update install
This commit is contained in:
Flatlogic Bot
parent
a232fc60a3
commit
4fb5c927e3
@ -15,14 +15,15 @@ if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST') {
|
||||
if ($action === 'create_user') {
|
||||
$username = trim($_POST['username'] ?? '');
|
||||
$password = $_POST['password'] ?? '';
|
||||
$role = $_POST['role'] ?? 'admin';
|
||||
|
||||
if ($username === '' || $password === '') {
|
||||
$error = qh_t('Username and password are required.', 'اسم المستخدم وكلمة المرور مطلوبان.');
|
||||
} else {
|
||||
try {
|
||||
$hash = password_hash($password, PASSWORD_DEFAULT);
|
||||
$stmt = $pdo->prepare("INSERT INTO users (username, password) VALUES (:username, :password)");
|
||||
$stmt->execute(['username' => $username, 'password' => $hash]);
|
||||
$stmt = $pdo->prepare("INSERT INTO users (username, password, role) VALUES (:username, :password, :role)");
|
||||
$stmt->execute(['username' => $username, 'password' => $hash, 'role' => $role]);
|
||||
$success = qh_t('User created successfully.', 'تم إنشاء المستخدم بنجاح.');
|
||||
} catch (PDOException $e) {
|
||||
if ($e->getCode() == 23000) {
|
||||
@ -36,6 +37,7 @@ if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST') {
|
||||
$id = (int)($_POST['id'] ?? 0);
|
||||
$username = trim($_POST['username'] ?? '');
|
||||
$password = $_POST['password'] ?? '';
|
||||
$role = $_POST['role'] ?? 'admin';
|
||||
|
||||
if ($id <= 0 || $username === '') {
|
||||
$error = qh_t('Invalid user data.', 'بيانات المستخدم غير صالحة.');
|
||||
@ -43,11 +45,11 @@ if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST') {
|
||||
try {
|
||||
if ($password !== '') {
|
||||
$hash = password_hash($password, PASSWORD_DEFAULT);
|
||||
$stmt = $pdo->prepare("UPDATE users SET username = :username, password = :password WHERE id = :id");
|
||||
$stmt->execute(['username' => $username, 'password' => $hash, 'id' => $id]);
|
||||
$stmt = $pdo->prepare("UPDATE users SET username = :username, password = :password, role = :role WHERE id = :id");
|
||||
$stmt->execute(['username' => $username, 'password' => $hash, 'role' => $role, 'id' => $id]);
|
||||
} else {
|
||||
$stmt = $pdo->prepare("UPDATE users SET username = :username WHERE id = :id");
|
||||
$stmt->execute(['username' => $username, 'id' => $id]);
|
||||
$stmt = $pdo->prepare("UPDATE users SET username = :username, role = :role WHERE id = :id");
|
||||
$stmt->execute(['username' => $username, 'role' => $role, 'id' => $id]);
|
||||
}
|
||||
$success = qh_t('User updated successfully.', 'تم تحديث المستخدم بنجاح.');
|
||||
} catch (PDOException $e) {
|
||||
@ -74,10 +76,13 @@ if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST') {
|
||||
}
|
||||
|
||||
try {
|
||||
$users = $pdo->query("SELECT id, username, created_at FROM users ORDER BY id ASC")->fetchAll();
|
||||
$users = $pdo->query("SELECT id, username, role, created_at FROM users ORDER BY id ASC")->fetchAll();
|
||||
} catch (PDOException $e) {
|
||||
if ($e->getCode() == '42S02') {
|
||||
$pdo->exec("CREATE TABLE IF NOT EXISTS users (id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY, username VARCHAR(50) NOT NULL UNIQUE, password VARCHAR(255) NOT NULL, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci");
|
||||
if (str_contains($e->getMessage(), "Unknown column 'role'")) {
|
||||
$pdo->exec("ALTER TABLE users ADD COLUMN role VARCHAR(20) DEFAULT 'admin'");
|
||||
$users = $pdo->query("SELECT id, username, role, created_at FROM users ORDER BY id ASC")->fetchAll();
|
||||
} elseif ($e->getCode() == '42S02') {
|
||||
$pdo->exec("CREATE TABLE IF NOT EXISTS users (id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY, username VARCHAR(50) NOT NULL UNIQUE, password VARCHAR(255) NOT NULL, role VARCHAR(20) DEFAULT 'admin', created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci");
|
||||
$users = [];
|
||||
$error = qh_t('Users table was missing and has been created.', 'كان جدول المستخدمين مفقوداً وتم إنشاؤه.');
|
||||
} else {
|
||||
@ -86,6 +91,13 @@ try {
|
||||
}
|
||||
$stats = qh_admin_stats();
|
||||
|
||||
$roles = [
|
||||
'admin' => qh_t('Admin', 'مدير'),
|
||||
'reception' => qh_t('Reception', 'استقبال'),
|
||||
'nursing' => qh_t('Nursing', 'تمريض'),
|
||||
'doctor' => qh_t('Doctor', 'طبيب'),
|
||||
];
|
||||
|
||||
qh_page_start(
|
||||
'admin',
|
||||
qh_t('System Users', 'مستخدمو النظام'),
|
||||
@ -125,6 +137,7 @@ qh_page_start(
|
||||
<tr>
|
||||
<th scope="col" class="px-4 py-3">ID</th>
|
||||
<th scope="col" class="px-4 py-3"><?= qh_h(qh_t('Username', 'اسم المستخدم')) ?></th>
|
||||
<th scope="col" class="px-4 py-3"><?= qh_h(qh_t('Role / Permissions', 'الدور / الصلاحيات')) ?></th>
|
||||
<th scope="col" class="px-4 py-3"><?= qh_h(qh_t('Created At', 'تاريخ الإنشاء')) ?></th>
|
||||
<th scope="col" class="px-4 py-3 text-end"><?= qh_h(qh_t('Actions', 'الإجراءات')) ?></th>
|
||||
</tr>
|
||||
@ -134,13 +147,17 @@ qh_page_start(
|
||||
<tr>
|
||||
<td class="px-4 py-3 text-muted">#<?= qh_h((string)$user['id']) ?></td>
|
||||
<td class="px-4 py-3 fw-medium text-gray-900"><?= qh_h($user['username']) ?></td>
|
||||
<td class="px-4 py-3">
|
||||
<span class="badge bg-secondary"><?= qh_h($roles[$user['role']] ?? $user['role']) ?></span>
|
||||
</td>
|
||||
<td class="px-4 py-3 text-muted"><?= qh_h($user['created_at']) ?></td>
|
||||
<td class="px-4 py-3 text-end">
|
||||
<button type="button" class="btn btn-sm btn-outline-secondary me-2"
|
||||
data-bs-toggle="modal"
|
||||
data-bs-target="#editUserModal"
|
||||
data-id="<?= qh_h((string)$user['id']) ?>"
|
||||
data-username="<?= qh_h($user['username']) ?>">
|
||||
data-username="<?= qh_h($user['username']) ?>"
|
||||
data-role="<?= qh_h($user['role'] ?? 'admin') ?>">
|
||||
<?= qh_h(qh_t('Edit', 'تعديل')) ?>
|
||||
</button>
|
||||
<?php if (count($users) > 1): ?>
|
||||
@ -157,7 +174,7 @@ qh_page_start(
|
||||
<?php endforeach; ?>
|
||||
<?php if (empty($users)): ?>
|
||||
<tr>
|
||||
<td colspan="4" class="px-4 py-4 text-center text-muted">
|
||||
<td colspan="5" class="px-4 py-4 text-center text-muted">
|
||||
<?= qh_h(qh_t('No users found.', 'لا يوجد مستخدمين.')) ?>
|
||||
</td>
|
||||
</tr>
|
||||
@ -186,6 +203,14 @@ qh_page_start(
|
||||
<label class="form-label text-muted small fw-bold text-uppercase"><?= qh_h(qh_t('Username', 'اسم المستخدم')) ?></label>
|
||||
<input type="text" name="username" class="form-control form-control-lg bg-light" required>
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<label class="form-label text-muted small fw-bold text-uppercase"><?= qh_h(qh_t('Role / Permissions', 'الدور / الصلاحيات')) ?></label>
|
||||
<select name="role" class="form-select form-select-lg bg-light" required>
|
||||
<?php foreach ($roles as $key => $label): ?>
|
||||
<option value="<?= qh_h($key) ?>"><?= qh_h($label) ?></option>
|
||||
<?php endforeach; ?>
|
||||
</select>
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<label class="form-label text-muted small fw-bold text-uppercase"><?= qh_h(qh_t('Password', 'كلمة المرور')) ?></label>
|
||||
<input type="password" name="password" class="form-control form-control-lg bg-light" required>
|
||||
@ -216,6 +241,14 @@ qh_page_start(
|
||||
<label class="form-label text-muted small fw-bold text-uppercase"><?= qh_h(qh_t('Username', 'اسم المستخدم')) ?></label>
|
||||
<input type="text" name="username" id="editUserUsername" class="form-control form-control-lg bg-light" required>
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<label class="form-label text-muted small fw-bold text-uppercase"><?= qh_h(qh_t('Role / Permissions', 'الدور / الصلاحيات')) ?></label>
|
||||
<select name="role" id="editUserRole" class="form-select form-select-lg bg-light" required>
|
||||
<?php foreach ($roles as $key => $label): ?>
|
||||
<option value="<?= qh_h($key) ?>"><?= qh_h($label) ?></option>
|
||||
<?php endforeach; ?>
|
||||
</select>
|
||||
</div>
|
||||
<div class="mb-3">
|
||||
<label class="form-label text-muted small fw-bold text-uppercase"><?= qh_h(qh_t('New Password (Optional)', 'كلمة مرور جديدة (اختياري)')) ?></label>
|
||||
<input type="password" name="password" class="form-control form-control-lg bg-light" placeholder="<?= qh_h(qh_t('Leave blank to keep current password', 'اتركه فارغاً للاحتفاظ بكلمة المرور الحالية')) ?>">
|
||||
@ -238,9 +271,15 @@ document.addEventListener('DOMContentLoaded', function () {
|
||||
const button = event.relatedTarget;
|
||||
const id = button.getAttribute('data-id');
|
||||
const username = button.getAttribute('data-username');
|
||||
const role = button.getAttribute('data-role');
|
||||
|
||||
editModal.querySelector('#editUserId').value = id;
|
||||
editModal.querySelector('#editUserUsername').value = username;
|
||||
|
||||
const roleSelect = editModal.querySelector('#editUserRole');
|
||||
if (roleSelect && role) {
|
||||
roleSelect.value = role;
|
||||
}
|
||||
});
|
||||
}
|
||||
});
|
||||
|
||||
@ -23,7 +23,6 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
||||
try {
|
||||
$pdo = new PDO("mysql:host=$dbHost;dbname=$dbName;charset=utf8mb4", $dbUser, $dbPass, [PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION]);
|
||||
|
||||
|
||||
// Rewrite db/config.php
|
||||
$configContent = "<?php\n" .
|
||||
"define('DB_HOST', '$dbHost');\n" .
|
||||
@ -33,8 +32,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
||||
"function db() {\n" .
|
||||
" static \$pdo;\n" .
|
||||
" if (!\$pdo) {\n" .
|
||||
" \$pdo = new PDO('mysql:host=".DB_HOST.";dbname=".DB_NAME.";charset=utf8mb4', DB_USER, DB_PASS, [
|
||||
" .
|
||||
" \$pdo = new PDO('mysql:host=' . DB_HOST . ';dbname=' . DB_NAME . ';charset=utf8mb4', DB_USER, DB_PASS, [\n" .
|
||||
" PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,\n" .
|
||||
" PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,\n" .
|
||||
" ]);\n" .
|
||||
|
||||
@ -16,13 +16,14 @@ if (($_SERVER['REQUEST_METHOD'] ?? 'GET') === 'POST') {
|
||||
$error = qh_t('Please enter your username and password.', 'يرجى إدخال اسم المستخدم وكلمة المرور.');
|
||||
} else {
|
||||
try {
|
||||
$stmt = db()->prepare("SELECT id, password FROM users WHERE username = :username LIMIT 1");
|
||||
$stmt = db()->prepare("SELECT id, password, role FROM users WHERE username = :username LIMIT 1");
|
||||
$stmt->execute(['username' => $username]);
|
||||
$user = $stmt->fetch();
|
||||
|
||||
if ($user && password_verify($password, $user['password'])) {
|
||||
$_SESSION['user_id'] = (int) $user['id'];
|
||||
$_SESSION['username'] = $username;
|
||||
$_SESSION['role'] = $user['role'] ?? 'admin';
|
||||
qh_redirect('index.php');
|
||||
} else {
|
||||
$error = qh_t('Invalid username or password.', 'اسم المستخدم أو كلمة المرور غير صحيحة.');
|
||||
|
||||
@ -15,6 +15,25 @@ if (file_exists(__DIR__ . "/.installed") && !in_array($currentPage, $publicPages
|
||||
header("Location: login.php");
|
||||
exit;
|
||||
}
|
||||
|
||||
$role = $_SESSION["role"] ?? "admin";
|
||||
$allowed = false;
|
||||
if ($role === "admin") {
|
||||
$allowed = true;
|
||||
} elseif ($currentPage === "index.php") {
|
||||
$allowed = true;
|
||||
} elseif ($role === "reception" && $currentPage === "reception.php") {
|
||||
$allowed = true;
|
||||
} elseif ($role === "nursing" && $currentPage === "nursing.php") {
|
||||
$allowed = true;
|
||||
} elseif ($role === "doctor" && $currentPage === "doctor.php") {
|
||||
$allowed = true;
|
||||
}
|
||||
|
||||
if (!$allowed) {
|
||||
header("Location: index.php");
|
||||
exit;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@ -109,6 +128,9 @@ SQL;
|
||||
try { db()->exec("ALTER TABLE hospital_profile_settings ADD COLUMN default_language VARCHAR(10) DEFAULT 'en'"); } catch (\Throwable $e) {}
|
||||
}
|
||||
|
||||
try { db()->exec("CREATE TABLE IF NOT EXISTS users (id INT UNSIGNED AUTO_INCREMENT PRIMARY KEY, username VARCHAR(50) NOT NULL UNIQUE, password VARCHAR(255) NOT NULL, role VARCHAR(20) DEFAULT 'admin', created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci"); } catch (\Throwable $e) {}
|
||||
try { db()->exec("ALTER TABLE users ADD COLUMN role VARCHAR(20) DEFAULT 'admin'"); } catch (\Throwable $e) {}
|
||||
|
||||
function qh_seed_demo_data(): void
|
||||
{
|
||||
$pdo = db();
|
||||
@ -1014,7 +1036,7 @@ function qh_admin_handle_request(): void
|
||||
}
|
||||
|
||||
$action = trim((string) ($_POST['action'] ?? ''));
|
||||
if ($action === '' || in_array($action, ['add_video', 'delete_video', 'toggle_status', 'add_news', 'delete_news', 'toggle_news_status'])) {
|
||||
if ($action === '' || in_array($action, ['add_video', 'delete_video', 'toggle_status', 'add_news', 'delete_news', 'toggle_news_status', 'create_user', 'update_user', 'delete_user'])) {
|
||||
return;
|
||||
}
|
||||
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user