0) {
require_permission('users', 'delete');
// Prevent deleting oneself
if ($post_id !== (int)$_SESSION['user_id']) {
$stmt = db()->prepare("DELETE FROM users WHERE id = ?");
$stmt->execute([$post_id]);
}
header('Location: ' . app_url('admin.php', ['page' => 'users']));
exit;
}
if ($post_action === 'edit' || $post_action === 'add') {
require_permission('users', $post_action === 'add' ? 'add' : 'edit');
$name = trim($_POST['name'] ?? '');
$email = trim($_POST['email'] ?? '');
$phone = trim($_POST['phone'] ?? '');
$role = $_POST['role'] ?? 'user';
if (!in_array($role, ['admin', 'user'])) {
$role = 'user';
}
$role_id = $_POST['role_id'] ?? '';
if ($role_id === '') $role_id = null;
$raw_password = $_POST['password'] ?? '';
$profile_picture = '';
$existing_password = '';
if ($post_action === 'edit' && $post_id > 0) {
$stmt = db()->prepare("SELECT profile_picture, password FROM users WHERE id = ?");
$stmt->execute([$post_id]);
$existing = $stmt->fetch(PDO::FETCH_ASSOC);
if ($existing) {
$profile_picture = $existing['profile_picture'];
$existing_password = $existing['password'];
}
}
$upload_dir = __DIR__ . '/assets/images/uploads/';
if (!is_dir($upload_dir)) {
mkdir($upload_dir, 0777, true);
}
if (!empty($_FILES['photo']['tmp_name'])) {
$filename = 'user_' . time() . '_' . basename($_FILES['photo']['name']);
$target = $upload_dir . $filename;
if (move_uploaded_file($_FILES['photo']['tmp_name'], $target)) {
$profile_picture = 'assets/images/uploads/' . $filename;
}
}
if ($post_action === 'add') {
$final_password = $raw_password ? password_hash($raw_password, PASSWORD_DEFAULT) : '';
} else {
if ($raw_password) {
$final_password = password_hash($raw_password, PASSWORD_DEFAULT);
} else {
$final_password = $existing_password;
}
}
if ($post_action === 'edit' && $post_id > 0) {
$stmt = db()->prepare("UPDATE users SET name=?, email=?, phone=?, role=?, profile_picture=?, password=?, role_id=? WHERE id=?");
$stmt->execute([$name, $email, $phone, $role, $profile_picture, $final_password, $role_id, $post_id]);
} else {
$stmt = db()->prepare("INSERT INTO users (name, email, phone, role, profile_picture, password, role_id) VALUES (?, ?, ?, ?, ?, ?, ?)");
$stmt->execute([$name, $email, $phone, $role, $profile_picture, $final_password, $role_id]);
}
header('Location: ' . app_url('admin.php', ['page' => 'users']));
exit;
}
}
$search = $_GET['search'] ?? '';
$page_num = max(1, (int)($_GET['p'] ?? 1));
$limit = 10;
$offset = ($page_num - 1) * $limit;
$where = "1=1";
$params = [];
if ($search) {
$where .= " AND (u.name LIKE ? OR u.email LIKE ?)";
$params[] = "%$search%";
$params[] = "%$search%";
}
$stmt = db()->prepare("SELECT COUNT(*) FROM users u WHERE $where");
$stmt->execute($params);
$total = $stmt->fetchColumn();
$total_pages = ceil($total / $limit);
$stmt = db()->prepare("SELECT u.*, r.name as role_name FROM users u LEFT JOIN roles r ON u.role_id = r.id WHERE $where ORDER BY u.id DESC LIMIT ? OFFSET ?");
$params[] = $limit;
$params[] = $offset;
foreach($params as $k => $v) {
$stmt->bindValue($k+1, $v, is_int($v) ? PDO::PARAM_INT : PDO::PARAM_STR);
}
$stmt->execute();
$users = $stmt->fetchAll(PDO::FETCH_ASSOC);
$stmt = db()->query("SELECT id, name FROM roles ORDER BY name ASC");
$roles_list = $stmt->fetchAll(PDO::FETCH_ASSOC);
?>
1): ?>