diff --git a/config/prod/settings.php b/config/prod/settings.php index 5664d52..f3f3554 100644 --- a/config/prod/settings.php +++ b/config/prod/settings.php @@ -6,3 +6,9 @@ define('APP_API_BASE', 'https://api.' . APP_DOMAIN_PRIMARY); define('APP_DB_ENABLED', true); // set true to enable DB connection + // Crypto-Key für verschlüsselte Felder (Telefon, Kinder etc.) + // Bitte in Staging per Hosting-ENV setzen; dieses putenv dient nur als Fallback/Beispiel. + if (getenv('DATA_KEY') === false) { + // Beispiel-Key (unbedingt in Staging durch sicheren Wert ersetzen, 32 Byte, base64) + putenv('DATA_KEY=base64:TSLBgK39KnwqMGT+ytJ+O8FwpVm+99VYZwi97TeloBw='); + } diff --git a/config/staging/settings.php b/config/staging/settings.php index 5664d52..ee83f2e 100644 --- a/config/staging/settings.php +++ b/config/staging/settings.php @@ -6,3 +6,9 @@ define('APP_API_BASE', 'https://api.' . APP_DOMAIN_PRIMARY); define('APP_DB_ENABLED', true); // set true to enable DB connection + // Crypto-Key für verschlüsselte Felder (Telefon, Kinder etc.) + // Bitte in Staging per Hosting-ENV setzen; dieses putenv dient nur als Fallback/Beispiel. + if (getenv('DATA_KEY') === false) { + // Beispiel-Key (unbedingt in Staging durch sicheren Wert ersetzen, 32 Byte, base64) + putenv('DATA_KEY=base64:FIanxMlz5/bn7Oyqv57BXVcFelqHV9qj3hkiTDyerls='); + } diff --git a/partials/landing/account/dashboard.php b/partials/landing/account/dashboard.php index 17f8351..1509179 100644 --- a/partials/landing/account/dashboard.php +++ b/partials/landing/account/dashboard.php @@ -9,32 +9,44 @@ $flash = $app->flash()->get(); $userId = (int)$_SESSION['user_id']; $error = ''; $info = ''; +$crypto = null; +try { $crypto = new \App\Crypto($app->config()); } catch (\Throwable) {} // POST Aktionen if ($_SERVER['REQUEST_METHOD'] === 'POST') { $action = $_POST['action'] ?? ''; try { if ($action === 'profile') { - $stmt = $pdo->prepare('UPDATE user_profiles SET display_name=:name, zip=:zip, city=:city, profession=:prof, languages=:langs, about=:about, updated_at=NOW() WHERE user_id=:id'); + $languages = $_POST['languages'] ?? ''; + if (is_array($languages)) { + $languages = implode(', ', array_map('trim', $languages)); + } + $phoneEnc = $crypto ? $crypto->encrypt(trim((string)$_POST['contact_phone'])) : trim((string)$_POST['contact_phone']); + $stmt = $pdo->prepare('UPDATE user_profiles SET display_name=:name, first_name=:fname, last_name=:lname, zip=:zip, city=:city, profession=:prof, languages=:langs, about=:about, contact_phone=:phone, updated_at=NOW() WHERE user_id=:id'); $stmt->execute([ - 'name' => trim((string)$_POST['display_name']), - 'zip' => trim((string)$_POST['zip']), - 'city' => trim((string)$_POST['city']), - 'prof' => trim((string)$_POST['profession']), - 'langs' => trim((string)$_POST['languages']), + 'name' => trim((string)$_POST['display_name']), + 'fname' => trim((string)$_POST['first_name']), + 'lname' => trim((string)$_POST['last_name']), + 'zip' => trim((string)$_POST['zip']), + 'city' => trim((string)$_POST['city']), + 'prof' => trim((string)$_POST['profession']), + 'langs' => trim((string)$languages), 'about' => trim((string)$_POST['about']), - 'id' => $userId, + 'phone' => $phoneEnc, + 'id' => $userId, ]); $info = 'Profil gespeichert.'; } elseif ($action === 'child_add') { + $firstNameEnc = $crypto ? $crypto->encrypt(trim((string)$_POST['first_name'])) : trim((string)$_POST['first_name']); + $noteEnc = $crypto ? $crypto->encrypt(trim((string)$_POST['note'])) : trim((string)$_POST['note']); $stmt = $pdo->prepare('INSERT INTO children (user_id, gender, birthdate, age_years, encrypted_first_name, note, created_at, updated_at) VALUES (:uid, :gender, :birthdate, :age, :name, :note, NOW(), NOW())'); $stmt->execute([ 'uid' => $userId, 'gender' => $_POST['gender'] ?? 'unknown', 'birthdate' => $_POST['birthdate'] ?: null, 'age' => $_POST['age_years'] ?: null, - 'name' => trim((string)$_POST['first_name']), - 'note' => trim((string)$_POST['note']), + 'name' => $firstNameEnc, + 'note' => $noteEnc, ]); $info = 'Kind hinzugefügt.'; } elseif ($action === 'event_add') { @@ -63,23 +75,37 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { // Daten laden $profile = [ 'display_name' => '', + 'first_name' => '', + 'last_name' => '', 'zip' => '', 'city' => '', 'profession' => '', 'languages' => '', 'about' => '', + 'email' => '', + 'contact_phone' => '', ]; -$stmt = $pdo->prepare('SELECT u.email, u.status, p.display_name, p.zip, p.city, p.profession, p.languages, p.about FROM users u LEFT JOIN user_profiles p ON p.user_id = u.id WHERE u.id = :id LIMIT 1'); +$stmt = $pdo->prepare('SELECT u.email, u.status, p.display_name, p.first_name, p.last_name, p.zip, p.city, p.profession, p.languages, p.about, p.contact_phone FROM users u LEFT JOIN user_profiles p ON p.user_id = u.id WHERE u.id = :id LIMIT 1'); $stmt->execute(['id' => $userId]); $row = $stmt->fetch(PDO::FETCH_ASSOC); if ($row) { $profile = array_merge($profile, array_filter($row, fn($v) => $v !== null)); + if ($crypto && !empty($profile['contact_phone'])) { + $profile['contact_phone'] = $crypto->decrypt((string)$profile['contact_phone']) ?: ''; + } } $children = []; -$stmt = $pdo->prepare('SELECT id, encrypted_first_name AS first_name, gender, birthdate, age_years FROM children WHERE user_id = :id ORDER BY id DESC'); +$stmt = $pdo->prepare('SELECT id, encrypted_first_name AS first_name, note, gender, birthdate, age_years FROM children WHERE user_id = :id ORDER BY id DESC'); $stmt->execute(['id' => $userId]); -$children = $stmt->fetchAll(PDO::FETCH_ASSOC) ?: []; +$childrenRaw = $stmt->fetchAll(PDO::FETCH_ASSOC) ?: []; +foreach ($childrenRaw as $c) { + if ($crypto) { + $c['first_name'] = $crypto->decrypt((string)$c['first_name']) ?: ''; + $c['note'] = $crypto->decrypt((string)($c['note'] ?? '')) ?: ''; + } + $children[] = $c; +} $events = []; $stmt = $pdo->prepare('SELECT id, title, teaser_public, starts_at, city, visibility FROM events WHERE created_by = :id ORDER BY starts_at DESC'); @@ -113,8 +139,11 @@ $events = $stmt->fetchAll(PDO::FETCH_ASSOC) ?: [];
Profil

Deine Angaben