From 67647de04ab218af6605acc33f71d50e2e13189a Mon Sep 17 00:00:00 2001
From: GaoxingAbdullah <abduldoobia@yahoo.com>
Date: Sat, 19 Nov 2022 21:48:07 +0800
Subject: [PATCH 1/7] Admin.php - Fixed Bug 485  Lecturer should not have the
 administration panel that allows him to create other Lecturer accounts

---
 Admin.php | 87 ++++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 70 insertions(+), 17 deletions(-)

diff --git a/Admin.php b/Admin.php
index f2cbee2..74e477b 100644
--- a/Admin.php
+++ b/Admin.php
@@ -7,13 +7,13 @@ $page = "admin";
 include 'Header.php';
 ?>
 
-<?php
-if ($_SESSION['user_type'] != "Lecturer") {
-  $_SESSION["info_login"] = "You must log in first.";
-  echo $_SESSION["info_login"];
-  header("Location: index.php");
-}
-?>
+<!-- <?php
+// if ($_SESSION['user_type'] != "Lecturer") {
+//   $_SESSION["info_login"] = "You must log in first.";
+//   echo $_SESSION["info_login"];
+//   header("Location: index.php");
+// }
+?> -->
 
 <style>
   .col-md-4 {
@@ -36,10 +36,23 @@ if ($_SESSION['user_type'] != "Lecturer") {
         <hr>
     -->
   <div class="col-md-6">
-    <h4> User Account Management </h4>
-    <hr>
 
-    <b>Lecturer / TA Accounts </b><br>
+  <?php 
+  if ($_SESSION['user_type'] == "Lecturer") {
+           
+        echo " <h4> TA Account Management </h4> 
+        <hr> " ;
+        echo    "<b>TA Accounts </b><br>" ;
+      }
+
+  else if(($_SESSION['user_type'] == "Admin")){
+         
+        echo " <h4> Lecturer Account Management </h4> 
+        <hr> ";
+        echo "<b>Lecturer Accounts </b><br>";
+    }
+    
+  ?>
 
     <div class="container">
 
@@ -65,7 +78,19 @@ if ($_SESSION['user_type'] != "Lecturer") {
 
         <div id="home" class="container tab-pane active"><br>
 
-          <b>Create Lecturer/TA Accounts </b>
+      <?php 
+        if ($_SESSION['user_type'] == "Lecturer") {
+                
+            echo "<b>Create TA Accounts </b>";
+             
+          }
+
+        else if(($_SESSION['user_type'] == "Admin")){
+              
+           echo "<b>Create Lecturer Accounts </b>";
+          }
+    
+      ?>
           <form method="post" action="Script.php" id="create_account_form">
             <input type="hidden" name="frm_createlecturrer" value="true" required="" />
             Full_Name
@@ -76,9 +101,25 @@ if ($_SESSION['user_type'] != "Lecturer") {
             Passport_Number / ID (Used as Intial Password)
             <input type="text" class="form-control" name="passport" placeholder="Passport No./ID" required="">
             <br> User Type :
-            <input type="radio" name="type" value="Lecturer" required="" id="role_lecturer"> Lecturer
-            <input type="radio" name="type" value="TA" required="" id="role_TA"> T/A
+
+          <?php 
+
+              if ($_SESSION['user_type'] == "Lecturer") {
+                      
+                    echo ' <input type="radio" name="type" value="TA" required="" id="role_TA"> T/A ';
+
+                }
+
+              else if(($_SESSION['user_type'] == "Admin")){
+                    
+                    echo " <input type='radio' name = 'type' value = 'Lecturer' required = '' id='role_lecturer' > Lecturer ";
+                  
+                }
+
+            ?>  
+
             <input type="submit" class="btn btn-primary" value="Create" id="create_btn"><br>
+            
             <?php
 
             error_reporting(E_ALL);
@@ -112,10 +153,22 @@ if ($_SESSION['user_type'] != "Lecturer") {
             </tr>
             <?php
 
-            $result = mysqli_query(
-              $con,
-              "SELECT * FROM Users_Table  WHERE UserType in ('Lecturer','TA')"
-            );
+          if ($_SESSION['user_type'] == "Lecturer") {
+                                  
+                $result = mysqli_query(
+                  $con,
+                  "SELECT * FROM Users_Table  WHERE UserType in ('TA')"
+                );
+            }
+
+          else if(($_SESSION['user_type'] == "Admin")){
+                
+                $result = mysqli_query(
+                  $con,
+                  "SELECT * FROM Users_Table  WHERE UserType in ('Lecturer')"
+                );
+            }
+
             while ($row = mysqli_fetch_assoc($result)) {
               $pass = $row['Passport_Number'];
               $btn = "<button class='btn-primary' onclick=\"updatePass(" . $row['User_ID'] . ",'$pass')\">Reset</button>";
-- 
2.17.1


From 2230bf4222fe48d56851b0a828e68b9c7105eae2 Mon Sep 17 00:00:00 2001
From: Hui Lan <lanhui@zjnu.edu.cn>
Date: Thu, 1 Dec 2022 20:25:42 +0800
Subject: [PATCH 2/7] Admin.php: check privilege first

---
 Admin.php | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/Admin.php b/Admin.php
index 74e477b..0ca1453 100644
--- a/Admin.php
+++ b/Admin.php
@@ -7,13 +7,12 @@ $page = "admin";
 include 'Header.php';
 ?>
 
-<!-- <?php
-// if ($_SESSION['user_type'] != "Lecturer") {
-//   $_SESSION["info_login"] = "You must log in first.";
-//   echo $_SESSION["info_login"];
-//   header("Location: index.php");
-// }
-?> -->
+<?php
+// Only Lecturer or Admin could access this page
+if ($_SESSION['user_type'] != "Lecturer" || $_SESSION['user_type'] != "Admin") {
+  die("Sorry.  Nothing to see here.");
+}
+?>
 
 <style>
   .col-md-4 {
-- 
2.17.1


From ce4a9b76c730fab9df837b90cb2eeba9e4f956c1 Mon Sep 17 00:00:00 2001
From: Hui Lan <lanhui@zjnu.edu.cn>
Date: Thu, 1 Dec 2022 20:26:27 +0800
Subject: [PATCH 3/7] Admin.php: remove redundant parenthese

---
 Admin.php | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/Admin.php b/Admin.php
index 0ca1453..1c29bcd 100644
--- a/Admin.php
+++ b/Admin.php
@@ -44,7 +44,7 @@ if ($_SESSION['user_type'] != "Lecturer" || $_SESSION['user_type'] != "Admin") {
         echo    "<b>TA Accounts </b><br>" ;
       }
 
-  else if(($_SESSION['user_type'] == "Admin")){
+  else if($_SESSION['user_type'] == "Admin"){
          
         echo " <h4> Lecturer Account Management </h4> 
         <hr> ";
@@ -84,7 +84,7 @@ if ($_SESSION['user_type'] != "Lecturer" || $_SESSION['user_type'] != "Admin") {
              
           }
 
-        else if(($_SESSION['user_type'] == "Admin")){
+        else if($_SESSION['user_type'] == "Admin"){
               
            echo "<b>Create Lecturer Accounts </b>";
           }
@@ -109,7 +109,7 @@ if ($_SESSION['user_type'] != "Lecturer" || $_SESSION['user_type'] != "Admin") {
 
                 }
 
-              else if(($_SESSION['user_type'] == "Admin")){
+              else if($_SESSION['user_type'] == "Admin"){
                     
                     echo " <input type='radio' name = 'type' value = 'Lecturer' required = '' id='role_lecturer' > Lecturer ";
                   
@@ -160,7 +160,7 @@ if ($_SESSION['user_type'] != "Lecturer" || $_SESSION['user_type'] != "Admin") {
                 );
             }
 
-          else if(($_SESSION['user_type'] == "Admin")){
+          else if($_SESSION['user_type'] == "Admin"){
                 
                 $result = mysqli_query(
                   $con,
-- 
2.17.1


From 12520a603f807b6a2d4093316c153e7f2c03f4ad Mon Sep 17 00:00:00 2001
From: Hui Lan <lanhui@zjnu.edu.cn>
Date: Thu, 1 Dec 2022 20:41:18 +0800
Subject: [PATCH 4/7] Admin.php: fix logic error

---
 Admin.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Admin.php b/Admin.php
index 1c29bcd..95fcc1f 100644
--- a/Admin.php
+++ b/Admin.php
@@ -9,7 +9,7 @@ include 'Header.php';
 
 <?php
 // Only Lecturer or Admin could access this page
-if ($_SESSION['user_type'] != "Lecturer" || $_SESSION['user_type'] != "Admin") {
+if ($_SESSION['user_type'] != "Lecturer" && $_SESSION['user_type'] != "Admin") {
   die("Sorry.  Nothing to see here.");
 }
 ?>
-- 
2.17.1


From a753bdbafaffa91f6d8069f828f34488350482d5 Mon Sep 17 00:00:00 2001
From: Hui Lan <lanhui@zjnu.edu.cn>
Date: Thu, 1 Dec 2022 20:55:57 +0800
Subject: [PATCH 5/7] NoDirectPhpAcess.php: logout user when he tries direct
 url access to a php file

---
 Admin.php            | 2 +-
 NoDirectPhpAcess.php | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/Admin.php b/Admin.php
index 95fcc1f..564b4be 100644
--- a/Admin.php
+++ b/Admin.php
@@ -10,7 +10,7 @@ include 'Header.php';
 <?php
 // Only Lecturer or Admin could access this page
 if ($_SESSION['user_type'] != "Lecturer" && $_SESSION['user_type'] != "Admin") {
-  die("Sorry.  Nothing to see here.");
+    die("Sorry.  Nothing to see here.");
 }
 ?>
 
diff --git a/NoDirectPhpAcess.php b/NoDirectPhpAcess.php
index d5e6143..4e85779 100644
--- a/NoDirectPhpAcess.php
+++ b/NoDirectPhpAcess.php
@@ -2,6 +2,6 @@
     // https://stackoverflow.com/questions/33999475/prevent-direct-url-access-to-php-file
     if (!isset($_SERVER['HTTP_REFERER']) ) {
         /* choose the appropriate page to redirect users */
-        die( header( 'location: index.php' ) );
+        die( header( 'location: logout.php' ) );
     }
 ?>
-- 
2.17.1


From b685ce73d4b7395d21252a1c4a4bf2d755d8fb54 Mon Sep 17 00:00:00 2001
From: Hui Lan <lanhui@zjnu.edu.cn>
Date: Thu, 1 Dec 2022 20:57:58 +0800
Subject: [PATCH 6/7] Admin.php: use a better label for TA

---
 Admin.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Admin.php b/Admin.php
index 564b4be..69e94fd 100644
--- a/Admin.php
+++ b/Admin.php
@@ -105,7 +105,7 @@ if ($_SESSION['user_type'] != "Lecturer" && $_SESSION['user_type'] != "Admin") {
 
               if ($_SESSION['user_type'] == "Lecturer") {
                       
-                    echo ' <input type="radio" name="type" value="TA" required="" id="role_TA"> T/A ';
+                    echo ' <input type="radio" name="type" value="TA" required="" id="role_TA"> TA (Teaching Assistant) ';
 
                 }
 
-- 
2.17.1


From 97e659b0d89bb582cb590d084086150cb37babc0 Mon Sep 17 00:00:00 2001
From: Hui Lan <lanhui@zjnu.edu.cn>
Date: Thu, 1 Dec 2022 21:19:44 +0800
Subject: [PATCH 7/7] Script.php: better info message.

---
 Script.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Script.php b/Script.php
index 7191f4d..224c84f 100644
--- a/Script.php
+++ b/Script.php
@@ -283,7 +283,7 @@ if (!empty($_POST["frm_createlecturrer"])) {
         . "('$email','$password','$fullname','$type')";
 
     if ($con->query($sql) === TRUE) {
-        $_SESSION["info_Admin_Users"] = $type . " user Created successfully : email " . $email . " and $password as Password.";
+        $_SESSION["info_Admin_Users"] = $type . " user created successfully. Use email " . $email . " as accout name and $password as password.";
         header("Location: Admin.php");
     } else {
         echo "Error: " . $sql . "<br>" . $con->error;
-- 
2.17.1