How to allow only one user edit the form in php? - php

Question

I have a php code as shown below in which usernames/passwords are verified through db and only one user are allowed to login (At Line X in the php code below).
In the php code, the table trace_users (user_name, open, write are the columns) keeps the track of logged in users. When any user is logged in, the column open is set to true with value 1 on write column. If the user logs out, the column open is set to false with value 0 on write column.
logged in user => open = true, write = 1
when user logs out => open = false, write = 0
php code:
if ($user_from_db && password_verify($password, $user_from_db->user_pass)) {
$sql = "SELECT * FROM trace_users where open='true'";
if($result1 = mysqli_query($connect, $sql)){
if(mysqli_num_rows($result1) > 0){ // Line X
while($row = mysqli_fetch_array($result1)){
if($row['open'] == "true") {
if(!isset($_SESSION['admin'])) {
$message = "user " . $row['user_name'] . " is currently editing the form. Want to take over ?";
echo "<script type='text/javascript'>if(confirm('$message')) { } else { };</script>"; // Line A
}
break;
}
}
} else{
$_SESSION['admin'] = true;
$_SESSION['user_name'] = $username;
$open="true";
$write="1";
$stmt= $connect->prepare("UPDATE trace_users SET open=?, write=? WHERE user_name=?");
$stmt->bind_param('sss', $open, $write, $_SESSION['user_name']);
$stmt->execute();
}
}
} else {
echo "Invalid Username or Password";
}
At line A if userA is logged in and another user lets say userB tries to login then it will say userA is currently editing the form. Want to take over ?.
What I want to achieve is if userB takes over the form on clicking ok in the alert box then userA should come in the readonly mode (revoke the write access) and userB should
be given full access (write).
userA => open = true, write = 0
userB => open = true, write = 1
This is what I have tried:
After Line A, I am thinking to add these lines so that the user who is trying to take over should be able to login.
$_SESSION['admin'] = true;
$_SESSION['user_name'] = $username;
$open="true";
$write="1";
$stmt= $connect->prepare("UPDATE trace_users SET open=?, write=? WHERE user_name=?");
$stmt->bind_param('sss', $open, $write, $_SESSION['user_name']);
$stmt->execute();
Problem Statement:
I am wondering what changes I should make in the php code above so that if userA is logged in and userB also want to login and try to take over the form
then there should be no write access for userA, and userB should be given full access i.e.
userA (open=true , write=0)
userB (open=true, write=1)
Note: For no write access, the save button will not appear for the user.

Answer 1

The issue is more in the flow logic, than in the code :
UserA connects (call 1, php grants access : open => 1, write => 1)
UserB connects (call 2, php shows popup to UserB : open => 1)
UserB has to decide to take over (or not) (call 3, php grants write access to UserB and revokes write access of UserA : UserA write => 0, UserB write=>1)
With your code you are managing step 1 and 2.
When UserB decides to take over, the php code of step 2 is already over (your prompted the question). You have to write a dedicated code to get the UserB answer to the question (it is all about the javascript you prepared).
Whatever, you are not checking any write access, so once UserB took over and then logged out, UserA will still be with open connection but without write access. If UserB connects again it will be prompted again to take over something that doesn't exist (UserA write access is gone).

Answer 2

I see two basic problems with your approach:
The trace_users.write column might inadvertently get set to 1 for multiple users unless you're really careful about locking the table before updating it. That's just not a good way to go about tracking who is the "active" editor.
Your line "A" might display some HTML, but until the user confirms yes/no, it won't get executed. That step has to be done somewhere else.
A better way would be to have a single canonical record (probably in another table) track the current admin, and your code can check (or update) that record any time as necessary. Any time a user elects to make a change, PHP would first check whether they're the active editor and if so, commit the update, otherwise deny the update.
Pseudo-code for some server-side functions you'll need:
// When an update is requested:
if ( user is logged in and is the current admin ) {
commit the change;
} else {
Display "sorry" message to user
}
// -----------
// When user "X" logs in:
if ( another user is currently the active admin ) {
Display message: "User Y is currently the admin. Take over?"
} else {
Log in user "X" and set user "X" to current admin
}
// -----------
// When user "X" asks to take over as admin:
log in user "X"
set user "X" to current admin
The only flaw I can see here is that user "A" is logged in and editing and saves changes, user "B" might have the old data loaded in their browser. But that's an issue you didn't ask to solve, so it may not be a problem for you anyway.

Answer 3

How about something like this?
$username = $_SESSION['user_name'];
$open="true";
$write="1";
$stmt=$connect->prepare("UPDATE trace_users SET write=0 WHERE write=1"); // revoke write access of all users
$stmt=$connect->prepare("UPDATE trace_users SET open=:open, write=:write WHERE user_name=:username");
$stmt->bind_param('sss', $open, $write, $username);
$stmt->execute();
That will revoke write-access of all users, then set write-access only for the most recent user to request write-acces.
And you will need to make sure your client is updated about its revocation of write access, so the save button can be hidden when necessary.

Answer 4

Not recommended on a large data set, but a single line option for you is to replace your update with one that includes reference to the username:
$stmt= $connect->prepare("UPDATE trace_users SET open=IF(open=1 OR user_name=?,1,0), write=IF(user_name=?,1,0)");
$stmt->bind_param('sss', $_SESSION['user_name'], $_SESSION['user_name']);
This will, for every record in the table:
Leave open=1 where it is 1
Set open=1 where username is targetUser
Leave open=0 where is is 0 and username is not targetUser
Set write=1 where username is targetUser
Set write=0 where username is not targetUser
All in one hit.
For large data sets, create a separate table to track. There are other smarts you can do using unique or primary keys to ensure only one record gets updated, and then validate "If record got updated (i.e. rowCount() > 0), then I got the flag, if not, someone else got it". Only consider that when you're more used to MySQL.
Warning: "Open" and "Write" are both keywords / reserved words and your SQL may not be portable. Either wrap in back ticks, or preface with something like userOpen, userWrite. I've added back ticks in the example below. Read more here: https://dev.mysql.com/doc/refman/8.0/en/keywords.html
$stmt= $connect->prepare("UPDATE trace_users SET `open`=IF(`open`=1 OR user_name=?,1,0), `write`=IF(user_name=?,1,0)");
$stmt->bind_param('sss', $_SESSION['user_name'], $_SESSION['user_name']);