From 67647de04ab218af6605acc33f71d50e2e13189a Mon Sep 17 00:00:00 2001
From: GaoxingAbdullah <abduldoobia@yahoo.com>
Date: Sat, 19 Nov 2022 21:48:07 +0800
Subject: [PATCH 1/6] Admin.php - Fixed Bug 485  Lecturer should not have the
 administration panel that allows him to create other Lecturer accounts

---
 Admin.php | 87 ++++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 70 insertions(+), 17 deletions(-)

diff --git a/Admin.php b/Admin.php
index f2cbee2..74e477b 100644
--- a/Admin.php
+++ b/Admin.php
@@ -7,13 +7,13 @@ $page = "admin";
 include 'Header.php';
 ?>
 
-<?php
-if ($_SESSION['user_type'] != "Lecturer") {
-  $_SESSION["info_login"] = "You must log in first.";
-  echo $_SESSION["info_login"];
-  header("Location: index.php");
-}
-?>
+<!-- <?php
+// if ($_SESSION['user_type'] != "Lecturer") {
+//   $_SESSION["info_login"] = "You must log in first.";
+//   echo $_SESSION["info_login"];
+//   header("Location: index.php");
+// }
+?> -->
 
 <style>
   .col-md-4 {
@@ -36,10 +36,23 @@ if ($_SESSION['user_type'] != "Lecturer") {
         <hr>
     -->
   <div class="col-md-6">
-    <h4> User Account Management </h4>
-    <hr>
 
-    <b>Lecturer / TA Accounts </b><br>
+  <?php 
+  if ($_SESSION['user_type'] == "Lecturer") {
+           
+        echo " <h4> TA Account Management </h4> 
+        <hr> " ;
+        echo    "<b>TA Accounts </b><br>" ;
+      }
+
+  else if(($_SESSION['user_type'] == "Admin")){
+         
+        echo " <h4> Lecturer Account Management </h4> 
+        <hr> ";
+        echo "<b>Lecturer Accounts </b><br>";
+    }
+    
+  ?>
 
     <div class="container">
 
@@ -65,7 +78,19 @@ if ($_SESSION['user_type'] != "Lecturer") {
 
         <div id="home" class="container tab-pane active"><br>
 
-          <b>Create Lecturer/TA Accounts </b>
+      <?php 
+        if ($_SESSION['user_type'] == "Lecturer") {
+                
+            echo "<b>Create TA Accounts </b>";
+             
+          }
+
+        else if(($_SESSION['user_type'] == "Admin")){
+              
+           echo "<b>Create Lecturer Accounts </b>";
+          }
+    
+      ?>
           <form method="post" action="Script.php" id="create_account_form">
             <input type="hidden" name="frm_createlecturrer" value="true" required="" />
             Full_Name
@@ -76,9 +101,25 @@ if ($_SESSION['user_type'] != "Lecturer") {
             Passport_Number / ID (Used as Intial Password)
             <input type="text" class="form-control" name="passport" placeholder="Passport No./ID" required="">
             <br> User Type :
-            <input type="radio" name="type" value="Lecturer" required="" id="role_lecturer"> Lecturer
-            <input type="radio" name="type" value="TA" required="" id="role_TA"> T/A
+
+          <?php 
+
+              if ($_SESSION['user_type'] == "Lecturer") {
+                      
+                    echo ' <input type="radio" name="type" value="TA" required="" id="role_TA"> T/A ';
+
+                }
+
+              else if(($_SESSION['user_type'] == "Admin")){
+                    
+                    echo " <input type='radio' name = 'type' value = 'Lecturer' required = '' id='role_lecturer' > Lecturer ";
+                  
+                }
+
+            ?>  
+
             <input type="submit" class="btn btn-primary" value="Create" id="create_btn"><br>
+            
             <?php
 
             error_reporting(E_ALL);
@@ -112,10 +153,22 @@ if ($_SESSION['user_type'] != "Lecturer") {
             </tr>
             <?php
 
-            $result = mysqli_query(
-              $con,
-              "SELECT * FROM Users_Table  WHERE UserType in ('Lecturer','TA')"
-            );
+          if ($_SESSION['user_type'] == "Lecturer") {
+                                  
+                $result = mysqli_query(
+                  $con,
+                  "SELECT * FROM Users_Table  WHERE UserType in ('TA')"
+                );
+            }
+
+          else if(($_SESSION['user_type'] == "Admin")){
+                
+                $result = mysqli_query(
+                  $con,
+                  "SELECT * FROM Users_Table  WHERE UserType in ('Lecturer')"
+                );
+            }
+
             while ($row = mysqli_fetch_assoc($result)) {
               $pass = $row['Passport_Number'];
               $btn = "<button class='btn-primary' onclick=\"updatePass(" . $row['User_ID'] . ",'$pass')\">Reset</button>";
-- 
2.17.1


From b78062c9da3d27dd6d7c70c99880b503f13f6501 Mon Sep 17 00:00:00 2001
From: GaoxingAbdullah <abduldoobia@yahoo.com>
Date: Sun, 27 Nov 2022 19:57:50 +0800
Subject: [PATCH 2/6] Script.php - Fixed Bug 510 - newly created account for
 lecturer/ TA can't log in with the default password

---
 Script.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/Script.php b/Script.php
index 7191f4d..16b8065 100644
--- a/Script.php
+++ b/Script.php
@@ -279,11 +279,12 @@ if (!empty($_POST["frm_createlecturrer"])) {
         $_SESSION["info_Admin_Users"]="Email address : ".$email." is already in use.";
         header("Location: Admin.php");        
     }
+    $password_hash = password_hash("$password-Lrr@2022", PASSWORD_DEFAULT);
     $sql= "INSERT INTO `users_table`(`Email`, `Password`, `Full_Name`, `UserType`) VALUES "
-        . "('$email','$password','$fullname','$type')";
+        . "('$email','$password_hash','$fullname','$type')";
 
     if ($con->query($sql) === TRUE) {
-        $_SESSION["info_Admin_Users"] = $type . " user Created successfully : email " . $email . " and $password as Password.";
+        $_SESSION["info_Admin_Users"] = $type . " user Created successfully : email " . $email . " and $password-Lrr@2022 as Password.";
         header("Location: Admin.php");
     } else {
         echo "Error: " . $sql . "<br>" . $con->error;
-- 
2.17.1


From 4ac03f766cf2eaf2f68e175751ecb94b1d460174 Mon Sep 17 00:00:00 2001
From: GaoxingAbdullah <abduldoobia@yahoo.com>
Date: Mon, 5 Dec 2022 15:45:57 +0800
Subject: [PATCH 3/6] Script.php: Moved lecturer and TA append password
 variable to get credential file.

---
 Script.php                | 4 ++--
 get_mysql_credentials.php | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/Script.php b/Script.php
index 59e67a4..54c068b 100644
--- a/Script.php
+++ b/Script.php
@@ -279,12 +279,12 @@ if (!empty($_POST["frm_createlecturrer"])) {
         $_SESSION["info_Admin_Users"]="Email address : ".$email." is already in use.";
         header("Location: Admin.php");        
     }
-    $password_hash = password_hash("$password-Lrr@2022", PASSWORD_DEFAULT);
+    $password_hash = password_hash("$password-$append_password", PASSWORD_DEFAULT);
     $sql= "INSERT INTO `users_table`(`Email`, `Password`, `Full_Name`, `UserType`) VALUES "
         . "('$email','$password_hash','$fullname','$type')";
 
     if ($con->query($sql) === TRUE) {
-        $_SESSION["info_Admin_Users"] = $type . " user created successfully. Use email " . $email . " as account name and $password-Lrr@2022 as password.";
+        $_SESSION["info_Admin_Users"] = $type . " user created successfully. Use email " . $email . " as account name and $password-$append_password as password.";
         header("Location: Admin.php");
     } else {
         echo "Error: " . $sql . "<br>" . $con->error;
diff --git a/get_mysql_credentials.php b/get_mysql_credentials.php
index c520376..d7f707d 100644
--- a/get_mysql_credentials.php
+++ b/get_mysql_credentials.php
@@ -2,4 +2,6 @@
 $csv = array_map('str_getcsv', file('./../../lrr_submission/KeepItSafe.txt'));
 $mysql_username = $csv[0][0];
 $mysql_password = $csv[0][1];
+//append password for Lecturer and TA
+$append_password = "Lrr@2022" ;
 ?>
-- 
2.17.1


From 03d9c20cf74bb08d65ac1e6ada2fd030b3054ee8 Mon Sep 17 00:00:00 2001
From: Hui Lan <lanhui@zjnu.edu.cn>
Date: Sun, 11 Dec 2022 18:46:43 +0800
Subject: [PATCH 4/6] Use a better variable salt (to replace append_password)

---
 Script.php                | 4 ++--
 get_mysql_credentials.php | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Script.php b/Script.php
index 54c068b..bf8f6bd 100644
--- a/Script.php
+++ b/Script.php
@@ -279,12 +279,12 @@ if (!empty($_POST["frm_createlecturrer"])) {
         $_SESSION["info_Admin_Users"]="Email address : ".$email." is already in use.";
         header("Location: Admin.php");        
     }
-    $password_hash = password_hash("$password-$append_password", PASSWORD_DEFAULT);
+    $password_hash = password_hash("$password-$salt", PASSWORD_DEFAULT);
     $sql= "INSERT INTO `users_table`(`Email`, `Password`, `Full_Name`, `UserType`) VALUES "
         . "('$email','$password_hash','$fullname','$type')";
 
     if ($con->query($sql) === TRUE) {
-        $_SESSION["info_Admin_Users"] = $type . " user created successfully. Use email " . $email . " as account name and $password-$append_password as password.";
+        $_SESSION["info_Admin_Users"] = $type . " user created successfully. Use email " . $email . " as account name and $password-$salt as password.";
         header("Location: Admin.php");
     } else {
         echo "Error: " . $sql . "<br>" . $con->error;
diff --git a/get_mysql_credentials.php b/get_mysql_credentials.php
index d7f707d..71e875d 100644
--- a/get_mysql_credentials.php
+++ b/get_mysql_credentials.php
@@ -3,5 +3,5 @@ $csv = array_map('str_getcsv', file('./../../lrr_submission/KeepItSafe.txt'));
 $mysql_username = $csv[0][0];
 $mysql_password = $csv[0][1];
 //append password for Lecturer and TA
-$append_password = "Lrr@2022" ;
+$salt = "Lrr@2022" ;
 ?>
-- 
2.17.1


From 6543782ebe81a64c74a763431f0991becb57cec4 Mon Sep 17 00:00:00 2001
From: Hui Lan <lanhui@zjnu.edu.cn>
Date: Sun, 11 Dec 2022 18:48:58 +0800
Subject: [PATCH 5/6] Do not write the password salt in the source code. 
 Instead, let KeepItSafe.txt include it.

---
 get_mysql_credentials.php | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/get_mysql_credentials.php b/get_mysql_credentials.php
index 71e875d..6c232bc 100644
--- a/get_mysql_credentials.php
+++ b/get_mysql_credentials.php
@@ -2,6 +2,5 @@
 $csv = array_map('str_getcsv', file('./../../lrr_submission/KeepItSafe.txt'));
 $mysql_username = $csv[0][0];
 $mysql_password = $csv[0][1];
-//append password for Lecturer and TA
-$salt = "Lrr@2022" ;
+$salt = $csv[1][1]; // the second column in the second line of KeepItSafe.txt has the salt, e.g., Lrr@2022
 ?>
-- 
2.17.1


From 9816a7e22afd337310723c0ac12d3f35e2a2bbe2 Mon Sep 17 00:00:00 2001
From: GaoxingAbdullah <abduldoobia@yahoo.com>
Date: Mon, 12 Dec 2022 16:46:53 +0800
Subject: [PATCH 6/6] Script.php & get_mysql_credentials.php: Password salt
 variable removed.

---
 Script.php                | 4 ++--
 get_mysql_credentials.php | 1 -
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/Script.php b/Script.php
index bf8f6bd..56d963d 100644
--- a/Script.php
+++ b/Script.php
@@ -279,12 +279,12 @@ if (!empty($_POST["frm_createlecturrer"])) {
         $_SESSION["info_Admin_Users"]="Email address : ".$email." is already in use.";
         header("Location: Admin.php");        
     }
-    $password_hash = password_hash("$password-$salt", PASSWORD_DEFAULT);
+    $password_hash = password_hash("$password", PASSWORD_DEFAULT);
     $sql= "INSERT INTO `users_table`(`Email`, `Password`, `Full_Name`, `UserType`) VALUES "
         . "('$email','$password_hash','$fullname','$type')";
 
     if ($con->query($sql) === TRUE) {
-        $_SESSION["info_Admin_Users"] = $type . " user created successfully. Use email " . $email . " as account name and $password-$salt as password.";
+        $_SESSION["info_Admin_Users"] = $type . " user created successfully. Use email " . $email . " as account name and $password as password.";
         header("Location: Admin.php");
     } else {
         echo "Error: " . $sql . "<br>" . $con->error;
diff --git a/get_mysql_credentials.php b/get_mysql_credentials.php
index 6c232bc..c520376 100644
--- a/get_mysql_credentials.php
+++ b/get_mysql_credentials.php
@@ -2,5 +2,4 @@
 $csv = array_map('str_getcsv', file('./../../lrr_submission/KeepItSafe.txt'));
 $mysql_username = $csv[0][0];
 $mysql_password = $csv[0][1];
-$salt = $csv[1][1]; // the second column in the second line of KeepItSafe.txt has the salt, e.g., Lrr@2022
 ?>
-- 
2.17.1