diff --git a/items.php b/items.php
index 7a4e473..60b26aa 100644
--- a/items.php
+++ b/items.php
@@ -1,205 +1,38 @@
false, 'error' => 'Unauthorized']);
- exit;
- }
- header('Location: login.php');
- exit;
-}
-
-// Initial view check
-if (!has_permission('view')) {
- if ($isAjax) {
- header('Content-Type: application/json');
- echo json_encode(['success' => false, 'error' => 'Forbidden']);
- exit;
- }
- header('Location: admin.php');
- exit;
-}
-
-$branch_id = $_SESSION['branch_id'];
-
-function handleImageUpload($file) {
- if (!$file || $file['error'] !== UPLOAD_ERR_OK) {
- return null;
- }
-
- $targetDir = "assets/images/items/";
- if (!is_dir($targetDir)) {
- mkdir($targetDir, 0775, true);
- }
-
- $fileExtension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
- $newFileName = uniqid('item_', true) . '.' . $fileExtension;
- $targetFile = $targetDir . $newFileName;
-
- // Check if image file is a actual image or fake image
- $check = getimagesize($file['tmp_name']);
- if($check === false) {
- return null;
- }
-
- // Allow certain file formats
- $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif', 'webp'];
- if (!in_array($fileExtension, $allowedExtensions)) {
- return null;
- }
-
- if (move_uploaded_file($file['tmp_name'], $targetFile)) {
- return $targetFile;
- }
-
- return null;
-}
-
-function deleteOldImage($imageUrl) {
- if ($imageUrl && strpos($imageUrl, 'assets/images/items/') === 0) {
- if (file_exists($imageUrl)) {
- unlink($imageUrl);
- }
- }
-}
-
-// Helper to render category list HTML for AJAX
-function renderCategoryList($lang) {
- $categories = db()->query("SELECT * FROM categories ORDER BY name_en ASC")->fetchAll();
- $html = '';
- foreach($categories as $cat) {
- $html .= '
-
- ' . htmlspecialchars($cat['name_en']) . ' ' . htmlspecialchars($cat['name_ar']) . '
-
-
-';
- if (has_permission('edit')) {
- $html .= '
- ';
- }
- if (has_permission('delete')) {
- $html .= '
- ';
- }
- $html .= ' ';
- }
- return $html;
-}
-
-// Helper to render service list HTML for AJAX
-function renderServiceList($lang) {
- $services = db()->query("SELECT * FROM services ORDER BY name_en ASC")->fetchAll();
- $html = '';
- foreach($services as $svc) {
- $html .= '
-
- ' . htmlspecialchars($svc['name_en']) . ' ' . htmlspecialchars($svc['name_ar']) . '
-
-
-';
- if (has_permission('edit')) {
- $html .= '
- ';
- }
- if (has_permission('delete')) {
- $html .= '
- ';
- }
- $html .= ' ';
- }
- return $html;
-}
-
-// Handle Actions
+// Action handling
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) {
$action = $_POST['action'];
-
- // Permission mapping for actions
- $required_permission = 'view';
- if (strpos($action, 'add_') === 0) $required_permission = 'add';
- if (strpos($action, 'edit_') === 0 || strpos($action, 'update_') === 0) $required_permission = 'edit';
- if (strpos($action, 'delete_') === 0) $required_permission = 'delete';
- if (!has_permission($required_permission)) {
- if ($isAjax) {
- header('Content-Type: application/json');
- echo json_encode(['success' => false, 'error' => 'Forbidden']);
- exit;
- }
- header('Location: items.php?error=no_permission');
- exit;
- }
-
- if ($action === 'add_item') {
- $name_en = $_POST['name_en'];
- $name_ar = $_POST['name_ar'];
- $category_id = $_POST['category_id'] ?: null;
- $vat_percent = $_POST['vat_percent'] ?: 0.00;
-
- $image_url = handleImageUpload($_FILES['image'] ?? null);
-
- $stmt = db()->prepare("INSERT INTO items (category_id, name_en, name_ar, image_url, vat_percent) VALUES (?, ?, ?, ?, ?)");
- $stmt->execute([$category_id, $name_en, $name_ar, $image_url, $vat_percent]);
- header('Location: items.php?success=item_added');
- exit;
- } elseif ($action === 'edit_item') {
- $id = $_POST['id'];
- $name_en = $_POST['name_en'];
- $name_ar = $_POST['name_ar'];
- $category_id = $_POST['category_id'] ?: null;
- $vat_percent = $_POST['vat_percent'] ?: 0.00;
-
- // Get current image to delete it if new one is uploaded
- $stmt = db()->prepare("SELECT image_url FROM items WHERE id = ?");
- $stmt->execute([$id]);
- $currentItem = $stmt->fetch();
- $image_url = $currentItem['image_url'] ?? null;
-
- $new_image = handleImageUpload($_FILES['image'] ?? null);
- if ($new_image) {
- deleteOldImage($image_url);
- $image_url = $new_image;
- }
-
- $stmt = db()->prepare("UPDATE items SET category_id = ?, name_en = ?, name_ar = ?, image_url = ?, vat_percent = ? WHERE id = ?");
- $stmt->execute([$category_id, $name_en, $name_ar, $image_url, $vat_percent, $id]);
- header('Location: items.php?success=item_updated');
- exit;
- } elseif ($action === 'delete_item') {
- $id = $_POST['id'];
-
- // Delete image file if exists
- $stmt = db()->prepare("SELECT image_url FROM items WHERE id = ?");
- $stmt->execute([$id]);
- $item = $stmt->fetch();
- deleteOldImage($item['image_url'] ?? null);
-
- $stmt = db()->prepare("DELETE FROM items WHERE id = ?");
- $stmt->execute([$id]);
- header('Location: items.php?success=item_deleted');
- exit;
- } elseif ($action === 'add_category') {
+ if ($action === 'add_category') {
$name_en = $_POST['cat_name_en'];
$name_ar = $_POST['cat_name_ar'];
$stmt = db()->prepare("INSERT INTO categories (name_en, name_ar) VALUES (?, ?)");
$stmt->execute([$name_en, $name_ar]);
-
+
if ($isAjax) {
header('Content-Type: application/json');
- echo json_encode(['success' => true, 'html' => renderCategoryList($lang)]);
+ $categories = db()->query("SELECT * FROM categories ORDER BY name_en ASC")->fetchAll();
+ ob_start();
+ foreach($categories as $cat): ?>
+
+
+
+
+ true, 'html' => $html]);
exit;
}
header('Location: items.php?success=category_added');
@@ -213,7 +46,20 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) {
if ($isAjax) {
header('Content-Type: application/json');
- echo json_encode(['success' => true, 'html' => renderCategoryList($lang)]);
+ $categories = db()->query("SELECT * FROM categories ORDER BY name_en ASC")->fetchAll();
+ ob_start();
+ foreach($categories as $cat): ?>
+
+
+
+
+ true, 'html' => $html]);
exit;
}
header('Location: items.php?success=category_updated');
@@ -225,11 +71,78 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) {
if ($isAjax) {
header('Content-Type: application/json');
- echo json_encode(['success' => true, 'html' => renderCategoryList($lang)]);
+ $categories = db()->query("SELECT * FROM categories ORDER BY name_en ASC")->fetchAll();
+ ob_start();
+ foreach($categories as $cat): ?>
+
+
+
+
+ true, 'html' => $html]);
exit;
}
header('Location: items.php?success=category_deleted');
exit;
+ } elseif ($action === 'add_item') {
+ $category_id = $_POST['category_id'] ?: null;
+ $name_en = $_POST['name_en'];
+ $name_ar = $_POST['name_ar'];
+ $vat_percent = $_POST['vat_percent'] ?: 0;
+
+ $image_url = null;
+ if (isset($_FILES['image']) && $_FILES['image']['error'] === 0) {
+ $ext = pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION);
+ $filename = 'item_' . uniqid('', true) . '.' . $ext;
+ $upload_dir = __DIR__ . '/assets/images/items/';
+ if (!is_dir($upload_dir)) mkdir($upload_dir, 0777, true);
+ if (move_uploaded_file($_FILES['image']['tmp_name'], $upload_dir . $filename)) {
+ $image_url = 'assets/images/items/' . $filename;
+ }
+ }
+
+ $stmt = db()->prepare("INSERT INTO items (category_id, name_en, name_ar, vat_percent, image_url) VALUES (?, ?, ?, ?, ?)");
+ $stmt->execute([$category_id, $name_en, $name_ar, $vat_percent, $image_url]);
+ header('Location: items.php?success=item_added');
+ exit;
+ } elseif ($action === 'edit_item') {
+ $id = $_POST['id'];
+ $category_id = $_POST['category_id'] ?: null;
+ $name_en = $_POST['name_en'];
+ $name_ar = $_POST['name_ar'];
+ $vat_percent = $_POST['vat_percent'] ?: 0;
+
+ $image_url = null;
+ if (isset($_FILES['image']) && $_FILES['image']['error'] === 0) {
+ $ext = pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION);
+ $filename = 'item_' . uniqid('', true) . '.' . $ext;
+ $upload_dir = __DIR__ . '/assets/images/items/';
+ if (!is_dir($upload_dir)) mkdir($upload_dir, 0777, true);
+ if (move_uploaded_file($_FILES['image']['tmp_name'], $upload_dir . $filename)) {
+ $image_url = 'assets/images/items/' . $filename;
+ }
+ }
+
+ if ($image_url) {
+ $stmt = db()->prepare("UPDATE items SET category_id = ?, name_en = ?, name_ar = ?, vat_percent = ?, image_url = ? WHERE id = ?");
+ $stmt->execute([$category_id, $name_en, $name_ar, $vat_percent, $image_url, $id]);
+ } else {
+ $stmt = db()->prepare("UPDATE items SET category_id = ?, name_en = ?, name_ar = ?, vat_percent = ? WHERE id = ?");
+ $stmt->execute([$category_id, $name_en, $name_ar, $vat_percent, $id]);
+ }
+ header('Location: items.php?success=item_updated');
+ exit;
+ } elseif ($action === 'delete_item') {
+ $id = $_POST['id'];
+ $stmt = db()->prepare("DELETE FROM items WHERE id = ?");
+ $stmt->execute([$id]);
+ header('Location: items.php?success=item_deleted');
+ exit;
} elseif ($action === 'add_service') {
$name_en = $_POST['svc_name_en'];
$name_ar = $_POST['svc_name_ar'];
@@ -279,11 +192,29 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) {
$price = str_replace(',', '.', $price); // Handle comma as decimal separator
$price = (float)$price;
+ // Determine branch_id from session (if available)
+ $branch_id = $_SESSION['branch_id'] ?? null;
+ if ($branch_id === 'all') $branch_id = null;
+
+ // Final sanity check for branch_id to avoid FK errors if session has stale ID
+ if ($branch_id) {
+ $chk = db()->prepare("SELECT id FROM branches WHERE id = ?");
+ $chk->execute([$branch_id]);
+ if (!$chk->fetch()) $branch_id = null;
+ }
+
try {
- $stmt = db()->prepare("INSERT INTO prices (item_id, service_id, price)
- VALUES (?, ?, ?)
- ON DUPLICATE KEY UPDATE price = ?");
- $stmt->execute([$item_id, $service_id, $price, $price]);
+ if ($branch_id) {
+ $stmt = db()->prepare("INSERT INTO prices (item_id, service_id, price, branch_id)
+ VALUES (?, ?, ?, ?)
+ ON DUPLICATE KEY UPDATE price = ?");
+ $stmt->execute([$item_id, $service_id, $price, $branch_id, $price]);
+ } else {
+ $stmt = db()->prepare("INSERT INTO prices (item_id, service_id, price)
+ VALUES (?, ?, ?)
+ ON DUPLICATE KEY UPDATE price = ?");
+ $stmt->execute([$item_id, $service_id, $price, $price]);
+ }
if ($isAjax) {
header('Content-Type: application/json');
@@ -350,6 +281,22 @@ $prices = [];
foreach ($prices_raw as $p) {
$prices[$p['item_id']][$p['service_id']] = $p['price'];
}
+
+function renderServiceList($lang) {
+ $services = db()->query("SELECT * FROM services ORDER BY name_en ASC")->fetchAll();
+ ob_start();
+ foreach($services as $svc): ?>
+
+
+
+
+
@@ -558,15 +505,25 @@ foreach ($prices_raw as $p) {
-
-
+
+
-
-
+
+
+
+
+
+
@@ -621,10 +578,11 @@ foreach ($prices_raw as $p) {
-
-
+
+
-
@@ -641,80 +599,58 @@ foreach ($prices_raw as $p) {
-
-
+
+
+
-
-
-
-
-
+
\ No newline at end of file