diff --git a/api_v1_servers.php b/api_v1_servers.php index 05b064d..a857f4b 100644 --- a/api_v1_servers.php +++ b/api_v1_servers.php @@ -6,13 +6,33 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { $action = $_POST['action'] ?? 'create'; $user_id = $_SESSION['user_id']; + if ($action === 'refresh_invite_code') { + header('Content-Type: application/json'); + $server_id = $_POST['server_id'] ?? 0; + require_once 'includes/permissions.php'; + if (Permissions::hasPermission($user_id, $server_id, Permissions::MANAGE_SERVER)) { + $new_code = generateSecureInviteCode(); + $expiry_ts = time() + 1800; // 30 minutes + $expires_at = date('Y-m-d H:i:s', $expiry_ts); + $stmt = db()->prepare("UPDATE servers SET invite_code = ?, invite_code_expires_at = ? WHERE id = ?"); + $stmt->execute([$new_code, $expires_at, $server_id]); + echo json_encode(['success' => true, 'invite_code' => $new_code, 'expires_at' => $expires_at, 'expiry_timestamp' => $expiry_ts]); + } else { + echo json_encode(['success' => false, 'error' => 'Permission denied']); + } + exit; + } + if ($action === 'join') { $invite_code = $_POST['invite_code'] ?? ''; - $stmt = db()->prepare("SELECT id FROM servers WHERE invite_code = ?"); + $stmt = db()->prepare("SELECT id, invite_code_expires_at FROM servers WHERE invite_code = ?"); $stmt->execute([$invite_code]); $server = $stmt->fetch(); if ($server) { + if (!empty($server['invite_code_expires_at']) && strtotime($server['invite_code_expires_at']) < time()) { + die("Invite code has expired."); + } $stmt = db()->prepare("INSERT IGNORE INTO server_members (server_id, user_id) VALUES (?, ?)"); $stmt->execute([$server['id'], $user_id]); header('Location: index.php?server_id=' . $server['id']); @@ -56,9 +76,10 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { $db->beginTransaction(); // Create server - $invite_code = substr(strtoupper(md5(uniqid())), 0, 8); - $stmt = $db->prepare("INSERT INTO servers (name, owner_id, invite_code, icon_url) VALUES (?, ?, ?, ?)"); - $stmt->execute([$name, $user_id, $invite_code, $icon_url]); + $invite_code = generateSecureInviteCode(); + $expires_at = date('Y-m-d H:i:s', time() + 1800); + $stmt = $db->prepare("INSERT INTO servers (name, owner_id, invite_code, invite_code_expires_at, icon_url) VALUES (?, ?, ?, ?, ?)"); + $stmt->execute([$name, $user_id, $invite_code, $expires_at, $icon_url]); $server_id = $db->lastInsertId(); // Add owner as member diff --git a/assets/pasted-20260218-081927-02a8e8f5.png b/assets/pasted-20260218-081927-02a8e8f5.png new file mode 100644 index 0000000..c435be2 Binary files /dev/null and b/assets/pasted-20260218-081927-02a8e8f5.png differ diff --git a/assets/pasted-20260218-090941-11404470.png b/assets/pasted-20260218-090941-11404470.png new file mode 100644 index 0000000..63a04bc Binary files /dev/null and b/assets/pasted-20260218-090941-11404470.png differ diff --git a/auth/register.php b/auth/register.php index c0ba2b4..2a1b5c0 100644 --- a/auth/register.php +++ b/auth/register.php @@ -6,23 +6,49 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { $username = $_POST['username'] ?? ''; $email = $_POST['email'] ?? ''; $password = $_POST['password'] ?? ''; + $invite_code = $_POST['invite_code'] ?? ''; if ($username && $email && $password) { - $hash = password_hash($password, PASSWORD_DEFAULT); - try { - $stmt = db()->prepare("INSERT INTO users (username, display_name, email, password_hash) VALUES (?, ?, ?, ?)"); - $stmt->execute([$username, $username, $email, $hash]); - $userId = db()->lastInsertId(); - - // Add to default server - $stmt = db()->prepare("INSERT IGNORE INTO server_members (server_id, user_id) VALUES (1, ?)"); - $stmt->execute([$userId]); + $target_server_id = 1; + $can_register = true; - $_SESSION['user_id'] = $userId; - header('Location: ../index.php'); - exit; - } catch (Exception $e) { - $error = "Registration failed: " . $e->getMessage(); + if (defined('PRIVATE_REGISTRATION') && PRIVATE_REGISTRATION && empty($invite_code)) { + $can_register = false; + $error = "Invite code is required for private registration."; + } + + if ($can_register && !empty($invite_code)) { + $stmt = db()->prepare("SELECT id, invite_code_expires_at FROM servers WHERE invite_code = ?"); + $stmt->execute([$invite_code]); + $server = $stmt->fetch(); + if (!$server) { + $can_register = false; + $error = "Invalid invite code."; + } elseif (!empty($server['invite_code_expires_at']) && strtotime($server['invite_code_expires_at']) < time()) { + $can_register = false; + $error = "Invite code has expired."; + } else { + $target_server_id = $server['id']; + } + } + + if ($can_register) { + $hash = password_hash($password, PASSWORD_DEFAULT); + try { + $stmt = db()->prepare("INSERT INTO users (username, display_name, email, password_hash) VALUES (?, ?, ?, ?)"); + $stmt->execute([$username, $username, $email, $hash]); + $userId = db()->lastInsertId(); + + // Add to target server + $stmt = db()->prepare("INSERT IGNORE INTO server_members (server_id, user_id) VALUES (?, ?)"); + $stmt->execute([$target_server_id, $userId]); + + $_SESSION['user_id'] = $userId; + header('Location: ../index.php'); + exit; + } catch (Exception $e) { + $error = "Registration failed: " . $e->getMessage(); + } } } else { $error = "Please fill all fields."; @@ -67,6 +93,10 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { +
+ + > +
Already have an account? Login diff --git a/data/22.participants.json b/data/22.participants.json index 3caf8fb..0637a08 100644 --- a/data/22.participants.json +++ b/data/22.participants.json @@ -1 +1 @@ -{"de65a0b0b1a29c9a":{"id":"de65a0b0b1a29c9a","user_id":2,"name":"swefpifh ᵇʰᶠʳ","avatar_url":"","last_seen":1771343410040}} \ No newline at end of file +[] \ No newline at end of file diff --git a/data/3.log b/data/3.log index e69de29..0750eb9 100644 --- a/data/3.log +++ b/data/3.log @@ -0,0 +1,4 @@ +{"from":"d52b05b241a00981","to":"dab810918717cee5","data":{"type":"voice_speaking","channel_id":"3","user_id":2,"speaking":true},"time":1771423958367} +{"from":"d52b05b241a00981","to":"dab810918717cee5","data":{"type":"voice_speaking","channel_id":"3","user_id":2,"speaking":false},"time":1771423959219} +{"from":"d52b05b241a00981","to":"dab810918717cee5","data":{"type":"voice_speaking","channel_id":"3","user_id":2,"speaking":true},"time":1771423959434} +{"from":"d52b05b241a00981","to":"dab810918717cee5","data":{"type":"voice_speaking","channel_id":"3","user_id":2,"speaking":false},"time":1771423967708} diff --git a/data/3.participants.json b/data/3.participants.json index 486a3e1..dd21f21 100644 --- a/data/3.participants.json +++ b/data/3.participants.json @@ -1 +1 @@ -{"920464469dc771ed":{"id":"920464469dc771ed","user_id":3,"name":"swefheim","avatar_url":"","last_seen":1771343410598}} \ No newline at end of file +{"d52b05b241a00981":{"id":"d52b05b241a00981","user_id":2,"name":"swefpifh ᵇʰᶠʳ","avatar_url":"","last_seen":1771423987533},"c96c42356d6a3ee4":{"id":"c96c42356d6a3ee4","user_id":3,"name":"swefheim","avatar_url":"","last_seen":1771423988087}} \ No newline at end of file diff --git a/db/config.php b/db/config.php index 3876e87..96046ca 100644 --- a/db/config.php +++ b/db/config.php @@ -16,6 +16,18 @@ function db() { return $pdo; } +define('PRIVATE_REGISTRATION', true); + +function generateSecureInviteCode() { + $length = random_int(8, 12); + $chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()'; + $code = ''; + for ($i = 0; $i < $length; $i++) { + $code .= $chars[random_int(0, strlen($chars) - 1)]; + } + return $code; +} + function enforceChannelLimit($channel_id) { $stmt = db()->prepare("SELECT message_limit FROM channels WHERE id = ?"); $stmt->execute([$channel_id]); diff --git a/index.php b/index.php index 3576530..b0b8f2f 100644 --- a/index.php +++ b/index.php @@ -147,6 +147,19 @@ $stmt = db()->prepare(" "); $stmt->execute([$current_user_id]); $servers = $stmt->fetchAll(); + +// Automatic rotation of expired invite codes for owned servers +foreach ($servers as &$s) { + if ($s['owner_id'] == $current_user_id && (empty($s['invite_code_expires_at']) || strtotime($s['invite_code_expires_at']) < time())) { + $new_code = generateSecureInviteCode(); + $new_expiry = date('Y-m-d H:i:s', time() + 1800); + $stmt = db()->prepare("UPDATE servers SET invite_code = ?, invite_code_expires_at = ? WHERE id = ?"); + $stmt->execute([$new_code, $new_expiry, $s['id']]); + $s['invite_code'] = $new_code; + $s['invite_code_expires_at'] = $new_expiry; + } +} +unset($s); $is_dm_view = (isset($_GET['server_id']) && $_GET['server_id'] == 'dms') || !isset($_GET['server_id']) && empty($servers); if ($is_dm_view) { @@ -1518,12 +1531,87 @@ async function handleSaveUserSettings(btn) {
- - + + +
+
+ Expire dans : --:-- +
+
@@ -1997,15 +2085,16 @@ async function handleSaveUserSettings(btn) {
-
- Roles / Members -
- - +
+ Roles / Members +
+ + +
@@ -2075,11 +2164,6 @@ async function handleSaveUserSettings(btn) {
-
-
- - -