upload pfp in profile

.gitignore

@@ -4,7 +4,9 @@
 # Ignore all files in uploads/videos and uploads/thumbnails
 /uploads/videos/*
 /uploads/thumbnails/*
+/uploads/pfp/*
 
 # Except for .gitkeep files
 !/uploads/videos/.gitkeep
 !/uploads/thumbnails/.gitkeep
+!/uploads/pfp/.gitkeep

controllers/edit_profile.inc.php

@@ -4,14 +4,15 @@
 declare(strict_types=1);
 
 
-function is_edit_form_empty(string $fullname, string $email, string $username)
+function is_edit_form_empty(string $fullname, string $email, string $username, array $pfp)
 {
-    if (empty($fullname) && empty($email) && empty($username)) {
+    if (empty($fullname) && empty($email) && empty($username) && empty($pfp['name'])) {
         return true;
     }
     return false;
 }
 
+
 // is the email new and different from the old one?
 function is_email_new(string $new_email, string $old_email)
 {
@@ -38,3 +39,27 @@ function is_name_new(string $new_name, string $old_name)
     }
     return false;
 }
+
+
+// is pfp image file invalid
+function is_pfp_file_invalid(array $pfp)
+{
+    $pfp_name = $pfp['name'];
+    $pfp_size = $pfp['size'];
+    $pfp_error = $pfp['error'];
+
+    $pfp_ext = explode('.', $pfp_name);
+    $pfp_actual_ext = strtolower(end($pfp_ext));
+
+    $allowed = ['jpg', 'jpeg', 'png'];
+
+    if (in_array($pfp_actual_ext, $allowed)) {
+        if ($pfp_error === 0 && $pfp_size > 0 && $pfp_size <= 2 * 1024 * 1024) {
+            return false;
+        } else {
+            return true;
+        }
+    } else {
+        return true;
+    }
+}

includes/edit_profile.inc.php

@@ -4,6 +4,7 @@
     $new_email = $_POST['email'];
     $new_name = $_POST['name'];
     $new_username = $_POST['username'];
+    $new_pfp = $_FILES['pfp'];
 
     try {
         require_once "./db_handler.inc.php";
@@ -22,16 +23,15 @@
 
 
         // Check for empty inputs
-        if (is_edit_form_empty($new_name, $new_email, $new_username)) {
+        if (is_edit_form_empty($new_name, $new_email, $new_username, $new_pfp)) {
             // make sure to use local variables here
-            $errors["empty_input"] = "Please fill in all fields";
+            $errors["empty_input"] = "Please fill at least one field to update your profile";
         } else {
-            // Check if atleast one field is different from the old one
+            // Check if at least one field is different from the old one
             if (!is_email_new($new_email, $current_user['email']) && !is_username_new($new_username, $current_user['username']) && !is_name_new($new_name, $current_user['full_name'])) {
                 $errors["no_changes"] = "No changes were made";
             }
 
-
             // Check if email is invalid
             else if (is_email_invalid($new_email) && !empty($new_email)) {
                 $errors["invalid_email"] = "Please enter a valid email address";
@@ -58,6 +58,9 @@
         if (empty($new_username)) {
             $new_username = $current_user['username'];
         }
+        if (empty($new_pfp)) {
+            $new_pfp = $current_user['pfp'];
+        }
 
 
 
@@ -69,7 +72,7 @@
         }
 
         // Update user details
-        update_user_details($pdo, $_SESSION['user_id'], $new_name, $new_email, $new_username);
+        update_user_details($pdo, $_SESSION['user_id'], $new_name, $new_email, $new_username, $new_pfp);
 
         // log out the user
         session_start();

includes/login.inc.php

@@ -60,6 +60,7 @@
         $_SESSION["user_fullname"] = htmlspecialchars($result["full_name"]);
         $_SESSION["user_email"] = htmlspecialchars($result["email"]);
         $_SESSION["user_role"] = $result["role"];
+        $_SESSION["user_pfp"] = $result["pfp"];
         $_SESSION["last_regeneration"] = time();
 
         // redirect to home page

models/edit_profile.inc.php

@@ -13,7 +13,7 @@ function get_current_user_details(object $pdo, int $user_id): array
     return $result;
 }
 
-function update_user_details(object $pdo, int $user_id, string $new_name, string $new_email, string $new_username): void
+function update_user_details(object $pdo, int $user_id, string $new_name, string $new_email, string $new_username, array $new_pfp): void
 {
     $query = "UPDATE users SET full_name = :new_name, email = :new_email, username = :new_username WHERE user_id = :user_id";
     $stmt = $pdo->prepare($query);
@@ -23,6 +23,10 @@ function update_user_details(object $pdo, int $user_id, string $new_name, string
     $stmt->bindParam(":user_id", $user_id, PDO::PARAM_INT);
     $stmt->execute();
 
+    // if pfp is not empty, upload pfp
+    if (!empty($new_pfp['name'])) {
+        upload_pfp($pdo, $user_id, $new_pfp);
+    }
     // if successful, update updated_at in user to current timestamp
     update_user_updated_at($pdo, $user_id);
 }
@@ -35,3 +39,29 @@ function update_user_updated_at(object $pdo, int $user_id): void
     $stmt->bindParam(":user_id", $user_id, PDO::PARAM_INT);
     $stmt->execute();
 }
+
+
+// upload profile picture
+function upload_pfp(object $pdo, int $user_id, array $new_pfp): void
+{
+    $pfp_name = $new_pfp['name'];
+    $pfp_tmp_name = $new_pfp['tmp_name'];
+
+    $pfp_ext = explode('.', $pfp_name);
+    $pfp_actual_ext = strtolower(end($pfp_ext));
+
+    $allowed = ['jpg', 'jpeg', 'png'];
+
+    if (in_array($pfp_actual_ext, $allowed)) {
+        $pfp_new_name = uniqid() . '_' . bin2hex(random_bytes(8)) . '.' . $pfp_actual_ext;
+        $pfp_destination = "../uploads/pfp/" . $pfp_new_name;
+        move_uploaded_file($pfp_tmp_name, $pfp_destination);
+
+        // update pfp in database
+        $query = "UPDATE users SET pfp = :pfp WHERE user_id = :user_id";
+        $stmt = $pdo->prepare($query);
+        $stmt->bindParam(":pfp", $pfp_new_name, PDO::PARAM_STR);
+        $stmt->bindParam(":user_id", $user_id, PDO::PARAM_INT);
+        $stmt->execute();
+    }
+}

pages/edit_profile.php

@@ -34,17 +34,19 @@
             <span class="subheading">Enter values you want to update</span>
         </h1>
 
-        <form action="../includes/edit_profile.inc.php" class="profile__form" method="post">
+        <form action="../includes/edit_profile.inc.php" class="profile__form" method="post" enctype="multipart/form-data">
 
             <input type="text" name="name" placeholder="<?php
-                                                        echo $current_user['full_name'];
+                                                        echo "Name: " . $current_user['full_name'];
                                                         ?>">
             <input type=" email" name="email" placeholder="<?php
-                                                            echo $current_user['email'];
+                                                            echo "Email: " . $current_user['email'];
                                                             ?>">
             <input type="text" name="username" placeholder="<?php
-                                                            echo $current_user['username'];
+                                                            echo "Username: " . $current_user['username'];
                                                             ?>">
+            <label for="pfp" class="btn">Upload or change profile picture</label>
+            <input type="file" name="pfp">
             <button type="submit" class="profile__btn profile__btn--edit">Update</button>
         </form>
 

pages/user_profile.php

@@ -28,7 +28,19 @@
         <h1 class="profile__title">My Profile</h1>
         <section class="profile__hero">
             <div class="profile__hero__img">
-                <img src="../assets/default_pfp.svg" alt="User profile picture" width="200" height="200">
+                <img src="<?php
+                            if ($_SESSION["user_pfp"] === null) {
+                                echo "../assets/default_pfp.svg";
+                            } else {
+                                echo "../uploads/pfp/" . $_SESSION["user_pfp"];
+                            }
+                            ?>" alt="<?php
+                                        if ($_SESSION["user_pfp"] === null) {
+                                            echo "Default profile picture";
+                                        } else {
+                                            echo "Profile picture of " . $_SESSION["user_username"];
+                                        }
+                                        ?>" width="200" height="200">
             </div>
             <p class="profile__hero__fullname">
                 <?php if (isset($_SESSION['user_fullname'])) {