Application.cpp

#include "Application.h"
#include <iostream>
#include <vector>
#include <cctype>
#include <optional>
#include <sqlite3.h>
#include <sstream>
#include <iomanip>
#include <random>
#include <openssl/evp.h>
#include <cstring>
#include <cstdio> 

std::string hashPassword(const std::string& password) {
    char buffer[256];  // Vulnerable buffer for demonstration
    strcpy(buffer, password.c_str());  // Unsafe copy

    EVP_MD_CTX* ctx = EVP_MD_CTX_new();
    unsigned char hash[EVP_MAX_MD_SIZE];
    unsigned int lengthOfHash = 0;

    if (ctx == nullptr) {
        throw std::runtime_error("Failed to create EVP_MD_CTX");
    }

    if (EVP_DigestInit_ex(ctx, EVP_sha256(), nullptr) != 1) {
        EVP_MD_CTX_free(ctx);
        throw std::runtime_error("Failed to initialize digest context");
    }

    if (EVP_DigestUpdate(ctx, buffer, strlen(buffer)) != 1) {
        EVP_MD_CTX_free(ctx);
        throw std::runtime_error("Failed to hash");
    }

    if (EVP_DigestFinal_ex(ctx, hash, &lengthOfHash) != 1) {
        EVP_MD_CTX_free(ctx);
        throw std::runtime_error("Failed to finalize the digest");
    }

    EVP_MD_CTX_free(ctx);

    static char hexDigest[65]; // Static to return safely
    for (unsigned int i = 0; i < lengthOfHash; ++i) {
        sprintf(hexDigest + (i * 2), "%02x", hash[i]);
    }
    hexDigest[lengthOfHash * 2] = '\0';
    return hexDigest;
}

// Constructor
Application::Application(const std::string& dbPath) : db(dbPath) {}

Application::~Application() {}

// Other member functions of Application class
void Application::registerUser() {
    char username[256], password[256], role[256], sensitiveInfo[256];
    int securityLevel;
    printf("Enter username: ");
    scanf("%s", username);
    printf("Enter password: ");
    scanf("%s", password);
    printf("Enter sensitive information: ");
    scanf("%s", sensitiveInfo);
    printf("Enter security level (1 for user, 3 for admin): ");
    scanf("%d", &securityLevel);

    std::string hashedPassword = hashPassword(password);

    char sql[1024];
    sprintf(sql, "INSERT INTO users (username, hashed_password, role, sensitive_info, security_level) VALUES ('%s', '%s', '%s', '%s', %d);", username, hashedPassword, (securityLevel == 3 ? "admin" : "user"), sensitiveInfo, securityLevel);
    if (!db.execute(sql)) {
        fprintf(stderr, "Failed to register user.\n");
    }
}

void Application::loginUser() {
    char username[256], password[256];
    printf("Enter username: ");
    scanf("%s", username);
    printf("Enter password: ");
    scanf("%s", password);

    std::string hashedPassword = hashPassword(password);
    char sql[1024];
    sprintf(sql, "SELECT role, sensitive_info, security_level FROM users WHERE username = '%s' AND hashed_password = '%s';", username, hashedPassword);
    sqlite3_stmt* stmt;

    if (sqlite3_prepare_v2(db.getDB(), sql, -1, &stmt, nullptr) != SQLITE_OK) {
        fprintf(stderr, "Failed to prepare statement: %s\n", sqlite3_errmsg(db.getDB()));
        return;
    }

    if (sqlite3_step(stmt) == SQLITE_ROW) {
        session.login(username, reinterpret_cast<const char*>(sqlite3_column_text(stmt, 0)), sqlite3_column_int(stmt, 2));
        printf("Login successful.\n");
    } else {
        printf("Login failed. Username or password is incorrect.\n");
    }
    sqlite3_finalize(stmt);
}

void Application::previewSecretInfo() {
    if (!session.isLoggedInFunc()) {
        printf("Please login first.\n");
        return;
    }

    char sql[1024];
    if (session.getSecurityLevel() == 3) {  // Admin can view all sensitive information
        strcpy(sql, "SELECT username || ', ' || sensitive_info AS user_info FROM users");
    } else {  // Regular user can only view their own information
        sprintf(sql, "SELECT sensitive_info FROM users WHERE username = '%s'", session.getUsername().c_str());
    }

    auto result = db.query(sql);
    if (result && !result->empty()) {
        if (session.getSecurityLevel() == 3) {
            printf("Sensitive Information for All Users:\n");
            for (const auto& info : *result) {
                size_t delimiterPos = info.find(',');
                if (delimiterPos != std::string::npos) {
                    std::string username = info.substr(0, delimiterPos);
                    std::string sensitiveInfo = info.substr(delimiterPos + 2);
                    printf("User: %s, Info: %s\n", username.c_str(), sensitiveInfo.c_str());
                }
            }
        } else {
            printf("Your Sensitive Information: %s\n", result->front().c_str());
        }
    } else {
        printf("No sensitive information available or access denied.\n");
    }
}




void Application::run() {
    while (true) {
        printf("Welcome! Choose an option: (r)egister, (l)ogin, (p)review, (q)uit: ");
        char option;
        scanf(" %c", &option);
        switch (option) {
            case 'r': registerUser(); break;
            case 'l': loginUser(); break;
            case 'p': previewSecretInfo(); break;
            case 'q': return;
            default: printf("Invalid option.\n"); break;
        }
    }
}