PHP: How to delete user without delete the 'authenticate' function - php

Question

Today I create a function in my web service to delete user from table in mysql.
I use SLIM framework to build my RESTful API.
this is the function in my class user:
public function deleteUser($user_id)
{
$stmt = $this->conn->prepare("DELETE
FROM users
WHERE user_id = ?");
if($stmt == FALSE)
{
die($this->conn->error);
}
else
{
$stmt->bind_param("i", $user_id);
$stmt->execute();
$num_affected_rows = $stmt->affected_rows;
$stmt->close();
return $num_affected_rows > 0;
}
}
and this is my code in index.php
$app->delete('/users/:user_id', 'authenticate', function() use($app)
{
global $user_id;
$db = new User();
$response = array();
$result = $db->deleteUser($user_id);
if ($result)
{
// user deleted successfully
$response["error"] = false;
$response["message"] = "User deleted succesfully";
}
else
{
// user failed to delete
$response["error"] = true;
$response["message"] = "User failed to delete. Please try again!";
}
echoRespnse(200, $response);
});
the problem is my authenticate function is get the user_id from user table for placed in header authorization.
function authenticate(\Slim\Route $route)
{
// Getting request headers
$headers = apache_request_headers();
$response = array();
$app = \Slim\Slim::getInstance();
// Verifying Authorization Header
if (isset($headers['Authorization']))
{
$db = new User();
// get the api key
$api_key = $headers['Authorization'];
// validating api key
if (!$db->isValidApiKey($api_key))
{
// api key is not present in users table
$response["error"] = true;
$response["message"] = "Access Denied. Invalid Api key";
echoRespnse(401, $response);
$app->stop();
}
else
{
global $user_id;
// get user primary key id
$user_id = $db->getUserId($api_key);
}
}
else
{
// api key is missing in header
$response["error"] = true;
$response["message"] = "Api key is misssing";
echoRespnse(400, $response);
$app->stop();
}
}
so everytime I tried to delete the user with 'user_id', it always goes wrong because the system will be delete users depends on API KEY which is submited in header authorization.
My Goal is : the delete function will be deleting the user with ther user id.
Does anyone know how to fix it?
Thanks :)

Answer 1

I am quite fishy in these lines of code:
else
{
global $user_id;
// get user primary key id
$user_id = $db->getUserId($api_key);
}
The big question for yourself is, what is the scope of the $user_id as the global variable?
Authenticate function will run before you executing the deleteUser($user_id), so no matter how hard you try, you will end up deleting the current authenticated user because $user_id = $db->getUserId($api_key) will store the current authenticated user_id to the global variable.
This will be very bad for your implementation because cureent user gonna delete itself. That's not cool man. So I suggest you the easiest workaround such as:
First declare another variable beside global $user_id named global $executor_id
Then, change your code from $user_id = $db->getUserId($api_key); to $executor_id = $db->getUserId($api_key); It assigns who will execute the delete function.
Then make your delete() function in index.php like this:
$app->delete('/users/:user_id', 'authenticate', function() use($app)
{
global $user_id;
global $executor_id;
$db = new User();
$response = array();
$user_id = // please get the user_id that would be deleted here.
$result = false;
if($user_id != $executor_id)
$result = $db->deleteUser($user_id);
if ($result)
{
// user deleted successfully
$response["error"] = false;
$response["message"] = "User deleted succesfully";
}
else
{
// user failed to delete
$response["error"] = true;
$response["message"] = "User failed to delete. Please try again!";
}
echoRespnse(200, $response);
});
Sorry, I am not familiar with SLIM Framework, but Hope it helps :)