diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml new file mode 100644 index 0000000..cb67dcc --- /dev/null +++ b/.github/workflows/semgrep.yml @@ -0,0 +1,23 @@ +on: + pull_request: {} + push: + branches: + - main + - master + paths: + - .github/workflows/semgrep.yml + schedule: + # random HH:MM to avoid a load spike on GitHub Actions at 00:00 + - cron: 23 15 * * * +name: Semgrep +jobs: + semgrep: + name: Scan + runs-on: ubuntu-20.04 + env: + SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }} + container: + image: returntocorp/semgrep + steps: + - uses: actions/checkout@v3 + - run: semgrep ci diff --git a/README.md b/README.md index 270cd22..35d8963 100644 --- a/README.md +++ b/README.md @@ -33,7 +33,11 @@ If you find this project useful... [Donate](https://www.paypal.com/biz/fund?id=ZDR2NTBSKK7JE) **** -Enhanced by Cory J. Potter aka CoreConduit Consulting Services 2018 - 2020 +# Enhanced by Cory J. Potter aka CoreConduit Consulting Services 2018 - 2020 + +# Core Contributor: Juan Gimpaya +YT link:https://www.youtube.com/c/ClevergunsYT/featured + The application was initially created by Siamon Hasan, using [php](http:php.net), [mysql](https://www.mysql.com) and [bootstrap](http://getbootstrap.com). diff --git a/includes/formatcurrency.php b/includes/formatcurrency.php index 3d15433..56e2fa6 100644 --- a/includes/formatcurrency.php +++ b/includes/formatcurrency.php @@ -107,7 +107,8 @@ function formatcurrency($floatcurr, $curr = 'USD') 'TOP' => array(NULL,2,'.',',',0), // Tonga, Paanga 'AED' => array(NULL,2,'.',',',0), // UAE Dirham 'UAH' => array(NULL,2,',',' ',0), // Ukraine, Hryvnia - 'USD' => array('$',2,'.',',',0), // US Dollar + /* i just change peso sign but not php*/ + 'USD' => array('₱',2,'.',',',0), // US Dollar 'VUV' => array(NULL,0,'',',',0), // Vanuatu, Vatu 'VEF' => array(NULL,2,',','.',0), // Venezuela Bolivares Fuertes 'VEB' => array(NULL,2,',','.',0), // Venezuela, Bolivar diff --git a/includes/sql.php b/includes/sql.php index 3fbcf0c..4a9bc73 100755 --- a/includes/sql.php +++ b/includes/sql.php @@ -188,9 +188,12 @@ function updateLastLogIn($user_id) /*--------------------------------------------------------------*/ /* Function to log the action of a user - /*--------------------------------------------------------------*/ - function logAction($user_id, $remote_ip, $action) + (old version)function logAction($user_id, $remote_ip, $action ) + + + /*--------------------------------------------------------------*/ + function logAction($user_id = null, $remote_ip = null, $action = null) { global $db; $date = make_date(); diff --git a/products/add_product.php b/products/add_product.php index 6291c61..9452e94 100755 --- a/products/add_product.php +++ b/products/add_product.php @@ -13,7 +13,7 @@ $all_categories = find_all('categories'); $all_photo = find_all('media'); - + if (isset($_POST['add_product'])) { $req_fields = array('product-title', 'product-category', 'product-quantity', 'cost-price', 'sale-price' ); validate_fields($req_fields); @@ -44,8 +44,6 @@ $product_id = $product['id']; if ( $product_id == 0 ) { $session->msg('d', ' Sorry, Failed to Add!'); - $log_action = "failed"; - logAction( $log_action ); redirect('../products/add_product.php', false); } @@ -58,21 +56,15 @@ $result = $db->query($sql); if ( $result && $db->affected_rows() === 1) { $session->msg('s', "Product Added "); - $log_action = "success"; - logAction( $log_action ); redirect('../products/products.php', false); } } else { $session->msg('d', ' Sorry, Failed to Add!'); - $log_action = "failed"; - logAction( $log_action ); redirect('../products/add_product.php', false); } } else { $session->msg("d", $errors); - $log_action = $errors; - logAction( $log_action ); redirect('../products/add_product.php', false); } @@ -108,7 +100,7 @@ - + @@ -118,7 +110,7 @@ - +
@@ -126,7 +118,7 @@ - +
@@ -134,7 +126,7 @@ - +
@@ -145,7 +137,7 @@ @@ -154,14 +146,14 @@ - +
@@ -171,7 +163,7 @@ - +
@@ -182,7 +174,7 @@ - + @@ -193,7 +185,7 @@ - + diff --git a/users/add_user.php b/users/add_user.php index c21fcd4..a05ebd0 100644 --- a/users/add_user.php +++ b/users/add_user.php @@ -1,102 +1,265 @@ -escape($_POST['full-name'])); - $username = strtolower(remove_junk($db->escape($_POST['username']))); - - foreach ($all_users as $a_user) { - if ( $username == $a_user['username'] ) { - //failed - $session->msg('d', ' Sorry, username already used!'); - redirect('../users/add_user.php', false); - } - } - - $password = remove_junk($db->escape($_POST['password'])); - $user_level = (int)$db->escape($_POST['level']); - $password = sha1($password); - $query = "INSERT INTO users ("; - $query .="name,username,password,user_level,status"; - $query .=") VALUES ("; - $query .=" '{$name}', '{$username}', '{$password}', '{$user_level}','1'"; - $query .=")"; - if ($db->query($query)) { - //sucess - $session->msg('s', "User account has been created! "); - redirect('../users/add_user.php', false); - } else { - //failed - $session->msg('d', ' Sorry, failed to create account!'); - redirect('../users/add_user.php', false); - } - - - - } else { - $session->msg("d", $errors); - redirect('../users/add_user.php', false); - } -} -?> - - -
-
-
- - - Add New User - -
-
-
-
-
- - -
-
- - -
-
- - -
-
- - -
-
- -
-
-
- -
- -
-
- - + + + + + + + + + + + + + + + + + + + + +escape($_POST['full-name'])); + $username = strtolower(remove_junk($db->escape($_POST['username']))); + + foreach ($all_users as $a_user) { + if ( $username == $a_user['username'] ) { + //failed + $session->msg('d', ' Sorry, username already used!'); + redirect('../users/add_user.php', false); + } + } + + $password = remove_junk($db->escape($_POST['password'])); + $user_level = (int)$db->escape($_POST['level']); + $password = sha1($password); + $query = "INSERT INTO users ("; + $query .="name,username,password,user_level,status"; + $query .=") VALUES ("; + $query .=" '{$name}', '{$username}', '{$password}', '{$user_level}','1'"; + $query .=")"; + if ($db->query($query)) { + //sucess + $session->msg('s', "User account has been created! "); + redirect('../users/add_user.php', false); + } else { + //failed + $session->msg('d', ' Sorry, failed to create account!'); + redirect('../users/add_user.php', false); + } + + + + } else { + $session->msg("d", $errors); + redirect('../users/add_user.php', false); + } +} +?> + + + + + +
+
+
+ + + Add New User + +
+
+
+
+
+ + +
+
+ + +
+
+ + + +
+ +
+ + +
+
+ +
+
+
+ +
+ +
+
+ + +
+

Password must contain the following:

+

A lowercase letter

+

A capital (uppercase) letter

+

A number

+

Minimum 8 characters

+
+ + + + diff --git a/users/admin.php b/users/admin.php index 498de7d..1a8a10c 100644 --- a/users/admin.php +++ b/users/admin.php @@ -97,7 +97,7 @@ function closePanel() - +
diff --git a/users/css/style.css b/users/css/style.css new file mode 100644 index 0000000..ff4abe9 --- /dev/null +++ b/users/css/style.css @@ -0,0 +1,222 @@ +*{ + padding: 0; + margin: 0; + box-sizing: border-box; +} + +body{ + font-family: 'Poppins', sans-serif; + overflow: hidden; +} + +.wave{ + position: fixed; + bottom: 0; + left: 0; + height: 100%; + z-index: -1; +} + +.container{ + width: 100vw; + height: 100vh; + display: grid; + grid-template-columns: repeat(2, 1fr); + grid-gap :7rem; + padding: 0 2rem; +} + +.img{ + display: flex; + justify-content: flex-end; + align-items: center; +} + +.login-content{ + display: flex; + justify-content: flex-start; + align-items: center; + text-align: center; +} + +.img img{ + width: 500px; +} + +form{ + width: 360px; +} + +.login-content img{ + height: 100px; +} + +.login-content h2{ + margin: 15px 0; + color: #333; + text-transform: uppercase; + font-size: 2.9rem; +} + +.login-content .input-div{ + position: relative; + display: grid; + grid-template-columns: 7% 93%; + margin: 25px 0; + padding: 5px 0; + border-bottom: 2px solid #d9d9d9; +} + +.login-content .input-div.one{ + margin-top: 0; +} + +.i{ + color: #d9d9d9; + display: flex; + justify-content: center; + align-items: center; +} + +.i i{ + transition: .3s; +} + +.input-div > div{ + position: relative; + height: 45px; +} + +.input-div > div > h5{ + position: absolute; + left: 10px; + top: 50%; + transform: translateY(-50%); + color: rgba(9, 76, 221, 0.897); + font-size: 18px; + transition: .3s; +} + +.input-div:before, .input-div:after{ + content: ''; + position: absolute; + bottom: -2px; + width: 0%; + height: 2px; + background-color: #38d39f; + transition: .4s; +} + +.input-div:before{ + right: 50%; +} + +.input-div:after{ + left: 50%; +} + +.input-div.focus:before, .input-div.focus:after{ + width: 50%; +} + +.input-div.focus > div > h5{ + top: -5px; + font-size: 15px; +} + +.input-div.focus > .i > i{ + color: #38d39f; +} + +.input-div > div > input{ + position: absolute; + left: 0; + top: 0; + width: 100%; + height: 100%; + border: none; + outline: none; + background: none; + padding: 0.5rem 0.7rem; + font-size: 1.2rem; + color: #555; + font-family: 'poppins', sans-serif; +} + +.input-div.pass{ + margin-bottom: 4px; +} + +a{ + display: block; + text-align: right; + text-decoration: none; + color: #999; + font-size: 0.9rem; + transition: .3s; +} + +a:hover{ + color: #38d39f; +} + +.btn{ + display: block; + width: 100%; + height: 50px; + border-radius: 25px; + outline: none; + border: none; + background-image: linear-gradient(to right, #32be8f, #38d39f, #32be8f); + background-size: 200%; + font-size: 1.2rem; + color: #fff; + font-family: 'Poppins', sans-serif; + text-transform: uppercase; + margin: 1rem 0; + cursor: pointer; + transition: .5s; +} +.btn:hover{ + background-position: right; +} + + +@media screen and (max-width: 1050px){ + .container{ + grid-gap: 5rem; + } +} + +@media screen and (max-width: 1000px){ + form{ + width: 290px; + } + + .login-content h2{ + font-size: 2.4rem; + margin: 8px 0; + } + + .img img{ + width: 400px; + } +} + +@media screen and (max-width: 900px){ + .container{ + grid-template-columns: 1fr; + } + + .img{ + display: none; + } + + .wave{ + display: none; + } + + .login-content{ + justify-content: center; + } +} \ No newline at end of file diff --git a/users/delete_log.php b/users/delete_log.php index 01d8d91..d9697c9 100644 --- a/users/delete_log.php +++ b/users/delete_log.php @@ -11,19 +11,17 @@ page_require_level(2); $id = filter_var($_GET['id'], FILTER_VALIDATE_INT); - $log = find_by_id('log',$id); - if( ! $log ) - { - $session->msg("d","Missing log id."); - redirect('../users/log.php'); - } +$log = find_by_id('log', $id); +if ( ! $log ) { + $session->msg("d", "Missing log id."); + redirect('../users/log.php'); +} - $delete_id = delete_by_id('log',(int)$log['id']); - if( $delete_id ) - { - $session->msg("s","logs deleted."); - redirect('../users/log.php'); - } else { - $session->msg("d","log deletion failed."); - redirect('../users/log.php'); - } +$delete_id = delete_by_id('log', (int)$log['id']); +if ( $delete_id ) { + $session->msg("s", "logs deleted."); + redirect('../users/log.php'); +} else { + $session->msg("d", "log deletion failed."); + redirect('../users/log.php'); +} diff --git a/users/delete_log_by_ip.php b/users/delete_log_by_ip.php index 461e4af..53bd1dc 100644 --- a/users/delete_log_by_ip.php +++ b/users/delete_log_by_ip.php @@ -10,21 +10,19 @@ // Checkin What level user has permission to view this page page_require_level(2); -if ( isset($_GET['ip']) ) -{ +if ( isset($_GET['ip']) ) { $remote_ip = filter_var($_GET['ip'], FILTER_VALIDATE_IP); - $delete_id = delete_by_ip('log',$remote_ip); - if( $delete_id ) - { - $session->msg("s","logs deleted."); - redirect('../users/log.php'); - } else { - $session->msg("d","log deletion failed."); - redirect('../users/log.php'); - } - + $delete_id = delete_by_ip('log', $remote_ip); + if ( $delete_id ) { + $session->msg("s", "logs deleted."); + redirect('../users/log.php'); + } else { + $session->msg("d", "log deletion failed."); + redirect('../users/log.php'); + } + } else { - $session->msg("d","Missing log id."); - redirect('../users/log.php'); + $session->msg("d", "Missing log id."); + redirect('../users/log.php'); } diff --git a/users/edit_category.php b/users/edit_category.php index 6536905..a4956d7 100755 --- a/users/edit_category.php +++ b/users/edit_category.php @@ -1,41 +1,48 @@ msg("d","Missing category id."); - redirect('../users/category.php'); - } +//Display all catgories. +$category = find_by_id('categories', (int)$_GET['id']); +if (!$category) { + $session->msg("d", "Missing category id."); + redirect('../users/category.php'); +} ?> escape($_POST['category-name'])); - if(empty($errors)){ - $sql = "UPDATE categories SET name='{$cat_name}'"; - $sql .= " WHERE id='{$category['id']}'"; - $result = $db->query($sql); - if($result && $db->affected_rows() === 1) { - $session->msg("s", "Successfully updated category"); - redirect('../users/category.php',false); - } else { - $session->msg("d", "Sorry! Failed to Update"); - redirect('../users/category.php',false); - } - } else { - $session->msg("d", $errors); - redirect('../users/category.php',false); - } +if (isset($_POST['edit_cat'])) { + $req_field = array('category-name'); + validate_fields($req_field); + $cat_name = remove_junk($db->escape($_POST['category-name'])); + if (empty($errors)) { + $sql = "UPDATE categories SET name='{$cat_name}'"; + $sql .= " WHERE id='{$category['id']}'"; + $result = $db->query($sql); + if ($result && $db->affected_rows() === 1) { + $session->msg("s", "Successfully updated category"); + redirect('../users/category.php', false); + } else { + $session->msg("d", "Sorry! Failed to Update"); + redirect('../users/category.php', false); + } + } else { + $session->msg("d", $errors); + redirect('../users/category.php', false); + } } ?> - +
@@ -63,4 +70,4 @@ - + diff --git a/users/header.php b/users/header.php new file mode 100644 index 0000000..61e7aa7 --- /dev/null +++ b/users/header.php @@ -0,0 +1,84 @@ + + + + + + <?php + $user = current_user(); + if (!empty($page_title)) + echo remove_junk($page_title); + elseif(!empty($user)) + echo ucfirst($user['name']); + else echo "Inventory Management System"; + ?> + + + + isUserLoggedIn()): ?> + + + + +
+
diff --git a/users/home.php b/users/home.php index 7fd4f47..bf615e4 100644 --- a/users/home.php +++ b/users/home.php @@ -37,7 +37,7 @@ function closePanel()
- +
diff --git a/users/img/asdw.svg b/users/img/asdw.svg new file mode 100644 index 0000000..fd8df0f --- /dev/null +++ b/users/img/asdw.svg @@ -0,0 +1,123 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/users/img/avatar.svg b/users/img/avatar.svg new file mode 100644 index 0000000..2f4c969 --- /dev/null +++ b/users/img/avatar.svg @@ -0,0 +1 @@ +profile pic \ No newline at end of file diff --git a/users/img/bg.svg b/users/img/bg.svg new file mode 100644 index 0000000..fa47e74 --- /dev/null +++ b/users/img/bg.svg @@ -0,0 +1 @@ +personalization \ No newline at end of file diff --git a/users/img/inventory.png b/users/img/inventory.png new file mode 100644 index 0000000..857b91d Binary files /dev/null and b/users/img/inventory.png differ diff --git a/users/img/wave.png b/users/img/wave.png new file mode 100644 index 0000000..bc59616 Binary files /dev/null and b/users/img/wave.png differ diff --git a/users/index.php b/users/index.php index b48d5ab..bd28e1f 100644 --- a/users/index.php +++ b/users/index.php @@ -1,31 +1,64 @@ isUserLoggedIn()) { redirect('../users/home.php', false);} ?> - -