admin/38682-vm
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

updating url

Browse Source
This commit is contained in:
Flatlogic Bot 2026-02-24 10:22:29 +00:00
parent e2fb4c84bf
commit 3245d00d29
8 changed files with 159 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
admin/company.php
View File

@ -21,6 +21,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$currency_decimals = $_POST['currency_decimals'] ?? 2;
$ctr_number = $_POST['ctr_number'] ?? '';
$vat_number = $_POST['vat_number'] ?? '';
$commission_enabled = isset($_POST['commission_enabled']) ? 1 : 0;
// Handle File Uploads
$uploadDir = __DIR__ . '/../assets/images/company/';
@ -66,11 +67,11 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$exists = $pdo->query("SELECT COUNT(*) FROM company_settings")->fetchColumn();
if ($exists) {
$stmt = $pdo->prepare("UPDATE company_settings SET company_name=?, address=?, phone=?, email=?, vat_rate=?, currency_symbol=?, currency_decimals=?, ctr_number=?, vat_number=?, logo_url=?, favicon_url=?, updated_at=NOW()");
$stmt->execute([$company_name, $address, $phone, $email, $vat_rate, $currency_symbol, $currency_decimals, $ctr_number, $vat_number, $logo_url, $favicon_url]);
$stmt = $pdo->prepare("UPDATE company_settings SET company_name=?, address=?, phone=?, email=?, vat_rate=?, currency_symbol=?, currency_decimals=?, ctr_number=?, vat_number=?, logo_url=?, favicon_url=?, commission_enabled=?, updated_at=NOW()");
$stmt->execute([$company_name, $address, $phone, $email, $vat_rate, $currency_symbol, $currency_decimals, $ctr_number, $vat_number, $logo_url, $favicon_url, $commission_enabled]);
} else {
$stmt = $pdo->prepare("INSERT INTO company_settings (company_name, address, phone, email, vat_rate, currency_symbol, currency_decimals, ctr_number, vat_number, logo_url, favicon_url) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
$stmt->execute([$company_name, $address, $phone, $email, $vat_rate, $currency_symbol, $currency_decimals, $ctr_number, $vat_number, $logo_url, $favicon_url]);
$stmt = $pdo->prepare("INSERT INTO company_settings (company_name, address, phone, email, vat_rate, currency_symbol, currency_decimals, ctr_number, vat_number, logo_url, favicon_url, commission_enabled) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
$stmt->execute([$company_name, $address, $phone, $email, $vat_rate, $currency_symbol, $currency_decimals, $ctr_number, $vat_number, $logo_url, $favicon_url, $commission_enabled]);
}
$message = '<div class="alert alert-success">Company settings updated successfully!</div>';
@ -81,6 +82,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$settings['vat_number'] = $vat_number;
$settings['logo_url'] = $logo_url;
$settings['favicon_url'] = $favicon_url;
$settings['commission_enabled'] = $commission_enabled;
} catch (Exception $e) {
$message = '<div class="alert alert-danger">Error updating settings: ' . htmlspecialchars($e->getMessage()) . '</div>';
@ -153,6 +155,18 @@ include 'includes/header.php';
</div>
</div>
<hr class="my-4">
<h5 class="mb-3">Commission System</h5>
<div class="row">
<div class="col-md-6 mb-3">
<div class="form-check form-switch mt-2">
<input class="form-check-input" type="checkbox" name="commission_enabled" id="commissionEnabled" <?= ($settings['commission_enabled'] ?? 0) ? 'checked' : '' ?> <?= !has_permission('settings_add') ? 'disabled' : '' ?>>
<label class="form-check-label fw-bold" for="commissionEnabled">Enable Commissions for Cashiers</label>
<div class="form-text">When enabled, commissions will be calculated for each order based on the cashier's commission rate.</div>
</div>
</div>
</div>
<hr class="my-4">
<h5 class="mb-3">Branding</h5>
<div class="row align-items-center">

55
admin/orders.php
View File

@ -86,18 +86,21 @@ if (!empty($_GET['search'])) {
$where_clause = !empty($where) ? 'WHERE ' . implode(' AND ', $where) : '';
// Calculate Total Sum for filtered orders
$sum_query = "SELECT SUM(total_amount) as total_sum FROM orders o $where_clause";
// Calculate Total Sum and Total Commission for filtered orders
$sum_query = "SELECT SUM(total_amount) as total_sum, SUM(commission_amount) as total_commission FROM orders o $where_clause";
$stmt_sum = $pdo->prepare($sum_query);
$stmt_sum->execute($params);
$total_sum = $stmt_sum->fetchColumn() ?: 0;
$sum_data = $stmt_sum->fetch(PDO::FETCH_ASSOC);
$total_sum = (float)($sum_data['total_sum'] ?? 0);
$total_commission = (float)($sum_data['total_commission'] ?? 0);
// Main Query
$query = "SELECT o.*, ot.name as outlet_name, pt.name as payment_type_name,
$query = "SELECT o.*, ot.name as outlet_name, pt.name as payment_type_name, u.username as cashier_name,
(SELECT GROUP_CONCAT(CONCAT(p.name, ' x', oi.quantity) SEPARATOR ', ') FROM order_items oi JOIN products p ON oi.product_id = p.id WHERE oi.order_id = o.id) as items_summary
FROM orders o
LEFT JOIN outlets ot ON o.outlet_id = ot.id
LEFT JOIN payment_types pt ON o.payment_type_id = pt.id
LEFT JOIN users u ON o.user_id = u.id
$where_clause
ORDER BY o.created_at DESC";
@ -107,6 +110,9 @@ $orders = $orders_pagination['data'];
// Add total sum to pagination object for rendering
$orders_pagination['total_amount_sum'] = $total_sum;
$settings = get_company_settings();
$commission_enabled = !empty($settings['commission_enabled']);
include 'includes/header.php';
?>
@ -149,7 +155,7 @@ include 'includes/header.php';
<!-- Summary Stats -->
<div class="row mb-4">
<div class="col-md-4">
<div class="col-md-3">
<div class="card border-0 shadow-sm">
<div class="card-body">
<div class="d-flex align-items-center">
@ -164,7 +170,24 @@ include 'includes/header.php';
</div>
</div>
</div>
<div class="col-md-4">
<?php if ($commission_enabled): ?>
<div class="col-md-3">
<div class="card border-0 shadow-sm">
<div class="card-body">
<div class="d-flex align-items-center">
<div class="flex-shrink-0 bg-warning bg-opacity-10 text-warning p-3 rounded">
<i class="bi bi-percent fs-4"></i>
</div>
<div class="flex-grow-1 ms-3">
<h6 class="text-muted mb-0 small text-uppercase fw-bold">Total Commission</h6>
<div class="fs-4 fw-bold text-warning"><?= format_currency($total_commission) ?></div>
</div>
</div>
</div>
</div>
</div>
<?php endif; ?>
<div class="col-md-<?= $commission_enabled ? '3' : '4' ?>">
<div class="card border-0 shadow-sm">
<div class="card-body">
<div class="d-flex align-items-center">
@ -179,7 +202,7 @@ include 'includes/header.php';
</div>
</div>
</div>
<div class="col-md-4">
<div class="col-md-<?= $commission_enabled ? '3' : '4' ?>">
<div class="card border-0 shadow-sm">
<div class="card-body">
<div class="d-flex align-items-center">
@ -253,11 +276,14 @@ include 'includes/header.php';
<tr>
<th class="ps-4">ID</th>
<th>Outlet</th>
<th>Cashier</th>
<th>Customer</th>
<th>Type</th>
<th>Source</th>
<th>Items</th>
<th>Total</th>
<?php if ($commission_enabled): ?>
<th>Commission</th>
<?php endif; ?>
<th>Payment</th>
<th>Status</th>
<th>Time</th>
@ -274,6 +300,9 @@ include 'includes/header.php';
<?= htmlspecialchars($order['outlet_name'] ?? 'Unknown') ?>
</span>
</td>
<td>
<small class="fw-bold">@<?= htmlspecialchars((string)($order['cashier_name'] ?? 'Guest')) ?></small>
</td>
<td>
<?php if (!empty($order['customer_name'])): ?>
<div><?= htmlspecialchars((string)($order['customer_name'] ?? '')) ?></div>
@ -303,8 +332,12 @@ include 'includes/header.php';
<span class="badge bg-light text-dark border"><?= ucfirst($order['order_type']) ?></span>
<?php endif; ?>
</td>
<td><small class="text-muted"><?= htmlspecialchars((string)($order['items_summary'] ?? '')) ?></small></td>
<td><?= format_currency($order['total_amount']) ?></td>
<td class="fw-bold"><?= format_currency($order['total_amount']) ?></td>
<?php if ($commission_enabled): ?>
<td>
<span class="text-warning fw-bold"><?= format_currency($order['commission_amount']) ?></span>
</td>
<?php endif; ?>
<td>
<?php
$payment_name = $order['payment_type_name'] ?? 'Unpaid';
@ -379,7 +412,7 @@ include 'includes/header.php';
<?php endforeach; ?>
<?php if (empty($orders)): ?>
<tr>
<td colspan="11" class="text-center py-5 text-muted">
<td colspan="12" class="text-center py-5 text-muted">
<i class="bi bi-inbox fs-1 d-block mb-2"></i>
No active orders found matching your criteria.
</td>

33
admin/users.php
View File

@ -16,6 +16,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) {
$group_id = (int)$_POST['group_id'];
$is_active = isset($_POST['is_active']) ? 1 : 0;
$is_ratable = isset($_POST['is_ratable']) ? 1 : 0;
$commission_rate = (float)($_POST['commission_rate'] ?? 0);
$id = isset($_POST['id']) ? (int)$_POST['id'] : null;
$profile_pic = null;
@ -46,13 +47,13 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) {
if (!has_permission('users_edit') && !has_permission('users_add')) {
$message = '<div class="alert alert-danger">Access Denied: You do not have permission to edit users.</div>';
} else {
$sql = "UPDATE users SET username = ?, full_name = ?, full_name_ar = ?, email = ?, group_id = ?, is_active = ?, is_ratable = ?, profile_pic = ? WHERE id = ?";
$params = [$username, $full_name, $full_name_ar, $email, $group_id, $is_active, $is_ratable, $profile_pic, $id];
$sql = "UPDATE users SET username = ?, full_name = ?, full_name_ar = ?, email = ?, group_id = ?, is_active = ?, is_ratable = ?, profile_pic = ?, commission_rate = ? WHERE id = ?";
$params = [$username, $full_name, $full_name_ar, $email, $group_id, $is_active, $is_ratable, $profile_pic, $commission_rate, $id];
if (!empty($_POST['password'])) {
$password = password_hash($_POST['password'], PASSWORD_DEFAULT);
$sql = "UPDATE users SET username = ?, full_name = ?, full_name_ar = ?, email = ?, group_id = ?, is_active = ?, is_ratable = ?, profile_pic = ?, password = ? WHERE id = ?";
$params = [$username, $full_name, $full_name_ar, $email, $group_id, $is_active, $is_ratable, $profile_pic, $password, $id];
$sql = "UPDATE users SET username = ?, full_name = ?, full_name_ar = ?, email = ?, group_id = ?, is_active = ?, is_ratable = ?, profile_pic = ?, commission_rate = ?, password = ? WHERE id = ?";
$params = [$username, $full_name, $full_name_ar, $email, $group_id, $is_active, $is_ratable, $profile_pic, $commission_rate, $password, $id];
}
$stmt = $pdo->prepare($sql);
@ -64,8 +65,8 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) {
$message = '<div class="alert alert-danger">Access Denied: You do not have permission to add users.</div>';
} else {
$password = password_hash($_POST['password'] ?: '123456', PASSWORD_DEFAULT);
$stmt = $pdo->prepare("INSERT INTO users (username, password, full_name, full_name_ar, email, group_id, is_active, is_ratable, profile_pic) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)");
$stmt->execute([$username, $password, $full_name, $full_name_ar, $email, $group_id, $is_active, $is_ratable, $profile_pic]);
$stmt = $pdo->prepare("INSERT INTO users (username, password, full_name, full_name_ar, email, group_id, is_active, is_ratable, profile_pic, commission_rate) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
$stmt->execute([$username, $password, $full_name, $full_name_ar, $email, $group_id, $is_active, $is_ratable, $profile_pic, $commission_rate]);
$message = '<div class="alert alert-success">User created successfully!</div>';
}
}
@ -137,7 +138,7 @@ include 'includes/header.php';
<th>Email</th>
<th>Role / Group</th>
<th>Status</th>
<th>Ratable</th>
<th>Commission</th>
<th class="text-end pe-4">Actions</th>
</tr>
</thead>
@ -168,11 +169,7 @@ include 'includes/header.php';
<?php endif; ?>
</td>
<td>
<?php if ($user['is_ratable']): ?>
<span class="badge bg-info-subtle text-info px-3 py-1 rounded-pill">Yes</span>
<?php else: ?>
<span class="badge bg-secondary-subtle text-secondary px-3 py-1 rounded-pill">No</span>
<?php endif; ?>
<span class="fw-bold text-primary"><?= number_format($user['commission_rate'], 1) ?>%</span>
</td>
<td class="text-end pe-4">
<?php if (has_permission('users_edit') || has_permission('users_add')): ?>
@ -261,6 +258,16 @@ include 'includes/header.php';
<?php endforeach; ?>
</select>
</div>
<div class="row g-3 mb-3">
<div class="col-md-12">
<label class="form-label small fw-bold text-muted">COMMISSION RATE (%)</label>
<div class="input-group">
<input type="number" step="0.1" name="commission_rate" id="userCommissionRate" class="form-control rounded-3 border-0 bg-light" placeholder="0.0">
<span class="input-group-text border-0 bg-light">%</span>
</div>
<small class="text-muted">Percentage earned per sale processed by this user.</small>
</div>
</div>
<div class="mb-4">
<label class="form-label small fw-bold text-muted">PROFILE PICTURE</label>
<input type="file" name="profile_pic" id="userProfilePicFile" class="form-control rounded-3 border-0 bg-light" accept="image/*">
@ -299,6 +306,7 @@ function prepareAddForm() {
document.getElementById('pwdHint').style.display = 'none';
document.getElementById('userPassword').required = true;
document.getElementById('userImagePreviewContainer').style.display = 'none';
document.getElementById('userCommissionRate').value = '0.0';
}
function prepareEditForm(user) {
@ -313,6 +321,7 @@ function prepareEditForm(user) {
document.getElementById('userGroupId').value = user.group_id || '';
document.getElementById('userIsActive').checked = user.is_active == 1;
document.getElementById('userIsRatable').checked = user.is_ratable == 1;
document.getElementById('userCommissionRate').value = user.commission_rate || '0.0';
document.getElementById('userPassword').required = false;
document.getElementById('pwdLabel').style.display = 'none';
document.getElementById('pwdHint').style.display = 'block';

30
api/order.php
View File

@ -72,10 +72,10 @@ try {
// Fetch Loyalty Settings
$settingsStmt = $pdo->query("SELECT is_enabled, points_per_order, points_for_free_meal FROM loyalty_settings WHERE id = 1");
$settings = $settingsStmt->fetch(PDO::FETCH_ASSOC);
$loyalty_enabled = $settings ? (bool)$settings['is_enabled'] : true;
$points_per_order = $settings ? intval($settings['points_per_order']) : 10;
$points_threshold = $settings ? intval($settings['points_for_free_meal']) : 70;
$loyaltySettings = $settingsStmt->fetch(PDO::FETCH_ASSOC);
$loyalty_enabled = $loyaltySettings ? (bool)$loyaltySettings['is_enabled'] : true;
$points_per_order = $loyaltySettings ? intval($loyaltySettings['points_per_order']) : 10;
$points_threshold = $loyaltySettings ? intval($loyaltySettings['points_for_free_meal']) : 70;
$current_points = 0;
$points_deducted = 0;
@ -189,6 +189,19 @@ try {
$final_total = max(0, $calculated_total + $vat);
// Commission Calculation
$commission_amount = 0;
$companySettings = get_company_settings();
if (!empty($companySettings['commission_enabled']) && $user_id) {
$userStmt = $pdo->prepare("SELECT commission_rate FROM users WHERE id = ?");
$userStmt->execute([$user_id]);
$commission_rate = (float)$userStmt->fetchColumn();
if ($commission_rate > 0) {
// Commission is usually calculated on the subtotal (before tax/VAT)
$commission_amount = $calculated_total * ($commission_rate / 100);
}
}
// Check for Existing Order ID (Update Mode)
$order_id = isset($data['order_id']) ? intval($data['order_id']) : null;
$is_update = false;
@ -208,21 +221,22 @@ try {
$stmt = $pdo->prepare("UPDATE orders SET
outlet_id = ?, table_id = ?, table_number = ?, order_type = ?,
customer_id = ?, customer_name = ?, customer_phone = ?,
payment_type_id = ?, total_amount = ?, discount = ?, user_id = ?, status = 'pending'
payment_type_id = ?, total_amount = ?, discount = ?, user_id = ?,
commission_amount = ?, status = 'pending'
WHERE id = ?");
$stmt->execute([
$outlet_id, $table_id, $table_number, $order_type,
$customer_id, $customer_name, $customer_phone,
$payment_type_id, $final_total, $vat, $user_id,
$order_id
$commission_amount, $order_id
]);
$delStmt = $pdo->prepare("DELETE FROM order_items WHERE order_id = ?");
$delStmt->execute([$order_id]);
} else {
// INSERT New Order
$stmt = $pdo->prepare("INSERT INTO orders (outlet_id, table_id, table_number, order_type, customer_id, customer_name, customer_phone, payment_type_id, total_amount, discount, user_id, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending')");
$stmt->execute([$outlet_id, $table_id, $table_number, $order_type, $customer_id, $customer_name, $customer_phone, $payment_type_id, $final_total, $vat, $user_id]);
$stmt = $pdo->prepare("INSERT INTO orders (outlet_id, table_id, table_number, order_type, customer_id, customer_name, customer_phone, payment_type_id, total_amount, discount, user_id, commission_amount, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'pending')");
$stmt->execute([$outlet_id, $table_id, $table_number, $order_type, $customer_id, $customer_name, $customer_phone, $payment_type_id, $final_total, $vat, $user_id, $commission_amount]);
$order_id = $pdo->lastInsertId();
}

8
db/migrations/034_commission_system.sql Normal file
View File

@ -0,0 +1,8 @@
-- Add commission toggle to company_settings
ALTER TABLE company_settings ADD COLUMN commission_enabled TINYINT(1) DEFAULT 0;
-- Add commission_rate to users
ALTER TABLE users ADD COLUMN commission_rate DECIMAL(5, 2) DEFAULT 0.00;
-- Add commission_amount to orders
ALTER TABLE orders ADD COLUMN commission_amount DECIMAL(10, 2) DEFAULT 0.00;

31
includes/functions.php
View File

@ -296,16 +296,39 @@ function require_permission($permission) {
* @return string The base URL.
*/
function get_base_url() {
$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off' || $_SERVER['SERVER_PORT'] == 443) ? "https://" : "http://";
$protocol = 'http://';
if ((!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
$_SERVER['SERVER_PORT'] == 443 ||
(isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https')) {
$protocol = 'https://';
}
$domainName = $_SERVER['HTTP_HOST'];
// Remove admin/ if we are in it
// Calculate script directory
$script_dir = dirname($_SERVER['SCRIPT_NAME']);
$script_dir = str_replace(['/admin', '/api'], '', $script_dir);
if ($script_dir === '/') $script_dir = '';
// Replace only at the end to be safer
if (str_ends_with($script_dir, '/admin')) {
$script_dir = substr($script_dir, 0, -6);
} elseif (str_ends_with($script_dir, '/api')) {
$script_dir = substr($script_dir, 0, -4);
}
if ($script_dir === DIRECTORY_SEPARATOR || $script_dir === '/') {
$script_dir = '';
}
return $protocol . $domainName . $script_dir . '/';
}
if (!function_exists('str_ends_with')) {
function str_ends_with($haystack, $needle) {
$length = strlen($needle);
if (!$length) return true;
return substr($haystack, -$length) === $needle;
}
}
/**
* Backup functions
*/

20
login.php
View File

@ -6,9 +6,25 @@ init_session();
$baseUrl = get_base_url();
/**
* Determine where to redirect the user based on permissions
*/
function get_redirect_url($baseUrl) {
if (has_permission('dashboard_view')) {
return $baseUrl . 'admin/index.php';
} elseif (has_permission('pos')) {
return $baseUrl . 'pos.php';
} elseif (has_permission('kitchen_view')) {
return $baseUrl . 'kitchen.php';
}
// Fallback to admin index if no specific view permission found,
// the page itself will handle the final access denied
return $baseUrl . 'admin/index.php';
}
// Redirect if already logged in
if (get_logged_user()) {
header('Location: ' . $baseUrl . 'admin/index.php');
header('Location: ' . get_redirect_url($baseUrl));
exit;
}
@ -19,7 +35,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$password = $_POST['password'] ?? '';
if (login_user($username, $password)) {
header('Location: ' . $baseUrl . 'admin/index.php');
header('Location: ' . get_redirect_url($baseUrl));
exit;
} else {
$error = 'Invalid username or password.';

7
test_url.php
View File

@ -1,7 +0,0 @@
<?php
require_once __DIR__ . '/db/config.php';
require_once __DIR__ . '/includes/functions.php';
echo "Script Name: " . $_SERVER['SCRIPT_NAME'] . "\n";
echo "Dirname: " . dirname($_SERVER['SCRIPT_NAME']) . "\n";
echo "Base URL: " . get_base_url() . "\n";