From e79fa2eb5f3c41e9b60a899df49ffe1f2f511d66 Mon Sep 17 00:00:00 2001
From: hyzen <hyzen@disroot.org>
Date: Sat, 13 Jun 2026 11:48:12 +0530
Subject: [PATCH] Update: user-management panel

---
 docs/admin/index.html     |  2 +-
 layouts/admin/single.html | 39 ++++++++++++++++++++++++++-------------
 2 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/docs/admin/index.html b/docs/admin/index.html
index b9e2d5d..79e3331 100644
--- a/docs/admin/index.html
+++ b/docs/admin/index.html
@@ -8,4 +8,4 @@
 All updates
 </button>
 <button class=rss-subscribe__item data-rss-url=https://freedoms4.org/blog/index.xml>
-Blog posts</button></div></div></div></div><nav class="menu language"><ul class="menu__list language__list"><li class=menu__item><a class=menu__link href=/>Home</a></li><li class=menu__item><a class=menu__link href=/blog/>Blog</a></li><li class=menu__item><a class=menu__link href=/services/>Services</a></li><li class=menu__item><a class=menu__link href=/uninotes/>UniNotes</a></li><li class=menu__item><a class=menu__link href=/contact/>Contact</a></li></ul></nav></header><main class=main><div id=admin-gate style=display:none><p>You do not have permission to access this page.</p></div><div id=admin-panel style=display:none><h1>User Management</h1><div id=admin-msg class=auth-message style=display:none aria-live=polite></div><div id=admin-table-wrap></div></div><script>(function(){var o="https://backend.freedoms4.org/admin.php",a=localStorage.getItem("f4_username"),r=document.getElementById("admin-gate"),c=document.getElementById("admin-panel"),t=document.getElementById("admin-msg"),e=document.getElementById("admin-table-wrap");if(a!=="hyzen"){r.style.display="";return}c.style.display="";function s(e,n){t.textContent=e,t.className="auth-message auth-message--"+n,t.style.display="block",setTimeout(function(){t.style.display="none"},3e3)}function n(e){return String(e).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;")}function l(t){if(!t.length){e.innerHTML="<p>No users found.</p>";return}var a='<table class="admin-table"><thead><tr><th>#</th><th>Username</th><th>Email</th><th>Joined</th><th>Status</th><th>Actions</th></tr></thead><tbody>';t.forEach(function(e){var s=new Date(e.created_at).toLocaleDateString(),t=e.blocked===!0||e.blocked==="t"||e.blocked==="1",o=t?'<span class="admin-badge admin-badge--blocked">Blocked</span>':'<span class="admin-badge admin-badge--active">Active</span>',i=t?'<button class="admin-btn admin-btn--unblock" data-id="'+e.id+'" data-action="unblock_user">Unblock</button>':'<button class="admin-btn admin-btn--block"   data-id="'+e.id+'" data-action="block_user">Block</button>',r='<button class="admin-btn admin-btn--delete" data-id="'+e.id+'" data-username="'+n(e.username)+'" data-action="delete_user">Delete</button>';a+='<tr id="user-row-'+e.id+'"><td>'+e.id+"</td><td>"+n(e.username)+"</td><td>"+n(e.email)+"</td><td>"+s+"</td><td>"+o+'</td><td class="admin-actions">'+i+" "+r+"</td></tr>"}),a+="</tbody></table>",e.innerHTML=a,e.querySelectorAll("[data-action]").forEach(function(e){e.addEventListener("click",function(){var t=e.dataset.action,n=parseInt(e.dataset.id,10),a=e.dataset.username||"";if(t==="delete_user"&&!confirm('Permanently delete user "'+a+'"? This cannot be undone.'))return;e.disabled=!0,fetch(o,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify({action:t,user_id:n})}).then(function(e){return e.json()}).then(function(o){if(o.success)if(t==="delete_user"){var a=document.getElementById("user-row-"+n);a&&a.remove(),s("User deleted.","success")}else i();else s(o.message||"Action failed.","error"),e.disabled=!1}).catch(function(){s("Network error.","error"),e.disabled=!1})})})}function i(){e.innerHTML="<p>Loading&hellip;</p>",fetch(o+"?action=list_users",{credentials:"include"}).then(function(e){return e.json()}).then(function(t){t.success?l(t.users):e.innerHTML='<p class="admin-error">'+n(t.message||"Failed to load users.")+"</p>"}).catch(function(){e.innerHTML='<p class="admin-error">Network error.</p>'})}i()})()</script></main><footer class=footer><p class=footer__copyright-notice>&copy; <a href=https://freedoms4.org>freedoms4.org</a> <a href=/changelog/>Changelog</a></p><p class=footer__theme-info>Built with <a href=https://gohugo.io>Hugo</a> and based on <a href=https://github.com/CyrusYip/hugo-theme-yue>Yue</a> theme</p></footer><script>(function(){document.querySelectorAll(".menu__item").forEach(function(e){var t=e.querySelector("a");t&&t.getAttribute("href")==="/uninotes/"&&e.classList.add("menu__item--uninotes")})})()</script><script>(function(){var e=document.getElementById("theme-toggle");if(!e)return;function t(){var e=localStorage.getItem("theme");return e?e:window.matchMedia("(prefers-color-scheme: light)").matches?"light":"dark"}function n(e){document.documentElement.setAttribute("data-theme",e),localStorage.setItem("theme",e)}n(t()),e.addEventListener("click",function(){var e=document.documentElement.getAttribute("data-theme")||t();n(e==="dark"?"light":"dark")})})()</script><script>(function(){var t="https://backend.freedoms4.org/auth.php",e=localStorage.getItem("f4_username");if(!e)return;function n(e){var t,n,o,i,a,c,r=document.querySelector(".brand__auth");r&&!r.querySelector(".brand__auth-user")&&(r.classList.add("brand__auth--loggedin"),t=document.createElement("div"),t.className="brand__auth-user",n=document.createElement("button"),n.className="brand__auth-user-btn",n.setAttribute("aria-label","Account menu"),c=document.createElement("span"),c.innerHTML='<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="12" height="12" fill="currentColor"><path d="M12 12c2.7 0 4.8-2.1 4.8-4.8S14.7 2.4 12 2.4 7.2 4.5 7.2 7.2 9.3 12 12 12zm0 2.4c-3.2 0-9.6 1.6-9.6 4.8v2.4h19.2v-2.4c0-3.2-6.4-4.8-9.6-4.8z"/></svg>',n.appendChild(c.firstChild),n.appendChild(document.createTextNode(" "+e)),o=document.createElement("div"),o.className="brand__auth-user-dropdown",i=document.createElement("button"),i.className="brand__auth-user-logout",i.textContent="Log Out",i.addEventListener("click",s),e==="hyzen"&&(a=document.createElement("a"),a.className="brand__auth-user-admin",a.href="/admin/",a.textContent="User Management",o.appendChild(a)),o.appendChild(i),o.appendChild(i),t.appendChild(n),t.appendChild(o),r.appendChild(t),n.addEventListener("click",function(e){e.stopPropagation(),t.classList.toggle("is-open")}),document.addEventListener("click",function(){t.classList.remove("is-open")}))}function s(){fetch(t,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify({action:"logout"})}).finally(function(){localStorage.removeItem("f4_username"),localStorage.removeItem("f4_login_time"),localStorage.removeItem("f4_session_fails"),window.location.reload()})}n(e)})()</script><script>(function(){var t,e=document.querySelector(".rss-subscribe");if(!e)return;t=e.querySelector(".rss-subscribe__btn"),t.addEventListener("click",function(t){t.stopPropagation(),e.classList.toggle("is-open")}),document.addEventListener("click",function(t){e.contains(t.target)||e.classList.remove("is-open")}),e.querySelectorAll(".rss-subscribe__item").forEach(function(t){t.addEventListener("click",function(n){n.stopPropagation();var s,o=t.getAttribute("data-rss-url"),a=t.textContent;function i(){t.textContent="Copied!",setTimeout(function(){t.textContent=a,e.classList.remove("is-open")},1200)}try{s=document.createElement("textarea"),s.value=o,s.style.cssText="position:fixed;top:0;left:0;opacity:0;pointer-events:none;",document.body.appendChild(s),s.focus(),s.select(),document.execCommand("copy"),document.body.removeChild(s),i()}catch{navigator.clipboard&&navigator.clipboard.writeText(o).then(i).catch(function(){t.textContent=o})}})})})()</script><script src=/js/session-check.js></script></body></html>
\ No newline at end of file
+Blog posts</button></div></div></div></div><nav class="menu language"><ul class="menu__list language__list"><li class=menu__item><a class=menu__link href=/>Home</a></li><li class=menu__item><a class=menu__link href=/blog/>Blog</a></li><li class=menu__item><a class=menu__link href=/services/>Services</a></li><li class=menu__item><a class=menu__link href=/uninotes/>UniNotes</a></li><li class=menu__item><a class=menu__link href=/contact/>Contact</a></li></ul></nav></header><main class=main><div id=admin-gate style=display:none><p>You do not have permission to access this page.</p></div><div id=admin-panel style=display:none><h1>User Management</h1><div id=admin-msg class=auth-message style=display:none aria-live=polite></div><div id=admin-table-wrap></div></div><script>(function(){var o="https://backend.freedoms4.org/admin.php",i=localStorage.getItem("f4_username"),r=document.getElementById("admin-gate"),c=document.getElementById("admin-panel"),t=document.getElementById("admin-msg"),e=document.getElementById("admin-table-wrap");if(i!=="hyzen"){r.style.display="";return}c.style.display="";function s(e,n){t.textContent=e,t.className="auth-message auth-message--"+n,t.style.display="block",setTimeout(function(){t.style.display="none"},3e3)}function n(e){return String(e).replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;")}function l(t){if(!t.length){e.innerHTML="<p>No users found.</p>";return}var r='<table class="admin-table"><thead><tr><th>#</th><th>Username</th><th>Email</th><th>Joined</th><th>Status</th><th>Actions</th></tr></thead><tbody>';t.forEach(function(e){var a=new Date(e.created_at).toLocaleDateString(),t=e.blocked===!0||e.blocked==="t"||e.blocked==="1",c=t?'<span class="admin-badge admin-badge--blocked">Blocked</span>':'<span class="admin-badge admin-badge--active">Active</span>',l=e.username===i,s="",o="";l||(s=t?'<button class="admin-btn admin-btn--unblock" data-id="'+e.id+'" data-action="unblock_user">Unblock</button>':'<button class="admin-btn admin-btn--block" data-id="'+e.id+'" data-action="block_user">Block</button>',o='<button class="admin-btn admin-btn--delete" data-id="'+e.id+'" data-username="'+n(e.username)+'" data-action="delete_user">Delete Records</button>'),r+='<tr id="user-row-'+e.id+'"><td>'+e.id+"</td><td>"+n(e.username)+"</td><td>"+n(e.email)+"</td><td>"+a+"</td><td>"+c+'</td><td class="admin-actions">'+s+" "+o+"</td></tr>"}),r+="</tbody></table>",e.innerHTML=r,e.querySelectorAll("[data-action]").forEach(function(e){e.addEventListener("click",function(){var t=e.dataset.action,n=parseInt(e.dataset.id,10),i=e.dataset.username||"";if(t==="delete_user"){if(!confirm('Permanently delete user "'+i+'"? This cannot be undone.'))return}else if(t==="block_user"&&!confirm("This will permanently delete the user's email history and cannot be undone"))return;e.disabled=!0,fetch(o,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify({action:t,user_id:n})}).then(function(e){return e.json()}).then(function(o){if(o.success)if(t==="delete_user"){var i=document.getElementById("user-row-"+n);i&&i.remove(),s("User deleted.","success")}else a();else s(o.message||"Action failed.","error"),e.disabled=!1}).catch(function(){s("Network error.","error"),e.disabled=!1})})})}function a(){e.innerHTML="<p>Loading&hellip;</p>",fetch(o+"?action=list_users",{credentials:"include"}).then(function(e){return e.json()}).then(function(t){t.success?l(t.users):e.innerHTML='<p class="admin-error">'+n(t.message||"Failed to load users.")+"</p>"}).catch(function(){e.innerHTML='<p class="admin-error">Network error.</p>'})}a()})()</script></main><footer class=footer><p class=footer__copyright-notice>&copy; <a href=https://freedoms4.org>freedoms4.org</a> <a href=/changelog/>Changelog</a></p><p class=footer__theme-info>Built with <a href=https://gohugo.io>Hugo</a> and based on <a href=https://github.com/CyrusYip/hugo-theme-yue>Yue</a> theme</p></footer><script>(function(){document.querySelectorAll(".menu__item").forEach(function(e){var t=e.querySelector("a");t&&t.getAttribute("href")==="/uninotes/"&&e.classList.add("menu__item--uninotes")})})()</script><script>(function(){var e=document.getElementById("theme-toggle");if(!e)return;function t(){var e=localStorage.getItem("theme");return e?e:window.matchMedia("(prefers-color-scheme: light)").matches?"light":"dark"}function n(e){document.documentElement.setAttribute("data-theme",e),localStorage.setItem("theme",e)}n(t()),e.addEventListener("click",function(){var e=document.documentElement.getAttribute("data-theme")||t();n(e==="dark"?"light":"dark")})})()</script><script>(function(){var t="https://backend.freedoms4.org/auth.php",e=localStorage.getItem("f4_username");if(!e)return;function n(e){var t,n,o,i,a,c,r=document.querySelector(".brand__auth");r&&!r.querySelector(".brand__auth-user")&&(r.classList.add("brand__auth--loggedin"),t=document.createElement("div"),t.className="brand__auth-user",n=document.createElement("button"),n.className="brand__auth-user-btn",n.setAttribute("aria-label","Account menu"),c=document.createElement("span"),c.innerHTML='<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" width="12" height="12" fill="currentColor"><path d="M12 12c2.7 0 4.8-2.1 4.8-4.8S14.7 2.4 12 2.4 7.2 4.5 7.2 7.2 9.3 12 12 12zm0 2.4c-3.2 0-9.6 1.6-9.6 4.8v2.4h19.2v-2.4c0-3.2-6.4-4.8-9.6-4.8z"/></svg>',n.appendChild(c.firstChild),n.appendChild(document.createTextNode(" "+e)),o=document.createElement("div"),o.className="brand__auth-user-dropdown",i=document.createElement("button"),i.className="brand__auth-user-logout",i.textContent="Log Out",i.addEventListener("click",s),e==="hyzen"&&(a=document.createElement("a"),a.className="brand__auth-user-admin",a.href="/admin/",a.textContent="User Management",o.appendChild(a)),o.appendChild(i),o.appendChild(i),t.appendChild(n),t.appendChild(o),r.appendChild(t),n.addEventListener("click",function(e){e.stopPropagation(),t.classList.toggle("is-open")}),document.addEventListener("click",function(){t.classList.remove("is-open")}))}function s(){fetch(t,{method:"POST",headers:{"Content-Type":"application/json"},credentials:"include",body:JSON.stringify({action:"logout"})}).finally(function(){localStorage.removeItem("f4_username"),localStorage.removeItem("f4_login_time"),localStorage.removeItem("f4_session_fails"),window.location.reload()})}n(e)})()</script><script>(function(){var t,e=document.querySelector(".rss-subscribe");if(!e)return;t=e.querySelector(".rss-subscribe__btn"),t.addEventListener("click",function(t){t.stopPropagation(),e.classList.toggle("is-open")}),document.addEventListener("click",function(t){e.contains(t.target)||e.classList.remove("is-open")}),e.querySelectorAll(".rss-subscribe__item").forEach(function(t){t.addEventListener("click",function(n){n.stopPropagation();var s,o=t.getAttribute("data-rss-url"),a=t.textContent;function i(){t.textContent="Copied!",setTimeout(function(){t.textContent=a,e.classList.remove("is-open")},1200)}try{s=document.createElement("textarea"),s.value=o,s.style.cssText="position:fixed;top:0;left:0;opacity:0;pointer-events:none;",document.body.appendChild(s),s.focus(),s.select(),document.execCommand("copy"),document.body.removeChild(s),i()}catch{navigator.clipboard&&navigator.clipboard.writeText(o).then(i).catch(function(){t.textContent=o})}})})})()</script><script src=/js/session-check.js></script></body></html>
\ No newline at end of file
diff --git a/layouts/admin/single.html b/layouts/admin/single.html
index 2c5c2fc..77439d8 100644
--- a/layouts/admin/single.html
+++ b/layouts/admin/single.html
@@ -58,20 +58,26 @@
 					? '<span class="admin-badge admin-badge--blocked">Blocked</span>'
 					: '<span class="admin-badge admin-badge--active">Active</span>';
 
-				var blockBtn = blocked
-					? '<button class="admin-btn admin-btn--unblock" data-id="' +
-						u.id +
-						'" data-action="unblock_user">Unblock</button>'
-					: '<button class="admin-btn admin-btn--block"   data-id="' +
-						u.id +
-						'" data-action="block_user">Block</button>';
+				var isCurrentUser = u.username === username;
+				var blockBtn = '';
+				var deleteBtn = '';
 
-				var deleteBtn =
-					'<button class="admin-btn admin-btn--delete" data-id="' +
-					u.id +
-					'" data-username="' +
-					escHtml(u.username) +
-					'" data-action="delete_user">Delete</button>';
+				if (!isCurrentUser) {
+					blockBtn = blocked
+						? '<button class="admin-btn admin-btn--unblock" data-id="' +
+							u.id +
+							'" data-action="unblock_user">Unblock</button>'
+						: '<button class="admin-btn admin-btn--block" data-id="' +
+							u.id +
+							'" data-action="block_user">Block</button>';
+
+					deleteBtn =
+						'<button class="admin-btn admin-btn--delete" data-id="' +
+						u.id +
+						'" data-username="' +
+						escHtml(u.username) +
+						'" data-action="delete_user">Delete Records</button>';
+				}
 
 				html +=
 					'<tr id="user-row-' +
@@ -116,6 +122,13 @@
 							)
 						)
 							return;
+					} else if (action === 'block_user') {
+						if (
+							!confirm(
+								"This will permanently delete the user's email history and cannot be undone"
+							)
+						)
+							return;
 					}
 
 					btn.disabled = true;