archives/FHeD
1
0
Fork 0
Code Issues Pull Requests Actions Packages Releases 40 Activity

🎨 Move SQL functions to prereqs.php for easy reuse

Browse Source 
Signed-off-by: Luke Tainton <luke@tainton.uk>
This commit is contained in:
Luke Tainton
2020-08-09 15:23:29 +01:00
parent 1f59131dc0
commit 5b3a49cf43
9 changed files with 127 additions and 301 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
app/public/actions/upload.php
View File

@@ -1,29 +1,10 @@
<?php
$PAGE_NAME = "Upload file to request";
require_once __DIR__ . "/../../includes/header.php";
// Get authorised subscribers
try {
$users_stmt = "SELECT user_uuid FROM ticket_subscribers WHERE ticket_uuid=:uuid";
$users_sql = $db->prepare($users_stmt);
$users_sql->bindParam(':uuid', $_GET['rid']);
$users_sql->execute();
$users_sql->setFetchMode(PDO::FETCH_ASSOC);
$users_result = $users_sql->fetchAll();
} catch (PDOException $e) {
$new_ticket_alert = array("danger", "Failed to get subscribers: " . $e->getMessage());
}
$authorised_users = array();
foreach($users_result as $user) {
array_push($authorised_users, $user['user_uuid']);
}
if (in_array($_SESSION['uuid'], $authorised_users) || $_SESSION['uuid'] == $request['created_by']) {
$is_authorised = true;
} else {
$is_authorised = false;
}
$request = get_request($db, $_POST['rid']);
$authorised_users = get_subscribers($db, $request);
$is_authorised = isAuthorised($authorised_users, $request);
// If form submitted, save to database
if($_SERVER['REQUEST_METHOD'] == 'POST') {
@@ -39,18 +20,18 @@
$stmt = "INSERT INTO ticket_uploads (id, ticket, user, filename) VALUES (:fileuuid, :ticket, :user, :name)";
$sql = $db->prepare($stmt);
$sql->bindParam(':fileuuid', $file_uuid);
$sql->bindParam(':ticket', $_POST['rid']);
$sql->bindParam(':ticket', $request['uuid']);
$sql->bindParam(':user', $_SESSION['uuid']);
$sql->bindParam(':name', $file_name);
$sql->execute();
} catch (PDOException $e) {
$new_ticket_alert = array("danger", "Failed to upload file: " . $e->getMessage());
}
header('Location: /view?rid=' . $_POST['rid'], true);
header('Location: /view?rid=' . $request['uuid'], true);
}
} else {
$new_ticket_alert = array("danger", "You are not authorised to update this request.");
header('Location: /view?rid=' . $_POST['rid'], true);
header('Location: /view?rid=' . $request['uuid'], true);
}
}