commit 082263b55937497c73975ffb5b4f58edd4e9ec8a
Author: Tomáš Pašek <pasek.thomas@gmail.com>
Date:   Sat Apr 10 23:03:57 2021 +0200

    Feature #8522 Login a bezpečnost webové aplikace
    Feature #8523 Tvorba uživatele

diff --git a/application/controller/DeleteUserController.php b/application/controller/DeleteUserController.php
new file mode 100644
index 0000000..cc2f94d
--- /dev/null
+++ b/application/controller/DeleteUserController.php
@@ -0,0 +1,6 @@
+<?php
+require "../model/DB.php";
+
+$DB = new DB();
+
+$result = $DB->deleteUser($_POST['userId']);
\ No newline at end of file
diff --git a/application/controller/LoginController.php b/application/controller/LoginController.php
new file mode 100644
index 0000000..bced67c
--- /dev/null
+++ b/application/controller/LoginController.php
@@ -0,0 +1,25 @@
+<?php
+require "../model/DB.php";
+session_start();
+$DB = new DB();
+var_dump($_POST);
+$result = $DB->getUser($_POST['username']);
+
+if (count($result) == 1) {
+    $user = $result[0];
+    if (password_verify($_POST['password'], $user['password'])) {
+        session_regenerate_id();
+        $_SESSION['loggedIn'] = true;
+        $_SESSION['username'] = $_POST['username'];
+        $_SESSION['id'] = $user['id'];
+        $_SESSION['role'] = $user['role'];
+    } else {
+        // Incorrect password
+        echo 'Incorrect username and/or password!';
+    }
+} else {
+    // Incorrect username
+    echo 'Incorrect username and/or password!';
+}
+
+
diff --git a/application/controller/LogoutController.php b/application/controller/LogoutController.php
new file mode 100644
index 0000000..ec599e3
--- /dev/null
+++ b/application/controller/LogoutController.php
@@ -0,0 +1,3 @@
+<?php
+session_start();
+session_destroy();
\ No newline at end of file
diff --git a/application/controller/RegistrationController.php b/application/controller/RegistrationController.php
new file mode 100644
index 0000000..b01d59f
--- /dev/null
+++ b/application/controller/RegistrationController.php
@@ -0,0 +1,5 @@
+<?php
+require "../model/DB.php";
+$DB = new DB();
+
+$result = $DB->createUser($_POST);
diff --git a/application/controller/UpdateUserRoleController.php b/application/controller/UpdateUserRoleController.php
new file mode 100644
index 0000000..8467999
--- /dev/null
+++ b/application/controller/UpdateUserRoleController.php
@@ -0,0 +1,10 @@
+<?php
+require "../model/DB.php";
+
+if ($_SESSION['role'] == "ADMIN") {
+    $DB = new DB();
+
+    $results = $DB->updateUserRole($_POST["userId"], $_POST["role"]);
+
+    echo json_encode(count($results) == 0 ? null : $results);
+}
diff --git a/application/controller/UsersListController.php b/application/controller/UsersListController.php
new file mode 100644
index 0000000..881ca18
--- /dev/null
+++ b/application/controller/UsersListController.php
@@ -0,0 +1,10 @@
+<?php
+require "../model/DB.php";
+
+if ($_SESSION['role'] == "ADMIN") {
+    $DB = new DB();
+
+    $results = $DB->select("SELECT id, username, role from USERS", array());
+
+    echo json_encode(count($results) == 0 ? null : $results);
+}
diff --git a/application/index.php b/application/index.php
index 36bf7d6..1649102 100644
--- a/application/index.php
+++ b/application/index.php
@@ -1,3 +1,7 @@
+<?php
+session_start();
+?>
+
 <!doctype html>
 
 <html >
@@ -30,7 +34,26 @@
     </div>
     <?php include "./view/footer.html" ?>
 </div>
-
+<!--TODO logování upravit, zde pouze příklad -->
 <?php include "./view/modals/loginModal.html" ?>
+<?php if(isset($_SESSION['loggedIn']) && $_SESSION['loggedIn'] == true) {?>
+<h1>LOGGEDIN!!!!!!!!!</h1>
+    <button type="button" class="btn btn-default" data-dismiss="modal" onclick="logout()">Odhlásit se</button>
+<?php }?>
 </body>
 </html>
+
+<script>
+    function logout () {
+        var data = new FormData();
+        var xhr = new XMLHttpRequest();
+        xhr.open("POST", "controller/LogoutController.php");
+        xhr.onload = function(){
+            let search = JSON.parse(this.response);
+            console.log(search);
+        };
+        xhr.send(data);
+        return false;
+    }
+
+</script>
diff --git a/application/model/DB.php b/application/model/DB.php
index 0623847..1e531d2 100644
--- a/application/model/DB.php
+++ b/application/model/DB.php
@@ -65,6 +65,40 @@ class DB {
         }
     }
 
+    function getUser($username) {
+        $this->stmt = $this->pdo->prepare('SELECT id, username, password, role FROM users WHERE username = :username');
+        $this->stmt->bindParam(':username', $username);
+        $this->stmt->execute();
+        return $this->stmt->fetchAll();
+    }
+
+    function createUser($userDetails) {
+        $this->stmt = $this->pdo->prepare('INSERT INTO users (username, password, role) VALUES (:username, :password, :role)');
+        $password = password_hash($userDetails['username'], PASSWORD_DEFAULT);
+        $this->stmt->bindParam(':username', $userDetails['username']);
+        $this->stmt->bindParam(':password',$password);
+        $this->stmt->bindParam(':role',$userDetails['role']);
+        $this->stmt->execute();
+        return $this->stmt->fetchAll();
+    }
+
+    function updateUserRole($userId, $role) {
+        $this->stmt = $this->pdo->prepare("UPDATE users SET role = :role WHERE id = :userId");
+        $this->stmt->bindParam(':role', $role);
+        $this->stmt->bindParam(':userId',$userId);
+        $this->stmt->execute();
+        return $this->stmt->fetchAll();
+    }
+
+    function deleteUser($userId) {
+        $this->stmt = $this->pdo->prepare("DELETE from users WHERE id = :userId");
+        $this->stmt->bindParam(':userId',$userId);
+        $this->stmt->execute();
+        return $this->stmt->fetchAll();
+    }
+
+
+
 function update(){
 
     // ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| Tabulka dd_wordform |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
@@ -297,7 +331,7 @@ function update(){
 
 // (D) DATABASE SETTINGS - CHANGE TO YOUR OWN!
 define('DB_HOST', 'localhost');
-define('DB_NAME', 'dalimil1');
+define('DB_NAME', 'dalimil2');
 define('DB_CHARSET', 'utf8');
 define('DB_USER', 'postgres');
 define('DB_PASSWORD', 'a');
\ No newline at end of file
diff --git a/application/view/modals/loginModal.html b/application/view/modals/loginModal.html
index 3453b40..210fe33 100644
--- a/application/view/modals/loginModal.html
+++ b/application/view/modals/loginModal.html
@@ -26,9 +26,26 @@
                 </div>
             </div>
             <div class="modal-footer">
-                <button type="button" class="btn btn-default" data-dismiss="modal">Přihlásit se</button>
+                <button type="button" class="btn btn-default" data-dismiss="modal" onclick="login()">Přihlásit se</button>
                 <button type="button" class="btn btn-default" data-dismiss="modal">Zavřít</button>
             </div>
         </div>
     </div>
-</div>
\ No newline at end of file
+</div>
+
+<script>
+    function login () {
+        var data = new FormData();
+        data.append("username", document.getElementById('nick').value);
+        data.append("password", document.getElementById('password').value);
+        var xhr = new XMLHttpRequest();
+        xhr.open("POST", "controller/LoginController.php");
+        xhr.onload = function(){
+            let search = JSON.parse(this.response);
+            console.log(search);
+        };
+        xhr.send(data);
+        return false;
+    }
+
+</script>
\ No newline at end of file
diff --git a/dbUsersUpgrade/users.txt b/dbUsersUpgrade/users.txt
new file mode 100644
index 0000000..2c4765d
--- /dev/null
+++ b/dbUsersUpgrade/users.txt
@@ -0,0 +1,98 @@
+--
+-- PostgreSQL database dump
+--
+
+-- Dumped from database version 10.16
+-- Dumped by pg_dump version 10.16
+
+-- Started on 2021-04-10 22:53:56
+
+SET statement_timeout = 0;
+SET lock_timeout = 0;
+SET idle_in_transaction_session_timeout = 0;
+SET client_encoding = 'UTF8';
+SET standard_conforming_strings = on;
+SELECT pg_catalog.set_config('search_path', '', false);
+SET check_function_bodies = false;
+SET xmloption = content;
+SET client_min_messages = warning;
+SET row_security = off;
+
+SET default_tablespace = '';
+
+SET default_with_oids = false;
+
+--
+-- TOC entry 203 (class 1259 OID 16487)
+-- Name: users; Type: TABLE; Schema: public; Owner: postgres
+--
+
+CREATE TABLE public.users (
+    id integer NOT NULL,
+    password character varying(100) NOT NULL,
+    username character varying NOT NULL,
+    role character varying NOT NULL
+);
+
+
+ALTER TABLE public.users OWNER TO postgres;
+
+--
+-- TOC entry 204 (class 1259 OID 16497)
+-- Name: users_id_seq; Type: SEQUENCE; Schema: public; Owner: postgres
+--
+
+ALTER TABLE public.users ALTER COLUMN id ADD GENERATED ALWAYS AS IDENTITY (
+    SEQUENCE NAME public.users_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1
+);
+
+
+--
+-- TOC entry 2814 (class 0 OID 16487)
+-- Dependencies: 203
+-- Data for Name: users; Type: TABLE DATA; Schema: public; Owner: postgres
+--
+
+COPY public.users (id, password, username, role) FROM stdin;
+4	$2y$10$liQbaSxcPykR4516JVQ/G.pDYu0niSOF7q/IhJlOrUqXsHwIwp/p2	admin	editor
+\.
+
+
+--
+-- TOC entry 2821 (class 0 OID 0)
+-- Dependencies: 204
+-- Name: users_id_seq; Type: SEQUENCE SET; Schema: public; Owner: postgres
+--
+
+SELECT pg_catalog.setval('public.users_id_seq', 4, true);
+
+
+--
+-- TOC entry 2690 (class 2606 OID 16496)
+-- Name: users username_unique; Type: CONSTRAINT; Schema: public; Owner: postgres
+--
+
+ALTER TABLE ONLY public.users
+    ADD CONSTRAINT username_unique UNIQUE (username);
+
+
+--
+-- TOC entry 2692 (class 2606 OID 16491)
+-- Name: users users_pkey; Type: CONSTRAINT; Schema: public; Owner: postgres
+--
+
+ALTER TABLE ONLY public.users
+    ADD CONSTRAINT users_pkey PRIMARY KEY (id);
+
+
+-- Completed on 2021-04-10 22:53:56
+
+--
+-- PostgreSQL database dump complete
+--
+
