SWDB/application/action/edit_profile.php

<?php
/**
 * File for the profile edit action.
 *
 * Implements an action function to be called from the {@see Controller}.
 *
 * @author Iñigo Valentin <i@inigovalentin.com>
 * @license https://www.gnu.org/licenses/gpl-3.0.en.html GNU General Public License V3
 * @package SWDB
 */

/**
 * Executes the profile update.
 *
 * Reads the POST parameters looking for the following KEYS:
 *  mail: Optional, email to update.
 *  pass: Optional, password to update.
 *  currentPass: Mandatory for changing password, current one.
 *  api: Any value, indicates that the api key is to be changed.
 * Then it updates the selected info with the prameter vlue. Multiple itemss can be updated at the
 * same time.
 * 
 * @return int|string 201 on success, HTTP error codes on failure. If the API key has been updated,
 * the new key is returned instead.
 * @category Action
 */
function action(){

    $response = null;

    // Get the current user ID.
    $user = get_context()->get_user()->get_id();

    if (filter_input(INPUT_POST, "mail")){
        $mail = filter_input(INPUT_POST, 'mail');
        if (!filter_var($mail, FILTER_VALIDATE_EMAIL)){
            return -1;
        }
        $s = get_context()->get_db()->prepare('UPDATE user SET mail = :mail WHERE id = :user;');
        $s->bindValue(':user', $user, SQLITE3_TEXT);
        $s->bindValue(':mail', $mail, SQLITE3_TEXT);
        if(!$s->execute()){
            return 500;
        }
    }

    if (filter_input(INPUT_POST, "pass")){
        $pass = sha1(filter_input(INPUT_POST, 'pass'));
        $currentPass = sha1(filter_input(INPUT_POST, 'currentPass'));
        $s = get_context()->get_db()->prepare('SELECT COUNT(id) AS count FROM user WHERE id = :id AND password = :currentPass;');
        $s->bindValue(':id', $user, SQLITE3_TEXT);
        $s->bindValue(':currentPass', $currentPass, SQLITE3_TEXT);
        $q = $s->execute();
        $r = $q->fetchArray(SQLITE3_ASSOC);
        if ($r["count"] != 1){
            return -500;
        }
        $s = get_context()->get_db()->prepare('UPDATE user SET password = :pass WHERE id = :id AND password = :currentPass;');
        $s->bindValue(':id', $user, SQLITE3_TEXT);
        $s->bindValue(':pass', $pass, SQLITE3_TEXT);
        $s->bindValue(':currentPass', $currentPass, SQLITE3_TEXT);
        if(!$s->execute()){
            return -4;
        }
    }

    if (filter_input(INPUT_POST, "api")){
        $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
        $charactersLength = 16;
        $api = '';
        for ($i = 0; $i < $charactersLength; $i++) {
            $api .= $characters[rand(0, $charactersLength - 1)];
        }
        $s = get_context()->get_db()->prepare('UPDATE user SET api_key = :api WHERE id = :id;');
        $s->bindValue(':id', $user, SQLITE3_TEXT);
        $s->bindValue(':api', $api, SQLITE3_TEXT);
        if(! $s->execute()){
            return 500;
        }
        $response = $api;
    }

    if ($response == null){
        return 201;
    }
    else{
        return $response;
    }
}