diff --git a/includes/dotenv.php b/includes/dotenv.php index b1af16a..661cce7 100644 --- a/includes/dotenv.php +++ b/includes/dotenv.php @@ -20,7 +20,7 @@ function load_dotenv(): void { [$k, $v] = array_map('trim', explode('=', $line, 2)); if ($k === '') continue; - // Strip potential surrounding quotes + // Strip potential surrounding quotes (single or double) $v = trim($v, "' "); // Set env if not already set or if empty @@ -36,5 +36,4 @@ function load_dotenv(): void { } // Auto-load on include -load_dotenv(); - +load_dotenv(); \ No newline at end of file diff --git a/items.php b/items.php index f6c032b..3955f30 100644 --- a/items.php +++ b/items.php @@ -3,8 +3,10 @@ require_once __DIR__ . '/db/config.php'; require_once __DIR__ . '/includes/lang.php'; +$isAjax = isset($_POST['ajax']) || (isset($_SERVER['HTTP_X_REQUESTED_WITH']) && $_SERVER['HTTP_X_REQUESTED_WITH'] === 'XMLHttpRequest'); + if (!isset($_SESSION['user_id'])) { - if (isset($_POST['ajax'])) { + if ($isAjax) { header('Content-Type: application/json'); echo json_encode(['success' => false, 'error' => 'Unauthorized']); exit; @@ -15,7 +17,7 @@ if (!isset($_SESSION['user_id'])) { // Initial view check if (!has_permission('view')) { - if (isset($_POST['ajax'])) { + if ($isAjax) { header('Content-Type: application/json'); echo json_encode(['success' => false, 'error' => 'Forbidden']); exit; @@ -124,7 +126,6 @@ function renderServiceList($lang) { // Handle Actions if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { $action = $_POST['action']; - $isAjax = isset($_POST['ajax']); // Permission mapping for actions $required_permission = 'view'; @@ -278,7 +279,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { ON DUPLICATE KEY UPDATE price = ?"); $stmt->execute([$item_id, $service_id, $price, $price]); - if (isset($_POST['ajax'])) { + if ($isAjax) { header('Content-Type: application/json'); echo json_encode(['success' => true]); exit; @@ -430,8 +431,8 @@ foreach ($prices_raw as $p) {