diff --git a/includes/actions.php b/includes/actions.php index 5e7f9c4..68d1337 100644 --- a/includes/actions.php +++ b/includes/actions.php @@ -308,7 +308,7 @@ if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST') } } elseif ($_POST['action'] === 'edit_visit') { $id = $_POST['id'] ?? ''; - $patient_id = $_POST['patient_id'] ?? ''; + // Note: patient_id is not updated as it should be immutable $doctor_id = $_POST['doctor_id'] ?? ''; $weight = $_POST['weight'] ?? ''; $bp = $_POST['blood_pressure'] ?? ''; @@ -318,9 +318,33 @@ if (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] === 'POST') $diagnosis = $_POST['diagnosis'] ?? ''; $treatment = $_POST['treatment_plan'] ?? ''; - if ($id && $patient_id && $doctor_id) { - $stmt = $db->prepare("UPDATE visits SET patient_id = ?, doctor_id = ?, weight = ?, blood_pressure = ?, heart_rate = ?, temperature = ?, symptoms = ?, diagnosis = ?, treatment_plan = ? WHERE id = ?"); - $stmt->execute([$patient_id, $doctor_id, $weight, $bp, $hr, $temp, $symptoms, $diagnosis, $treatment, $id]); + // Check for 24h restriction + $stmtSet = $db->prepare("SELECT setting_value FROM settings WHERE setting_key = 'disable_visit_edit_24h'"); + $stmtSet->execute(); + $setting = $stmtSet->fetch(); + $disableEdit24h = ($setting && $setting['setting_value'] == '1'); + + if ($disableEdit24h && $id) { + $stmtDate = $db->prepare("SELECT visit_date FROM visits WHERE id = ?"); + $stmtDate->execute([$id]); + $visit = $stmtDate->fetch(); + + if ($visit) { + $visitDate = new DateTime($visit['visit_date']); + $now = new DateTime(); + // If more than 24 hours (86400 seconds) + if (($now->getTimestamp() - $visitDate->getTimestamp()) > 86400) { + $_SESSION['flash_message'] = __('error') . ': ' . __('disable_visit_edit_24h_desc'); + header("Location: " . $_SERVER['REQUEST_URI']); + exit; + } + } + } + + if ($id && $doctor_id) { + // Removed patient_id from UPDATE + $stmt = $db->prepare("UPDATE visits SET doctor_id = ?, weight = ?, blood_pressure = ?, heart_rate = ?, temperature = ?, symptoms = ?, diagnosis = ?, treatment_plan = ? WHERE id = ?"); + $stmt->execute([$doctor_id, $weight, $bp, $hr, $temp, $symptoms, $diagnosis, $treatment, $id]); $stmt = $db->prepare("DELETE FROM visit_prescriptions WHERE visit_id = ?"); $stmt->execute([$id]); if (isset($_POST['prescriptions']) && is_array($_POST['prescriptions'])) { diff --git a/includes/layout/footer.php b/includes/layout/footer.php index c80cd48..2563002 100644 --- a/includes/layout/footer.php +++ b/includes/layout/footer.php @@ -1073,10 +1073,15 @@ + +