prepare($sql);
$stmt->bind_param('iii', $project_id, $user_id, $user_id);
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows === 0) {
$stmt->close();
die("Unauthorized Access");
}
$stmt->close();
}
/**
* Verify that a design image belongs to the logged-in user
* This function ensures multi-user security by checking project ownership of the image
*
* @param int $design_image_id The design image ID to verify
* @param mysqli $conn Database connection
* @return void - Dies with "Unauthorized Access" if verification fails
*/
function verifyImageAccess($design_image_id, $conn) {
if (session_status() === PHP_SESSION_NONE) {
session_start();
}
if (!isset($_SESSION['user_id'])) {
die("Unauthorized Access");
}
$user_id = $_SESSION['user_id'];
$role = $_SESSION['user_role'] ?? 'Designer';
// Admins have access to all images
if ($role === 'Admin') {
return;
}
$sql = "SELECT di.id
FROM design_images di
JOIN projects p ON di.project_id = p.id
WHERE di.id = ? AND (p.created_by_user_id = ? OR p.master_designer_id = ?)";
$stmt = $conn->prepare($sql);
$stmt->bind_param('iii', $design_image_id, $user_id, $user_id);
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows === 0) {
$stmt->close();
die("Unauthorized Access");
}
$stmt->close();
}
/**
* Get projects that belong to the logged-in user
*
* @param mysqli $conn Database connection
* @return array Array of project records
*/
function getUserProjects($conn) {
// Start session if not already started
if (session_status() === PHP_SESSION_NONE) {
session_start();
}
// Check if user is logged in
if (!isset($_SESSION['user_id'])) {
return [];
}
$user_id = $_SESSION['user_id'];
$role = $_SESSION['user_role'] ?? 'Designer';
if ($role === 'Admin') {
$sql = "SELECT p.id, p.project_name, c.client_name
FROM projects p
JOIN clients c ON p.client_id = c.id
ORDER BY p.created_at DESC";
$stmt = $conn->prepare($sql);
} else {
$sql = "SELECT p.id, p.project_name, c.client_name
FROM projects p
JOIN clients c ON p.client_id = c.id
WHERE p.created_by_user_id = ? OR p.master_designer_id = ?
ORDER BY p.created_at DESC";
$stmt = $conn->prepare($sql);
$stmt->bind_param('ii', $user_id, $user_id);
}
$stmt->execute();
$result = $stmt->get_result();
$projects = [];
while ($row = $result->fetch_assoc()) {
$projects[] = $row;
}
$stmt->close();
return $projects;
}
/**
* Check if the logged-in user has the required role to access a page
*/
function checkAccess() {
if (session_status() === PHP_SESSION_NONE) {
session_start();
}
if (!isset($_SESSION['user_id'])) {
header("Location: index");
exit;
}
$role = $_SESSION['user_role'] ?? null;
// If role is empty or NULL
if (empty($role)) {
?>