<?php
    require_once('session.php');
    
    if (!isset($_SERVER['HTTPS']) || $_SERVER['HTTPS'] !== 'on') {
        header("HTTP/1.1 403 Forbidden");
        echo "Access forbidden. Use HTTPS.";
        exit();
    }
    if ($_SERVER["REQUEST_METHOD"] === "POST") {
    if (isset($_POST['csrf_token']) && hash_equals($_POST['csrf_token'], $_SESSION['csrf_token'])) {
    if($u['cuid'] == 1){ 
    $postID = $_POST['postID'];
    $user = $_POST['user'];
    $pass = password_hash($_POST['pass'],PASSWORD_DEFAULT);
    $re_pass = $_POST['pass'];
    $email = $_POST['email'];
    $no_hp = $_POST['no_hp'];
    $kode = date('YdmHis');
    $tipe_gambar = array('image/jpg','image/jpeg','image/bmp', 'image/x-png', 'image/png');
    $gbr = $_FILES['image']['name'];
    $ukuran = $_FILES['image']['size'];
    $tipe = $_FILES['image']['type'];
    $error = $_FILES['image']['error'];
    $explode = explode('.',$gbr);
    $extensi  = $explode[count($explode)-1];
    $newname = 'avatar_'.$users.'_'.$kode.'.'.$extensi;
    $upload_dir = "../../upload/";

    if($re_pass == ''){
        if ($gbr != "" && $error == 0) {
            $fileMimeType = mime_content_type($_FILES['image']['tmp_name']);
            $allowedMimeTypes = array('image/jpeg', 'image/png', 'image/gif');

            if (in_array($fileMimeType, $allowedMimeTypes)) {
                move_uploaded_file($_FILES['image']['tmp_name'], $upload_dir . $newname);
                $query = mysqli_query($conn,"UPDATE `tb_user` SET `image` = '$newname', `user` = '$user', `no_hp` = '$no_hp', `email` ='$email' WHERE cuid = '$postID'") or die(mysqli_error());
                header('location:../e_user/?notif=1');
            }
            else {
                header('location:../e_user/?notif=3');
            } 
        }
        else {
            $query = mysqli_query($conn,"UPDATE `tb_user` SET `user` = '$user', `no_hp` = '$no_hp', `email` ='$email' WHERE cuid = '$postID'") or die(mysqli_error());
            header('location:../e_user/?notif=1');
        } 
        
    }
    else {
        if($gbr !=="" && $error == 0){
            if(in_array(strtolower($tipe), $tipe_gambar)){
                move_uploaded_file($_FILES['image']['tmp_name'], $upload_dir . $newname);
                $query = mysqli_query($conn,"UPDATE `tb_user` SET `image` = '$newname', `pass` = '$pass', `user` = '$user', `no_hp` = '$no_hp', `email` ='$email' WHERE cuid = '$postID'") or die(mysqli_error());
                $_SESSION['user'] == '';
                unset($_SESSION['user']);
                session_destroy();
                header('location:../');
            }
            else {
                header('location:../e_user/?notif=3');
            } 
        }
        else {
            $query = mysqli_query($conn,"UPDATE `tb_user` SET `pass` = '$pass', `user` = '$user', `no_hp` = '$no_hp', `email` ='$email' WHERE cuid = '$postID'") or die(mysqli_error());
            $_SESSION['user'] == '';
            unset($_SESSION['user']);
            session_destroy();
            header('location:../');
        }
        
    } } else {
            echo 'BOKEP CXFTEAMS';
        }
} else {
    // Regenerate CSRF token on each form request
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));

    // CSRF token is invalid, handle the error
    echo "Ngapain Bang Ngetamper Data Kah?";
    exit();
}
}
    
    
?>