SWDB/application/action/Edit_Profile_Action.php

<?php
/**
 * File for the profile edit action.
 *
 * Implements an action function to be called from the {@see Controller}.
 *
 * @author Iñigo Valentin <i@inigovalentin.com>
 * @license https://www.gnu.org/licenses/gpl-3.0.en.html GNU General Public License V3
 * @package SWDB
 */

require_once(PATH::ACTION . "Action.php");

/**
 * Executes the profile update.
 *
 * Reads the POST parameters looking for the following KEYS:
 *  mail: Optional, email to update.
 *  pass: Optional, password to update.
 *  currentPass: Mandatory for changing password, current one.
 *  api: Any value, indicates that the api key is to be changed.
 * Then it updates the selected info with the prameter vlue. Multiple itemss can be updated at the
 * same time.
 * 
 * @return int|string 201 on success, HTTP error codes on failure. If the API key has been updated,
 * the new key is returned instead.
 * @category Action
 */
class Edit_Profile_Action extends Action{
    
    /**
     * Executes the action.
     */
    function execute(){
        // Get the current user ID.
        $user = get_context()->get_user()->get_id();
    
        if (filter_input(INPUT_POST, "mail")){
            $mail = filter_input(INPUT_POST, 'mail');
            if (! filter_var($mail, FILTER_VALIDATE_EMAIL)){
                $this->code = 400;
                $this->message = "Invalid email address.";
                return;
            }
            $s = get_context()->get_db()->prepare('UPDATE user SET mail = :mail WHERE id = :user;');
            $s->bindValue(':user', $user, SQLITE3_TEXT);
            $s->bindValue(':mail', $mail, SQLITE3_TEXT);
            $this->code = 500;
            $this->message = "Internal error.";
            return;
        }
    
        if (filter_input(INPUT_POST, "pass")){
            $pass = sha1(filter_input(INPUT_POST, 'pass'));
            $currentPass = sha1(filter_input(INPUT_POST, 'currentPass'));
            $s = get_context()->get_db()->prepare('SELECT COUNT(id) AS count FROM user WHERE id = :id AND password = :currentPass;');
            $s->bindValue(':id', $user, SQLITE3_TEXT);
            $s->bindValue(':currentPass', $currentPass, SQLITE3_TEXT);
            $q = $s->execute();
            $r = $q->fetchArray(SQLITE3_ASSOC);
            if ($r["count"] != 1){
                $this->code = 500;
                $this->message = "Internal error.";
                return;
            }
            $s = get_context()->get_db()->prepare('UPDATE user SET password = :pass WHERE id = :id AND password = :currentPass;');
            $s->bindValue(':id', $user, SQLITE3_TEXT);
            $s->bindValue(':pass', $pass, SQLITE3_TEXT);
            $s->bindValue(':currentPass', $currentPass, SQLITE3_TEXT);
            if(!$s->execute()){
                $this->code = 500;
                $this->message = "Internal error.";
                return;
            }
        }
    
        if (filter_input(INPUT_POST, "api")){
            $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
            $charactersLength = 16;
            $api = '';
            for ($i = 0; $i < $charactersLength; $i++) {
                $api .= $characters[rand(0, $charactersLength - 1)];
            }
            $s = get_context()->get_db()->prepare('UPDATE user SET api_key = :api WHERE id = :id;');
            $s->bindValue(':id', $user, SQLITE3_TEXT);
            $s->bindValue(':api', $api, SQLITE3_TEXT);
            if(! $s->execute()){
                $this->code = 500;
                $this->message = "Internal error.";
                return;
            }
            $this->code = 200;
            $this->message = "OK.";
            $this->output = $api;
        }
    }
}