Move files

webroot/api/dashboard/discordCallback.php

@@ -0,0 +1,115 @@
+<?php
+include '../../config/config.php';
+
+if (isset($_GET['code']) && !empty($_GET['code']) && isset($_COOKIE['session']) && !empty($_COOKIE['session'])){
+    $code = $_GET['code'];
+    $ch = curl_init();
+
+    curl_setopt($ch, CURLOPT_URL, 'https://discord.com/api/v8/oauth2/token');
+    curl_setopt($ch, CURLOPT_POST, 1);
+    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
+        'client_id' => $discordClientId,
+        'client_secret' => $discordClientSecret,
+        'grant_type' => 'authorization_code',
+        'code' => $code,
+        'redirect_uri' => $discordRedirectUri,
+        'scope' => 'identify guilds.join, email, identify'
+    ]));
+    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
+    $response = curl_exec($ch);
+    $status_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+    if ($status_code != 200) {
+        $response = [
+            'success' => 'false',
+            'message' => 'Invalid code provided.',
+        ];
+        header('Content-Type: application/json');
+        die(json_encode($response));
+    }
+    $data = json_decode($response, true);
+
+    curl_setopt($ch, CURLOPT_URL, 'https://discord.com/api/v8/users/@me');
+    curl_setopt($ch, CURLOPT_HTTPHEADER, [
+        'Authorization: Bearer ' . $data['access_token']
+    ]);
+    curl_setopt($ch, CURLOPT_POST, 0);
+    $response = curl_exec($ch);
+    $status_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+    if ($status_code != 200) {
+        $response = [
+            'success' => 'false',
+            'message' => 'Unable to fetch user data.',
+        ];
+        header('Content-Type: application/json');
+        die(json_encode($response));
+    }
+    $userData = json_decode($response, true);
+
+    curl_setopt($ch, CURLOPT_URL, "https://discord.com/api/v8/guilds/{$discordGuildId}/members/{$userData['id']}");
+    curl_setopt($ch, CURLOPT_HTTPHEADER, [
+        'Authorization: Bot ' . $discordBotToken,
+        'Content-Type: application/json'
+    ]);
+    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PUT');
+    curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
+        'access_token' => $data['access_token'],
+        'roles' => [],
+        'mute' => false,
+        'deaf' => false
+    ]));
+    curl_exec($ch);
+    curl_close($ch);
+
+    $conn = new mysqli($dbservername, $dbusername, $dbpassword, $dbname);
+    if ($conn->connect_error) {
+        $response = [
+            'success' => 'false',
+            'message' => 'Unable to connect to the database.',
+        ];
+        header('Content-Type: application/json');
+        die(json_encode($response));
+    }
+
+    $stmt = $conn->prepare("SELECT * FROM users WHERE session = ?");
+    $stmt->bind_param("s", $_COOKIE['session']);
+    $stmt->execute();
+    $result = $stmt->get_result();
+    $sqlData = $result->fetch_assoc();
+
+    if ($result->num_rows == 0) {
+        $response = [
+            'success' => 'false',
+            'message' => 'Invalid session.',
+        ];
+        header('Content-Type: application/json');
+        die(json_encode($response));
+    }
+
+    $avatar = "https://cdn.discordapp.com/avatars/" . $userData['id'] . "/" . $userData['avatar'];
+
+    $stmt = $conn->prepare("UPDATE users SET discord_id = ?, discord_access_token = ?, discord_refresh_token = ?, discord_expires_in = ?, discord_avatar = ?, discord_email = ? WHERE email = ?");
+    $stmt->bind_param("sssssss", $userData['id'], $data['access_token'], $data['refresh_token'], $data['expires_in'], $avatar, $userData['email'], $sqlData['email']);
+    $stmt->execute();
+
+    if (isset($_COOKIE['redirect_link']) && !empty($_COOKIE['redirect_link']) && strpos($_COOKIE['redirect_link'], 'https://upload.xytriza.com/dashboard') === 0) {
+        setcookie('redirect_link', '', time() - 3600, '/', '', true, true);
+        // deepcode ignore OR: already validated in the if condition
+        header('Location: ' . $_COOKIE['redirect_link']);
+        die();
+    }
+
+    $response = [
+        'success' => 'true',
+        'message' => 'Successfully saved to database'
+    ];
+    header('Content-Type: application/json');
+    die(json_encode($response));
+} else {
+    $response = [
+        'success' => 'false',
+        'message' => 'Invalid request.',
+    ];
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+?>

webroot/api/dashboard/generateAPIKey.php

@@ -0,0 +1,70 @@
+<?php
+require '../../config/config.php';
+
+$conn = new mysqli($dbservername, $dbusername, $dbpassword, $dbname);
+
+if ($conn->connect_error) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Unable to access database',
+    ];
+
+    http_response_code(500);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+function generateRandomString($length) {
+    $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
+    $randomString = '';
+    for ($i = 0; $i < $length; $i++) {
+        $randomString .= $characters[random_int(0, strlen($characters) - 1)];
+    }
+    return $randomString;
+}
+
+$session = isset($_COOKIE['session']) ? $_COOKIE['session'] : '';
+
+if (isset($session) && empty($session)) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Invalid session',
+    ];
+    http_response_code(401);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$stmt = $conn->prepare("SELECT * FROM users WHERE session = ?");
+$stmt->bind_param("s", $session);
+$stmt->execute();
+$result = $stmt->get_result();
+
+if ($result->num_rows > 0) {
+    $user = $result->fetch_assoc();
+    $api_key = generateRandomString(32);
+        
+    $stmt = $conn->prepare("UPDATE users SET api_key = ? WHERE session = ?");
+    $stmt->bind_param("ss", $api_key, $session);
+    $stmt->execute();
+
+    $response = [
+        'success' => 'true',
+        'response' => 'API key generated',
+        'api_key' => $api_key,
+    ];
+    header('Content-Type: application/json');
+    die(json_encode($response));
+} else {
+    $response = [
+        'success' => 'false',
+        'response' => 'Invalid session',
+    ];
+    http_response_code(401);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$stmt->close();
+$conn->close();
+?>

webroot/api/dashboard/generateConfig.php

@@ -0,0 +1,61 @@
+<?php
+require '../../config/config.php';
+require '../../incl/main.php';
+
+$conn = new mysqli($dbservername, $dbusername, $dbpassword, $dbname);
+
+if ($conn->connect_error) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Unable to access database',
+    ];
+
+    http_response_code(500);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$session = isset($_COOKIE['session']) ? $_COOKIE['session'] : '';
+
+$stmt = $conn->prepare("SELECT * FROM users WHERE session = ?");
+$stmt->bind_param("s", $session);
+$stmt->execute();
+$result = $stmt->get_result();
+$row = $result->fetch_assoc();
+$key = $row['api_key'];
+
+if ($result->num_rows == 0) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Invalid session',
+    ];
+
+    http_response_code(403);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$config = '{
+    "Name": "Xytriza\'s Uploading Service",
+    "DestinationType": "ImageUploader, FileUploader",
+    "RequestType": "POST",
+    "RequestURL": "https://upload.xytriza.com/api/uploadFile.php",
+    "FileFormName": "file",
+    "Body": "MultipartFormData",
+    "Headers": {
+        "key": "' . $key . '"
+    },
+    "URL": "$json:fileUrl$",
+    "DeletionURL": "$json:deletionUrl$",
+    "ErrorMessage": "$json:error$"
+}';
+header('Content-Type: application/json');
+header('Content-Disposition: attachment; filename="xytrizas-uploading-service.sxcu"');
+header('Expires: 0');
+header('Cache-Control: must-revalidate');
+header('Pragma: public');
+header('Content-Length: ' . strlen($config));
+echo $config;
+
+$stmt->close();
+$conn->close();

webroot/api/dashboard/getAPIKey.php

@@ -0,0 +1,57 @@
+<?php
+require '../../config/config.php';
+
+$conn = new mysqli($dbservername, $dbusername, $dbpassword, $dbname);
+
+if ($conn->connect_error) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Unable to access database',
+    ];
+
+    http_response_code(500);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$session = isset($_COOKIE['session']) ? $_COOKIE['session'] : '';
+
+if (isset($session) && empty($session)) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Invalid session',
+    ];
+    http_response_code(401);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$stmt = $conn->prepare("SELECT api_key FROM users WHERE session = ?");
+$stmt->bind_param("s", $session);
+$stmt->execute();
+$result = $stmt->get_result();
+
+if ($result->num_rows > 0) {
+    $user = $result->fetch_assoc();
+    $api_key = $user['api_key'];
+
+    $response = [
+        'success' => 'true',
+        'response' => 'Success',
+        'api_key' => $api_key,
+    ];
+    header('Content-Type: application/json');
+    die(json_encode($response));
+} else {
+    $response = [
+        'success' => 'false',
+        'response' => 'Invalid session',
+    ];
+    http_response_code(401);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$stmt->close();
+$conn->close();
+?>

webroot/api/dashboard/getAnnoucement.php

@@ -0,0 +1,52 @@
+<?php
+require '../../config/config.php';
+
+$conn = new mysqli($dbservername, $dbusername, $dbpassword, $dbname);
+
+if ($conn->connect_error) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Unable to access database',
+    ];
+
+    http_response_code(500);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$session = isset($_COOKIE['session']) ? $_COOKIE['session'] : '';
+
+if (isset($session) && empty($session)) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Invalid session',
+    ];
+    http_response_code(401);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$sql = "SELECT value FROM settings WHERE id = 1";
+$result = $conn->query($sql);
+$row = $result->fetch_assoc();
+$news = base64_decode($row['value']);
+
+$sql = "SELECT value FROM settings WHERE id = 2";
+$result = $conn->query($sql);
+$row = $result->fetch_assoc();
+$motd = base64_decode($row['value']);
+
+$response = [
+    'success' => 'true',
+    'response' => 'Here is the announcements',
+    'news' => $news,
+    'motd' => $motd,
+];
+
+http_response_code(200);
+header('Content-Type: application/json');
+echo json_encode($response);
+
+$stmt->close();
+$conn->close();
+?>

webroot/api/dashboard/getAnnouncements.php

@@ -0,0 +1,57 @@
+<?php
+require '../../config/config.php';
+
+$conn = new mysqli($dbservername, $dbusername, $dbpassword, $dbname);
+
+if ($conn->connect_error) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Unable to access database',
+    ];
+
+    http_response_code(500);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$key = isset($_SERVER['HTTP_KEY']) ? $_SERVER['HTTP_KEY'] : '';
+
+$stmt = $conn->prepare("SELECT * FROM users WHERE api_key = ?");
+$stmt->bind_param("s", $key);
+$stmt->execute();
+$result = $stmt->get_result();
+
+if ($result->num_rows == 0) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Invalid API Key',
+    ];
+
+    http_response_code(401);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$sql = "SELECT value FROM settings WHERE id = 1";
+$result = $conn->query($sql);
+$row = $result->fetch_assoc();
+$news = base64_decode($row['value']);
+
+$sql = "SELECT value FROM settings WHERE id = 2";
+$result = $conn->query($sql);
+$row = $result->fetch_assoc();
+$motd = base64_decode($row['value']);
+
+$response = [
+    'success' => 'true',
+    'response' => 'Here is the announcements',
+    'news' => $news,
+    'motd' => $motd,
+];
+
+http_response_code(200);
+header('Content-Type: application/json');
+echo json_encode($response);
+
+$conn->close();
+?>

webroot/api/dashboard/setPreferences.php

@@ -0,0 +1,147 @@
+<?php
+require '../../config/config.php';
+require '../../incl/main.php';
+
+$conn = new mysqli($dbservername, $dbusername, $dbpassword, $dbname);
+
+if ($conn->connect_error) {
+    $response = [
+        'success' => 'false',
+        'response' => 'Unable to access database',
+    ];
+
+    http_response_code(500);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+$apiKey = isset($_POST['key']) ? $_POST['key'] : null;
+$session = isset($_COOKIE['session']) ? $_COOKIE['session'] : null;
+$country = isset($_POST['country']) ? $_POST['country'] : null;
+$timezone = isset($_POST['timezone']) ? $_POST['timezone'] : null;
+$dateformat = isset($_POST['dateformat']) ? $_POST['dateformat'] : null;
+$timeformat = isset($_POST['timeformat']) ? $_POST['timeformat'] : null;
+
+$query = "UPDATE users SET ";
+$params = [];
+$paramTypes = "";
+
+if ($country !== null) {
+    $countries = ["Andorra", "French Southern and Antarctic Lands", "Laos", "Canada", "Nigeria", "Vanuatu", "Czechia", "Malawi", "Mali", "Iceland", "Norway", "Saint Vincent and the Grenadines", "Guadeloupe", "Chile", "Bermuda", "Kuwait", "Dominica", "Montenegro", "United States Virgin Islands", "Cameroon", "Sri Lanka", "China", "Bangladesh", "Sweden", "Grenada", "Turkey", "Guinea", "Tanzania", "Rwanda", "Singapore", "Morocco", "Saint Barthélemy", "Iraq", "Brunei", "Isle of Man", "North Korea", "Iran", "Curaçao", "Paraguay", "Albania", "Tajikistan", "Bolivia", "Austria", "Saint Kitts and Nevis", "United States Minor Outlying Islands", "Colombia", "Kosovo", "Belize", "Guinea-Bissau", "Marshall Islands", "Myanmar", "French Polynesia", "Brazil", "Croatia", "Somalia", "Afghanistan", "Anguilla", "Cook Islands", "Western Sahara", "New Zealand", "Eritrea", "Cambodia", "Bahamas", "Belarus", "Norfolk Island", "Tuvalu", "South Georgia", "Mauritania", "New Caledonia", "Bulgaria", "Mozambique", "Niue", "Estonia", "Italy", "Malta", "Slovenia", "India", "Peru", "Burundi", "Lithuania", "United States", "Honduras", "Tonga", "Saudi Arabia", "Suriname", "Qatar", "Saint Helena, Ascension and Tristan da Cunha", "Gibraltar", "Northern Mariana Islands", "Mauritius", "Barbados", "Réunion", "British Indian Ocean Territory", "Syria", "Egypt", "São Tomé and Príncipe", "Kiribati", "Timor-Leste", "Lesotho", "Solomon Islands", "Libya", "South Korea", "Liechtenstein", "Nicaragua", "Ecuador", "Maldives", "Algeria", "Kyrgyzstan", "Finland", "Antarctica", "Kenya", "Cuba", "Montserrat", "Poland", "Åland Islands", "Ethiopia", "Togo", "Bosnia and Herzegovina", "Uruguay", "Guam", "Cape Verde", "Chad", "Vatican City", "Palau", "Haiti", "Yemen", "Eswatini", "Zimbabwe", "Greece", "Israel", "Saint Martin", "Antigua and Barbuda", "Cyprus", "Sint Maarten", "Monaco", "Fiji", "Ukraine", "Martinique", "Hong Kong", "Portugal", "Bhutan", "Nepal", "France", "Ireland", "United Arab Emirates", "Guernsey", "Saint Lucia", "Dominican Republic", "Serbia", "Botswana", "Ivory Coast", "Ghana", "Comoros", "Azerbaijan", "United Kingdom", "Central African Republic", "Palestine", "Caribbean Netherlands", "Taiwan", "Pitcairn Islands", "San Marino", "Svalbard and Jan Mayen", "Djibouti", "Wallis and Futuna", "Denmark", "Papua New Guinea", "Madagascar", "Bouvet Island", "Hungary", "Tokelau", "Trinidad and Tobago", "Gambia", "Luxembourg", "Cocos (Keeling) Islands", "Republic of the Congo", "Argentina", "DR Congo", "Greenland", "Jordan", "Belgium", "Switzerland", "Indonesia", "Lebanon", "Malaysia", "Cayman Islands", "Slovakia", "Armenia", "Christmas Island", "Mongolia", "Saint Pierre and Miquelon", "Japan", "South Africa", "Philippines", "Micronesia", "Germany", "Latvia", "Jamaica", "Macau", "Nauru", "Faroe Islands", "Guyana", "Burkina Faso", "Sudan", "Russia", "Mayotte", "Australia", "Liberia", "Mexico", "Tunisia", "Aruba", "Kazakhstan", "Oman", "French Guiana", "Niger", "Turkmenistan", "Sierra Leone", "Samoa", "Senegal", "Georgia", "Namibia", "South Sudan", "Thailand", "Bahrain", "Heard Island and McDonald Islands", "Falkland Islands", "Jersey", "Vietnam", "Guatemala", "Moldova", "North Macedonia", "Uzbekistan", "Romania", "Uganda", "El Salvador", "Zambia", "Gabon", "Equatorial Guinea", "Spain", "Netherlands", "British Virgin Islands", "Benin", "Pakistan", "Panama", "Turks and Caicos Islands", "Angola", "American Samoa", "Venezuela", "Costa Rica", "Puerto Rico", "Seychelles"];
+    if (!in_array($country, $countries)) {
+        $country = null;
+        die('{"success": false, "response": "Invalid country" }');
+        return;
+    }
+
+    $query .= "country = ?, ";
+    array_push($params, $country);
+    $paramTypes .= "s";
+}
+
+if ($timezone !== null) {
+    $timezones = ['Africa/Abidjan', 'Africa/Accra', 'Africa/Addis_Ababa', 'Africa/Algiers', 'Africa/Asmara', 'Africa/Asmera', 'Africa/Bamako', 'Africa/Bangui', 'Africa/Banjul', 'Africa/Bissau', 'Africa/Blantyre', 'Africa/Brazzaville', 'Africa/Bujumbura', 'Africa/Cairo', 'Africa/Casablanca', 'Africa/Ceuta', 'Africa/Conakry', 'Africa/Dakar', 'Africa/Dar_es_Salaam', 'Africa/Djibouti', 'Africa/Douala', 'Africa/El_Aaiun', 'Africa/Freetown', 'Africa/Gaborone', 'Africa/Harare', 'Africa/Johannesburg', 'Africa/Juba', 'Africa/Kampala', 'Africa/Khartoum', 'Africa/Kigali', 'Africa/Kinshasa', 'Africa/Lagos', 'Africa/Libreville', 'Africa/Lome', 'Africa/Luanda', 'Africa/Lubumbashi', 'Africa/Lusaka', 'Africa/Malabo', 'Africa/Maputo', 'Africa/Maseru', 'Africa/Mbabane', 'Africa/Mogadishu', 'Africa/Monrovia', 'Africa/Nairobi', 'Africa/Ndjamena', 'Africa/Niamey', 'Africa/Nouakchott', 'Africa/Ouagadougou', 'Africa/Porto-Novo', 'Africa/Sao_Tome', 'Africa/Timbuktu', 'Africa/Tripoli', 'Africa/Tunis', 'Africa/Windhoek', 'America/Adak', 'America/Anchorage', 'America/Anguilla', 'America/Antigua', 'America/Araguaina', 'America/Argentina/Buenos_Aires', 'America/Argentina/Catamarca', 'America/Argentina/ComodRivadavia', 'America/Argentina/Cordoba', 'America/Argentina/Jujuy', 'America/Argentina/La_Rioja', 'America/Argentina/Mendoza', 'America/Argentina/Rio_Gallegos', 'America/Argentina/Salta', 'America/Argentina/San_Juan', 'America/Argentina/San_Luis', 'America/Argentina/Tucuman', 'America/Argentina/Ushuaia', 'America/Aruba', 'America/Asuncion', 'America/Atikokan', 'America/Atka', 'America/Bahia', 'America/Bahia_Banderas', 'America/Barbados', 'America/Belem', 'America/Belize', 'America/Blanc-Sablon', 'America/Boa_Vista', 'America/Bogota', 'America/Boise', 'America/Buenos_Aires', 'America/Cambridge_Bay', 'America/Campo_Grande', 'America/Cancun', 'America/Caracas', 'America/Catamarca', 'America/Cayenne', 'America/Cayman', 'America/Chicago', 'America/Chihuahua', 'America/Ciudad_Juarez', 'America/Coral_Harbour', 'America/Cordoba', 'America/Costa_Rica', 'America/Creston', 'America/Cuiaba', 'America/Curacao', 'America/Danmarkshavn', 'America/Dawson', 'America/Dawson_Creek', 'America/Denver', 'America/Detroit', 'America/Dominica', 'America/Edmonton', 'America/Eirunepe', 'America/El_Salvador', 'America/Ensenada', 'America/Fort_Nelson', 'America/Fort_Wayne', 'America/Fortaleza', 'America/Glace_Bay', 'America/Godthab', 'America/Goose_Bay', 'America/Grand_Turk', 'America/Grenada', 'America/Guadeloupe', 'America/Guatemala', 'America/Guayaquil', 'America/Guyana', 'America/Halifax', 'America/Havana', 'America/Hermosillo', 'America/Indiana/Indianapolis', 'America/Indiana/Knox', 'America/Indiana/Marengo', 'America/Indiana/Petersburg', 'America/Indiana/Tell_City', 'America/Indiana/Vevay', 'America/Indiana/Vincennes', 'America/Indiana/Winamac', 'America/Indianapolis', 'America/Inuvik', 'America/Iqaluit', 'America/Jamaica', 'America/Jujuy', 'America/Juneau', 'America/Kentucky/Louisville', 'America/Kentucky/Monticello', 'America/Knox_IN', 'America/Kralendijk', 'America/La_Paz', 'America/Lima', 'America/Los_Angeles', 'America/Louisville', 'America/Lower_Princes', 'America/Maceio', 'America/Managua', 'America/Manaus', 'America/Marigot', 'America/Martinique', 'America/Matamoros', 'America/Mazatlan', 'America/Mendoza', 'America/Menominee', 'America/Merida', 'America/Metlakatla', 'America/Mexico_City', 'America/Miquelon', 'America/Moncton', 'America/Monterrey', 'America/Montevideo', 'America/Montreal', 'America/Montserrat', 'America/Nassau', 'America/New_York', 'America/Nipigon', 'America/Nome', 'America/Noronha', 'America/North_Dakota/Beulah', 'America/North_Dakota/Center', 'America/North_Dakota/New_Salem', 'America/Nuuk', 'America/Ojinaga', 'America/Panama', 'America/Pangnirtung', 'America/Paramaribo', 'America/Phoenix', 'America/Port-au-Prince', 'America/Port_of_Spain', 'America/Porto_Acre', 'America/Porto_Velho', 'America/Puerto_Rico', 'America/Punta_Arenas', 'America/Rainy_River', 'America/Rankin_Inlet', 'America/Recife', 'America/Regina', 'America/Resolute', 'America/Rio_Branco', 'America/Rosario', 'America/Santa_Isabel', 'America/Santarem', 'America/Santiago', 'America/Santo_Domingo', 'America/Sao_Paulo', 'America/Scoresbysund', 'America/Shiprock', 'America/Sitka', 'America/St_Barthelemy', 'America/St_Johns', 'America/St_Kitts', 'America/St_Lucia', 'America/St_Thomas', 'America/St_Vincent', 'America/Swift_Current', 'America/Tegucigalpa', 'America/Thule', 'America/Thunder_Bay', 'America/Tijuana', 'America/Toronto', 'America/Tortola', 'America/Vancouver', 'America/Virgin', 'America/Whitehorse', 'America/Winnipeg', 'America/Yakutat', 'America/Yellowknife', 'Antarctica/Casey', 'Antarctica/Davis', 'Antarctica/DumontDUrville', 'Antarctica/Macquarie', 'Antarctica/Mawson', 'Antarctica/McMurdo', 'Antarctica/Palmer', 'Antarctica/Rothera', 'Antarctica/South_Pole', 'Antarctica/Syowa', 'Antarctica/Troll', 'Antarctica/Vostok', 'Arctic/Longyearbyen', 'Asia/Aden', 'Asia/Line truncated
+    if (!in_array($timezone, $timezones)) {
+        $timezone = null;
+        return;
+    }
+
+    $query .= "timezone = ?, ";
+    array_push($params, $timezone);
+    $paramTypes .= "s";
+}
+
+if ($dateformat !== null) {
+    if ($dateformat !== "mmddyyyy" && $dateformat !== "ddmmyyyy") {
+        $dateformat = null;
+        return;
+    }
+
+    $query .= "dateformat = ?, ";
+    array_push($params, $dateformat);
+    $paramTypes .= "s";
+}
+
+if ($timeformat !== null) {
+    if ($timeformat !== "12hour" && $timeformat !== "24hour") {
+        $timeformat = null;
+        return;
+    }
+
+    $query .= "timeformat = ?, ";
+    array_push($params, str_replace('hour', '', $timeformat));
+    $paramTypes .= "s";
+}
+
+if ($country !== null || $timezone !== null || $dateformat !== null || $timeformat !== null) {
+    $query = rtrim($query, ", ");
+    if ($apiKey) {
+        $stmt = $conn->prepare("SELECT COUNT(*) FROM users WHERE api_key = ?");
+        $stmt->bind_param("s", $apiKey);
+        $stmt->execute();
+        $result = $stmt->get_result();
+        $count = $result->fetch_array(MYSQLI_NUM)[0];
+
+        if ($count == 0) {
+            $response = [
+                'success' => 'false',
+                'response' => 'Invalid API Key',
+            ];
+
+            http_response_code(401);
+            header('Content-Type: application/json');
+            die(json_encode($response));
+        }
+        $query .= " WHERE api_key = ?";
+        array_push($params, $apiKey);
+    } else if ($_COOKIE['session']) {
+        $query .= " WHERE session = ?";
+        array_push($params, $_COOKIE['session']);
+    } else {
+        $response = [
+            'success' => 'false',
+            'response' => 'Invalid API Key',
+        ];
+    
+        http_response_code(401);
+        header('Content-Type: application/json');
+        die(json_encode($response));
+    }
+    $paramTypes .= "s";
+
+    $stmt = $conn->prepare($query);
+    $stmt->bind_param($paramTypes, ...$params);
+} else {
+    $response = [
+        'success' => 'false',
+        'response' => 'No data provided',
+    ];
+
+    http_response_code(400);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+
+if ($stmt->execute()) {
+    $response = [
+        'success' => 'true',
+        'response' => 'Saved preferences',
+    ];
+
+    http_response_code(200);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+} else {
+    $response = [
+        'success' => 'false',
+        'response' => 'Error updating database',
+    ];
+
+    http_response_code(500);
+    header('Content-Type: application/json');
+    die(json_encode($response));
+}
+$stmt->close();
+
+$stmt->close();
+$conn->close();