|
Server : LiteSpeed System : Linux terra.hostitbro.com 5.14.0-611.54.3.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Thu May 7 16:31:24 EDT 2026 x86_64 User : outerorb ( 1091) PHP Version : 8.1.34 Disable Function : mail Directory : /home2/outerorb/.trash/survey_system/ | |
|
Path: /home2/outerorb/.trash/survey_system/user_delete.php
Size: 4.14 KB
Permissions: 0666
<?php
require_once 'config.php';
// Check if user is logged in and is admin
if (!is_logged_in()) {
header("Location: index.php");
exit;
}
$user = current_user();
if ($user['role'] !== 'admin') {
header("Location: dashboard.php");
exit;
}
$errors = [];
$user_id = $_GET['id'] ?? null;
if ($user_id === null || !ctype_digit($user_id)) {
$errors[] = "Invalid user ID.";
} else {
$user_id = (int)$user_id;
}
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['confirm_delete'])) {
if (empty($errors)) {
// Prevent admin from deleting themselves
if ($user_id === $user['id']) {
$errors[] = "You cannot delete your own account.";
require_once 'inc/eventlog.php';
log_event('user_delete_failed', ['reason' => 'self_delete', 'user_id' => $user_id], 'failure');
} else {
// Get user info before deletion for logging
$stmt = $pdo->prepare("SELECT username, role, full_name FROM users WHERE id = ?");
$stmt->execute([$user_id]);
$user_info = $stmt->fetch();
if ($user_info) {
// Permanently delete user from database
$stmt = $pdo->prepare("DELETE FROM users WHERE id = ?");
$stmt->execute([$user_id]);
require_once 'inc/eventlog.php';
log_event('user_deleted', [
'user_id' => $user_id,
'username' => $user_info['username'],
'role' => $user_info['role'],
'full_name' => $user_info['full_name']
]);
header("Location: users.php?msg=User+permanently+deleted");
exit;
} else {
$errors[] = "User not found.";
}
}
}
}
?>
<!DOCTYPE html>
<html lang="en">
<?php include __DIR__ . '/inc/header.php'; ?>
<div class="container mt-5">
<h2>Delete User Permanently</h2>
<?php if (!empty($errors)): ?>
<div class="alert alert-danger">
<ul class="mb-0">
<?php foreach ($errors as $error): ?>
<li><?= htmlspecialchars($error) ?></li>
<?php endforeach; ?>
</ul>
</div>
<?php endif; ?>
<?php if (empty($errors) && $_SERVER['REQUEST_METHOD'] !== 'POST'): ?>
<?php
// Get user details
$stmt = $pdo->prepare("SELECT username, full_name, role FROM users WHERE id = ?");
$stmt->execute([$user_id]);
$user_data = $stmt->fetch();
?>
<?php if ($user_data): ?>
<div class="alert alert-danger">
<strong>⚠️ WARNING: This action is PERMANENT and CANNOT be undone!</strong>
</div>
<p>Are you sure you want to <b>permanently delete</b> the following user?</p>
<ul>
<li><strong>Username:</strong> <?= htmlspecialchars($user_data['username']) ?></li>
<li><strong>Full Name:</strong> <?= htmlspecialchars($user_data['full_name']) ?></li>
<li><strong>Role:</strong> <?= htmlspecialchars($user_data['role']) ?></li>
</ul>
<p class="text-danger"><strong>This will:</strong></p>
<ul class="text-danger">
<li>Remove the user completely from the database</li>
<li>The user will no longer be able to log in</li>
<li>This action cannot be reversed</li>
</ul>
<form method="post" action="user_delete.php?id=<?= htmlspecialchars($user_id) ?>">
<button type="submit" name="confirm_delete" class="btn btn-danger">Yes, Permanently Delete User</button>
<a href="users.php" class="btn btn-secondary ms-2">Cancel</a>
</form>
<?php else: ?>
<div class="alert alert-warning">User not found.</div>
<a href="users.php" class="btn btn-secondary">Back to Users</a>
<?php endif; ?>
<?php endif; ?>
</div>
<?php include __DIR__ . '/inc/footer.php'; ?>
</html>