From 533e1cf98e300cb9fb3f98161b8cd30569b45c73 Mon Sep 17 00:00:00 2001
From: jakani24 <janis.st44@gmail.com>
Date: Sun, 21 Jan 2024 16:49:48 +0100
Subject: [PATCH] update

---
 .../cyberhex-code/api/php/log/add_entry.php   |  3 ++
 .../system/secure_zone/php/view_log.php       | 29 +++++++++++++++++--
 src/server/perms.txt                          |  2 +-
 3 files changed, 30 insertions(+), 4 deletions(-)
 create mode 100644 src/server/cyberhex-code/api/php/log/add_entry.php

diff --git a/src/server/cyberhex-code/api/php/log/add_entry.php b/src/server/cyberhex-code/api/php/log/add_entry.php
new file mode 100644
index 0000000..cb2bd6b
--- /dev/null
+++ b/src/server/cyberhex-code/api/php/log/add_entry.php
@@ -0,0 +1,3 @@
+<?php
+//we need to auth the user => apikey
+?>
\ No newline at end of file
diff --git a/src/server/cyberhex-code/system/secure_zone/php/view_log.php b/src/server/cyberhex-code/system/secure_zone/php/view_log.php
index 5d9a818..99fe771 100644
--- a/src/server/cyberhex-code/system/secure_zone/php/view_log.php
+++ b/src/server/cyberhex-code/system/secure_zone/php/view_log.php
@@ -40,7 +40,29 @@ if($perms[2]!=="1"){
 					<!-- table with all users => delete button -->
 					<?php
 						//include db pw
-						include "../../../config.php";						
+						include "../../../config.php";
+						//delete entry if requested and if user has rights to do that
+						if(isset($_GET["delete"])){
+							if($perms[3]!=="0"){
+								echo '<div class="alert alert-danger" role="alert">
+												You are not allowed to delete log entrys. (insufficient permissions)
+								</div>';
+							}else{
+								$id=htmlspecialchars($_GET["delete"]);
+								$conn = new mysqli($DB_SERVERNAME, $DB_USERNAME, $DB_PASSWORD, $DB_DATABASE);
+								if ($conn->connect_error) {
+									die("Connection failed: " . $conn->connect_error);
+								}
+								$sql = "DELETE FROM log WHERE id = ?";
+								$stmt = $conn->prepare($sql);
+								$stmt->bind_param("i", $id);
+								// Execute the statement
+								$stmt->execute();
+								$stmt->close();
+								$conn->close();
+							}
+						}
+						
 						//get count of log entrys
 						// Create a connection
 						$conn = new mysqli($DB_SERVERNAME, $DB_USERNAME, $DB_PASSWORD, $DB_DATABASE);
@@ -73,7 +95,7 @@ if($perms[2]!=="1"){
 						echo('<table class="table">');
 						echo('<thead>');
 						echo('<tr>');
-						echo('<th>Entry id</th><th>Loglevel</th><th>Logtext</th><th>Machine id</th>');
+						echo('<th>Entry id</th><th>Loglevel</th><th>Logtext</th><th>Machine id</th><th>Delete entry</th>');
 						echo('</tr>');
 						echo('</thead>');
 						echo('<tbody>');
@@ -99,6 +121,7 @@ if($perms[2]!=="1"){
 						echo('<td><input type="text" class="form-control" name="loglevel" placeholder="'.$loglevel_ss.'"></td>');
 						echo('<td><input type="text" class="form-control" name="logtext" placeholder="'.$logtext_ss.'"></td>');
 						echo('<td><input type="text" class="form-control" name="machine_id" placeholder="'.$machine_id_ss.'"></td>');
+						echo('<td>---</td>');
 						echo('</form>');
 						echo('</tr>');
 						
@@ -134,7 +157,7 @@ if($perms[2]!=="1"){
 									echo('<td>'.$loglevel.'</td>');
 									echo('<td>'.$logtext.'</td>');
 									echo('<td>'.$machine_id.'</td>');
-									//echo('<td><a href="user_list.php?delete='.$last_id.'">delete</a></td>');
+									echo('<td><a href="view_log.php?delete='.$last_id.'">delete</a></td>');
 								echo('</tr>');
 							}
 							$stmt->close();
diff --git a/src/server/perms.txt b/src/server/perms.txt
index 2704583..e17fd08 100644
--- a/src/server/perms.txt
+++ b/src/server/perms.txt
@@ -1,6 +1,6 @@
 1 Add User
 1 User List (delete...)
-1 View Log
+1 View Log + export
 1 Delete Log
 1 Server Settings
 1 Client Settings