Files
UbuntuandClaude Opus 4.6 420bcb37fd Security hardening: fix SQLi, XSS, file upload, and migrate DB to RDS
- Fix all SQL injection vulnerabilities across Service_model, User_model,
  Module_model, Log_model, and Admin controller using parameterized queries
- Add htmlspecialchars() to all user-controlled output in admin views
  (bookings, services, workers, service categories, login form)
- Fix XSS in AJAX worker response and manage-booking-cancelled view
- Add file extension whitelist (jpg, jpeg, png, gif, webp) to all uploads
- Remove webshell (pentest2.php) from assets/img/profiles/
- Stop logging plaintext passwords on failed login attempts
- Migrate database.php hostname from localhost to AWS RDS endpoint
- Fix dropdown styling (white-on-white) in worker calendar view

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-05-07 13:00:32 +00:00

223 lines
8.8 KiB
PHP
Executable File

<?php
require getcwd().'/vendor/autoload.php';
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;
class User_model extends CI_Model {
function __construct(){
parent::__construct();
}
public function userCanLogin($username, $password){
$this->load->database();
$query = $this->db->query('SELECT * FROM users WHERE username = ? AND password = ? AND is_enabled = 1 LIMIT 1', array($username, hash('sha256', $password)));
if($query->num_rows() == 1){
return 1;
}
else{
return 0;
}
}
public function getAllUser(){
$this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug ORDER BY fullname ASC');
$userResults = $query->result();
foreach($userResults as $userResultItem){
if($userResultItem->profile_img_url == ''){
$userResultItem->profile_img_url = base_url().'img/default_profile.jpg';
}
}
return $userResults;
}
public function getUserByUsername($username){
$this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = ? LIMIT 1', array($username));
if($query->num_rows() == 1){
if($query->result()[0]->profile_img_url == ''){
$query->result()[0]->profile_img_url = base_url().'img/default_profile.jpg';
}
return $query->result()[0];
}
else{
return 0;
}
}
public function getAllUserPermission(){
$this->load->database();
$query = $this->db->query('SELECT * FROM permissions;');
if($query->num_rows() > 0){
return $query->result();
}
else{
return 0;
}
}
public function getUserById($userId){
$this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE user_id = ? LIMIT 1', array($userId));
if($query->num_rows() == 1){
if($query->result()[0]->profile_img_url == ''){
$query->result()[0]->profile_img_url = base_url().'img/default_profile.jpg';
}
return $query->result()[0];
}
else{
return 0;
}
}
public function deleteUser($userId){
$this->load->database();
$query = $this->db->query('DELETE FROM users WHERE user_id = ?', array($userId));
}
public function isUsernameAvailable($username){
$this->load->database();
$query = $this->db->query('SELECT * FROM users WHERE username = ?', array($username));
if($query->num_rows() == 1){
return 0;
}
else{
return 1;
}
}
public function updateUser($userId, $userArray){
$this->load->database();
$this->db->where('user_id', $userId);
$this->db->update('users', $userArray);
}
public function addNewUser($userArray){
$this->load->database();
if(!is_object($this->getUserByUsername($userArray['username']))){
$query = $this->db->query('INSERT INTO users (username, password, fullname, permission_slug, is_enabled, user_notes) VALUES(?, ?, ?, ?, ?, ?)', array($userArray['username'], hash('sha256', $userArray['password']), $userArray['fullname'], $userArray['permission_slug'], $userArray['is_enabled'], $userArray['user_notes']));
return 1;
}
else{
return 0;
}
}
public function getAllUserGroup(){
$this->load->database();
$query = $this->db->query('SELECT * FROM permissions ORDER BY permission_name ASC;');
return $query->result();
}
public function getPermissionById($groupId){
$this->load->database();
$query = $this->db->query('SELECT * FROM permissions WHERE permission_id = ? LIMIT 1', array($groupId));
return $query->result()[0];
}
public function getPermissionBySlug($permission_slug){
$this->load->database();
$query = $this->db->query('SELECT * FROM permissions WHERE permission_slug = ? LIMIT 1', array($permission_slug));
return $query->result()[0];
}
public function sendEmail($addressList, $lang, $subpage){
// Import PHPMailer classes into the global namespace
// These must be at the top of your script, not inside a function
echo $lang;
if(!empty($addressList)){
foreach($addressList as $addressListItem){
// Instantiation and passing `true` enables exceptions
$mail = new PHPMailer(true);
$mail->SMTPDebug = false;
$mail->do_debug = 1;
try {
//Server settings
$mail->CharSet = 'UTF-8';
//$mail->SMTPDebug = SMTP::DEBUG_SERVER; // Enable verbose debug output
$mail->isSMTP(); //Send using SMTP
$mail->Host = 'mail.absolutesolution.hu'; //Set the SMTP server to send through
$mail->SMTPAuth = true; //Enable SMTP authentication
$mail->Username = 'reservations@studiobeve.no'; //SMTP username
$mail->Password = 'StudioBeve-1234'; //SMTP password
$mail->SMTPSecure = PHPMailer::ENCRYPTION_SMTPS; //Enable TLS encryption; `PHPMailer::ENCRYPTION_SMTPS` encouraged
$mail->Port = 465; //TCP port to connect to, use 465 for `PHPMailer::ENCRYPTION_SMTPS` above
//Recipients
$mail->setFrom('reservations@studiobeve.no', '[studiobeve]');
$mail->addAddress($addressListItem['addressee_email'], $addressListItem['addressee_name']); // Add a recipient
//$mail->addAddress('ellen@example.com'); // Name is optional
//$mail->addReplyTo('info@example.com', 'Information');
$mail->addCC('evelin@studiobeve.no');
//$mail->addBCC('bcc@example.com');
// Attachments
if(is_array($addressListItem['attachments'])){
$attachments = $addressListItem['attachments'];
foreach($attachments as $attachmentsItem){
$mail->addAttachment(getcwd().'/documents/'.$attachmentsItem); // Add attachments
}
}
//$mail->addAttachment('/tmp/image.jpg', 'new.jpg'); // Optional name
// Content
$mail->isHTML(true); // Set email format to HTML
$mail->Subject = $addressListItem['subject'];
ob_start();
$body = ob_get_clean();
$body .= $addressListItem['content'];
$mail->Body = $body;
//$mail->AltBody = strip_tags($answer_message);
$mail->send();
echo 'Üzenet elküldve';
if($subpage != ''){
header('location:'.base_url().$lang.'/booking-finished/'.$subpage);
}
} catch (Exception $e) {
//header('location:'.base_url().'manage-applicants/?email-sent=false&error='.$mail->ErrorInfo);
log_message('error', 'sendEmail FAILED: ' . $mail->ErrorInfo);
echo "Üzenetküldési hiba. Mailer Error: {$mail->ErrorInfo}";
}
}
}
}
public function is_user_admin($username){
$this->load->database();
$query = $this->db->query('SELECT * FROM users JOIN permissions ON users.permission_slug = permissions.permission_slug WHERE username = ? LIMIT 1', array($username));
if($query->num_rows() == 1){
if($query->result()[0]->permission_slug == 'admin'){
return 1;
}
else{
return 0;
}
}
else{
return 0;
}
}
}
?>