<commit_before><?php

require_once dirname(dirname(__DIR__)) . "/classes/autoloader.php";
require_once dirname(dirname(__DIR__)) . "/lib/xsrf.php";
require_once("/etc/apache2/capstone-mysql/encrypted-config.php");
require_once(dirname(dirname(dirname(dirname(__DIR__)))) . "/vendor/autoload.php");

/**
 * controller/api for the volunteer class
 *
 * @author <NAME> <EMAIL>>
 */

//verify the xsrf challenge
if(session_status() !== PHP_SESSION_ACTIVE) {
	session_start();
}

//prepare an empty reply
$reply = new stdClass();
$reply->status = 200;
$reply->data = null;

try {
	//grab the mySQL connection
	$pdo = connectToEncryptedMySQL("/etc/apache2/capstone-mysql/breadbasket.ini");

	//if the volunteer session is empty, the user is not logged in, throw an exception
	if(empty($_SESSION["volunteer"]) === true) {
		setXsrfCookie("/");
		throw(new RuntimeException("Please log-in or sign up", 401));
	}

	//determine which HTTP method was used
	$method = array_key_exists("HTTP_X_HTTP_METHOD", $_SERVER) ? $_SERVER["HTTP_X_HTTP_METHOD"] : $_SERVER["REQUEST_METHOD"];

	//sanitize inputs
	$id = filter_input(INPUT_GET, "id", FILTER_VALIDATE_INT);
	//make sure the id is valid for methods that require it
	if(($method === "DELETE" || $method === "PUT") && (empty($id) === true || $id < 0)) {
		throw(new InvalidArgumentException("id cannot be empty or negative", 405));
	}
	//sanitize and trim other fields
	$orgId = filter_input(INPUT_GET, "orgId", FILTER_VALIDATE_INT);
	$email = filter_input(INPUT_GET, "email", FILTER_SANITIZE_EMAIL);
	$admin = filter_input(INPUT_GET, "admin", FILTER_VALIDATE_BOOLEAN);
	$phone = filter_input(INPUT_GET, "phone", FILTER_SANITIZE_STRING);
	$emailActivation = filter_input(INPUT_GET, "emailActivation", FILTER_SANITIZE_STRING);

	//handle REST calls, while only allowing administrators to access database-modifying methods
	if($method === "GET") {
		//set XSRF cookie
		setXsrfCookie("/");

		//get the organization based on the given field
		if(empty($id) === false) {
			$volunteer = Volunteer::getVolunteerByVolId($pdo, $id);
			if($volunteer !== null && $volunteer->getOrgId() === $_SESSION["volunteer"]->getOrgId()) {
				$reply->data = $volunteer;
			}
		} else if(empty($email) === false) {
			$volunteer = Volunteer::getVolunteerByVolEmail($pdo, $email);
			if($volunteer !== null && $volunteer->getOrgId() === $_SESSION["volunteer"]->getOrgId()) {
				$reply->data = $volunteer;
			}
		} else if(empty($admin) === false) {
			$volunteer = Volunteer::getVolunteerByVolIsAdmin($pdo, $admin);
			if($volunteer !== null && $volunteer->getOrgId() === $_SESSION["volunteer"]->getOrgId()) {
				$reply->data = $volunteer;
			}
		} else if(empty($phone) === false) {
			$volunteer = Volunteer::getVolunteerByVolPhone($pdo, $phone);
			if($volunteer !== null && $volunteer->getOrgId() === $_SESSION["volunteer"]->getOrgId()) {
			}
			$reply->data = $volunteer;
		} else if(empty($emailActivation) === false) {
			$volunteer = Volunteer::getVolunteerByVolEmailActivation($pdo, $emailActivation);
			if($volunteer !== null && $volunteer->getOrgId() === $_SESSION["volunteer"]->getOrgId()) {
				$reply->data = $volunteer;
			}
		} else {
			$reply->data = Volunteer::getVolunteerByOrgId($pdo, $_SESSION["volunteer"]->getOrgId())->toArray();
		}
	}

	// if the session belongs to an admin, allow post, put, and delete methods.
	if(empty($_SESSION["volunteer"]) === false && $_SESSION["volunteer"]->getVolIsAdmin() === true) {

		if($method === "PUT" || $method === "POST") {
			verifyXsrf();
			$requestContent = file_get_contents("php://input");
			$requestObject = json_decode($requestContent);



			//make sure all fields are present, in order to prevent database issues

			if(empty($requestObject->volEmail) === true) {
				throw(new InvalidArgumentException ("email cannot be empty", 418));
			}
			if(empty($requestObject->volFirstName) === true) {
				throw(new InvalidArgumentException ("first name cannot be empty", 405));
			}
			if(empty($requestObject->volLastName) === true) {
				throw(new InvalidArgumentException ("last name cannot be empty", 405));
			}
			if(empty($requestObject->volPhone) === true) {
				throw(new InvalidArgumentException ("phone cannot be empty", 405));
			}

// perform the actual put or post
			if($method === "PUT") {
				$volunteer = Volunteer::getVolunteerByVolId($pdo, $id);
				if($volunteer === null) {
					throw(new RuntimeException("Volunteer does not exist", 404));
				}


				$volunteer = Volunteer::getVolunteerByVolId($pdo, $id);
				$volunteer->setVolEmail($requestObject->volEmail);
				$volunteer->setVolFirstName($requestObject->volFirstName);
				$volunteer->setVolLastName($requestObject->volLastName);
				$volunteer->setVolPhone($requestObject->volPhone);

				//if there's a password, hash it, and set it
				if($requestObject->volPassword !== null) {
					$hash = hash_pbkdf2("sha512", $requestObject->volPassword, $volunteer->getVolSalt(), 262144, 128);
					$volunteer->setVolHash($hash);
				}

				$volunteer->update($pdo);
				//kill the temporary admin access, if they're not supposed to have it
				//check to see if the password is not null; this means it's a regular volunteer changing their password and not an admin
				//prevents admins from being logged out for editing their regular volunteers
				if(($volunteer->getVolIsAdmin() === false) && ($requestObject->volPassword !== null)) {
					$_SESSION["volunteer"]->setVolIsAdmin(false);
				}

				$reply->message = "Volunteer updated OK";

<commit_msg>volunteer password update should work once and for all https://app.asana.com/0/60990639151493/70723740899547<commit_after><?php

require_once dirname(dirname(__DIR__)) . "/classes/autoloader.php";
require_once dirname(dirname(__DIR__)) . "/lib/xsrf.php";
require_once("/etc/apache2/capstone-mysql/encrypted-config.php");
require_once(dirname(dirname(dirname(dirname(__DIR__)))) . "/vendor/autoload.php");

/**
 * controller/api for the volunteer class
 *
 * @author <NAME> <EMAIL>>
 */

//verify the xsrf challenge
if(session_status() !== PHP_SESSION_ACTIVE) {
	session_start();
}

//prepare an empty reply
$reply = new stdClass();
$reply->status = 200;
$reply->data = null;

try {
	//grab the mySQL connection
	$pdo = connectToEncryptedMySQL("/etc/apache2/capstone-mysql/breadbasket.ini");

	//if the volunteer session is empty, the user is not logged in, throw an exception
	if(empty($_SESSION["volunteer"]) === true) {
		setXsrfCookie("/");
		throw(new RuntimeException("Please log-in or sign up", 401));
	}

	//determine which HTTP method was used
	$method = array_key_exists("HTTP_X_HTTP_METHOD", $_SERVER) ? $_SERVER["HTTP_X_HTTP_METHOD"] : $_SERVER["REQUEST_METHOD"];

	//sanitize inputs
	$id = filter_input(INPUT_GET, "id", FILTER_VALIDATE_INT);
	//make sure the id is valid for methods that require it
	if(($method === "DELETE" || $method === "PUT") && (empty($id) === true || $id < 0)) {
		throw(new InvalidArgumentException("id cannot be empty or negative", 405));
	}
	//sanitize and trim other fields
	$orgId = filter_input(INPUT_GET, "orgId", FILTER_VALIDATE_INT);
	$email = filter_input(INPUT_GET, "email", FILTER_SANITIZE_EMAIL);
	$admin = filter_input(INPUT_GET, "admin", FILTER_VALIDATE_BOOLEAN);
	$phone = filter_input(INPUT_GET, "phone", FILTER_SANITIZE_STRING);
	$emailActivation = filter_input(INPUT_GET, "emailActivation", FILTER_SANITIZE_STRING);

	//handle REST calls, while only allowing administrators to access database-modifying methods
	if($method === "GET") {
		//set XSRF cookie
		setXsrfCookie("/");

		//get the organization based on the given field
		if(empty($id) === false) {
			$volunteer = Volunteer::getVolunteerByVolId($pdo, $id);
			if($volunteer !== null && $volunteer->getOrgId() === $_SESSION["volunteer"]->getOrgId()) {
				$reply->data = $volunteer;
			}
		} else if(empty($email) === false) {
			$volunteer = Volunteer::getVolunteerByVolEmail($pdo, $email);
			if($volunteer !== null && $volunteer->getOrgId() === $_SESSION["volunteer"]->getOrgId()) {
				$reply->data = $volunteer;
			}
		} else if(empty($admin) === false) {
			$volunteer = Volunteer::getVolunteerByVolIsAdmin($pdo, $admin);
			if($volunteer !== null && $volunteer->getOrgId() === $_SESSION["volunteer"]->getOrgId()) {
				$reply->data = $volunteer;
			}
		} else if(empty($phone) === false) {
			$volunteer = Volunteer::getVolunteerByVolPhone($pdo, $phone);
			if($volunteer !== null && $volunteer->getOrgId() === $_SESSION["volunteer"]->getOrgId()) {
			}
			$reply->data = $volunteer;
		} else if(empty($emailActivation) === false) {
			$volunteer = Volunteer::getVolunteerByVolEmailActivation($pdo, $emailActivation);
			if($volunteer !== null && $volunteer->getOrgId() === $_SESSION["volunteer"]->getOrgId()) {
				$reply->data = $volunteer;
			}
		} else {
			$reply->data = Volunteer::getVolunteerByOrgId($pdo, $_SESSION["volunteer"]->getOrgId())->toArray();
		}
	}

	// if the session belongs to an admin, allow post, put, and delete methods.
	if(empty($_SESSION["volunteer"]) === false && $_SESSION["volunteer"]->getVolIsAdmin() === true) {

		if($method === "PUT" || $method === "POST") {
			verifyXsrf();
			$requestContent = file_get_contents("php://input");
			$requestObject = json_decode($requestContent);



			//make sure all fields are present, in order to prevent database issues

			if(empty($requestObject->volEmail) === true) {
				throw(new InvalidArgumentException ("email cannot be empty", 418));
			}
			if(empty($requestObject->volFirstName) === true) {
				throw(new InvalidArgumentException ("first name cannot be empty", 405));
			}
			if(empty($requestObject->volLastName) === true) {
				throw(new InvalidArgumentException ("last name cannot be empty", 405));
			}
			if(empty($requestObject->volPhone) === true) {
				throw(new InvalidArgumentException ("phone cannot be empty", 405));
			}

// perform the actual put or post
			if($method === "PUT") {
				$volunteer = Volunteer::getVolunteerByVolId($pdo, $id);
				if($volunteer === null) {
					throw(new RuntimeException("Volunteer does not exist", 404));
				}

				//check to make sure a non-admin is only attempting to edit themselves
				//if not, take their temp access and throw an exception
				$security = Volunteer::getVolunteerByVolId($pdo, $_SESSION["volunteer"]->getVolId());
				if(($security->getVolIsAdmin() === false) && ($_SESSION["volunteer"]->getVolId() !== $volunteer->getVolId())) {
					$_SESSION["volunteer"]->setVolIsAdmin(false);
					throw(new RunTimeException("Only administrators can modify entries", 403));
				}

				$volunteer->setVolEmail($requestObject->volEmail);
				$volunteer->setVolFirstName($requestObject->volFirstName);
				$volunteer->setVolLastName($requestObject->volLastName);
				$volunteer->setVolPhone($requestObject->volPhone);

				//if there's a password, hash it, and set it
				if($requestObject->volPassword !== null) {
					$hash = hash_pbkdf2("sha512", $requestObject->volPassword, $volunteer->getVolSalt(), 262144, 128);
					$volunteer->setVolHash($hash);
				}

				$volunteer->update($pdo);
				//kill the temporary admin access, if they're not supposed to have it
				//check to see if the password is not null; this means it's a regular volunteer changing their password and not an admin
				//prevents admins from being logged out for editing their regular volunteers
				if(($volunteer->getVolIsAdmin() === false) && ($requestObject->volPassword !== null)) {
					$_SESSION["volunteer"]->setVolIsAdmin(false);
				}

				$reply->message = "Volunteer updated OK";


{'fraction_non_alphanumeric': 0.1666955316937998, 'fraction_numerical': 0.009698649116730169, 'mean_word_length': 4.856490872210953, 'pattern_counts': {'":': 0, '<': 11, '<?xml version=': 0, '>': 98, 'https://': 1, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '512234', 'n_tokens_mistral': 4264, 'n_tokens_neox': 3717, 'n_words': 853}