From 35d8fe23f8483d072ed07e25cc7b63cd68e93af9 Mon Sep 17 00:00:00 2001 From: Flatlogic Bot Date: Tue, 3 Mar 2026 18:08:33 +0000 Subject: [PATCH] update items --- items.php | 452 +++++++++++++++++++++++------------------------------- 1 file changed, 194 insertions(+), 258 deletions(-) diff --git a/items.php b/items.php index 7a4e473..60b26aa 100644 --- a/items.php +++ b/items.php @@ -1,205 +1,38 @@ false, 'error' => 'Unauthorized']); - exit; - } - header('Location: login.php'); - exit; -} - -// Initial view check -if (!has_permission('view')) { - if ($isAjax) { - header('Content-Type: application/json'); - echo json_encode(['success' => false, 'error' => 'Forbidden']); - exit; - } - header('Location: admin.php'); - exit; -} - -$branch_id = $_SESSION['branch_id']; - -function handleImageUpload($file) { - if (!$file || $file['error'] !== UPLOAD_ERR_OK) { - return null; - } - - $targetDir = "assets/images/items/"; - if (!is_dir($targetDir)) { - mkdir($targetDir, 0775, true); - } - - $fileExtension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION)); - $newFileName = uniqid('item_', true) . '.' . $fileExtension; - $targetFile = $targetDir . $newFileName; - - // Check if image file is a actual image or fake image - $check = getimagesize($file['tmp_name']); - if($check === false) { - return null; - } - - // Allow certain file formats - $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif', 'webp']; - if (!in_array($fileExtension, $allowedExtensions)) { - return null; - } - - if (move_uploaded_file($file['tmp_name'], $targetFile)) { - return $targetFile; - } - - return null; -} - -function deleteOldImage($imageUrl) { - if ($imageUrl && strpos($imageUrl, 'assets/images/items/') === 0) { - if (file_exists($imageUrl)) { - unlink($imageUrl); - } - } -} - -// Helper to render category list HTML for AJAX -function renderCategoryList($lang) { - $categories = db()->query("SELECT * FROM categories ORDER BY name_en ASC")->fetchAll(); - $html = ''; - foreach($categories as $cat) { - $html .= ' - - ' . htmlspecialchars($cat['name_en']) . '
- ' . htmlspecialchars($cat['name_ar']) . ' - - -'; - if (has_permission('edit')) { - $html .= ''; - } - if (has_permission('delete')) { - $html .= ''; - } - $html .= ''; - } - return $html; -} - -// Helper to render service list HTML for AJAX -function renderServiceList($lang) { - $services = db()->query("SELECT * FROM services ORDER BY name_en ASC")->fetchAll(); - $html = ''; - foreach($services as $svc) { - $html .= ' - - ' . htmlspecialchars($svc['name_en']) . '
- ' . htmlspecialchars($svc['name_ar']) . ' - - -'; - if (has_permission('edit')) { - $html .= ''; - } - if (has_permission('delete')) { - $html .= ''; - } - $html .= ''; - } - return $html; -} - -// Handle Actions +// Action handling if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { $action = $_POST['action']; - - // Permission mapping for actions - $required_permission = 'view'; - if (strpos($action, 'add_') === 0) $required_permission = 'add'; - if (strpos($action, 'edit_') === 0 || strpos($action, 'update_') === 0) $required_permission = 'edit'; - if (strpos($action, 'delete_') === 0) $required_permission = 'delete'; - if (!has_permission($required_permission)) { - if ($isAjax) { - header('Content-Type: application/json'); - echo json_encode(['success' => false, 'error' => 'Forbidden']); - exit; - } - header('Location: items.php?error=no_permission'); - exit; - } - - if ($action === 'add_item') { - $name_en = $_POST['name_en']; - $name_ar = $_POST['name_ar']; - $category_id = $_POST['category_id'] ?: null; - $vat_percent = $_POST['vat_percent'] ?: 0.00; - - $image_url = handleImageUpload($_FILES['image'] ?? null); - - $stmt = db()->prepare("INSERT INTO items (category_id, name_en, name_ar, image_url, vat_percent) VALUES (?, ?, ?, ?, ?)"); - $stmt->execute([$category_id, $name_en, $name_ar, $image_url, $vat_percent]); - header('Location: items.php?success=item_added'); - exit; - } elseif ($action === 'edit_item') { - $id = $_POST['id']; - $name_en = $_POST['name_en']; - $name_ar = $_POST['name_ar']; - $category_id = $_POST['category_id'] ?: null; - $vat_percent = $_POST['vat_percent'] ?: 0.00; - - // Get current image to delete it if new one is uploaded - $stmt = db()->prepare("SELECT image_url FROM items WHERE id = ?"); - $stmt->execute([$id]); - $currentItem = $stmt->fetch(); - $image_url = $currentItem['image_url'] ?? null; - - $new_image = handleImageUpload($_FILES['image'] ?? null); - if ($new_image) { - deleteOldImage($image_url); - $image_url = $new_image; - } - - $stmt = db()->prepare("UPDATE items SET category_id = ?, name_en = ?, name_ar = ?, image_url = ?, vat_percent = ? WHERE id = ?"); - $stmt->execute([$category_id, $name_en, $name_ar, $image_url, $vat_percent, $id]); - header('Location: items.php?success=item_updated'); - exit; - } elseif ($action === 'delete_item') { - $id = $_POST['id']; - - // Delete image file if exists - $stmt = db()->prepare("SELECT image_url FROM items WHERE id = ?"); - $stmt->execute([$id]); - $item = $stmt->fetch(); - deleteOldImage($item['image_url'] ?? null); - - $stmt = db()->prepare("DELETE FROM items WHERE id = ?"); - $stmt->execute([$id]); - header('Location: items.php?success=item_deleted'); - exit; - } elseif ($action === 'add_category') { + if ($action === 'add_category') { $name_en = $_POST['cat_name_en']; $name_ar = $_POST['cat_name_ar']; $stmt = db()->prepare("INSERT INTO categories (name_en, name_ar) VALUES (?, ?)"); $stmt->execute([$name_en, $name_ar]); - + if ($isAjax) { header('Content-Type: application/json'); - echo json_encode(['success' => true, 'html' => renderCategoryList($lang)]); + $categories = db()->query("SELECT * FROM categories ORDER BY name_en ASC")->fetchAll(); + ob_start(); + foreach($categories as $cat): ?> + + + + + + + + + true, 'html' => $html]); exit; } header('Location: items.php?success=category_added'); @@ -213,7 +46,20 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { if ($isAjax) { header('Content-Type: application/json'); - echo json_encode(['success' => true, 'html' => renderCategoryList($lang)]); + $categories = db()->query("SELECT * FROM categories ORDER BY name_en ASC")->fetchAll(); + ob_start(); + foreach($categories as $cat): ?> + + + + + + + + + true, 'html' => $html]); exit; } header('Location: items.php?success=category_updated'); @@ -225,11 +71,78 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { if ($isAjax) { header('Content-Type: application/json'); - echo json_encode(['success' => true, 'html' => renderCategoryList($lang)]); + $categories = db()->query("SELECT * FROM categories ORDER BY name_en ASC")->fetchAll(); + ob_start(); + foreach($categories as $cat): ?> + + + + + + + + + true, 'html' => $html]); exit; } header('Location: items.php?success=category_deleted'); exit; + } elseif ($action === 'add_item') { + $category_id = $_POST['category_id'] ?: null; + $name_en = $_POST['name_en']; + $name_ar = $_POST['name_ar']; + $vat_percent = $_POST['vat_percent'] ?: 0; + + $image_url = null; + if (isset($_FILES['image']) && $_FILES['image']['error'] === 0) { + $ext = pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION); + $filename = 'item_' . uniqid('', true) . '.' . $ext; + $upload_dir = __DIR__ . '/assets/images/items/'; + if (!is_dir($upload_dir)) mkdir($upload_dir, 0777, true); + if (move_uploaded_file($_FILES['image']['tmp_name'], $upload_dir . $filename)) { + $image_url = 'assets/images/items/' . $filename; + } + } + + $stmt = db()->prepare("INSERT INTO items (category_id, name_en, name_ar, vat_percent, image_url) VALUES (?, ?, ?, ?, ?)"); + $stmt->execute([$category_id, $name_en, $name_ar, $vat_percent, $image_url]); + header('Location: items.php?success=item_added'); + exit; + } elseif ($action === 'edit_item') { + $id = $_POST['id']; + $category_id = $_POST['category_id'] ?: null; + $name_en = $_POST['name_en']; + $name_ar = $_POST['name_ar']; + $vat_percent = $_POST['vat_percent'] ?: 0; + + $image_url = null; + if (isset($_FILES['image']) && $_FILES['image']['error'] === 0) { + $ext = pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION); + $filename = 'item_' . uniqid('', true) . '.' . $ext; + $upload_dir = __DIR__ . '/assets/images/items/'; + if (!is_dir($upload_dir)) mkdir($upload_dir, 0777, true); + if (move_uploaded_file($_FILES['image']['tmp_name'], $upload_dir . $filename)) { + $image_url = 'assets/images/items/' . $filename; + } + } + + if ($image_url) { + $stmt = db()->prepare("UPDATE items SET category_id = ?, name_en = ?, name_ar = ?, vat_percent = ?, image_url = ? WHERE id = ?"); + $stmt->execute([$category_id, $name_en, $name_ar, $vat_percent, $image_url, $id]); + } else { + $stmt = db()->prepare("UPDATE items SET category_id = ?, name_en = ?, name_ar = ?, vat_percent = ? WHERE id = ?"); + $stmt->execute([$category_id, $name_en, $name_ar, $vat_percent, $id]); + } + header('Location: items.php?success=item_updated'); + exit; + } elseif ($action === 'delete_item') { + $id = $_POST['id']; + $stmt = db()->prepare("DELETE FROM items WHERE id = ?"); + $stmt->execute([$id]); + header('Location: items.php?success=item_deleted'); + exit; } elseif ($action === 'add_service') { $name_en = $_POST['svc_name_en']; $name_ar = $_POST['svc_name_ar']; @@ -279,11 +192,29 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { $price = str_replace(',', '.', $price); // Handle comma as decimal separator $price = (float)$price; + // Determine branch_id from session (if available) + $branch_id = $_SESSION['branch_id'] ?? null; + if ($branch_id === 'all') $branch_id = null; + + // Final sanity check for branch_id to avoid FK errors if session has stale ID + if ($branch_id) { + $chk = db()->prepare("SELECT id FROM branches WHERE id = ?"); + $chk->execute([$branch_id]); + if (!$chk->fetch()) $branch_id = null; + } + try { - $stmt = db()->prepare("INSERT INTO prices (item_id, service_id, price) - VALUES (?, ?, ?) - ON DUPLICATE KEY UPDATE price = ?"); - $stmt->execute([$item_id, $service_id, $price, $price]); + if ($branch_id) { + $stmt = db()->prepare("INSERT INTO prices (item_id, service_id, price, branch_id) + VALUES (?, ?, ?, ?) + ON DUPLICATE KEY UPDATE price = ?"); + $stmt->execute([$item_id, $service_id, $price, $branch_id, $price]); + } else { + $stmt = db()->prepare("INSERT INTO prices (item_id, service_id, price) + VALUES (?, ?, ?) + ON DUPLICATE KEY UPDATE price = ?"); + $stmt->execute([$item_id, $service_id, $price, $price]); + } if ($isAjax) { header('Content-Type: application/json'); @@ -350,6 +281,22 @@ $prices = []; foreach ($prices_raw as $p) { $prices[$p['item_id']][$p['service_id']] = $p['price']; } + +function renderServiceList($lang) { + $services = db()->query("SELECT * FROM services ORDER BY name_en ASC")->fetchAll(); + ob_start(); + foreach($services as $svc): ?> + + + + + + + + +
@@ -558,15 +505,25 @@ foreach ($prices_raw as $p) {
- - +
+ - + + - + + + + + + +
+ + +
@@ -621,10 +578,11 @@ foreach ($prices_raw as $p) {
- - +
+ - + + @@ -641,80 +599,58 @@ foreach ($prices_raw as $p) { -
- - - - - - - - - - - - - -
()
- - -
- > - - - -
-
-
-
- - +
+
+ + +
+
+ +
+
+ + +
+
+ + +
- - - - - + \ No newline at end of file