diff --git a/admin/client_prices.php b/admin/client_prices.php index f23dd88..0b8a772 100644 --- a/admin/client_prices.php +++ b/admin/client_prices.php @@ -8,28 +8,36 @@ $pdo = db(); $message = ''; // Handle form submission -if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['client_id'], $_POST['product_id'], $_POST['price'])) { +if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['client_id'], $_POST['product_id'])) { $clientId = $_POST['client_id']; $productId = $_POST['product_id']; - $price = $_POST['price']; + $priceNet = isset($_POST['price_net']) && is_numeric($_POST['price_net']) ? (float)$_POST['price_net'] : null; + $priceGross = isset($_POST['price_gross']) && is_numeric($_POST['price_gross']) ? (float)$_POST['price_gross'] : null; - if (!empty($clientId) && !empty($productId) && is_numeric($price)) { + // Server-side validation and calculation + if ($priceGross !== null) { + $priceNet = round($priceGross / 1.23, 2); + } elseif ($priceNet !== null) { + $priceGross = round($priceNet * 1.23, 2); + } + + if (!empty($clientId) && !empty($productId) && $priceNet !== null && $priceGross !== null) { // Upsert logic $stmt = $pdo->prepare("SELECT COUNT(*) FROM client_prices WHERE client_id = :client_id AND product_id = :product_id"); $stmt->execute(['client_id' => $clientId, 'product_id' => $productId]); $exists = $stmt->fetchColumn() > 0; if ($exists) { - $stmt = $pdo->prepare("UPDATE client_prices SET price = :price WHERE client_id = :client_id AND product_id = :product_id"); - $stmt->execute(['price' => $price, 'client_id' => $clientId, 'product_id' => $productId]); + $stmt = $pdo->prepare("UPDATE client_prices SET price_net = :price_net, price_gross = :price_gross WHERE client_id = :client_id AND product_id = :product_id"); + $stmt->execute(['price_net' => $priceNet, 'price_gross' => $priceGross, 'client_id' => $clientId, 'product_id' => $productId]); $message = '