SWDB/application/action/Register_Action.php

<?php
/**
 * File for the login action.
 *
 * Implements an action function to be called from the {@see Controller}.
 *
 * @author Iñigo Valentin <i@inigovalentin.com>
 * @license https://www.gnu.org/licenses/gpl-3.0.en.html GNU General Public License V3
 * @package SWDB
 */

require_once(PATH::ACTION . "Action.php");

/**
 * Logs the user in.
 *
 * Reads the POST parameters looking for the following KEYS:
 *  uname: username.
 *  e-mail: e-mail.
 *  password: password.
 *  password_repeat: password.
 * If there is a match, it generates a token and sets cookies and session variablesand
 * redirects to the user homepage.
 *
 * @category Action
 */
class Register_Action extends Action{
    
    /**
     * Executes the action.
     */
    function execute(){

        if (!isset($_POST['uname'])){
            $this->code = 400;
            $this->message = "Username is required.";
            header("Location: " . URL::BASE . "register/");
            return;
        }
        if (!isset($_POST['password'])){
            $this->code = 400;
            $this->message = "Password is required.";
            header("Location: " . URL::BASE . "register/");
            return;
        }
        if (!isset($_POST['password_repeat'])){
            $this->code = 400;
            $this->message = "Passwords do not match.";
            header("Location: " . URL::BASE . "register/");
            return;
        }
        if (!isset($_POST['mail'])){
            $this->code = 400;
            $this->message = "eMail is required.";
            header("Location: " . URL::BASE . "register/");
            return;
        }
        $uname = SQLite3::escapeString($_POST['uname']);
        if (strlen($uname) == 0){
            $this->code = 400;
            $this->message = "Username is required.";
            header("Location: " . URL::BASE . "register/");
            return;
        }
        $mail = SQLite3::escapeString($_POST['mail']);
        // TODO: Validate email
        if (strlen($mail) == 0){
            $this->code = 400;
            $this->message = "eMail is required.";
            header("Location: " . URL::BASE . "register/");
            return;
        }
        $password = SQLite3::escapeString($_POST['password']);
        if (strlen($password) == 0){
            $this->code = 400;
            $this->message = "Password is required.";
            header("Location: " . URL::BASE . "register/");
            return;
        }
        $password_repeat = SQLite3::escapeString($_POST['password_repeat']);
        if ($password_repeat != $password){
            $this->code = 400;
            $this->message = "Passwords do not match.";
            header("Location: " . URL::BASE . "register/");
            return;
        }
        $statement = get_context()->get_db()->prepare("
          SELECT count(id) AS c
          FROM user WHERE name = :name;
        ");
        $statement->bindValue(":name", $uname, SQLITE3_TEXT);
        if ($statement->execute()->fetchArray(SQLITE3_ASSOC)["c"] != 0){
            $this->code = 400;
            $this->message = "Username already in use.";
            header("Location: " . URL::BASE . "register/");
            return;
        }
        $statement = get_context()->get_db()->prepare("
          SELECT count(id) AS c
          FROM user WHERE mail = :mail;
        ");
        $statement->bindValue(":mail", $mail, SQLITE3_TEXT);
        if ($statement->execute()->fetchArray(SQLITE3_ASSOC)["c"] != 0){
            $this->code = 400;
            $this->message = "Mail address already in use.";
            header("Location: " . URL::BASE . "register/");
            return;
        }
        
        // All data is correct
        
        // Generate an API key
        $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
        $charactersLength = 16;
        $api = '';
        for ($i = 0; $i < $charactersLength; $i++) {
            $api .= $characters[rand(0, $charactersLength - 1)];
        }
        
        // Encode password
        $password = hash('sha256', $password);
        
        // Insert
        $statement = get_context()->get_db()->prepare("
          INSERT INTO user (id, name, mail, password, api_key, admin)
          VALUES(
            (SELECT max(id) + 1 FROM user),
            :name,
            :mail,
            :password,
            :api_key,
            :admin
          );
        ");
        $statement->bindValue(":name", $uname, SQLITE3_TEXT);
        $statement->bindValue(":mail", $uname, SQLITE3_TEXT);
        $statement->bindValue(":password", $password, SQLITE3_TEXT);
        $statement->bindValue(":api_key", $api, SQLITE3_TEXT);
        $statement->bindValue(":admin", 0, SQLITE3_INTEGER);
        $statement->execute();
        $statement->execute();
        // TODO: Redirect to login?
        $this->code = 204;
        $this->message = "No content.";
        header("Location: " . URL::BASE);
        return;
    }
}