');
                exit();
            }else
	    {
		       header('Location: addassist.php?error=register success!');
       exit();
		    
	    }
        } 
      
       header('Location: addassist.php?error=register success!');
       exit();
    }

}else
{
header('Location: addassist.php?error=all information are required!');
  exit();
    
}
}else if(isset($_POST["submitsales"]) && $_POST["submitsales"]!="") {
if (isset ($_POST['username'], $_POST['email'], $_POST['p'], $_POST['initiale'], $_POST['Fullname'], $_POST['Familyname'], $_POST['cellphone'], $_POST['Personnaladdressd'])) {
    // Sanitize and validate the data passed in

// Create salted password 
        $password = hash('sha512', $password . $random_salt); 
	$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
	
	$Managers_ID= $_SESSION['username'];
	$query = "SELECT * FROM Master Where Username ='".$Managers_ID."'";	
	$result = $mysqli->query($query);	
	$Admin = $result->fetch_assoc();	
	$ManagerID = $Admin['ID'];	
	$Company_names = $Admin['Company_Name'];	
	if(($Company_names == $Companynames) && ($Companynames == ""))
	{
	$CompanynamesID = $Company_names;
	}else{
	$CompanynamesID = $_POST['Companyname'];
	}
        // Insert the new user into the database 
      //if ($insert_stmt = $mysqli->prepare("INSERT INTO $User_Type (Username, Email, Password, salt) VALUES (?, ?, ?, ?)")) {
	//$insert_stmt->bind_param('ssss', $username, $email, $password, $random_salt);
        if ($insert_stmt = $mysqli->prepare("INSERT INTO Sales (Manager_ID, Initial, Username, First_Name, Last_name, Company_Name, Email, Phone, Address, Password, salt, Register_Time) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")) {
           $insert_stmt->bind_param('ssssssssssss',$ManagerID,$initiales,$username,$FName,$LName,$CompanynamesID,$email,$Phone,$Address,$password,$random_salt,$datetime);
           
            // Execute the prepared query.
            if (! $insert_stmt->execute()) {
		header('Location: addsales.php?error=Registration failure!');
                //header('Location: addassist.php?error='.$Managers_ID.'');
                exit();
            }else
	    {
		       header('Location: addsales.php?error=register success!');
       exit();
		    
	    }
        } 
      
       header('Location: addsales.php?error=register success!');
       exit();
    }

}else
{
header('Location: addsales.php?error=all information are required!');
  exit();
    
}
}else if(isset($_POST["submituser"]) && $_POST["submituser"]!="") {
if (isset ($_POST['username'], $_POST['email'], $_POST['p'], $_POST['initiale'], $_POST['Fullname'], $_POST['Familyname'], $_POST['cellphone'], $_POST['Personnaladdressd'])) {
    // Sanitize and validate the data passed in

// TODO: 
    // We'll also have to account for the situation where the user doesn't have
    // rights to do registration, by checking what type of user is attempting to
    // perform the operation.
   
//$error_msg .= $username .' '. $FName .' '. $LName .' '. $email .' '. $Phone  .' '. $Address  .' '. $random_salt  .' '. $datetime .' '. $Managers_ID;
    //if (empty($error_msg)) {
        // Create a random salt
        $random_salt = hash('sha512', uniqid(openssl_random_pseudo_bytes(16), TRUE));

// Create salted password 
        $password = hash('sha512', $password . $random_salt); 
	$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
	$Managers_ID = $_SESSION['user_id'];
	
	$query = "SELECT * FROM Master Where ID ='".$Managers_ID."'";	
	$result = $mysqli->query($query);	
	$Admin = $result->fetch_assoc();	
	$ManagerID = $Admin['ID'];	
	$Company_names = $Admin['Company_Name'];	
	if(($Company_names == $Companynames) && ($Companynames == ""))
	{
	$CompanynamesID = $Company_names;
	}else{
	$CompanynamesID = $_POST['Companyname'];
	}
        // Insert the new user into the database 
      //if ($insert_stmt = $mysqli->prepare("INSERT INTO $User_Type (Username, Email, Password, salt) VALUES (?, ?, ?, ?)")) {
	//$insert_stmt->bind_param('ssss', $username, $email, $password, $random_salt);
   // $error_msg .= $ManagerID .' '. $initiales .' '. $username .' '. $FName .' '. $LName .' '. $CompanynamesID .' '. $email .' '. $Phone .' '. $Address .' '. $password .' '. $random_salt .' '. $datetime;
	//if (empty($error_msg)) {

if ($insert_stmt = $mysqli->prepare("INSERT INTO Users (Manager_ID, Initial, Username, First_Name, Last_name, Company_Name, Email, Phone, Address, Password, salt, Register_Time) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")) {
           $insert_stmt->bind_param('ssssssssssss',$ManagerID,$initiales,$username,$FName,$LName,$CompanynamesID,$email,$Phone,$Address,$password,$random_salt,$datetime);
           
            // Execute the prepared query.
            if (! $insert_stmt->execute()) {
		header('Location: adduser.php?error=Registration failure!');
                //header('Location: addassist.php?error='.$Managers_ID.'');
                exit();
            }else
	    {
		       header('Location: adduser.php?error=register success!');
       exit();
		    
	    }
        } 
		  header('Location: adduser.php?error=register success!');
       exit();
	  //} 
     
    //}

}else
{
header('Location: adduser.php?error=all information are required!');
  exit();
    
}

}else if(isset($_POST["submitinspector"]) && $_POST["submitinspector"]!="") {
 if (isset ($_POST['username'], $_POST['email'], $_POST['p'], $_POST['initiale'], $_POST['Fullname'], $_POST['Familyname'], $_POST['cellphone'], $_POST['Personnaladdressd'])) {
    // Sanitize and validate the data passed in

$prep_stmt = "SELECT ID FROM Printer WHERE Username = ? LIMIT 1";
 
 $stmt = $mysqli->prepare($prep_stmt);
 
 if ($stmt) {
 $stmt->bind_param('s', $username);
 $stmt->execute();
 $stmt->store_result();
 
 if ($stmt->num_rows == 1) {
 // A user with this email address already exists
 $error_msg .= 'A user with this user name already exists.';
 }
 } else {
 $error_msg .= 'Database error';
 }
 
 $prep_stmt = "SELECT ID FROM Inspector WHERE Username = ? LIMIT 1";
 
 $stmt = $mysqli->prepare($prep_stmt);
 
 if ($stmt) {
 $stmt->bind_param('s', $username);
 $stmt->execute();
 $stmt->store_result();
 
 if ($stmt->num_rows == 1) {
 // A user with this email address already exists
 $error_msg .= 'A user with this user name already exists.';
 }
 } else {
 $error_msg .= 'Database error';
 }

// Create salted password 
        $password = hash('sha512', $password . $random_salt); 
	$datetime =date("Y/m/d") . ' ' . date('H:i:s') ;
	
	$Managers_ID= $_SESSION['username'];
	$query = "SELECT * FROM Master Where Username ='".$Managers_ID."'";	
	$result = $mysqli->query($query);	
	$Admin = $result->fetch_assoc();	
	$ManagerID = $Admin['ID'];	
	$Company_names = $Admin['Company_Name'];	
	if(($Company_names == $Companynames) && ($Companynames == ""))
	{
	$CompanynamesID = $Company_names;
	}else{
	$CompanynamesID = $_POST['Companyname'];
	}
        // Insert the new user into the database 
      //if ($insert_stmt = $mysqli->prepare("INSERT INTO $User_Type (Username, Email, Password, salt) VALUES (?, ?, ?, ?)")) {
	//$insert_stmt->bind_param('ssss', $username, $email, $password, $random_salt);
        if ($insert_stmt = $mysqli->prepare("INSERT INTO Inspector (Manager_ID, Initial, Username, First_Name, Last_name, Company_Name, Email, Phone, Address, Password, salt, Register_Time) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)")) {
           $insert_stmt->bind_param('ssssssssssss',$ManagerID,$initiales,$username,$FName,$LName,$CompanynamesID,$email,$Phone,$Address,$password,$random_salt,$datetime);
           
            // Execute the prepared query.
            if (! $insert_stmt->execute()) {
		header('Location: addinspector.php?error=Registration failure!');
                //header('Location: addassist.php?error='.$Managers_ID.'');
                exit();
            }else
	    {
		       header('Location: addinspector.php?error=register success!');
       exit();
		    
	    }
        } 
      
       header('Location: addinspector.php?error=register success!');
       exit();
    }

}else
{
header('Location: addinspector.php?error=all information are required!');
  exit();
    
}
}

cmd: