From 67647de04ab218af6605acc33f71d50e2e13189a Mon Sep 17 00:00:00 2001
From: GaoxingAbdullah <abduldoobia@yahoo.com>
Date: Sat, 19 Nov 2022 21:48:07 +0800
Subject: [PATCH 1/2] Admin.php - Fixed Bug 485  Lecturer should not have the
 administration panel that allows him to create other Lecturer accounts

---
 Admin.php | 87 ++++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 70 insertions(+), 17 deletions(-)

diff --git a/Admin.php b/Admin.php
index f2cbee2..74e477b 100644
--- a/Admin.php
+++ b/Admin.php
@@ -7,13 +7,13 @@ $page = "admin";
 include 'Header.php';
 ?>
 
-<?php
-if ($_SESSION['user_type'] != "Lecturer") {
-  $_SESSION["info_login"] = "You must log in first.";
-  echo $_SESSION["info_login"];
-  header("Location: index.php");
-}
-?>
+<!-- <?php
+// if ($_SESSION['user_type'] != "Lecturer") {
+//   $_SESSION["info_login"] = "You must log in first.";
+//   echo $_SESSION["info_login"];
+//   header("Location: index.php");
+// }
+?> -->
 
 <style>
   .col-md-4 {
@@ -36,10 +36,23 @@ if ($_SESSION['user_type'] != "Lecturer") {
         <hr>
     -->
   <div class="col-md-6">
-    <h4> User Account Management </h4>
-    <hr>
 
-    <b>Lecturer / TA Accounts </b><br>
+  <?php 
+  if ($_SESSION['user_type'] == "Lecturer") {
+           
+        echo " <h4> TA Account Management </h4> 
+        <hr> " ;
+        echo    "<b>TA Accounts </b><br>" ;
+      }
+
+  else if(($_SESSION['user_type'] == "Admin")){
+         
+        echo " <h4> Lecturer Account Management </h4> 
+        <hr> ";
+        echo "<b>Lecturer Accounts </b><br>";
+    }
+    
+  ?>
 
     <div class="container">
 
@@ -65,7 +78,19 @@ if ($_SESSION['user_type'] != "Lecturer") {
 
         <div id="home" class="container tab-pane active"><br>
 
-          <b>Create Lecturer/TA Accounts </b>
+      <?php 
+        if ($_SESSION['user_type'] == "Lecturer") {
+                
+            echo "<b>Create TA Accounts </b>";
+             
+          }
+
+        else if(($_SESSION['user_type'] == "Admin")){
+              
+           echo "<b>Create Lecturer Accounts </b>";
+          }
+    
+      ?>
           <form method="post" action="Script.php" id="create_account_form">
             <input type="hidden" name="frm_createlecturrer" value="true" required="" />
             Full_Name
@@ -76,9 +101,25 @@ if ($_SESSION['user_type'] != "Lecturer") {
             Passport_Number / ID (Used as Intial Password)
             <input type="text" class="form-control" name="passport" placeholder="Passport No./ID" required="">
             <br> User Type :
-            <input type="radio" name="type" value="Lecturer" required="" id="role_lecturer"> Lecturer
-            <input type="radio" name="type" value="TA" required="" id="role_TA"> T/A
+
+          <?php 
+
+              if ($_SESSION['user_type'] == "Lecturer") {
+                      
+                    echo ' <input type="radio" name="type" value="TA" required="" id="role_TA"> T/A ';
+
+                }
+
+              else if(($_SESSION['user_type'] == "Admin")){
+                    
+                    echo " <input type='radio' name = 'type' value = 'Lecturer' required = '' id='role_lecturer' > Lecturer ";
+                  
+                }
+
+            ?>  
+
             <input type="submit" class="btn btn-primary" value="Create" id="create_btn"><br>
+            
             <?php
 
             error_reporting(E_ALL);
@@ -112,10 +153,22 @@ if ($_SESSION['user_type'] != "Lecturer") {
             </tr>
             <?php
 
-            $result = mysqli_query(
-              $con,
-              "SELECT * FROM Users_Table  WHERE UserType in ('Lecturer','TA')"
-            );
+          if ($_SESSION['user_type'] == "Lecturer") {
+                                  
+                $result = mysqli_query(
+                  $con,
+                  "SELECT * FROM Users_Table  WHERE UserType in ('TA')"
+                );
+            }
+
+          else if(($_SESSION['user_type'] == "Admin")){
+                
+                $result = mysqli_query(
+                  $con,
+                  "SELECT * FROM Users_Table  WHERE UserType in ('Lecturer')"
+                );
+            }
+
             while ($row = mysqli_fetch_assoc($result)) {
               $pass = $row['Passport_Number'];
               $btn = "<button class='btn-primary' onclick=\"updatePass(" . $row['User_ID'] . ",'$pass')\">Reset</button>";

From b78062c9da3d27dd6d7c70c99880b503f13f6501 Mon Sep 17 00:00:00 2001
From: GaoxingAbdullah <abduldoobia@yahoo.com>
Date: Sun, 27 Nov 2022 19:57:50 +0800
Subject: [PATCH 2/2] Script.php - Fixed Bug 510 - newly created account for
 lecturer/ TA can't log in with the default password

---
 Script.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Script.php b/Script.php
index 7191f4d..16b8065 100644
--- a/Script.php
+++ b/Script.php
@@ -279,11 +279,12 @@ if (!empty($_POST["frm_createlecturrer"])) {
         $_SESSION["info_Admin_Users"]="Email address : ".$email." is already in use.";
         header("Location: Admin.php");        
     }
+    $password_hash = password_hash("$password-Lrr@2022", PASSWORD_DEFAULT);
     $sql= "INSERT INTO `users_table`(`Email`, `Password`, `Full_Name`, `UserType`) VALUES "
-        . "('$email','$password','$fullname','$type')";
+        . "('$email','$password_hash','$fullname','$type')";
 
     if ($con->query($sql) === TRUE) {
-        $_SESSION["info_Admin_Users"] = $type . " user Created successfully : email " . $email . " and $password as Password.";
+        $_SESSION["info_Admin_Users"] = $type . " user Created successfully : email " . $email . " and $password-Lrr@2022 as Password.";
         header("Location: Admin.php");
     } else {
         echo "Error: " . $sql . "<br>" . $con->error;