here is the SQL and PHP code written out fully and formatted for maximum readability with proper indentation and spacing. **SQL File:** ```sql -- Create the database if it doesn't exist CREATE DATABASE IF NOT EXISTS admin_system; -- Use the database USE admin_system; -- Create the users table CREATE TABLE users ( id INT AUTO_INCREMENT PRIMARY KEY, -- Unique identifier for the user username VARCHAR(50) UNIQUE NOT NULL, -- User's chosen username, must be unique gmail VARCHAR(100) UNIQUE NOT NULL, -- User's email address, must be unique password VARCHAR(255) NOT NULL, -- User's password (should be hashed) user_type ENUM('user', 'admin') DEFAULT 'user', -- Type of user ('user' or 'admin') admin_actions VARCHAR(255) DEFAULT '', -- Stores comma-separated admin actions or specific role keywords (e.g., 'super_admin', 'admin_own', 'view_users,add_user') status ENUM('active', 'inactive', 'blocked') DEFAULT 'active', -- User account status account_status ENUM('online', 'offline') DEFAULT 'offline', -- Current online/offline status remaining_time DATETIME NOT NULL, -- Datetime until the account is valid login_count INT DEFAULT 0, -- Number of times the user has logged in last_login DATETIME NULL, -- Timestamp of the last login last_logout DATETIME NULL, -- Timestamp of the last logout last_logout_reason VARCHAR(50) NULL, -- Reason for the last logout (e.g., 'manual', 'session_timeout', 'force_logout') last_inactive_reason VARCHAR(50) NULL, -- Reason for last inactive status (e.g., 'time_expired') added_by VARCHAR(50) DEFAULT 'system', -- Username of the admin who added the user (or 'system') created_at DATETIME DEFAULT CURRENT_TIMESTAMP -- Timestamp when the user was created ); -- Create the logs table for system activity logging CREATE TABLE logs ( id INT AUTO_INCREMENT PRIMARY KEY, -- Unique identifier for the log entry username VARCHAR(50) NOT NULL, -- Username associated with the action (who performed the action) action VARCHAR(100) NOT NULL, -- Description of the action (e.g., 'LOGIN', 'ADD_USER', 'UPDATE_SETTING') details TEXT, -- More detailed information about the action ip_address VARCHAR(45) NOT NULL, -- IP address from which the action was performed added_by VARCHAR(50) DEFAULT '', -- Optional: Username of the admin who initiated the log entry (if different from username) timestamp DATETIME DEFAULT CURRENT_TIMESTAMP -- Timestamp of the log entry ); -- Create the keys_generated table to store generated activation keys CREATE TABLE keys_generated ( id INT AUTO_INCREMENT PRIMARY KEY, -- Unique identifier for the key entry activation_code VARCHAR(255) NOT NULL, -- The original activation code used to generate the key valid_days INT NOT NULL, -- The number of days the key is valid for generated_key TEXT NOT NULL, -- The actual generated key string username VARCHAR(50) NOT NULL, -- Username of the user *for whom* the key was generated added_by VARCHAR(50) DEFAULT '', -- Username of the admin who generated the key created_time DATETIME DEFAULT CURRENT_TIMESTAMP, -- Timestamp when the key was generated end_date DATETIME NOT NULL -- Datetime when the key expires ); -- Create the ip_history table to track IP activity CREATE TABLE ip_history ( id INT AUTO_INCREMENT PRIMARY KEY, -- Unique identifier for the IP history entry ip_address VARCHAR(45) NOT NULL, -- The IP address involved username VARCHAR(50) NOT NULL, -- User associated with the IP attempt/action (e.g., attempted login username) action VARCHAR(50) NOT NULL, -- Type of action from the IP (e.g., 'login_attempt', 'login_success', 'login_fail', 'warned', 'blocked') timestamp DATETIME DEFAULT CURRENT_TIMESTAMP -- Timestamp of the IP action ); -- Create the password_history table to log password changes CREATE TABLE password_history ( id INT AUTO_INCREMENT PRIMARY KEY, -- Unique identifier for the history entry user_id INT NOT NULL, -- Link to the users table (ID of the user whose password changed) username VARCHAR(50) NOT NULL, -- Username of the user whose password changed (for easier logs) old_password VARCHAR(255) NOT NULL, -- The password before the change new_password VARCHAR(255) NOT NULL, -- The new password added_by VARCHAR(50) DEFAULT '', -- Username of the admin who changed the password (or the user themselves) timestamp DATETIME DEFAULT CURRENT_TIMESTAMP -- Timestamp of the password change ); -- Create the warned_ips table to store temporarily warned IPs CREATE TABLE warned_ips ( id INT AUTO_INCREMENT PRIMARY KEY, -- Unique identifier for the warned IP entry ip_address VARCHAR(45) NOT NULL UNIQUE, -- The warned IP address (must be unique) username VARCHAR(50) NOT NULL, -- Username of the admin who warned the IP (based on application logic) warn_until DATETIME NOT NULL, -- Datetime until the IP is warned timestamp DATETIME DEFAULT CURRENT_TIMESTAMP -- Timestamp when the IP was warned ); -- Create the blocked_ips table to store permanently blocked IPs CREATE TABLE blocked_ips ( id INT AUTO_INCREMENT PRIMARY KEY, -- Unique identifier for the blocked IP entry ip_address VARCHAR(45) NOT NULL UNIQUE, -- The blocked IP address (must be unique) username VARCHAR(50) NOT NULL, -- Username of the admin who blocked the IP (based on application logic) timestamp DATETIME DEFAULT CURRENT_TIMESTAMP -- Timestamp when the IP was blocked ); -- Create the settings table to store application configuration CREATE TABLE settings ( id INT AUTO_INCREMENT PRIMARY KEY, -- Unique identifier for the setting setting_key VARCHAR(100) UNIQUE NOT NULL, -- Unique key for the setting (e.g., 'panel_title', 'max_login_attempts') setting_value TEXT NOT NULL, -- The value of the setting updated_at DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP -- Timestamp when the setting was last updated ); -- Initial Data Population -- Insert the default admin user INSERT INTO users (username, gmail, password, user_type, admin_actions, status, account_status, remaining_time, added_by) VALUES ('admin', 'admin@gmail.com', 'admin123', 'admin', 'super_admin', 'active', 'offline', DATE_ADD(NOW(), INTERVAL 365 DAY), 'system'); -- Insert initial settings INSERT INTO settings (setting_key, setting_value) VALUES ('main_admin_username', 'admin'), ('main_admin_email', 'admin@gmail.com'), ('blocked_ip_message', 'Your IP is blocked permanently'), ('warned_ip_message', 'Please try again after {TIME}'), ('account_blocked_message', 'Your account is blocked permanently. Please contact support.'), ('account_inactive_message', 'Your account is inactive. Please contact support.'), ('wrong_password_message', 'Your password is incorrect, please try with correct password'), ('time_expired_message', 'Your session has expired. Please contact support.'), ('max_login_attempts', '5'), ('warn_time_minutes', '15'), ('key_generation_enabled', 'Yes'), ('key_generation_disabled_message', 'Key generation is currently disabled'), ('whatsapp_number', '+1234567890'), ('whatsapp_enabled', 'Yes'), ('whatsapp_message', 'Hello sir! My Username: {USERNAME} I need Help..'), ('whatsapp_button_text', 'WhatsApp'), ('notification_duration', '3'), ('loading_time', '5'), ('auto_hide_key_time', '60'), ('session_timeout', '3600'), -- Session timeout in seconds ('theme_primary_color', '#00ff99'), ('theme_secondary_color', '#00c6ff'), ('background_style', 'hacker'), -- Placeholder for CSS class or indicator ('animations_enabled', 'Yes'), -- Global animation toggle ('notification_position', 'top-right'), ('auto_refresh_enabled', 'Yes'), -- Auto-refresh for admin panel dashboards/tables ('global_logout_time', '3600'), -- This seems redundant with session_timeout, let's use session_timeout ('logout_warning_time', '180'), -- Warn user before session timeout ('mouse_hide_enabled', 'No'), -- Placeholder ('login_method', 'both'), -- 'username', 'gmail', 'both' ('auto_redirect_errors', 'Yes'), -- Redirect on error attempts ('failed_attempts_redirect', '5'), -- Number of attempts before redirect/warning ('redirect_whatsapp_number', '+1234567890'), -- WhatsApp number for error redirect ('login_error_template', 'Hi sir! Im on Page {PAGE} im trying to login but facing error. Error: {ERROR} Username/Gmail: {LOGIN} Password: {PASSWORD} please Help Me Sir'), ('logged_in_template', 'Hi sir! Im on page {PAGE} im trying to {ACTION} but facing error. Error: {ERROR} My Username: {USERNAME} Account Type: {TYPE} please Help Me Sir'), ('user_change_password_enabled', 'Yes'), ('user_key_generator_enabled', 'Yes'), ('notification_text_color', '#000'), -- Default black text for bright backgrounds ('notification_background_color', '#00ff99'), -- Matches primary color ('button_glow_enabled', 'Yes'), ('button_hover_scale', '1.05'), ('animation_duration', '0.3'), -- Default animation duration ('border_radius', '8'), -- Default border radius for elements ('box_shadow_intensity', '0.5'), ('text_shadow_enabled', 'Yes'), ('gradient_enabled', 'Yes'), ('pulse_animation_enabled', 'Yes'), -- Add placeholders for various animations ('typing_animation_enabled', 'Yes'), ('slide_animation_enabled', 'Yes'), ('fade_animation_enabled', 'Yes'), ('bounce_animation_enabled', 'Yes'), ('rotate_animation_enabled', 'Yes'), ('scale_animation_enabled', 'Yes'), ('color_change_animation_enabled', 'Yes'), ('background_animation_enabled', 'Yes'), ('border_animation_enabled', 'Yes'), ('glow_animation_enabled', 'Yes'), ('float_animation_enabled', 'Yes'), ('shake_animation_enabled', 'Yes'), ('flip_animation_enabled', 'Yes'), ('zoom_animation_enabled', 'Yes'), ('blur_animation_enabled', 'Yes'), ('wave_animation_enabled', 'Yes'), ('particle_animation_enabled', 'Yes'), ('matrix_animation_enabled', 'Yes'), ('neon_animation_enabled', 'Yes'), ('cyber_animation_enabled', 'Yes'), ('hacker_animation_enabled', 'Yes'), ('terminal_animation_enabled', 'Yes'), ('code_animation_enabled', 'Yes'), ('binary_animation_enabled', 'Yes'), ('circuit_animation_enabled', 'Yes'), ('hologram_animation_enabled', 'Yes'), ('laser_animation_enabled', 'Yes'), ('scanner_animation_enabled', 'Yes'), ('radar_animation_enabled', 'Yes'), ('grid_animation_enabled', 'Yes'), ('mesh_animation_enabled', 'Yes'), ('wireframe_animation_enabled', 'Yes'), ('geometric_animation_enabled', 'Yes'), ('fractal_animation_enabled', 'Yes'), ('kaleidoscope_animation_enabled', 'Yes'), ('spiral_animation_enabled', 'Yes'), ('vortex_animation_enabled', 'Yes'), ('ripple_animation_enabled', 'Yes'), ('explosion_animation_enabled', 'Yes'), ('implosion_animation_enabled', 'Yes'), ('morphing_animation_enabled', 'Yes'), ('liquid_animation_enabled', 'Yes'), ('fire_animation_enabled', 'Yes'), ('smoke_animation_enabled', 'Yes'), ('electricity_animation_enabled', 'Yes'), ('plasma_animation_enabled', 'Yes'), ('quantum_animation_enabled', 'Yes'), ('dimensional_animation_enabled', 'Yes'), ('teleport_animation_enabled', 'Yes'), ('portal_animation_enabled', 'Yes'), ('wormhole_animation_enabled', 'Yes'), ('blackhole_animation_enabled', 'Yes'), ('nebula_animation_enabled', 'Yes'), ('galaxy_animation_enabled', 'Yes'), ('universe_animation_enabled', 'Yes'), ('cosmic_animation_enabled', 'Yes'), ('stellar_animation_enabled', 'Yes'), ('orbital_animation_enabled', 'Yes'), ('lunar_animation_enabled', 'Yes'), ('solar_animation_enabled', 'Yes'), ('planetary_animation_enabled', 'Yes'), ('asteroid_animation_enabled', 'Yes'), ('comet_animation_enabled', 'Yes'), ('meteor_animation_enabled', 'Yes'), ('aurora_animation_enabled', 'Yes'), ('lightning_animation_enabled', 'Yes'), ('thunder_animation_enabled', 'Yes'), ('storm_animation_enabled', 'Yes'), ('tornado_animation_enabled', 'Yes'), ('hurricane_animation_enabled', 'Yes'), ('tsunami_animation_enabled', 'Yes'), ('earthquake_animation_enabled', 'Yes'), ('volcanic_animation_enabled', 'Yes'), ('glacial_animation_enabled', 'Yes'), ('desert_animation_enabled', 'Yes'), ('forest_animation_enabled', 'Yes'), ('ocean_animation_enabled', 'Yes'), ('mountain_animation_enabled', 'Yes'), ('valley_animation_enabled', 'Yes'), ('river_animation_enabled', 'Yes'), ('waterfall_animation_enabled', 'Yes'), ('rainbow_animation_enabled', 'Yes'), ('sunset_animation_enabled', 'Yes'), ('sunrise_animation_enabled', 'Yes'), ('twilight_animation_enabled', 'Yes'), ('dawn_animation_enabled', 'Yes'), ('dusk_animation_enabled', 'Yes'), ('midnight_animation_enabled', 'Yes'), ('noon_animation_enabled', 'Yes'), ('custom_css', '/* Custom CSS Styles */'), -- For CSS Editor ('custom_js', '// Custom JavaScript Functions'), -- For JS Editor ('custom_html', ''), -- For HTML Editor ('key_generation_disabled_users', ''), -- Comma-separated usernames ('key_generation_enabled_users', ''), -- Comma-separated usernames ('key_generation_only_enabled_message', 'The Key Gen is Only Enable for Specific Users ({USERNAME})'), ('key_generation_disabled_for_you_message', 'The Key Gen is Disabled for You ({USERNAME})'), ('panel_title', 'HACKER ADMIN SYSTEM'), -- Added default title based on usage ('refreshInterval', '30'); -- Added refresh interval setting -- Add indexes for performance on frequently queried columns CREATE INDEX idx_users_username ON users (username); CREATE INDEX idx_users_gmail ON users (gmail); CREATE INDEX idx_users_status ON users (status); CREATE INDEX idx_users_account_status ON users (account_status); CREATE INDEX idx_users_remaining_time ON users (remaining_time); CREATE INDEX idx_users_added_by ON users (added_by); CREATE INDEX idx_logs_username ON logs (username); CREATE INDEX idx_logs_action ON logs (action); CREATE INDEX idx_logs_timestamp ON logs (timestamp); CREATE INDEX idx_logs_added_by ON logs (added_by); CREATE INDEX idx_keys_username ON keys_generated (username); CREATE INDEX idx_keys_added_by ON keys_generated (added_by); CREATE INDEX idx_keys_end_date ON keys_generated (end_date); CREATE INDEX idx_ip_history_ip ON ip_history (ip_address); CREATE INDEX idx_ip_history_username ON ip_history (username); CREATE INDEX idx_ip_history_action_timestamp ON ip_history (action, timestamp); CREATE INDEX idx_password_history_user_id ON password_history (user_id); CREATE INDEX idx_password_history_added_by ON password_history (added_by); CREATE INDEX idx_password_history_timestamp ON password_history (timestamp); -- NOTE: Foreign key constraints can be added but omitted for simplicity in a single-file design. -- Example: ALTER TABLE password_history ADD CONSTRAINT fk_password_history_user FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE; ``` **PHP File:** ```php connect_error) { // Display a styled error message if connection fails die("

DATABASE CONNECTION FAILED

Error: " . htmlspecialchars($conn->connect_error) . "

Please check your database credentials and ensure the MySQL server is running.

"); } // Set character set to UTF-8 $conn->set_charset("utf8mb4"); // --- Helper Functions --- /** * Safely executes a database query using prepared statements. * * @param string $sql The SQL query string with placeholders (?). * @param string|null $types A string containing one or more characters which specify the types for the corresponding bind variables (e.g., 's' for string, 'i' for integer). * @param mixed ...$params The variables to bind to the parameter markers in the SQL statement. * @return mysqli_stmt|false The prepared statement object on success, false on failure. */ function db_query($sql, $types = null, ...$params) { global $conn; // Prepare the SQL statement $stmt = $conn->prepare($sql); // Check if preparation failed if ($stmt === false) { error_log("DB PREP ERROR: " . $conn->error . " SQL: " . $sql); return false; } // Bind parameters if types are provided if ($types) { // Using references for parameters is required by bind_param $param_refs = []; foreach ($params as $key => &$val) { $param_refs[$key] = &$val; } // Call bind_param dynamically with references if (!empty($param_refs) && !empty($types)) { if (!call_user_func_array([$stmt, 'bind_param'], array_merge([$types], $param_refs))) { error_log("DB BIND ERROR: " . $stmt->error . " SQL: " . $sql . " Types: " . $types . " Params: " . print_r($params, true)); $stmt->close(); return false; } } } // Execute the statement $result = $stmt->execute(); // Check if execution failed if ($result === false) { error_log("DB EXEC ERROR: " . $stmt->error . " SQL: " . $sql); $stmt->close(); return false; } // Return the statement object for fetching results return $stmt; } /** * Retrieves a setting value from the settings table. * If the setting key does not exist, it inserts the default value and returns it. * * @param string $key The setting key. * @param string $default The default value to use if the key is not found. * @return string The setting value. */ function getSetting($key, $default = '') { global $conn; // Prepare and execute the query to get the setting $stmt = db_query("SELECT setting_value FROM settings WHERE setting_key = ?", 's', $key); // Check if the query was successful and a row was fetched if ($stmt && $stmt->bind_result($value) && $stmt->fetch()) { $stmt->close(); return $value; // Return the found value } // Close the statement if it was created but no row fetched if ($stmt) { $stmt->close(); } // Setting not found, insert the default value db_query("INSERT IGNORE INTO settings (setting_key, setting_value) VALUES (?, ?)", 'ss', $key, $default); // Return the default value return $default; } /** * Sets or updates a setting value in the settings table. * * @param string $key The setting key. * @param string $value The setting value. */ function setSetting($key, $value) { global $conn; // Insert the setting or update its value if the key already exists db_query("INSERT INTO settings (setting_key, setting_value) VALUES (?, ?) ON DUPLICATE KEY UPDATE setting_value = ?", 'sss', $key, $value, $value); } /** * Logs an action to the logs table. * * @param string $username Username associated with the action. * @param string $action Description of the action. * @param string $details More details about the action. * @param string $ip IP address the action originated from. * @param string $added_by Username of the admin who performed the action (if applicable), default empty. */ function logAction($username, $action, $details, $ip, $added_by = '') { global $conn; // Insert the log entry into the logs table db_query("INSERT INTO logs (username, action, details, ip_address, added_by) VALUES (?, ?, ?, ?, ?)", 'sssss', $username, $action, $details, $ip, $added_by); } /** * Formats a future datetime string into a remaining time format (DD:HH:MM:SS). * * @param string|null $datetime The future datetime string (Y-m-d H:i:s). * @return string The formatted remaining time or '00:00:00:00' if expired or null. */ function formatTime($datetime) { // Return zero time if datetime is null or empty if (!$datetime) { return '00:00:00:00'; } // Get current time and the end time timestamp $now = time(); $end = strtotime($datetime); // Calculate the difference in seconds $diff = $end - $now; // If the time is not in the future or exactly now, return zero time if ($diff <= 0) { return '00:00:00:00'; } // Calculate days, hours, minutes, and seconds $days = floor($diff / 86400); $hours = floor(($diff % 86400) / 3600); $minutes = floor(($diff % 3600) / 60); $seconds = $diff % 60; // Return the formatted string return sprintf('%02d:%02d:%02d:%02d', $days, $hours, $minutes, $seconds); } /** * Formats a past datetime string into a human-readable "time ago" string. * * @param string|null $datetime The past datetime string (Y-m-d H:i:s). * @return string The formatted time ago string or 'Never' if null or empty. */ function timeAgo($datetime) { // Return 'Never' if datetime is null or empty if (!$datetime) { return 'Never'; } // Get current time and the past time timestamp $time = time() - strtotime($datetime); // Return formatted string based on the time difference if ($time < 60) { return 'just now'; } elseif ($time < 3600) { return floor($time / 60) . ' min ago'; } elseif ($time < 86400) { return floor($time / 3600) . ' hr ago'; } else { return floor($time / 86400) . ' days ago'; } } /** * Checks if a given username or email matches the main admin credentials from settings. * * @param string $username The username to check. * @param string $email The email to check. * @return bool True if it matches the main admin, false otherwise. */ function checkMainAdmin($username, $email) { // Get main admin credentials from settings $mainUsername = getSetting('main_admin_username', 'admin'); $mainEmail = getSetting('main_admin_email', 'admin@gmail.com'); // Check if either username or email matches the main admin credentials return ($username == $mainUsername || $email == $mainEmail); } /** * Checks the status of an IP address (blocked, warned, or ok). * * @param string $ip The IP address to check. * @return array An associative array with 'status' ('blocked', 'warned', 'ok') and 'data' (details if warned/blocked). */ function checkIP($ip) { global $conn; // Check if the IP is permanently blocked $stmt_blocked = db_query("SELECT id, ip_address, username, timestamp FROM blocked_ips WHERE ip_address = ?", 's', $ip); if ($stmt_blocked) { if ($stmt_blocked->fetch()) { $stmt_blocked->close(); return ['status' => 'blocked', 'data' => ['ip_address' => $ip]]; } $stmt_blocked->close(); } // Check if the IP is temporarily warned and the warn time has not expired $stmt_warned = db_query("SELECT id, ip_address, username, warn_until FROM warned_ips WHERE ip_address = ? AND warn_until > NOW()", 's', $ip); if ($stmt_warned) { if ($stmt_warned->bind_result($id, $ip_address, $username, $warn_until) && $stmt_warned->fetch()) { $stmt_warned->close(); return ['status' => 'warned', 'data' => ['id' => $id, 'ip_address' => $ip_address, 'username' => $username, 'warn_until' => $warn_until]]; } $stmt_warned->close(); } // If not blocked or warned, the IP is considered okay return ['status' => 'ok']; } /** * Adds an entry to the ip_history table. * * @param string $ip The IP address involved. * @param string $username Username associated with the action (e.g., attempted login username). * @param string $action Type of action (e.g., 'login_attempt', 'login_success', 'login_fail'). */ function addIPHistory($ip, $username, $action) { global $conn; // Insert the IP history entry db_query("INSERT INTO ip_history (ip_address, username, action) VALUES (?, ?, ?)", 'sss', $ip, $username, $action); } /** * Adds or updates a warned IP entry. * * @param string $ip The IP address to warn. * @param string $admin_username The username of the admin who performed the action. * @param int $minutes The number of minutes the IP should be warned for. */ function warnIP($ip, $admin_username, $minutes) { global $conn; // Calculate the expiration datetime $until = date('Y-m-d H:i:s', time() + ($minutes * 60)); // Use INSERT ... ON DUPLICATE KEY UPDATE to insert if new or update if already warned db_query("INSERT INTO warned_ips (ip_address, username, warn_until) VALUES (?, ?, ?) ON DUPLICATE KEY UPDATE username = ?, warn_until = ?", 'sssss', $ip, $admin_username, $until, $admin_username, $until); } /** * Blocks an IP address permanently and removes it from the warned list. * * @param string $ip The IP address to block. * @param string $admin_username The username of the admin who performed the action. */ function blockIP($ip, $admin_username) { global $conn; // Use INSERT IGNORE to add the IP to blocked_ips if it's not already there db_query("INSERT IGNORE INTO blocked_ips (ip_address, username) VALUES (?, ?)", 'ss', $ip, $admin_username); // Remove the IP from the warned_ips table if it exists db_query("DELETE FROM warned_ips WHERE ip_address = ?", 's', $ip); } /** * Gets the number of login attempts for an IP within a specified time window. * * @param string $ip The IP address. * @param int $minutes The time window in minutes. * @return int The number of login attempts. */ function getLoginAttempts($ip, $minutes = 15) { global $conn; // Calculate the cutoff time $cutoff = date('Y-m-d H:i:s', time() - ($minutes * 60)); // Query the number of 'login_attempt' actions for the IP within the time window $stmt = db_query("SELECT COUNT(*) FROM ip_history WHERE ip_address = ? AND action = 'login_attempt' AND timestamp > ?", 'ss', $ip, $cutoff); $count = 0; // Fetch the count if ($stmt && $stmt->bind_result($count) && $stmt->fetch()) { $count = (int)$count; } // Close the statement if ($stmt) { $stmt->close(); } // Return the count return $count; } /** * Retrieves user details by user ID. * * @param int $userId The ID of the user. * @return array|null The user's data as an associative array, or null if not found. */ function getUserById($userId) { global $conn; // Query user details by ID $sql = "SELECT id, username, gmail, password, user_type, admin_actions, status, account_status, remaining_time, login_count, last_login, last_logout, last_logout_reason, last_inactive_reason, added_by, created_at FROM users WHERE id = ?"; $stmt = db_query($sql, 'i', $userId); $user = null; // Fetch the user data if found if ($stmt) { $result = $stmt->get_result(); if ($row = $result->fetch_assoc()) { $user = $row; } $stmt->close(); } // Return the user data return $user; } /** * Retrieves a list of users, with optional search and filtering. * * @param string $search Search term (username, ID, or added_by). * @param string $searchType Type of search ('auto', 'username', 'id', 'added_by'). * @param string|null $addedByFilter Filter users added by a specific username. * @return array An array of user data. */ function getAllUsers($search = '', $searchType = 'auto', $addedByFilter = null) { global $conn; $sql = "SELECT id, username, gmail, password, user_type, admin_actions, status, account_status, remaining_time, login_count, last_login, last_logout, last_logout_reason, last_inactive_reason, added_by, created_at FROM users"; $where = []; $types = ''; $params = []; // Add filter for users added by a specific admin (used for 'admin_own') if ($addedByFilter !== null) { $where[] = "added_by = ?"; $types .= 's'; $params[] = $addedByFilter; } // Add search conditions if (!empty($search)) { $searchTerm = "%" . $search . "%"; // Add wildcards for LIKE searches if ($searchType == 'auto') { // Search in username, ID, or added_by $where[] = "(username LIKE ? OR id = ? OR added_by LIKE ?)"; $types .= 'sis'; $params[] = $searchTerm; $params[] = (int)str_replace('%', '', $searchTerm); // Treat ID search as integer $params[] = $searchTerm; } elseif ($searchType == 'username') { // Search by username $where[] = "username LIKE ?"; $types .= 's'; $params[] = $searchTerm; } elseif ($searchType == 'id') { // Search by ID $where[] = "id = ?"; $types .= 'i'; $params[] = (int)str_replace('%', '', $searchTerm); } elseif ($searchType == 'added_by') { // Search by added_by username $where[] = "added_by LIKE ?"; $types .= 's'; $params[] = $searchTerm; } } // Append WHERE clause if conditions exist if (!empty($where)) { $sql .= " WHERE " . implode(" AND ", $where); } // Optional: Add ORDER BY clause $sql .= " ORDER BY created_at DESC"; // Execute the query $stmt = db_query($sql, $types, ...$params); $users = []; // Fetch all rows and add calculated fields if ($stmt) { $result = $stmt->get_result(); while ($row = $result->fetch_assoc()) { // Calculate remaining time in seconds and formatted string $remaining = strtotime($row['remaining_time']) - time(); $row['time_left'] = $remaining > 0 ? $remaining : 0; $row['remaining_formatted'] = formatTime($row['remaining_time']); // Format last login/logout times as time ago $row['last_login_ago'] = timeAgo($row['last_login']); $row['last_logout_ago'] = timeAgo($row['last_logout']); // Add the row to the results array $users[] = $row; } $stmt->close(); } // Return the array of users return $users; } /** * Retrieves system logs, with optional search and filtering. * * @param string $search Search term (username, ID, added_by). * @param string $searchType Type of search ('auto', 'username', 'id', 'added_by'). * @param string|null $addedByFilter Filter logs added by a specific username. * @return array An array of log data. */ function getAllLogs($search = '', $searchType = 'auto', $addedByFilter = null) { global $conn; $sql = "SELECT id, username, action, details, ip_address, added_by, timestamp FROM logs"; $where = []; $types = ''; $params = []; // Add filter for logs added by a specific admin (used for 'admin_own') // Note: The 'added_by' column in the logs table indicates *who performed the action*, // which aligns well with filtering for 'admin_own' to see actions *they* took. if ($addedByFilter !== null) { $where[] = "added_by = ?"; $types .= 's'; $params[] = $addedByFilter; } // Add search conditions if (!empty($search)) { $searchTerm = "%" . $search . "%"; if ($searchType == 'auto') { // Search in username, ID, or added_by $where[] = "(username LIKE ? OR id = ? OR added_by LIKE ?)"; $types .= 'sis'; $params[] = $searchTerm; $params[] = (int)str_replace('%', '', $searchTerm); $params[] = $searchTerm; } elseif ($searchType == 'username') { // Search by username associated with the log entry $where[] = "username LIKE ?"; $types .= 's'; $params[] = $searchTerm; } elseif ($searchType == 'id') { // Search by log ID $where[] = "id = ?"; $types .= 'i'; $params[] = (int)str_replace('%', '', $searchTerm); } elseif ($searchType == 'added_by') { // Search by added_by username (admin who performed the action) $where[] = "added_by LIKE ?"; $types .= 's'; $params[] = $searchTerm; } } // Append WHERE clause if conditions exist if (!empty($where)) { $sql .= " WHERE " . implode(" AND ", $where); } // Order by timestamp descending and limit results for performance $sql .= " ORDER BY timestamp DESC LIMIT 100"; // Execute the query $stmt = db_query($sql, $types, ...$params); $logs = []; // Fetch all rows if ($stmt) { $result = $stmt->get_result(); while ($row = $result->fetch_assoc()) { $logs[] = $row; } $stmt->close(); } // Return the array of logs return $logs; } /** * Retrieves generated keys, with optional search and filtering by username or added_by. * Used for both admin key management and user's own key history. * * @param string $search Search term (username, ID, added_by, activation_code). * @param string $searchType Type of search ('auto', 'username', 'id', 'added_by'). * @param string|null $usernameFilter Filter keys generated *for* a specific username (used for user panel). * @param string|null $addedByFilter Filter keys generated *by* a specific admin (used for 'admin_own'). * @return array An array of key data. */ function getAllKeys($search = '', $searchType = 'auto', $usernameFilter = null, $addedByFilter = null) { global $conn; $sql = "SELECT id, activation_code, valid_days, generated_key, username, added_by, created_time, end_date FROM keys_generated"; $where = []; $types = ''; $params = []; // Filter keys generated *for* a specific user (used for user panel) if ($usernameFilter !== null) { $where[] = "username = ?"; $types .= 's'; $params[] = $usernameFilter; } // Filter keys generated *by* a specific admin (used for 'admin_own') if ($addedByFilter !== null) { $where[] = "added_by = ?"; $types .= 's'; $params[] = $addedByFilter; } // Add search conditions if (!empty($search)) { $searchTerm = "%" . $search . "%"; if ($searchType == 'auto') { // Search in username, ID, added_by, or activation_code $where[] = "(username LIKE ? OR id = ? OR added_by LIKE ? OR activation_code LIKE ?)"; $types .= 'siss'; $params[] = $searchTerm; $params[] = (int)str_replace('%', '', $searchTerm); $params[] = $searchTerm; $params[] = $searchTerm; } elseif ($searchType == 'username') { // Search by username *for whom* the key was generated $where[] = "username LIKE ?"; $types .= 's'; $params[] = $searchTerm; } elseif ($searchType == 'id') { // Search by key ID $where[] = "id = ?"; $types .= 'i'; $params[] = (int)str_replace('%', '', $searchTerm); } elseif ($searchType == 'added_by') { // Search by added_by username (admin who generated) $where[] = "added_by LIKE ?"; $types .= 's'; $params[] = $searchTerm; } // Note: Search by activation_code is only in 'auto' currently. Could add a specific type if needed. } // Append WHERE clause if conditions exist if (!empty($where)) { $sql .= " WHERE " . implode(" AND ", $where); } // Order by creation time descending $sql .= " ORDER BY created_time DESC"; // Execute the query $stmt = db_query($sql, $types, ...$params); $keys = []; // Fetch all rows if ($stmt) { $result = $stmt->get_result(); while ($row = $result->fetch_assoc()) { $keys[] = $row; } $stmt->close(); } // Return the array of keys return $keys; } /** * Retrieves IP history entries, with optional search and filtering. * Note: 'added_by' filtering is applied to the 'username' column in ip_history, * assuming 'username' stores the user whose action triggered the log. * * @param string $search Search term (username, ID, IP address). * @param string $searchType Type of search ('auto', 'username', 'id', 'ip'). * @param string|null $addedByFilter Filter history for entries associated with users added by this admin (complex, simplified to filter by ip_history.username). * @return array An array of IP history data. */ function getAllIpHistory($search = '', $searchType = 'auto', $addedByFilter = null) { global $conn; $sql = "SELECT id, ip_address, username, action, timestamp FROM ip_history"; $where = []; $types = ''; $params = []; // Apply 'added_by' filter to the 'username' column in ip_history. // This assumes 'username' in ip_history refers to the user involved, // and we want to see history for users added by the current admin. // A more accurate approach for 'admin_own' would join with 'users' table. // Sticking to simple filter on ip_history.username for this single file. if ($addedByFilter !== null) { // Find IDs of users added by this admin $user_ids_added_by_admin = []; $stmt_users = db_query("SELECT id FROM users WHERE added_by = ?", 's', $addedByFilter); if ($stmt_users) { $result_users = $stmt_users->get_result(); while($row_user = $result_users->fetch_assoc()) { $user_ids_added_by_admin[] = $row_user['id']; } $stmt_users->close(); } // If no users were added by this admin, return empty results if (empty($user_ids_added_by_admin)) { return []; } // Filter ip_history by the usernames of users added by this admin // This requires a subquery or joining with users table on username, or fetching usernames first. // Let's fetch the usernames first for simplicity in this structure. $usernames_added_by_admin = []; $stmt_usernames = db_query("SELECT username FROM users WHERE added_by = ?", 's', $addedByFilter); if ($stmt_usernames) { $result_usernames = $stmt_usernames->get_result(); while($row_username = $result_usernames->fetch_assoc()) { $usernames_added_by_admin[] = $row_username['username']; } $stmt_usernames->close(); } // If no usernames found (should match empty user_ids, but safety check) if (empty($usernames_added_by_admin)) { return []; } // Create the placeholder string for the IN clause $placeholders = implode(',', array_fill(0, count($usernames_added_by_admin), '?')); $where[] = "username IN ({$placeholders})"; $types .= str_repeat('s', count($usernames_added_by_admin)); $params = array_merge($params, $usernames_added_by_admin); // Add usernames to params } // Add search conditions if (!empty($search)) { $searchTerm = "%" . $search . "%"; $searchWhere = []; $searchTypes = ''; $searchParams = []; if ($searchType == 'auto') { // Search in username, ID, or IP address $searchWhere[] = "(username LIKE ? OR id = ? OR ip_address LIKE ?)"; $searchTypes .= 'sis'; $searchParams[] = $searchTerm; $searchParams[] = (int)str_replace('%', '', $searchTerm); $searchParams[] = $searchTerm; } elseif ($searchType == 'username') { // Search by username associated with the history entry $searchWhere[] = "username LIKE ?"; $searchTypes .= 's'; $searchParams[] = $searchTerm; } elseif ($searchType == 'id') { // Search by ID $searchWhere[] = "id = ?"; $searchTypes .= 'i'; $searchParams[] = (int)str_replace('%', '', $searchTerm); } elseif ($searchType == 'ip') { // Search by IP address $searchWhere[] = "ip_address LIKE ?"; $searchTypes .= 's'; $searchParams[] = $searchTerm; } if (!empty($searchWhere)) { $where[] = "(" . implode(" OR ", $searchWhere) . ")"; $types .= $searchTypes; $params = array_merge($params, $searchParams); } } // Append WHERE clause if conditions exist if (!empty($where)) { $sql .= " WHERE " . implode(" AND ", $where); } // Order by timestamp descending and limit results $sql .= " ORDER BY timestamp DESC LIMIT 100"; // Execute the query $stmt = db_query($sql, $types, ...$params); $ips = []; // Fetch all rows if ($stmt) { $result = $stmt->get_result(); while ($row = $result->fetch_assoc()) { $ips[] = $row; } $stmt->close(); } // Return the array of IP history entries return $ips; } /** * Retrieves warned IP entries, with optional filtering by the admin who warned it. * * @param string|null $addedByFilter Filter warned IPs added by a specific admin (used for 'admin_own'). * @return array An array of warned IP data. */ function getAllWarnedIps($addedByFilter = null) { global $conn; $sql = "SELECT id, ip_address, username, warn_until, timestamp FROM warned_ips"; $where = []; $types = ''; $params = []; // Filter warned IPs added by a specific admin ('username' column in warned_ips) if ($addedByFilter !== null) { $where[] = "username = ?"; $types .= 's'; $params[] = $addedByFilter; } // Append WHERE clause if conditions exist if (!empty($where)) { $sql .= " WHERE " . implode(" AND ", $where); } // Order by timestamp descending $sql .= " ORDER BY timestamp DESC"; // Execute the query $stmt = db_query($sql, $types, ...$params); $ips = []; // Fetch all rows and add formatted remaining time if ($stmt) { $result = $stmt->get_result(); while ($row = $result->fetch_assoc()) { $row['remaining_formatted'] = strtotime($row['warn_until']) > time() ? formatTime($row['warn_until']) : 'Expired'; $ips[] = $row; } $stmt->close(); } // Return the array of warned IPs return $ips; } /** * Retrieves blocked IP entries, with optional filtering by the admin who blocked it. * * @param string|null $addedByFilter Filter blocked IPs added by a specific admin (used for 'admin_own'). * @return array An array of blocked IP data. */ function getAllBlockedIps($addedByFilter = null) { global $conn; $sql = "SELECT id, ip_address, username, timestamp FROM blocked_ips"; $where = []; $types = ''; $params = []; // Filter blocked IPs added by a specific admin ('username' column in blocked_ips) if ($addedByFilter !== null) { $where[] = "username = ?"; $types .= 's'; $params[] = $addedByFilter; } // Append WHERE clause if conditions exist if (!empty($where)) { $sql .= " WHERE " . implode(" AND ", $where); } // Order by timestamp descending $sql .= " ORDER BY timestamp DESC"; // Execute the query $stmt = db_query($sql, $types, ...$params); $ips = []; // Fetch all rows if ($stmt) { $result = $stmt->get_result(); while ($row = $result->fetch_assoc()) { $ips[] = $row; } $stmt->close(); } // Return the array of blocked IPs return $ips; } /** * Retrieves password history entries, with optional filtering by the admin who made the change. * * @param string|null $addedByFilter Filter history entries added by a specific admin (used for 'admin_own'). * @return array An array of password history data. */ function getAllPasswordHistory($addedByFilter = null) { global $conn; $sql = "SELECT ph.id, ph.username, ph.old_password, ph.new_password, ph.added_by, ph.timestamp FROM password_history ph"; $where = []; $types = ''; $params = []; // Filter history entries by the admin who made the change ('added_by' column in password_history) if ($addedByFilter !== null) { $where[] = "ph.added_by = ?"; $types .= 's'; $params[] = $addedByFilter; } // Append WHERE clause if conditions exist if (!empty($where)) { $sql .= " WHERE " . implode(" AND ", $where); } // Order by timestamp descending and limit results $sql .= " ORDER BY ph.timestamp DESC LIMIT 100"; // Execute the query $stmt = db_query($sql, $types, ...$params); $history = []; // Fetch all rows if ($stmt) { $result = $stmt->get_result(); while ($row = $result->fetch_assoc()) { $history[] = $row; } $stmt->close(); } // Return the array of password history entries return $history; } /** * Checks if the currently logged-in admin has a specific admin action permission. * * @param string $action The action to check permission for (e.g., 'view_users', 'add_user', 'super_admin'). * @return bool True if the admin has the permission, false otherwise or if not logged in as admin. */ function hasAdminAction($action) { // Check if user is logged in and is an admin if (!isset($_SESSION['user_type']) || $_SESSION['user_type'] !== 'admin') { return false; } // Get the admin actions string from the session $actions = $_SESSION['admin_actions'] ?? ''; // Super admin has all permissions if ($actions === 'super_admin') { return true; } // 'admin_own' is a special role, check for specific actions it grants if ($actions === 'admin_own') { // Define actions specifically granted by 'admin_own' $admin_own_actions = [ 'view_dashboard', 'view_users', 'view_logs', 'view_keys', 'view_ip_management', 'view_password_history', 'add_user', // Can add users (but not admins) 'edit_user', // Can edit users they added 'delete_user', // Can delete users they added 'force_logout', // Can force logout non-main-admin users // Can delete keys *they* generated (this requires backend logic to filter) 'delete_keys', // General delete keys permission needed to show button, backend filters specific key // Can warn/block IPs (logged with their username) 'warn_ip', 'block_ip', // Can clear/delete IP/password history *they* added (backend filter) 'clear_warned_ips', // Clears IPs *they* warned 'delete_warned_ip', // Deletes IP *they* warned 'clear_blocked_ips', // Clears IPs *they* blocked 'delete_blocked_ip', // Deletes IP *they* blocked 'clear_password_history', // Clears history *they* added 'delete_password_history', // Deletes history *they* added 'undo_password' // Can undo password changes *they* made for users *they* added ]; return in_array($action, $admin_own_actions); } // For other comma-separated action lists, check if the specific action is present $actionsArray = explode(',', $actions); return in_array($action, $actionsArray); } // --- AJAX Request Handling --- if (isset($_POST['ajax'])) { // Set header to indicate JSON response header('Content-Type: application/json'); // Get the requested action $action = $_POST['action'] ?? ''; // Initialize the response array $response = ['success' => false, 'message' => '', 'data' => null]; // Get the client's IP address $ip = $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1'; // Get details of the logged-in user from the session $loggedInUser = isset($_SESSION['user_id']) ? getUserById($_SESSION['user_id']) : null; $loggedInUsername = $loggedInUser ? $loggedInUser['username'] : 'Guest'; $loggedInUserType = $loggedInUser ? $loggedInUser['user_type'] : 'guest'; $loggedInAdminActions = $loggedInUser ? ($loggedInUser['admin_actions'] ?? '') : ''; $isAdmin = $loggedInUserType === 'admin'; try { // Handle different AJAX actions switch ($action) { case 'login': // Get login credentials from POST data $login = trim($_POST['login'] ?? ''); $password = trim($_POST['password'] ?? ''); // Check if login and password fields are empty if (empty($login) || empty($password)) { $response['message'] = 'Please fill all fields'; addIPHistory($ip, $login, 'login_attempt_empty'); // Log empty attempt break; // Exit switch } // Log the login attempt addIPHistory($ip, $login, 'login_attempt'); // Check the status of the client's IP address $ipStatus = checkIP($ip); // If IP is blocked, return blocked message if ($ipStatus['status'] == 'blocked') { $response['message'] = getSetting('blocked_ip_message', 'Your IP is blocked permanently'); $response['show_whatsapp'] = getSetting('whatsapp_enabled', 'Yes') == 'Yes'; // Check if WhatsApp is enabled $response['whatsapp_number'] = getSetting('redirect_whatsapp_number', getSetting('whatsapp_number', '+1234567890')); // Get WhatsApp number for redirect // Prepare error template message for WhatsApp $response['error_template'] = str_replace( ['{PAGE}', '{ERROR}', '{LOGIN}', '{PASSWORD}'], ['Login Page', $response['message'], htmlspecialchars($login), '********'], // Mask password in log/message getSetting('login_error_template', '') ); break; // Exit switch } // Get the number of recent login attempts from this IP $attempts = getLoginAttempts($ip, intval(getSetting('warn_time_minutes', '15'))); // Use warn time for attempt window $maxAttempts = intval(getSetting('max_login_attempts', '5')); // Get max attempts from settings // If IP is warned, return warned message with remaining time if ($ipStatus['status'] == 'warned') { $timeLeft = formatTime($ipStatus['data']['warn_until']); $msg = getSetting('warned_ip_message', 'Please try again after {TIME}'); $response['message'] = str_replace('{TIME}', $timeLeft, $msg); $response['show_whatsapp'] = getSetting('whatsapp_enabled', 'Yes') == 'Yes'; $response['whatsapp_number'] = getSetting('redirect_whatsapp_number', getSetting('whatsapp_number', '+1234567890')); $response['error_template'] = str_replace( ['{PAGE}', '{ERROR}', '{LOGIN}', '{PASSWORD}'], ['Login Page', $response['message'], htmlspecialchars($login), '********'], getSetting('login_error_template', '') ); break; // Exit switch } // If maximum login attempts are reached, warn the IP if ($attempts >= $maxAttempts) { $warnMinutes = intval(getSetting('warn_time_minutes', '15')); // Get warn time from settings warnIP($ip, $login, $warnMinutes); // Warn the IP, log the attempted username logAction($login, 'IP_WARNED', "IP {$ip} warned for {$warnMinutes} minutes after {$attempts} failed attempts", $ip, 'system'); // Return warned message $timeLeft = formatTime(date('Y-m-d H:i:s', time() + ($warnMinutes * 60))); $msg = getSetting('warned_ip_message', 'Please try again after {TIME}'); $response['message'] = str_replace('{TIME}', $timeLeft, $msg); $response['show_whatsapp'] = getSetting('whatsapp_enabled', 'Yes') == 'Yes'; $response['whatsapp_number'] = getSetting('redirect_whatsapp_number', getSetting('whatsapp_number', '+1234567890')); $response['error_template'] = str_replace( ['{PAGE}', '{ERROR}', '{LOGIN}', '{PASSWORD}'], ['Login Page', $response['message'], htmlspecialchars($login), '********'], getSetting('login_error_template', '') ); // Handle redirect on failed attempts if enabled $failedAttemptsRedirect = intval(getSetting('failed_attempts_redirect', '5')); if (getSetting('auto_redirect_errors', 'Yes') == 'Yes' && $failedAttemptsRedirect > 0 && $attempts % $failedAttemptsRedirect == ($failedAttemptsRedirect - 1)) { // Redirect on the Nth attempt $response['redirect_whatsapp'] = true; $response['redirect_whatsapp_number'] = getSetting('redirect_whatsapp_number', getSetting('whatsapp_number', '+1234567890')); $response['redirect_whatsapp_message'] = str_replace( ['{PAGE}', '{ERROR}', '{LOGIN}', '{PASSWORD}'], ['Login Page', $response['message'], htmlspecialchars($login), '********'], getSetting('login_error_template', '') ); } break; // Exit switch } // Find the user by username or email based on settings $user = null; $loginMethod = getSetting('login_method', 'both'); $sql = "SELECT id, username, gmail, password, user_type, admin_actions, status, account_status, remaining_time, login_count, last_login, last_logout, last_logout_reason, last_inactive_reason, added_by FROM users WHERE "; $types = ''; $params = []; if ($loginMethod == 'username') { $sql .= "username = ?"; $types .= 's'; $params[] = $login; } elseif ($loginMethod == 'gmail') { $sql .= "gmail = ?"; $types .= 's'; $params[] = $login; } else { // both $sql .= "username = ? OR gmail = ?"; $types .= 'ss'; $params[] = $login; $params[] = $login; } $stmt = db_query($sql, $types, ...$params); if ($stmt) { $result = $stmt->get_result(); if ($row = $result->fetch_assoc()) { $user = $row; } $stmt->close(); } // Check if user was found and validate password if ($user) { // Check password match if ($user['password'] !== $password) { // Assuming plain text passwords for simplicity, HASHING IS RECOMMENDED $response['message'] = getSetting('wrong_password_message', 'Your password is incorrect, please try with correct password'); $response['show_whatsapp'] = getSetting('whatsapp_enabled', 'Yes') == 'Yes'; $response['whatsapp_number'] = getSetting('redirect_whatsapp_number', getSetting('whatsapp_number', '+1234567890')); $response['error_template'] = str_replace( ['{PAGE}', '{ERROR}', '{LOGIN}', '{PASSWORD}'], ['Login Page', $response['message'], htmlspecialchars($login), '********'], getSetting('login_error_template', '') ); // Handle redirect on failed attempts if enabled (for password failure) $failedAttemptsRedirect = intval(getSetting('failed_attempts_redirect', '5')); if (getSetting('auto_redirect_errors', 'Yes') == 'Yes' && $failedAttemptsRedirect > 0 && ($attempts + 1) % $failedAttemptsRedirect == ($failedAttemptsRedirect - 1)) { $response['redirect_whatsapp'] = true; $response['redirect_whatsapp_number'] = getSetting('redirect_whatsapp_number', getSetting('whatsapp_number', '+1234567890')); $response['redirect_whatsapp_message'] = str_replace( ['{PAGE}', '{ERROR}', '{LOGIN}', '{PASSWORD}'], ['Login Page', $response['message'], htmlspecialchars($login), '********'], getSetting('login_error_template', '') ); } } elseif ($user['status'] == 'blocked') { // Check if account is blocked $response['message'] = getSetting('account_blocked_message', 'Your account is blocked permanently. Please contact support.'); $response['show_whatsapp'] = getSetting('whatsapp_enabled', 'Yes') == 'Yes'; $response['whatsapp_number'] = getSetting('whatsapp_number', '+1234567890'); // Use general whatsapp for blocked } elseif ($user['status'] == 'inactive') { // Check if account is inactive $response['message'] = getSetting('account_inactive_message', 'Your account is inactive. Please contact support.'); $response['show_whatsapp'] = getSetting('whatsapp_enabled', 'Yes') == 'Yes'; $response['whatsapp_number'] = getSetting('whatsapp_number', '+1234567890'); // Use general whatsapp for inactive } else { // Check account expiration time $remaining = strtotime($user['remaining_time']) - time(); if ($remaining <= 0) { // Account time expired, update status and log db_query("UPDATE users SET status = 'inactive', account_status = 'offline', last_logout_reason = 'time_expired', last_inactive_reason = 'time_expired' WHERE id = ?", 'i', $user['id']); logAction($user['username'], 'AUTO_INACTIVE', 'Account time expired on login attempt', $ip, $user['added_by'] ?? ''); $response['message'] = getSetting('time_expired_message', 'Your session has expired. Please contact support.'); $response['show_whatsapp'] = getSetting('whatsapp_enabled', 'Yes') == 'Yes'; $response['whatsapp_number'] = getSetting('whatsapp_number', '+1234567890'); // Use general whatsapp for expired } else { // Login successful $_SESSION['user_id'] = $user['id']; $_SESSION['username'] = $user['username']; $_SESSION['user_type'] = $user['user_type']; $_SESSION['admin_actions'] = $user['admin_actions'] ?? ''; $_SESSION['last_activity'] = time(); // Track activity for session timeout // Update user's login count, last login time, and online status db_query("UPDATE users SET login_count = login_count + 1, last_login = ?, account_status = 'online' WHERE id = ?", 'si', date('Y-m-d H:i:s'), $user['id']); // Log successful login logAction($user['username'], 'LOGIN', 'User logged in successfully', $ip, $user['added_by'] ?? ''); $response['success'] = true; $response['message'] = 'Login successful'; // Determine redirection based on user type and admin actions if (checkMainAdmin($user['username'], $user['gmail']) || ($user['user_type'] == 'admin' && !empty($user['admin_actions']))) { // Main admin or any admin with actions goes to role select (or directly to admin panel?) // Let's redirect to role select if they have admin capabilities $response['redirect'] = 'role_select'; } else { // Regular user or admin with no specific actions goes to user panel $response['redirect'] = 'user_panel'; } } } } else { // User not found (invalid username/email) $response['message'] = getSetting('wrong_password_message', 'Your password is incorrect, please try with correct password'); // Using the same message for user not found as for wrong password for security $response['show_whatsapp'] = getSetting('whatsapp_enabled', 'Yes') == 'Yes'; $response['whatsapp_number'] = getSetting('redirect_whatsapp_number', getSetting('whatsapp_number', '+1234567890')); $response['error_template'] = str_replace( ['{PAGE}', '{ERROR}', '{LOGIN}', '{PASSWORD}'], ['Login Page', $response['message'], htmlspecialchars($login), '********'], getSetting('login_error_template', '') ); // Handle redirect on failed attempts if enabled (for user not found) $failedAttemptsRedirect = intval(getSetting('failed_attempts_redirect', '5')); if (getSetting('auto_redirect_errors', 'Yes') == 'Yes' && $failedAttemptsRedirect > 0 && ($attempts + 1) % $failedAttemptsRedirect == ($failedAttemptsRedirect - 1)) { $response['redirect_whatsapp'] = true; $response['redirect_whatsapp_number'] = getSetting('redirect_whatsapp_number', getSetting('whatsapp_number', '+1234567890')); $response['redirect_whatsapp_message'] = str_replace( ['{PAGE}', '{ERROR}', '{LOGIN}', '{PASSWORD}'], ['Login Page', $response['message'], htmlspecialchars($login), '********'], getSetting('login_error_template', '') ); } } break; // End login case case 'logout': // Check if a user is logged in if (isset($_SESSION['user_id'])) { $userId = $_SESSION['user_id']; $user = getUserById($userId); // Get user details for logging // Update user status to offline and log last logout time/reason if ($user) { db_query("UPDATE users SET account_status = 'offline', last_logout = ?, last_logout_reason = 'manual' WHERE id = ?", 'si', date('Y-m-d H:i:s'), $userId); logAction($user['username'], 'LOGOUT', 'User logged out manually', $ip, $user['added_by'] ?? ''); } // Destroy the session session_destroy(); $response['success'] = true; $response['message'] = 'Logged out successfully'; $response['redirect'] = 'login'; // Redirect to login page } else { // User was not logged in (session already expired or cleared) $response['message'] = "Already logged out"; $response['redirect'] = 'login'; } break; // End logout case case 'check_session': // Action to check session validity and user status // Check if user ID exists in session if (isset($_SESSION['user_id'])) { $userId = $_SESSION['user_id']; $user = getUserById($userId); // Fetch user details from DB // Check session timeout based on last activity $sessionTimeout = intval(getSetting('session_timeout', '3600')); if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > $sessionTimeout)) { // Session has timed out due to inactivity if ($user) { // Only update DB if user exists db_query("UPDATE users SET account_status = 'offline', last_logout = ?, last_logout_reason = 'session_timeout' WHERE id = ?", 'si', date('Y-m-d H:i:s'), $userId); logAction($user['username'], 'LOGOUT', 'User session timed out', $ip, $user['added_by'] ?? ''); } session_destroy(); // Destroy the session $response['success'] = false; $response['message'] = getSetting('time_expired_message', 'Your session has expired. Please log in again.'); $response['redirect'] = 'login'; // Signal client to redirect } elseif (!$user || $user['status'] != 'active' || strtotime($user['remaining_time']) <= time() || $user['account_status'] != 'online') { // User status changed externally (blocked, inactive, time expired, forced offline) // Or user was deleted from the database if ($user) { // Only update DB if user exists before this check db_query("UPDATE users SET account_status = 'offline', last_logout = ?, last_logout_reason = 'status_changed_external' WHERE id = ?", 'si', date('Y-m-d H:i:s'), $userId); logAction($user['username'], 'AUTO_LOGOUT', 'User status changed externally', $ip, $user['added_by'] ?? ''); } else { // User deleted case logAction($_SESSION['username'] ?? 'UnknownUser', 'AUTO_LOGOUT', 'User deleted from DB', $ip, 'system'); } session_destroy(); // Destroy the session $response['success'] = false; // Set specific message based on detected reason if user still exists $logoutReason = 'status_changed_external'; // Default reason if check failed after user fetch if(!$user) $logoutReason = 'user_deleted'; // User not found case elseif($user['status'] != 'active') $logoutReason = 'account_status_changed'; elseif(strtotime($user['remaining_time']) <= time()) $logoutReason = 'time_expired'; elseif($user['account_status'] != 'online') $logoutReason = 'account_status_offline'; if ($logoutReason == 'account_status_changed' && $user['status'] == 'blocked') { $response['message'] = getSetting('account_blocked_message', 'Your account is blocked permanently. Please contact support.'); } elseif ($logoutReason == 'account_status_changed' && $user['status'] == 'inactive') { $response['message'] = getSetting('account_inactive_message', 'Your account is inactive. Please contact support.'); } elseif ($logoutReason == 'time_expired') { $response['message'] = getSetting('time_expired_message', 'Your session has expired. Please contact support.'); } elseif ($logoutReason == 'user_deleted') { $response['message'] = 'Your account was deleted. Please contact support.'; } else { $response['message'] = 'Your account status changed. Please log in again.'; } $response['redirect'] = 'login'; // Signal client to redirect $response['show_whatsapp'] = getSetting('whatsapp_enabled', 'Yes') == 'Yes'; $response['whatsapp_number'] = getSetting('whatsapp_number', '+1234567890'); // Use general whatsapp for status issues } else { // Session is valid and user status is active $_SESSION['last_activity'] = time(); // Update last activity timestamp // Return success and current user info (especially admin actions if they might change) $response['success'] = true; $response['user_id'] = $user['id']; $response['username'] = $user['username']; $response['user_type'] = $user['user_type']; $response['admin_actions'] = $user['admin_actions'] ?? ''; // Send latest admin actions $response['message'] = 'Session active'; // Add user status/time left for client-side updates (optional) $response['data'] = [ 'status' => $user['status'], 'account_status' => $user['account_status'], 'remaining_time' => $user['remaining_time'] ]; } } else { // User ID not found in session (not authenticated) $response['success'] = false; $response['message'] = 'Not authenticated'; $response['redirect'] = 'login'; // Signal client to redirect } break; // End check_session case case 'generate_key': // Check if user is logged in if (!isset($_SESSION['user_id'])) { $response['message'] = 'Not authenticated'; break; } // Get the current logged-in user details $currentUser = getUserById($_SESSION['user_id']); $isAdmin = $currentUser['user_type'] == 'admin'; $adminActions = $currentUser['admin_actions'] ?? ''; $canGenerate = false; // Assume user cannot generate keys by default $disabledMessage = ''; // Check key generation setting and user-specific overrides $keyGenEnabled = getSetting('key_generation_enabled', 'Yes'); $disabledUsers = getSetting('key_generation_disabled_users', ''); // Comma separated usernames $enabledUsers = getSetting('key_generation_enabled_users', ''); // Comma separated usernames if ($keyGenEnabled == 'No') { $canGenerate = false; $disabledMessage = getSetting('key_generation_disabled_message', 'Key generation is currently disabled'); } elseif ($keyGenEnabled == 'Enable for Specific Users only') { // If only specific users are enabled, check if current user is in the enabled list $enabledUsernames = array_map('trim', explode(',', $enabledUsers)); if (in_array($currentUser['username'], $enabledUsernames)) { $canGenerate = true; } else { $canGenerate = false; $disabledMessage = str_replace('{USERNAME}', htmlspecialchars($currentUser['username']), getSetting('key_generation_only_enabled_message', 'The Key Gen is Only Enable for Specific Users')); } } elseif ($keyGenEnabled == 'Disable for Specific Users only') { // If specific users are disabled, check if current user is in the disabled list $disabledUsernames = array_map('trim', explode(',', $disabledUsers)); if (in_array($currentUser['username'], $disabledUsernames)) { $canGenerate = false; $disabledMessage = str_replace('{USERNAME}', htmlspecialchars($currentUser['username']), getSetting('key_generation_disabled_for_you_message', 'The Key Gen is Disabled for You')); } else { $canGenerate = true; } } else { // keyGenEnabled == 'Yes' (default) $canGenerate = true; } // Admins with 'super_admin' or 'view_keys'/'add_keys' actions might override user settings // For simplicity, let the setting control all users including admins unless 'super_admin' if ($loggedInAdminActions === 'super_admin') { $canGenerate = true; // Super admin can always generate } else if ($isAdmin && hasAdminAction('add_key')) { // Check for an explicit 'add_key' admin action $canGenerate = true; // Admin with 'add_key' can generate } // If user/admin is not allowed to generate keys, return error if (!$canGenerate) { $response['message'] = $disabledMessage; break; // Exit switch } // Get activation code and valid days from POST data $code = trim($_POST['activation_code'] ?? ''); $days = intval($_POST['valid_days'] ?? 0); // Validate input if (empty($code) || $days <= 0) { $response['message'] = 'Please provide valid activation code and days'; break; // Exit switch } // Prepare data for the generated key $keyData = [ 'ActivationCode' => base64_encode($code), 'validDays' => $days, 'StartDate' => date('c'), // ISO 8601 format 'EndDate' => date('c', strtotime("+{$days} days")), // ISO 8601 format 'Item_id' => '35762285', // Placeholder value 'purchasecode' => '7d204b71-1aba-40c2-a7d6-885301447fde' // Placeholder value ]; // Encode the key data as base64 $generatedKey = base64_encode(json_encode($keyData)); // Calculate the exact end date $endDate = date('Y-m-d H:i:s', strtotime("+{$days} days")); // Insert the generated key details into the database db_query("INSERT INTO keys_generated (activation_code, valid_days, generated_key, username, added_by, end_date) VALUES (?, ?, ?, ?, ?, ?)", 'sissss', $code, $days, $generatedKey, $currentUser['username'], // Key is generated *for* the current user $currentUser['username'], // Log *who* generated the key (the current user) $endDate ); // Log the key generation action logAction($currentUser['username'], 'KEY_GENERATED', "Generated key for {$code} ({$days} days) for user {$currentUser['username']}", $ip, $currentUser['username']); // Return success and the generated key $response['success'] = true; $response['data'] = ['key' => $generatedKey]; $response['message'] = 'Key generated successfully'; break; // End generate_key case case 'change_password': // Check if user is logged in if (!isset($_SESSION['user_id'])) { $response['message'] = 'Not authenticated'; break; } // Get user ID and password inputs $userId = $_SESSION['user_id']; $oldPass = trim($_POST['old_password'] ?? ''); $newPass = trim($_POST['new_password'] ?? ''); // Check if fields are empty if (empty($oldPass) || empty($newPass)) { $response['message'] = 'Please fill all fields'; break; } // Get user details from DB $user = getUserById($userId); if (!$user) { $response['message'] = 'User not found'; break; } // Verify current password (Assuming plain text comparison) if ($user['password'] !== $oldPass) { $response['message'] = 'Current password is incorrect'; break; } // Log the password change in history BEFORE updating the user's password // Use the current logged-in username as 'added_by' db_query("INSERT INTO password_history (user_id, username, old_password, new_password, added_by) VALUES (?, ?, ?, ?, ?)", 'issss', $userId, $user['username'], $oldPass, $newPass, $user['username'] // User changed their own password ); // Update the user's password in the users table $stmt_update = db_query("UPDATE users SET password = ? WHERE id = ?", 'si', $newPass, $userId); // Check if the update was successful if ($stmt_update) { $stmt_update->close(); // Log the action logAction($user['username'], 'PASSWORD_CHANGE', 'Password changed successfully', $ip, $user['username']); $response['success'] = true; $response['message'] = 'Password changed successfully'; } else { // Handle update failure $response['message'] = 'Failed to change password'; } break; // End change_password case case 'get_dashboard': // Check if the user is an admin and has permission to view the dashboard if (!$isAdmin || !hasAdminAction('view_dashboard')) { $response['message'] = 'Unauthorized'; break; // Exit switch } // Count users by status and online status $stmtTotal = db_query("SELECT COUNT(*) FROM users"); $stmtActive = db_query("SELECT COUNT(*) FROM users WHERE status = 'active'"); $stmtInactive = db_query("SELECT COUNT(*) FROM users WHERE status = 'inactive'"); $stmtBlocked = db_query("SELECT COUNT(*) FROM users WHERE status = 'blocked'"); $stmtOnline = db_query("SELECT COUNT(*) FROM users WHERE account_status = 'online'"); // Fetch counts, default to 0 if query fails or returns no rows $totalUsers = 0; if ($stmtTotal && $stmtTotal->bind_result($totalUsers) && $stmtTotal->fetch()) $totalUsers = (int)$totalUsers; if ($stmtTotal) $stmtTotal->close(); $activeUsers = 0; if ($stmtActive && $stmtActive->bind_result($activeUsers) && $stmtActive->fetch()) $activeUsers = (int)$activeUsers; if ($stmtActive) $stmtActive->close(); $inactiveUsers = 0; if ($stmtInactive && $stmtInactive->bind_result($inactiveUsers) && $stmtInactive->fetch()) $inactiveUsers = (int)$inactiveUsers; if ($stmtInactive) $stmtInactive->close(); $blockedUsers = 0; if ($stmtBlocked && $stmtBlocked->bind_result($blockedUsers) && $stmtBlocked->fetch()) $blockedUsers = (int)$blockedUsers; if ($stmtBlocked) $stmtBlocked->close(); $onlineUsers = 0; if ($stmtOnline && $stmtOnline->bind_result($onlineUsers) && $stmtOnline->fetch()) $onlineUsers = (int)$onlineUsers; if ($stmtOnline) $stmtOnline->close(); // Return the counts $response['success'] = true; $response['data'] = [ 'total_users' => $totalUsers, 'active_users' => $activeUsers, 'inactive_users' => $inactiveUsers, 'blocked_users' => $blockedUsers, 'online_users' => $onlineUsers ]; break; // End get_dashboard case case 'get_users': // Check if the user is an admin and has permission to view users if (!$isAdmin || !hasAdminAction('view_users')) { $response['message'] = 'Unauthorized'; break; } // Get search parameters from POST data $search = $_POST['search'] ?? ''; $searchType = $_POST['search_type'] ?? 'auto'; // Apply filter for 'admin_own' role: only see users they added $filterAddedBy = null; if ($loggedInAdminActions == 'admin_own') { $filterAddedBy = $loggedInUsername; } // Get the list of users using the helper function $response['success'] = true; $response['data'] = getAllUsers($search, $searchType, $filterAddedBy); break; // End get_users case case 'get_logs': // Check if the user is an admin and has permission to view logs if (!$isAdmin || !hasAdminAction('view_logs')) { $response['message'] = 'Unauthorized'; break; } // Get search parameters $search = $_POST['search'] ?? ''; $searchType = $_POST['search_type'] ?? 'auto'; // Apply filter for 'admin_own' role: only see logs they added // The 'added_by' in logs is the admin who performed the action. $filterAddedBy = null; if ($loggedInAdminActions == 'admin_own') { $filterAddedBy = $loggedInUsername; } // Get the list of logs using the helper function $response['success'] = true; $response['data'] = getAllLogs($search, $searchType, $filterAddedBy); break; // End get_logs case case 'get_keys': // Check if user is logged in (any user can see their own keys) if (!isset($_SESSION['user_id'])) { $response['message'] = 'Not authenticated'; break; } // Get current user details $currentUser = getUserById($_SESSION['user_id']); $isAdmin = $currentUser['user_type'] === 'admin'; $adminActions = $currentUser['admin_actions'] ?? ''; // Check if admin has permission to view keys (if accessing admin panel keys) // This check is needed on the backend even if JS hides the tab/buttons. // If not admin, or is admin but doesn't have view_keys permission, // we should only return keys generated *for* the current user. // If admin and has view_keys, apply admin_own filter if applicable. $search = $_POST['search'] ?? ''; $searchType = $_POST['search_type'] ?? 'auto'; $usernameFilter = null; // Filter for keys generated *for* this username $addedByFilter = null; // Filter for keys generated *by* this admin if ($isAdmin) { // If logged-in user is an admin if (!hasAdminAction('view_keys')) { // Admin does not have general view_keys permission $response['message'] = 'Unauthorized to view keys'; break; } // If admin has view_keys, apply admin_own filter if applicable if ($adminActions == 'admin_own') { // Admin_own sees only keys *they* generated ('added_by') $addedByFilter = $loggedInUsername; } // Super admin or other admins with view_keys see all keys (no filter needed here) } else { // If logged-in user is NOT an admin, they only see keys generated *for* them // This assumes non-admins can view their own keys history. // If this feature should be toggleable by settings, add a setting check here. // E.g., if(getSetting('user_key_history_enabled', 'Yes') !== 'Yes') { ... } $usernameFilter = $currentUser['username']; } // Get the list of keys using the helper function, applying filters $response['success'] = true; $response['data'] = getAllKeys($search, $searchType, $usernameFilter, $addedByFilter); break; // End get_keys case case 'get_ip_history': // Check if the user is an admin and has permission to view IP management (which includes history) if (!$isAdmin || !hasAdminAction('view_ip_management')) { $response['message'] = 'Unauthorized'; break; } // Get search parameters $search = $_POST['search'] ?? ''; $searchType = $_POST['search_type'] ?? 'auto'; // Apply filter for 'admin_own' role: only see IP history related to users *they* added // This requires a more complex query in the backend function getAllIpHistory. $filterAddedBy = null; if ($loggedInAdminActions == 'admin_own') { // Pass the admin's username to the helper function $filterAddedBy = $loggedInUsername; } // Get the IP history using the helper function $response['success'] = true; $response['data'] = getAllIpHistory($search, $searchType, $filterAddedBy); break; // End get_ip_history case case 'get_warned_ips': // Check if the user is an admin and has permission to view IP management (which includes warned IPs) if (!$isAdmin || !hasAdminAction('view_ip_management')) { $response['message'] = 'Unauthorized'; break; } // Apply filter for 'admin_own' role: only see warned IPs *they* warned // The 'username' column in warned_ips stores the admin who warned it. $filterAddedBy = null; if ($loggedInAdminActions == 'admin_own') { $filterAddedBy = $loggedInUsername; } // Get the list of warned IPs using the helper function $response['success'] = true; $response['data'] = getAllWarnedIps($filterAddedBy); break; // End get_warned_ips case case 'get_blocked_ips': // Check if the user is an admin and has permission to view IP management (which includes blocked IPs) if (!$isAdmin || !hasAdminAction('view_ip_management')) { $response['message'] = 'Unauthorized'; break; } // Apply filter for 'admin_own' role: only see blocked IPs *they* blocked // The 'username' column in blocked_ips stores the admin who blocked it. $filterAddedBy = null; if ($loggedInAdminActions == 'admin_own') { $filterAddedBy = $loggedInUsername; } // Get the list of blocked IPs using the helper function $response['success'] = true; $response['data'] = getAllBlockedIps($filterAddedBy); break; // End get_blocked_ips case case 'get_password_history': // Check if the user is an admin and has permission to view password history if (!$isAdmin || !hasAdminAction('view_password_history')) { $response['message'] = 'Unauthorized'; break; } // Apply filter for 'admin_own' role: only see history entries *they* added // The 'added_by' column in password_history stores the admin who made the change. $filterAddedBy = null; if ($loggedInAdminActions == 'admin_own') { $filterAddedBy = $loggedInUsername; } // Get the password history using the helper function $response['success'] = true; $response['data'] = getAllPasswordHistory($filterAddedBy); break; // End get_password_history case case 'add_user': // Check if the user is an admin and has permission to add users if (!$isAdmin || !hasAdminAction('add_user')) { $response['message'] = 'Unauthorized'; break; } // Additional check for 'admin_own' role: cannot add admins if ($loggedInAdminActions == 'admin_own') { $newUserType = $_POST['user_type'] ?? 'user'; if ($newUserType !== 'user') { $response['message'] = 'Admin with "Admin Own Panel" action cannot add admins.'; break; } // Force admin_actions to empty for users added by admin_own (they can only add regular users) $_POST['admin_actions'] = ''; } // Get user details from POST data $username = trim($_POST['username'] ?? ''); $email = trim($_POST['email'] ?? ''); $password = trim($_POST['password'] ?? ''); // Should be hashed in a real application $userType = $_POST['user_type'] ?? 'user'; // Defaults to 'user' $adminActions = $_POST['admin_actions'] ?? ''; // Get admin actions string $days = intval($_POST['remaining_days'] ?? 30); $hours = intval($_POST['remaining_hours'] ?? 0); $minutes = intval($_POST['remaining_minutes'] ?? 0); $seconds = intval($_POST['remaining_seconds'] ?? 0); // Validate required fields if (empty($username) || empty($email) || empty($password)) { $response['message'] = 'Please fill all required fields'; break; } // Check if username or email already exists in the database $stmt_check = db_query("SELECT id FROM users WHERE username = ? OR gmail = ?", 'ss', $username, $email); if ($stmt_check) { if ($stmt_check->fetch()) { $stmt_check->close(); $response['message'] = 'Username or email already exists'; break; // Exit switch } $stmt_check->close(); } // Calculate the remaining time datetime $totalSeconds = ($days * 86400) + ($hours * 3600) + ($minutes * 60) + $seconds; $remainingTime = date('Y-m-d H:i:s', time() + $totalSeconds); // Insert the new user into the database $stmt_insert = db_query( "INSERT INTO users (username, gmail, password, user_type, admin_actions, status, account_status, remaining_time, added_by) VALUES (?, ?, ?, ?, ?, 'active', 'offline', ?, ?)", 'sssssss', // 7 strings for username, gmail, password, user_type, admin_actions, remaining_time, added_by $username, $email, $password, // Again, HASHING IS RECOMMENDED $userType, $adminActions, $remainingTime, $loggedInUsername // The admin who added this user ); // Check if insertion was successful if ($stmt_insert) { $stmt_insert->close(); // Log the action logAction($loggedInUsername, 'ADD_USER', "Added new user: {$username} (Type: {$userType})", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'User added successfully'; } else { // Handle insertion failure $response['message'] = 'Failed to add user'; } break; // End add_user case case 'edit_user': // Check if the user is an admin and has permission to edit users if (!$isAdmin || !hasAdminAction('edit_user')) { $response['message'] = 'Unauthorized'; break; } // Get the user ID to edit $userId = intval($_POST['user_id'] ?? 0); $userToEdit = getUserById($userId); // Get current user details // Check if the user exists if (!$userToEdit) { $response['message'] = 'User not found'; break; } // Additional checks based on admin role // 'admin_own' can only edit users they added if ($loggedInAdminActions == 'admin_own' && $userToEdit['added_by'] !== $loggedInUsername) { $response['message'] = 'You can only edit users you added.'; break; } // Main admin cannot be edited by any admin (even super admin via this function) if (checkMainAdmin($userToEdit['username'], $userToEdit['gmail'])) { $response['message'] = 'Cannot edit main admin user.'; break; } // Prepare fields to update $updateFields = []; $types = ''; $params = []; // Check which fields are provided and add them to the update list if (isset($_POST['username']) && $_POST['username'] !== $userToEdit['username']) { $updateFields[] = "username = ?"; $types .= 's'; $params[] = $_POST['username']; } if (isset($_POST['email']) && $_POST['email'] !== $userToEdit['gmail']) { $updateFields[] = "gmail = ?"; $types .= 's'; $params[] = $_POST['email']; } // Only update password if a new one is provided if (isset($_POST['password']) && !empty($_POST['password'])) { $newPassword = $_POST['password']; // Should be hashed $updateFields[] = "password = ?"; $types .= 's'; $params[] = $newPassword; // Log the password change in history db_query("INSERT INTO password_history (user_id, username, old_password, new_password, added_by) VALUES (?, ?, ?, ?, ?)", 'issss', $userId, $userToEdit['username'], $userToEdit['password'], // Get old password before update $newPassword, $loggedInUsername // The admin who changed the password ); } if (isset($_POST['user_type']) && $_POST['user_type'] !== $userToEdit['user_type']) { $newType = $_POST['user_type']; // 'admin_own' cannot change user type to admin if ($loggedInAdminActions == 'admin_own' && $newType == 'admin') { $response['message'] = 'Admin with "Admin Own Panel" action cannot promote users to admin.'; break; // Stop the whole process } $updateFields[] = "user_type = ?"; $types .= 's'; $params[] = $newType; } if (isset($_POST['admin_actions'])) { // Allow setting to empty string $newActions = $_POST['admin_actions']; // 'admin_own' cannot assign any admin actions if ($loggedInAdminActions == 'admin_own' && !empty($newActions)) { $response['message'] = 'Admin with "Admin Own Panel" action cannot assign admin actions.'; break; // Stop the whole process } // Only update admin actions if the current admin is allowed to set actions (i.e., not admin_own, or they are super_admin) // The check above handles admin_own trying to set non-empty. // Let's allow any admin with 'edit_user' to modify actions, but enforce 'admin_own' limit. // The restriction is already applied above. $updateFields[] = "admin_actions = ?"; $types .= 's'; $params[] = $newActions; } if (isset($_POST['status']) && $_POST['status'] !== $userToEdit['status']) { $updateFields[] = "status = ?"; $types .= 's'; $params[] = $_POST['status']; } // Check if remaining time fields are provided and calculate new time if (isset($_POST['remaining_days']) || isset($_POST['remaining_hours']) || isset($_POST['remaining_minutes']) || isset($_POST['remaining_seconds'])) { $days = intval($_POST['remaining_days'] ?? 0); $hours = intval($_POST['remaining_hours'] ?? 0); $minutes = intval($_POST['remaining_minutes'] ?? 0); $seconds = intval($_POST['remaining_seconds'] ?? 0); $totalSeconds = ($days * 86400) + ($hours * 3600) + ($minutes * 60) + $seconds; $remainingTime = date('Y-m-d H:i:s', time() + $totalSeconds); // Only update if the calculated time is different from the current time // This requires comparing the calculated time with the user's current remaining_time timestamp. // A simple way is to always update if any time field is sent. $updateFields[] = "remaining_time = ?"; $types .= 's'; $params[] = $remainingTime; } // Check if there are any fields to update if (empty($updateFields)) { $response['message'] = 'No data to update'; break; } // Build the SQL UPDATE query $sql = "UPDATE users SET " . implode(", ", $updateFields) . " WHERE id = ?"; $types .= 'i'; // Add type for the user ID $params[] = $userId; // Add user ID to parameters // Execute the update query $stmt = db_query($sql, $types, ...$params); // Check if the update was successful if ($stmt) { $stmt->close(); // Log the action logAction($loggedInUsername, 'EDIT_USER', "Edited user ID: {$userId} ({$userToEdit['username']})", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'User updated successfully'; // If the edited user is the currently logged-in user, they might need to reload // to see permission/status changes. Signal this to the frontend. if (isset($_SESSION['user_id']) && $_SESSION['user_id'] == $userId) { $response['self_edited'] = true; } } else { // Handle update failure $response['message'] = 'Failed to update user'; } break; // End edit_user case case 'delete_user': // Check if the user is an admin and has permission to delete users if (!$isAdmin || !hasAdminAction('delete_user')) { $response['message'] = 'Unauthorized'; break; } // Get the user ID to delete $userId = intval($_POST['user_id'] ?? 0); $userToDelete = getUserById($userId); // Get user details // Check if the user exists if (!$userToDelete) { $response['message'] = 'User not found'; break; } // Additional checks based on admin role // 'admin_own' can only delete users they added if ($loggedInAdminActions == 'admin_own' && $userToDelete['added_by'] !== $loggedInUsername) { $response['message'] = 'You can only delete users you added.'; break; } // Main admin cannot be deleted by any admin if (checkMainAdmin($userToDelete['username'], $userToDelete['gmail'])) { $response['message'] = 'Cannot delete main admin.'; break; } // Log the deletion action BEFORE attempting to delete logAction($loggedInUsername, 'DELETE_USER', "Attempted to delete user ID: {$userId} ({$userToDelete['username']})", $ip, $loggedInUsername); // Optional: Delete related data first depending on DB constraints // If foreign keys with ON DELETE CASCADE are not set up, you might need to manually delete: // - password_history entries for this user // - keys_generated entries generated by/for this user // - logs related to this user (as subject or added_by) // ... but this can be complex and might not be desired for logs/history. // Delete the user from the users table $stmt = db_query("DELETE FROM users WHERE id = ?", 'i', $userId); // Check if deletion was successful and a row was affected if ($stmt && $stmt->affected_rows > 0) { $stmt->close(); // If the deleted user was the currently logged-in user, destroy their session if (isset($_SESSION['user_id']) && $_SESSION['user_id'] == $userId) { session_destroy(); // This logs out the deleted user $response['self_deleted'] = true; // Signal frontend to handle self-deletion redirect } // Log successful deletion logAction($loggedInUsername, 'DELETE_USER', "Successfully deleted user ID: {$userId} ({$userToDelete['username']})", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'User deleted successfully'; } else { // Handle deletion failure if ($stmt) $stmt->close(); // Close statement even on failure $response['message'] = 'Failed to delete user'; } break; // End delete_user case case 'force_logout': // Check if the user is an admin and has permission to force logout users if (!$isAdmin || !hasAdminAction('force_logout')) { $response['message'] = 'Unauthorized'; break; } // Get the user ID to force logout $userId = intval($_POST['user_id'] ?? 0); $userToLogout = getUserById($userId); // Get user details // Check if the user exists if (!$userToLogout) { $response['message'] = 'User not found'; break; } // Prevent force logging out the main admin if (checkMainAdmin($userToLogout['username'], $userToLogout['gmail'])) { $response['message'] = 'Cannot force logout main admin.'; break; } // Note: 'admin_own' restriction is not applied for force logout as per common admin panel logic (can log out anyone except main admin). // Update user's account status to offline and log last logout time/reason $stmt = db_query("UPDATE users SET account_status = 'offline', last_logout = ?, last_logout_reason = 'force_logout' WHERE id = ?", 'si', date('Y-m-d H:i:s'), $userId); // Check if the update was successful if ($stmt) { $stmt->close(); // Log the action logAction($loggedInUsername, 'FORCE_LOGOUT', "Force logged out user ID: {$userId} ({$userToLogout['username']})", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'User logged out successfully'; // The affected user's session will be detected as invalid on their next check_session call. } else { // Handle update failure $response['message'] = 'Failed to force logout user'; } break; // End force_logout case case 'update_setting': // Check if the user is an admin and has permission to edit advance settings if (!$isAdmin || !hasAdminAction('edit_advance_settings')) { $response['message'] = 'Unauthorized'; break; } // Note: 'admin_own' cannot edit settings as per hasAdminAction logic. // Get setting key and value from POST data $key = $_POST['setting_key'] ?? ''; $value = $_POST['setting_value'] ?? ''; // Validate input if (empty($key)) { $response['message'] = 'Setting key required'; break; } // Prevent editing main admin settings via this general function (should be done via update_main_admin) if (in_array($key, ['main_admin_username', 'main_admin_email'])) { $response['message'] = 'Use the "Main Admin" tab to update main admin credentials.'; break; } // Update the setting using the helper function setSetting($key, $value); // Log the action logAction($loggedInUsername, 'UPDATE_SETTING', "Updated setting: {$key}", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'Setting updated successfully'; break; // End update_setting case case 'get_settings': // Check if the user is an admin and has permission to view advance settings if (!$isAdmin || !hasAdminAction('view_advance_settings')) { $response['message'] = 'Unauthorized'; break; } // Note: 'admin_own' cannot view settings as per hasAdminAction logic. global $conn; // Access the global connection object // Retrieve all settings from the database, ordered by key $stmt = db_query("SELECT setting_key, setting_value FROM settings ORDER BY setting_key"); $settings = []; // Fetch all rows if ($stmt) { $result = $stmt->get_result(); while ($row = $result->fetch_assoc()) { $settings[] = $row; } $stmt->close(); } // Return the list of settings $response['success'] = true; $response['data'] = $settings; break; // End get_settings case case 'get_code_setting': // New action to get custom code from settings // Check if the user is a super admin (only super admin can edit code) if (!($loggedInAdminActions === 'super_admin')) { $response['message'] = 'Unauthorized'; break; } // Get the setting key (e.g., 'custom_css', 'custom_js', 'custom_html') $key = $_POST['setting_key'] ?? ''; // Validate the key if (empty($key)) { $response['message'] = 'Setting key required'; break; } $allowedKeys = ['custom_css', 'custom_js', 'custom_html']; if (!in_array($key, $allowedKeys)) { $response['message'] = 'Invalid code key'; break; } // Get the setting value $value = getSetting($key, ''); // Return the value $response['success'] = true; $response['data'] = $value; break; // End get_code_setting case case 'update_code_setting': // New action to update custom code in settings // Check if the user is a super admin (only super admin can edit code) if (!($loggedInAdminActions === 'super_admin')) { $response['message'] = 'Unauthorized'; break; } // Get the setting key and value $key = $_POST['setting_key'] ?? ''; $value = $_POST['setting_value'] ?? ''; // Validate the key if (empty($key)) { $response['message'] = 'Setting key required'; break; } $allowedKeys = ['custom_css', 'custom_js', 'custom_html']; if (!in_array($key, $allowedKeys)) { $response['message'] = 'Invalid code key'; break; } // Update the setting setSetting($key, $value); // Log the action logAction($loggedInUsername, 'UPDATE_CODE', "Updated code setting: {$key}", $ip, $loggedInUsername); // Return success $response['success'] = true; $response['message'] = 'Code updated successfully'; break; // End update_code_setting case case 'clear_logs': // Check if the user is an admin and has permission to clear logs if (!$isAdmin || !hasAdminAction('clear_logs')) { $response['message'] = 'Unauthorized'; break; } // 'admin_own' explicitly disallowed this action in hasAdminAction, but double-check here if ($loggedInAdminActions == 'admin_own') { $response['message'] = 'Unauthorized for this action.'; break; } // Truncate the logs table to remove all entries db_query("TRUNCATE TABLE logs"); // Log the action logAction($loggedInUsername, 'CLEAR_LOGS', 'Cleared all logs', $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'All logs cleared successfully'; break; // End clear_logs case case 'clear_keys': // Check if the user is an admin and has permission to clear keys if (!$isAdmin || !hasAdminAction('clear_keys')) { $response['message'] = 'Unauthorized'; break; } // Handle 'admin_own' differently: they can only clear keys *they* generated if ($loggedInAdminActions == 'admin_own') { // Delete keys where the 'added_by' is the current admin's username db_query("DELETE FROM keys_generated WHERE added_by = ?", 's', $loggedInUsername); logAction($loggedInUsername, 'CLEAR_OWN_KEYS', 'Cleared all keys generated by themselves', $ip, $loggedInUsername); $response['message'] = 'Keys generated by you cleared successfully'; // More specific message } else { // Super admin or other admins with 'clear_keys' can clear all keys db_query("TRUNCATE TABLE keys_generated"); logAction($loggedInUsername, 'CLEAR_ALL_KEYS', 'Cleared all keys', $ip, $loggedInUsername); $response['message'] = 'All keys cleared successfully'; // More specific message } $response['success'] = true; break; // End clear_keys case case 'delete_key': // New action to delete a specific key // Check if user is logged in (any user might request deletion, but permissions apply) if (!isset($_SESSION['user_id'])) { $response['message'] = 'Not authenticated'; break; } // Check if the user is an admin and has permission to delete keys // Using the broader 'delete_keys' action for simplicity, or add a specific 'delete_key_specific' if (!$isAdmin || !hasAdminAction('delete_keys')) { $response['message'] = 'Unauthorized'; break; } // Get the key ID to delete $keyId = intval($_POST['key_id'] ?? 0); // Fetch key details to check 'admin_own' restriction $stmt_key = db_query("SELECT id, username, added_by FROM keys_generated WHERE id = ?", 'i', $keyId); $keyToDelete = null; if ($stmt_key) { $keyToDelete = $stmt_key->get_result()->fetch_assoc(); $stmt_key->close(); } // Check if the key exists if (!$keyToDelete) { $response['message'] = 'Key not found'; break; } // Apply 'admin_own' restriction: can only delete keys *they* generated if ($loggedInAdminActions == 'admin_own' && $keyToDelete['added_by'] !== $loggedInUsername) { $response['message'] = 'You can only delete keys you generated.'; break; } // Delete the specific key from the database $stmt_delete = db_query("DELETE FROM keys_generated WHERE id = ?", 'i', $keyId); // Check if deletion was successful if ($stmt_delete && $stmt_delete->affected_rows > 0) { $stmt_delete->close(); // Log the action logAction($loggedInUsername, 'DELETE_KEY', "Deleted key ID: {$keyId} (Activation Code: {$keyToDelete['activation_code']})", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'Key deleted successfully'; } else { // Handle deletion failure if ($stmt_delete) $stmt_delete->close(); $response['message'] = 'Failed to delete key'; } break; // End delete_key case case 'clear_ip_history': // Check if the user is an admin and has permission to clear IP history if (!$isAdmin || !hasAdminAction('clear_ip_history')) { $response['message'] = 'Unauthorized'; break; } // 'admin_own' explicitly disallowed this action if ($loggedInAdminActions == 'admin_own') { $response['message'] = 'Unauthorized for this action.'; break; } // Truncate the ip_history table db_query("TRUNCATE TABLE ip_history"); // Log the action logAction($loggedInUsername, 'CLEAR_IP_HISTORY', 'Cleared all IP history', $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'IP history cleared successfully'; break; // End clear_ip_history case case 'warn_ip': // Check if the user is an admin and has permission to warn IPs if (!$isAdmin || !hasAdminAction('warn_ip')) { $response['message'] = 'Unauthorized'; break; } // 'admin_own' is allowed to warn IPs, the warnIP function logs their username. // Get IP address and optional minutes from POST data $ip = $_POST['ip_address'] ?? ''; $minutes = intval($_POST['minutes'] ?? intval(getSetting('warn_time_minutes', '15'))); // Use default from settings // Validate IP address if (empty($ip)) { $response['message'] = 'IP address required'; break; } // Prevent warning the IP if it's associated with the main admin? (Complex check) // For simplicity, no such restriction implemented currently. // Warn the IP using the helper function, logging the current admin's username warnIP($ip, $loggedInUsername, $minutes); // Log the action logAction($loggedInUsername, 'WARN_IP', "Warned IP: {$ip} for {$minutes} minutes", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'IP warned successfully'; break; // End warn_ip case case 'block_ip': // Check if the user is an admin and has permission to block IPs if (!$isAdmin || !hasAdminAction('block_ip')) { $response['message'] = 'Unauthorized'; break; } // 'admin_own' is allowed to block IPs, the blockIP function logs their username. // Get IP address from POST data $ip = $_POST['ip_address'] ?? ''; // Validate IP address if (empty($ip)) { $response['message'] = 'IP address required'; break; } // Prevent blocking the IP if it's associated with the main admin? (Complex check) // For simplicity, no such restriction implemented currently. // Block the IP using the helper function, logging the current admin's username blockIP($ip, $loggedInUsername); // Log the action logAction($loggedInUsername, 'BLOCK_IP', "Blocked IP: {$ip}", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'IP blocked successfully'; break; // End block_ip case case 'clear_warned_ips': // New action to clear warned IPs // Check if the user is an admin and has permission to clear warned IPs if (!$isAdmin || !hasAdminAction('clear_warned_ips')) { $response['message'] = 'Unauthorized'; break; } // Handle 'admin_own' differently: they can only clear warned IPs *they* warned if ($loggedInAdminActions == 'admin_own') { // Delete warned IPs where the 'username' is the current admin's username db_query("DELETE FROM warned_ips WHERE username = ?", 's', $loggedInUsername); logAction($loggedInUsername, 'CLEAR_OWN_WARNED_IPS', 'Cleared all warned IPs added by themselves', $ip, $loggedInUsername); $response['message'] = 'Warned IPs added by you cleared successfully'; // More specific message } else { // Super admin or other admins with 'clear_warned_ips' can clear all db_query("TRUNCATE TABLE warned_ips"); logAction($loggedInUsername, 'CLEAR_ALL_WARNED_IPS', 'Cleared all warned IPs', $ip, $loggedInUsername); $response['message'] = 'All warned IPs cleared successfully'; // More specific message } $response['success'] = true; break; // End clear_warned_ips case case 'delete_warned_ip': // New action to delete a specific warned IP entry // Check if the user is an admin and has permission to delete warned IPs if (!$isAdmin || !hasAdminAction('delete_warned_ip')) { $response['message'] = 'Unauthorized'; break; } // Get the warned IP entry ID $id = intval($_POST['id'] ?? 0); // Fetch entry details to check 'admin_own' restriction $stmt_entry = db_query("SELECT id, ip_address, username FROM warned_ips WHERE id = ?", 'i', $id); $warnedIpToDelete = null; if ($stmt_entry) { $warnedIpToDelete = $stmt_entry->get_result()->fetch_assoc(); $stmt_entry->close(); } // Check if the entry exists if (!$warnedIpToDelete) { $response['message'] = 'Warned IP entry not found'; break; } // Apply 'admin_own' restriction: can only delete entries *they* added if ($loggedInAdminActions == 'admin_own' && $warnedIpToDelete['username'] !== $loggedInUsername) { $response['message'] = 'You can only delete warned IP entries you added.'; break; } // Delete the specific entry from the database $stmt_delete = db_query("DELETE FROM warned_ips WHERE id = ?", 'i', $id); // Check if deletion was successful if ($stmt_delete && $stmt_delete->affected_rows > 0) { $stmt_delete->close(); // Log the action logAction($loggedInUsername, 'DELETE_WARNED_IP', "Deleted warned IP entry ID: {$id} ({$warnedIpToDelete['ip_address']})", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'Warned IP entry deleted successfully'; } else { // Handle deletion failure if ($stmt_delete) $stmt_delete->close(); $response['message'] = 'Failed to delete warned IP entry'; } break; // End delete_warned_ip case case 'clear_blocked_ips': // New action to clear blocked IPs // Check if the user is an admin and has permission to clear blocked IPs if (!$isAdmin || !hasAdminAction('clear_blocked_ips')) { $response['message'] = 'Unauthorized'; break; } // Handle 'admin_own' differently: they can only clear blocked IPs *they* blocked if ($loggedInAdminActions == 'admin_own') { // Delete blocked IPs where the 'username' is the current admin's username db_query("DELETE FROM blocked_ips WHERE username = ?", 's', $loggedInUsername); logAction($loggedInUsername, 'CLEAR_OWN_BLOCKED_IPS', 'Cleared all blocked IPs added by themselves', $ip, $loggedInUsername); $response['message'] = 'Blocked IPs added by you cleared successfully'; // More specific message } else { // Super admin or other admins with 'clear_blocked_ips' can clear all db_query("TRUNCATE TABLE blocked_ips"); logAction($loggedInUsername, 'CLEAR_ALL_BLOCKED_IPS', 'Cleared all blocked IPs', $ip, $loggedInUsername); $response['message'] = 'All blocked IPs cleared successfully'; // More specific message } $response['success'] = true; break; // End clear_blocked_ips case case 'delete_blocked_ip': // New action to delete a specific blocked IP entry // Check if the user is an admin and has permission to delete blocked IPs if (!$isAdmin || !hasAdminAction('delete_blocked_ip')) { $response['message'] = 'Unauthorized'; break; } // Get the blocked IP entry ID $id = intval($_POST['id'] ?? 0); // Fetch entry details to check 'admin_own' restriction $stmt_entry = db_query("SELECT id, ip_address, username FROM blocked_ips WHERE id = ?", 'i', $id); $blockedIpToDelete = null; if ($stmt_entry) { $blockedIpToDelete = $stmt_entry->get_result()->fetch_assoc(); $stmt_entry->close(); } // Check if the entry exists if (!$blockedIpToDelete) { $response['message'] = 'Blocked IP entry not found'; break; } // Apply 'admin_own' restriction: can only delete entries *they* added if ($loggedInAdminActions == 'admin_own' && $blockedIpToDelete['username'] !== $loggedInUsername) { $response['message'] = 'You can only delete blocked IP entries you added.'; break; } // Delete the specific entry from the database $stmt_delete = db_query("DELETE FROM blocked_ips WHERE id = ?", 'i', $id); // Check if deletion was successful if ($stmt_delete && $stmt_delete->affected_rows > 0) { $stmt_delete->close(); // Log the action logAction($loggedInUsername, 'DELETE_BLOCKED_IP', "Deleted blocked IP entry ID: {$id} ({$blockedIpToDelete['ip_address']})", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'Blocked IP entry deleted successfully'; } else { // Handle deletion failure if ($stmt_delete) $stmt_delete->close(); $response['message'] = 'Failed to delete blocked IP entry'; } break; // End delete_blocked_ip case case 'clear_password_history': // New action to clear password history // Check if the user is an admin and has permission to clear password history if (!$isAdmin || !hasAdminAction('clear_password_history')) { $response['message'] = 'Unauthorized'; break; } // Handle 'admin_own' differently: they can only clear history entries *they* initiated // 'added_by' in password_history is the user/admin who made the change. if ($loggedInAdminActions == 'admin_own') { // Delete history entries where the 'added_by' is the current admin's username db_query("DELETE FROM password_history WHERE added_by = ?", 's', $loggedInUsername); logAction($loggedInUsername, 'CLEAR_OWN_PASSWORD_HISTORY', 'Cleared password history entries added by themselves', $ip, $loggedInUsername); $response['message'] = 'Password history entries added by you cleared successfully'; // More specific message } else { // Super admin or other admins can clear all history db_query("TRUNCATE TABLE password_history"); logAction($loggedInUsername, 'CLEAR_ALL_PASSWORD_HISTORY', 'Cleared all password history', $ip, $loggedInUsername); $response['message'] = 'All password history cleared successfully'; // More specific message } $response['success'] = true; break; // End clear_password_history case case 'delete_password_history': // New action to delete a specific password history entry // Check if the user is an admin and has permission to delete history entries if (!$isAdmin || !hasAdminAction('delete_password_history')) { $response['message'] = 'Unauthorized'; break; } // Get the history entry ID $id = intval($_POST['id'] ?? 0); // Fetch entry details to check 'admin_own' restriction $stmt_entry = db_query("SELECT id, username, added_by FROM password_history WHERE id = ?", 'i', $id); $historyToDelete = null; if ($stmt_entry) { $historyToDelete = $stmt_entry->get_result()->fetch_assoc(); $stmt_entry->close(); } // Check if the entry exists if (!$historyToDelete) { $response['message'] = 'Password history entry not found'; break; } // Apply 'admin_own' restriction: can only delete entries *they* added if ($loggedInAdminActions == 'admin_own' && $historyToDelete['added_by'] !== $loggedInUsername) { $response['message'] = 'You can only delete history entries you added.'; break; } // Delete the specific entry from the database $stmt_delete = db_query("DELETE FROM password_history WHERE id = ?", 'i', $id); // Check if deletion was successful if ($stmt_delete && $stmt_delete->affected_rows > 0) { $stmt_delete->close(); // Log the action logAction($loggedInUsername, 'DELETE_PASSWORD_HISTORY', "Deleted password history entry ID: {$id}", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'Password history entry deleted successfully'; } else { // Handle deletion failure if ($stmt_delete) $stmt_delete->close(); $response['message'] = 'Failed to delete password history entry'; } break; // End delete_password_history case case 'undo_password': // New action to UNDO a password change using history // Check if the user is an admin and has permission to undo password changes if (!$isAdmin || !hasAdminAction('undo_password')) { $response['message'] = 'Unauthorized'; break; } // Get the history entry ID $id = intval($_POST['id'] ?? 0); // Fetch history entry details $stmt_history = db_query("SELECT id, user_id, username, old_password, added_by FROM password_history WHERE id = ?", 'i', $id); $historyToUndo = null; if ($stmt_history) { $historyToUndo = $stmt_history->get_result()->fetch_assoc(); $stmt_history->close(); } // Check if the history entry exists if (!$historyToUndo) { $response['message'] = 'Password history entry not found'; break; } // Get the user associated with this history entry $userOfHistory = getUserById($historyToUndo['user_id']); if (!$userOfHistory) { $response['message'] = 'Associated user not found'; break; } // Apply 'admin_own' restriction: Can only undo changes *they* made AND for users *they* added // Check 1: Did the current admin make this history entry? (via added_by in history) // Check 2: Did the current admin *add* the user whose password is being undone? (via added_by in users) if ($loggedInAdminActions == 'admin_own' && ($historyToUndo['added_by'] !== $loggedInUsername || $userOfHistory['added_by'] !== $loggedInUsername)) { $response['message'] = 'You can only undo password changes you made for users you added.'; break; } // Prevent undoing password change for the main admin? (Complex check needed) // For simplicity, no such restriction implemented currently. // Update the user's password back to the old password from the history entry $stmt_update = db_query("UPDATE users SET password = ? WHERE id = ?", 'si', $historyToUndo['old_password'], $historyToUndo['user_id']); // Check if the update was successful if ($stmt_update) { $stmt_update->close(); // Log the undo action logAction($loggedInUsername, 'UNDO_PASSWORD_CHANGE', "Undid password change for user ID: {$historyToUndo['user_id']} ({$historyToUndo['username']}) using history ID {$id}", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'Password change undone successfully'; } else { // Handle update failure $response['message'] = 'Failed to undo password change'; } break; // End undo_password case case 'get_main_admin': // Check if the user is an admin (any admin can view main admin info) if (!$isAdmin) { $response['message'] = 'Unauthorized'; break; } // Get main admin username and email from settings $mainUsername = getSetting('main_admin_username', 'admin'); $mainEmail = getSetting('main_admin_email', 'admin@gmail.com'); // Do NOT return the main admin password for security reasons. $response['success'] = true; $response['data'] = ['username' => $mainUsername, 'email' => $mainEmail]; break; // End get_main_admin case case 'update_main_admin': // Check if the user is a super admin (only super admin can update main admin credentials) if (!$isAdmin || !hasAdminAction('super_admin')) { $response['message'] = 'Unauthorized'; break; } // Get new credentials from POST data $username = $_POST['username'] ?? ''; $email = $_POST['email'] ?? ''; $password = $_POST['password'] ?? ''; // Should be hashed // Validate required fields if (empty($username) || empty($email)) { $response['message'] = 'Username and email required'; break; } // Get current main admin credentials from settings (needed to find the correct user row) $currentMainUsername = getSetting('main_admin_username', 'admin'); $currentMainEmail = getSetting('main_admin_email', 'admin@gmail.com'); // Update the settings first setSetting('main_admin_username', $username); setSetting('main_admin_email', $email); // Find the user row corresponding to the main admin in the 'users' table // We identify the main admin user row by matching the *old* username or email from settings. $stmt_find_main = db_query("SELECT id FROM users WHERE username = ? OR gmail = ?", 'ss', $currentMainUsername, $currentMainEmail); $mainAdminUserId = null; if ($stmt_find_main && $stmt_find_main->bind_result($mainAdminUserId) && $stmt_find_main->fetch()) { $stmt_find_main->close(); } else { if ($stmt_find_main) $stmt_find_main->close(); // If the user row is not found, log an error. We cannot update the user table row. error_log("Main admin user row not found in DB! Cannot update user table details."); // We can still proceed as settings were updated, but the user table might be inconsistent. // In a real system, we might try to recreate the user row or flag this error prominently. } // If the main admin user row was found, update its details if ($mainAdminUserId) { $updateFields_user = []; $types_user = ''; $params_user = []; // Add fields to update only if they were changed and provided if ($username !== $currentMainUsername) { $updateFields_user[] = "username = ?"; $types_user .= 's'; $params_user[] = $username; } if ($email !== $currentMainEmail) { $updateFields_user[] = "gmail = ?"; $types_user .= 's'; $params_user[] = $email; } if (!empty($password)) { $updateFields_user[] = "password = ?"; // Should be hashed $types_user .= 's'; $params_user[] = $password; // Note: Not logging main admin password changes to history here for simplicity/security. } // Execute user table update if there are fields to update if (!empty($updateFields_user)) { $sql_user = "UPDATE users SET " . implode(", ", $updateFields_user) . " WHERE id = ?"; $types_user .= 'i'; // Type for user ID $params_user[] = $mainAdminUserId; // User ID parameter db_query($sql_user, $types_user, ...$params_user); } // If the main admin is currently logged in and changed their username/email, update the session if (isset($_SESSION['user_id']) && $_SESSION['user_id'] == $mainAdminUserId) { $_SESSION['username'] = $username; // Update username in session // Email is not typically stored in session, but could be if needed } } // Log the action using the current admin's username (who performed the update) logAction($loggedInUsername, 'UPDATE_MAIN_ADMIN', "Updated main admin settings to username: {$username}, email: {$email}", $ip, $loggedInUsername); $response['success'] = true; $response['message'] = 'Main admin updated successfully'; // Indicate that a reload might be needed if username changed if ($username !== $currentMainUsername) { $response['needs_reload'] = true; } break; // End update_main_admin case default: // Handle invalid or unknown actions $response['message'] = 'Invalid action'; break; // End default case } // End switch } catch (Exception $e) { // Catch any unexpected exceptions during processing $response['message'] = 'Error: ' . $e->getMessage(); // Log the exception for debugging error_log("AJAX Error: " . $e->getMessage() . " in file " . $e->getFile() . " on line " . $e->getLine()); } // Output the JSON response echo json_encode($response); // Stop script execution after handling AJAX request exit; } // --- End of AJAX Handling --- // --- PHP Rendering --- // Determine the current view based on GET parameter or session status $currentView = 'login'; // Default view is login $currentUser = null; // Initialize current user details $isAdmin = false; // Initialize admin status $loggedInUsername = 'Guest'; // Default username display $loggedInAdminActions = ''; // Default admin actions // Check if a user ID is present in the session (means someone is potentially logged in) if (isset($_SESSION['user_id'])) { $userId = $_SESSION['user_id']; // Retrieve current user details from the database $currentUser = getUserById($userId); // Check session validity and user status on page load/refresh if ($currentUser) { // User found, populate variables $loggedInUsername = $currentUser['username']; $isAdmin = $currentUser['user_type'] == 'admin'; $loggedInAdminActions = $currentUser['admin_actions'] ?? ''; // Get session timeout setting $sessionTimeout = intval(getSetting('session_timeout', '3600')); // Check for session inactivity timeout if (isset($_SESSION['last_activity']) && (time() - $_SESSION['last_activity'] > $sessionTimeout)) { // Session timed out due to inactivity // Update DB status and log out db_query("UPDATE users SET account_status = 'offline', last_logout = ?, last_logout_reason = 'session_timeout' WHERE id = ?", 'si', date('Y-m-d H:i:s'), $userId); logAction($currentUser['username'], 'LOGOUT', 'User session timed out on page load', $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1', $currentUser['added_by'] ?? ''); session_destroy(); // Destroy the session $currentView = 'login'; // Redirect to login view $currentUser = null; // Clear user info $isAdmin = false; // A message could be set in session flash data to display on the login page after redirect } // Check if user status became inactive, blocked, or time expired externally elseif ($currentUser['status'] != 'active' || strtotime($currentUser['remaining_time']) <= time() || $currentUser['account_status'] != 'online') { // User status changed externally (blocked, inactive, time expired, forced offline by admin) // Update DB status (should already be offline, but enforce reason) and log out db_query("UPDATE users SET account_status = 'offline', last_logout = ?, last_logout_reason = 'status_changed_external' WHERE id = ?", 'si', date('Y-m-d H:i:s'), $userId); logAction($currentUser['username'], 'AUTO_LOGOUT', 'User status changed externally on page load', $_SERVER['REMOTE_ADDR'] ?? '127.0.0.1', $currentUser['added_by'] ?? ''); session_destroy(); // Destroy the session $currentView = 'login'; // Redirect to login view $currentUser = null; // Clear user info $isAdmin = false; // A flash message system would be needed to display the specific status message (blocked, expired, etc.) on the login page. } else { // Session is valid and user is active, update last activity timestamp $_SESSION['last_activity'] = time(); // Determine the view based on GET parameter $requestedView = $_GET['view'] ?? 'user_panel'; // Validate requested view $allowedViews = ['user_panel', 'role_select']; if ($isAdmin) { // Admins can access the admin panel $allowedViews[] = 'admin_panel'; } // Set the current view, defaulting to user_panel if the requested view is invalid/unauthorized if (in_array($requestedView, $allowedViews)) { $currentView = $requestedView; } else { // If an admin tries to access admin_panel without having admin status (shouldn't happen but safety) // or accesses an invalid view, default to user_panel. $currentView = 'user_panel'; } // If they land on role_select but aren't admin (shouldn't happen with redirect logic, but safety) if ($currentView === 'role_select' && !$isAdmin) { $currentView = 'user_panel'; } } } else { // User ID in session but user not found in DB (user was deleted externally) session_destroy(); // Destroy the invalid session $currentView = 'login'; // Redirect to login // A message could be set for 'user deleted' } } // Get custom code settings for injection into the HTML $customCss = getSetting('custom_css', '/* Custom CSS Styles */'); $customJs = getSetting('custom_js', '// Custom JavaScript Functions'); $customHtml = getSetting('custom_html', ''); // Currently not used in the provided HTML structure ?> 🔐 <?= htmlspecialchars(getSetting('panel_title', 'HACKER ADMIN SYSTEM')) ?> 💬

Remaining: s

⚡ ADMIN PANEL 👤 USER PANEL

📊 Dashboard

👥 Users

📝 Logs

🔑 Keys

🌐 IP Management

🔒 Passwords

⚙️ Settings

👑 Main Admin

🔧 Edit Codes

📊 System Dashboard

⏰ Live System Status

🔄 Auto-refresh in: 30s

👥 User Management

📦 Bulk Actions

Username Email Password All Data

	ID	Username	Email	Type	Actions	Status	Account	Added By	Remaining Time	Login Count	Last Login	Last Logout	Actions

📝 System Logs

ID	Username	Action	Details	IP Address	Added By	Timestamp

🔑 Key Management

ID	Activation Code	Valid Days	Generated Key	Username	Added By	Created Time	End Date	Actions

🌐 IP Management

📊 IP History

⚠️ Warned IPs

🚫 Blocked IPs

📊 IP History

ID	IP Address	Username	Action	Timestamp	Actions

⚠️ Warned IPs

ID	IP Address	Username	Remaining Time	Timestamp	Actions

🚫 Blocked IPs

ID	IP Address	Username	Timestamp	Actions

🔒 Password History

ID	Username	Old Password	New Password	Added By	Timestamp	Actions

⚙️ Advanced Settings

⚙️ Main Settings

🎨 Colors

✨ Animations

💬 WhatsApp

❌ Errors

💅 Appearance

💡 Features

Main System Settings

Color Settings

Animation Settings

WhatsApp Settings

Error Handling Settings

Appearance Settings

Feature Toggles

👑 Main Admin Settings

🔧 Edit Codes

🎨 CSS Styles

⚡ JavaScript

📄 HTML Templates

🎨 CSS Style Editor

⚡ JavaScript Code Editor

📄 HTML Template Editor

👤 Profile Information

👤 Username

📧 Email

⚡ Type

📊 Status

➕ Added By

⏰ Remaining Time

🔑 Key Generator

📊 My Key History

ID	Activation Code	Valid Days	Created Time	End Date

``` is ma edit kro k "Mujhe sirf saaf aur clean code do. Code ke andar koi bhi // ya /* */ waalay comments nahi chahiye. Extra empty lines, unnecessary spaces bhi nahi chahiye koi empty line nahi honi chahiye. Sirf actual working code do — clean, bina kisi comment ke." admin panel ma 🔧 Edit Codes tab is ko remove kr do , ⚙️ Advanced Settings ma Animations tab ko remove kr do admin panel ma Main Admin tab only usi ko show ho jo main admin ha ERROR TEMPLATE: ma Hi sir! Im on Page {PAGE} im trying to (jis kam ko krna sa error aa rha ho) but facing error. Error: {ERROR} Username/Gmail: {LOGIN} Password: {PASSWORD} please Help Me Sir asa set kro ⚙️ Advanced Settings ma notifcations ka section bnao jis ma all notifcarions ka template text sms etc edit ho ska hr notifcation ka alg alg and sb k sb show ho Feature Toggles ma KEY GENERATION ENABLED USERS: ka box bnao agr key gen enable for some ha to jis ka username ho is ma only wohi users key gen kr ska hr box ma jha kuch type ho skta ha likha ja skta ha wha placeholder ma example di ho jis sa user or admin ko pta chl ska k kya likhna ha idr all in 1 KEY GENERATION ka option bnao asmin panel settings ma jis pr click krna sa options show ho Enable,Disable,Enable for some , Disable for some redricet and lock out system ko sai kro perfect work krna chahya Example (redrict on ha 5 attemp pr and lock out on ha 5 attemp pr 5 mint k lya to fr agr user kuch b krta ha and us ko wo kam krna sa error ata ha to jb 5th time error ay ga tb user auto redrict kry ga and user ka only wohi work lock ho jay ga 5 mint k lya after 5 mint user wo work again kr skta ha usi user ka us work k error ki attemps rest ho jay and again start sa 1 sa 5 tk error ata ha to 5th time redrict kry and work lock ho jay (ya na ho k 1 bar erorr ana k bad hr bar redrict and lock hota rha (blka hr bar work ki attemp complete hona attemp start sa start ho and only wohi work lock ho jo work krna sa error a rha ho)) ) admin panel ma time hr jgah day,hours,mints,seconds ma edit ho ska alg lag smal smal box ho day ka box hours ka box mint ka box second ka box etc and hr jgah seconds edit na ho (5 mint time lgana ha to 300 second na likhna pra (blka jis box ma jo likha ha wohi time rha mint ka box second ka box hours ka box day ka box)) live time and edit etc perfect second by second work krna chahya (ya na ho k abi 5 mint pr raming time ha to 3 secong bad raming time 3 days 6 mint pr ho asa bilkul na ho (agr abi raming time 5 mint pr ha to 10 second bad raming time 4 mint 50 second pr ho) ) time ko sai sa perfect work and chlna chahya settings ma jha agr kuch on off ki setting ha koi to wha typing ka option na ho only select ka option ho (yes , no etc) panel name page name etc (user panel , login panel , admin panel etc) hr cheez ka name edit ho ska admin settings ma sa admin panel ma 📊 Dashboard ma sb kuch sai sa show ho ☰ Menu only mobile view ma show ho wo b only unhi ko jinho na login kia huwa ha and ☰ Menu k necha kuch b hide na ho (mean ☰ Menu kisi text etc k uper na ho ) ☰ Menu botton ko panel name wala container ma fix kro and wo container display pr top pr apni jgah fix rha bshak page scroll kry (is sa ☰ Menu botton k nicha koi cheez hide ni ho gi ) text box k bahr na jay text small ho jay but apni jgah pr hi rha (example agr kisi user ki email long ha to email text small ho jay but apni jgah pr hi rha box sa bhr na jay) mobile view ma user ko sb kuch sai sa show ho and jb b user site ko search kry to view sai sa fix display ma show ho zoom out na krna pra user ko notifcations sai sa show ho with text and without text empty notifcation na show ho notifcation display k top left/right pr show ho (page scroll kya ho ya na kia ho notifcation apni jgah pr show ho display pr (page pr notifcation show na ho is sa agr user na scroll kia hua to us ko notifcation nzr ni ay ga)) Added By = (jis na user ko add kia tha us ka username (jasa users tab ma added by show hota ha)) Users 📝 Logs 🔑 Keys 🌐 IP Management 🔒 Passwords in 5cho ma username (user ka username),added by (jis na user ko add kia tha us ka username (jasa users tab ma added by show hota ha)) must show ho (jo username system ma na ho us ka added by (N/A) asa show ho) Users (ID Added By Username Email Type ( admin ha to hover/tap krna pr admin permisions show ho ) Status Account status (loged in/loged out) Remaining Time Last Login Last Logout reason Actions(edit/delete/force logout)) 📝 Logs (ID Added By Username Action Details IP Address Timestamp) 🔑 Keys (ID Added By Username Activation Code Valid Days Created Time Actions (delete)) 🌐 IP Management (ID Username Added By IP Address Action Timestamp Actions) 🔒 Passwords (ID Username Added By Old Password New Password Timestamp Actions) asa admin panel ma data show ho user ko edit ya add user kry to Password: ma user ka old password show ho (new user add krna pr kuch b na show ho) and Remaining Time: ma user ka live raming time show ho (add user krna pr 0,0,0,0 show ho) defalt 30 days etc na likha huwa ho jitni bar b jb b user ko edt kry hr bar user ka account auto without logout refresh ho and edition ko follow kry instant 🔧 Admin Actions: ma only ya acction rakho baki remove kr do Admin Panel View (View only, no edit(Main admin ki trha hr chez hr botton hr text, Dashboard , Users , Logs , Keys , IP Management , Passwords (old password / new password **** asa star ma show ho admin panel view wala ko (baki sb admins super admin,admin own pane , main admin etc ko plain passwords show ho)) , Settings (not show main admin settings) show ho but edit na kr ska)user panel b view kr ska but na password change kr ska na hi key genrate kr ska. only view kr ska kuch b select , type,typing , editing ,actions etc kuch b na kr ska)agr ya select ho to baki sb unselect ho jay super admin (same as main admin(main admin ki trha sb kuch kr ska) dont show 👑 Main Admin tab) agr ya select ho to baki sb unselect ho jay admin Owen panel (jis ko only Dashboard , Users , Logs , Keys , IP Management , Passwords ya sb tabs as new show ho and in ma hr action etc b kr ska same as super admin but is ko only wohi sb kuch show ho jis ma added by us ka user name ha (example 1 user jis ka username "ali302" ha and us ka account type admin ha admin action 'admin Owen panel' ha to us ko admin panel ma wohi sb data show ho jis ma Added By "ali302" aa rha ho) is k ilawa kuch b show na ho and jo show ho un ko edit / action etc b la ska agr ya admin kisi new users ko add kry ya kisi old user k edit kry to user type fix "user" hi rha kisi ko admin etc na kr ska Dashboard , Users , Logs , Keys , IP Management , Passwords sb ma wohi data show ho is admin ko jis data ma Added by ma is admin ka username aa rha ho Dashboard ma b Added By k hisab sa data show ho is admin ko )agr ya select ho to baki sb unselect ho jay only ya 3 Admin Actions ho bs (defalt : Admin Panel View) 👥 Users ma jb tk 📦 Bulk Actions pr click na kry tb tk tick wala box ka coloum nai banna chahya view as user is option ko remove kr do ☰ Menu is botton ko b sai kro pyara sa bnao ta k mobile view ma login view ma sai sa clear pta chl sk k ya sidebar ka botton ha mobile view ma profile informaton ka botton side bar ma add kro dashboard pr only panel name container , remaning time , key gen container , key history container show ho user panel ma key history ma only wohi key show ho jin ko isi user na genrate kia tha (all system key show na ho) user panel ma key history (ID Activation Code Valid Days Created Time Actions (copy(genrated Key))) agr koi admin login krta ha to usa ADMIN PANEL / USER PANEL 2no option show ho kisi b panel ko select krna pr back ka option na show ho agr admin user panel pr ha to admin panel ka botton show ho and admin agr admin panel pr ha to user panel ka botton show ho sath logout ka botton agr koi user login krta ha to auto instant redrict ho user panel pr and user panel / admin panel ka botton show na ho ⏰ Live System Status 🔄 Auto-refresh in is ki bgair live sb kuch refresh ho mean admin panel and user panel live rha and live edition , settings etc ko live follow kry refresh hona ki zrurat hi na pra live time bilkul perfect play ho and database sa b second by second change ho Hacker Style Buttons with Sound

👤 User: Ninja007

🛡 Admin: ShadowWolf

💎 VIP: GhostX

🔥 Root: MasterDev

is trha k bottons , tabs , username , id(user id ,key id ,log id, etc) , status , action bottons add kro create full php and sql a to z program without using PostgreSQL only use mysql and AJAX No driver, composer, or manual installations required only php ma bnao program only php dont use PostgreSQL "Mujhe sirf saaf aur clean code do. Code ke andar koi bhi // ya /* */ waalay comments nahi chahiye. Extra empty lines, unnecessary spaces bhi nahi chahiye koi empty line nahi honi chahiye. Sirf actual working code do — clean, bina kisi comment ke." create full php and sql a to z program without using PostgreSQL only use mysql and AJAX No driver, composer, or manual installations required only php ma bnao program only php dont use PostgreSQL all in 1 only new_index.php and 1 new.sql file Server error ya error ya koi b or error na ay full working panel bnao complete a to z with all featurs and functions full program sai sa bnao jo without error run ho and koi b .db ki file na bnao blka database sa data la and edit b kry database sa is k lya sql file b bnao complete only php dont use PostgreSQL

DATABASE CONNECTION FAILED

📱 Menu

🔐

⚡ SELECT ROLE -

⚡ ADMIN CONTROL PANEL -

📊 System Dashboard

⏰ Live System Status

👥 User Management

📦 Bulk Actions

📝 System Logs

🔑 Key Management

🌐 IP Management

📊 IP History

⚠️ Warned IPs

🚫 Blocked IPs

🔒 Password History

⚙️ Advanced Settings

Main System Settings

Color Settings

Animation Settings

WhatsApp Settings

Error Handling Settings

Appearance Settings

Feature Toggles

👑 Main Admin Settings

🔧 Edit Codes

🎨 CSS Style Editor

⚡ JavaScript Code Editor

📄 HTML Template Editor

👤 USER PANEL -

👤 Profile Information

👤 Username

📧 Email

⚡ Type

📊 Status

➕ Added By

⏰ Remaining Time

🔑 Key Generator

📊 My Key History

DATABASE CONNECTION FAILED

📱 Menu

🔐

⚡ SELECT ROLE -

⚡ ADMIN CONTROL PANEL -

📊 System Dashboard

⏰ Live System Status

👥 User Management

📦 Bulk Actions

📝 System Logs

🔑 Key Management

🌐 IP Management

📊 IP History

⚠️ Warned IPs

🚫 Blocked IPs

🔒 Password History

⚙️ Advanced Settings

Main System Settings

Color Settings

Animation Settings

WhatsApp Settings

Error Handling Settings

Appearance Settings

Feature Toggles

👑 Main Admin Settings

🔧 Edit Codes

🎨 CSS Style Editor

⚡ JavaScript Code Editor

📄 HTML Template Editor

👤 USER PANEL -

👤 Profile Information

👤 Username

📧 Email

⚡ Type

📊 Status

➕ Added By

⏰ Remaining Time

🔑 Key Generator

📊 My Key History

➕ Add New User

✏️ Edit User

🔑 Change Password

Confirm Action