| Server IP : 173.209.174.21 / Your IP : 216.73.216.89 Web Server : Apache/2.4.58 (Ubuntu) System : Linux wcfs-server 6.8.0-124-generic #124-Ubuntu SMP PREEMPT_DYNAMIC Tue May 26 13:00:45 UTC 2026 x86_64 User : nodor ( 1000) PHP Version : 8.3.6 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /var/www/thelittlebigshow/vendor-reg/ |
Upload File : |
<?php
ini_set('display_errors', 1);
error_reporting(E_ALL);
session_start();
if (!isset($_SESSION['admin_logged_in']) || $_SESSION['admin_logged_in'] !== true) {
header("Location: admin_login.php");
exit();
}
include __DIR__ . '/config.php';
$conn = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$message = '';
$error = '';
// ADD USER
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['add_user'])) {
$new_username = trim($_POST['new_username'] ?? '');
$new_password = trim($_POST['new_password'] ?? '');
if ($new_username === '' || $new_password === '') {
$error = "Username and password are required to add a user.";
} else {
$hashed_password = password_hash($new_password, PASSWORD_DEFAULT);
$sql = "INSERT INTO admin (username, password) VALUES (?, ?)";
$stmt = $conn->prepare($sql);
if (!$stmt) {
$error = "Prepare failed: " . $conn->error;
} else {
$stmt->bind_param("ss", $new_username, $hashed_password);
if ($stmt->execute()) {
$message = "User added successfully.";
} else {
$error = "Error adding user: " . $stmt->error;
}
$stmt->close();
}
}
}
// CHANGE PASSWORD
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['change_password'])) {
$user_id = (int)($_POST['user_id'] ?? 0);
$new_password = trim($_POST['reset_password'] ?? '');
if ($user_id <= 0 || $new_password === '') {
$error = "A valid user and new password are required.";
} else {
$hashed_password = password_hash($new_password, PASSWORD_DEFAULT);
$sql = "UPDATE admin SET password = ? WHERE id = ?";
$stmt = $conn->prepare($sql);
if (!$stmt) {
$error = "Prepare failed: " . $conn->error;
} else {
$stmt->bind_param("si", $hashed_password, $user_id);
if ($stmt->execute()) {
$message = "Password updated successfully.";
} else {
$error = "Error updating password: " . $stmt->error;
}
$stmt->close();
}
}
}
// DELETE USER
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['delete_user'])) {
$user_id = (int)($_POST['user_id'] ?? 0);
$current_admin = $_SESSION['admin_username'];
// Find username being deleted
$lookup_sql = "SELECT username FROM admin WHERE id = ?";
$lookup_stmt = $conn->prepare($lookup_sql);
if ($lookup_stmt) {
$lookup_stmt->bind_param("i", $user_id);
$lookup_stmt->execute();
$lookup_stmt->bind_result($delete_username);
$lookup_stmt->fetch();
$lookup_stmt->close();
if ($delete_username === $current_admin) {
$error = "You cannot delete the account you are currently logged in with.";
} else {
$sql = "DELETE FROM admin WHERE id = ?";
$stmt = $conn->prepare($sql);
if (!$stmt) {
$error = "Prepare failed: " . $conn->error;
} else {
$stmt->bind_param("i", $user_id);
if ($stmt->execute()) {
$message = "User deleted successfully.";
} else {
$error = "Error deleting user: " . $stmt->error;
}
$stmt->close();
}
}
} else {
$error = "Could not verify user before delete.";
}
}
// GET ALL USERS
$users = [];
$result = $conn->query("SELECT id, username FROM admin ORDER BY username ASC");
if ($result) {
while ($row = $result->fetch_assoc()) {
$users[] = $row;
}
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Manage Admin Users</title>
<style>
body {
font-family: Arial, sans-serif;
background: #f4f6f9;
margin: 0;
padding: 30px;
color: #333;
}
.container {
max-width: 1100px;
margin: 0 auto;
}
.topbar {
display: flex;
justify-content: space-between;
align-items: center;
margin-bottom: 25px;
}
.topbar a {
text-decoration: none;
color: #1E90FF;
font-weight: bold;
}
.card {
background: #fff;
border-radius: 10px;
padding: 25px;
box-shadow: 0 4px 14px rgba(0,0,0,0.08);
margin-bottom: 25px;
}
h1, h2 {
margin-top: 0;
}
.message {
background: #e8f8ec;
color: #1f7a38;
padding: 12px 15px;
border-radius: 6px;
margin-bottom: 20px;
}
.error {
background: #fdeaea;
color: #b42318;
padding: 12px 15px;
border-radius: 6px;
margin-bottom: 20px;
}
form.inline-form {
display: inline;
}
input[type="text"],
input[type="password"] {
width: 100%;
padding: 10px 12px;
margin: 6px 0 12px;
border: 1px solid #ccc;
border-radius: 6px;
box-sizing: border-box;
}
button {
background: #1E90FF;
color: #fff;
border: none;
padding: 10px 14px;
border-radius: 6px;
cursor: pointer;
}
button:hover {
background: #187bcd;
}
.delete-btn {
background: #d9534f;
}
.delete-btn:hover {
background: #b63b37;
}
table {
width: 100%;
border-collapse: collapse;
margin-top: 15px;
}
th, td {
text-align: left;
padding: 12px 10px;
border-bottom: 1px solid #e5e5e5;
vertical-align: top;
}
th {
background: #f8fafc;
}
.small-note {
color: #666;
font-size: 14px;
margin-top: -5px;
margin-bottom: 15px;
}
.password-hidden {
color: #888;
font-style: italic;
}
.action-group {
min-width: 280px;
}
</style>
</head>
<body>
<div class="container">
<div class="topbar">
<h1>Manage Admin Users</h1>
<div>
Logged in as: <strong><?php echo htmlspecialchars($_SESSION['admin_username']); ?></strong>
|
<a href="admin_dashboard.php">← Back to Dashboard</a>
</div>
</div>
<?php if ($message): ?>
<div class="message"><?php echo htmlspecialchars($message); ?></div>
<?php endif; ?>
<?php if ($error): ?>
<div class="error"><?php echo htmlspecialchars($error); ?></div>
<?php endif; ?>
<div class="card">
<h2>Add New User</h2>
<form method="POST">
<label for="new_username">Username</label>
<input type="text" name="new_username" id="new_username" required>
<label for="new_password">Password</label>
<input type="password" name="new_password" id="new_password" required>
<button type="submit" name="add_user">Add User</button>
</form>
</div>
<div class="card">
<h2>Current Users</h2>
<p class="small-note">
Current passwords cannot be shown because they are stored securely as hashes. You can reset them below.
</p>
<table>
<thead>
<tr>
<th style="width: 70px;">ID</th>
<th style="width: 220px;">Username</th>
<th style="width: 180px;">Password</th>
<th>Actions</th>
</tr>
</thead>
<tbody>
<?php if (count($users) > 0): ?>
<?php foreach ($users as $user): ?>
<tr>
<td><?php echo (int)$user['id']; ?></td>
<td><?php echo htmlspecialchars($user['username']); ?></td>
<td><span class="password-hidden">Hidden</span></td>
<td class="action-group">
<form method="POST" style="margin-bottom:10px;">
<input type="hidden" name="user_id" value="<?php echo (int)$user['id']; ?>">
<label>New Password for <?php echo htmlspecialchars($user['username']); ?></label>
<input type="password" name="reset_password" required>
<button type="submit" name="change_password">Change Password</button>
</form>
<form method="POST" onsubmit="return confirm('Are you sure you want to delete this user?');">
<input type="hidden" name="user_id" value="<?php echo (int)$user['id']; ?>">
<button type="submit" name="delete_user" class="delete-btn">Delete User</button>
</form>
</td>
</tr>
<?php endforeach; ?>
<?php else: ?>
<tr>
<td colspan="4">No users found.</td>
</tr>
<?php endif; ?>
</tbody>
</table>
</div>
</div>
</body>
</html>
<?php
$conn->close();
?>