pcwvanbeers/assetmgt
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CM89 - contract changes

Browse Source
This commit is contained in:
“VeLiTi”
2024-09-20 14:57:11 +02:00
parent e139b91c30
commit 78cfe93dce
19 changed files with 1780 additions and 211 deletions
Download Patch File Download Diff File Expand all files Collapse all files

243
api/v2/post/contracts.php Normal file
View File

@@ -0,0 +1,243 @@
<?php
defined($security_key) or exit;
//------------------------------------------
// contracts
//------------------------------------------
//Connect to DB
$pdo = dbConnect($dbname);
//CONTENT FROM API (POST)
$post_content = json_decode($input,true);
//SoldTo is empty
if (empty($partner->soldto) || $partner->soldto == ''){$soldto_search = '%';} else {$soldto_search = '-%';}
//default whereclause
$whereclause = '';
switch ($permission) {
case '4':
$whereclause = '';
break;
case '3':
$whereclause = '';
break;
case '2':
$condition = '__salesid___'.$partner->salesid.'___soldto___'.substr($partner->soldto, 0, strpos($partner->soldto, "-")).$soldto_search;
$whereclause = ' AND accounthierarchy like "'.$condition.'"';
break;
default:
$condition = '__salesid___'.$partner->salesid.'___soldto___'.substr($partner->soldto, 0, strpos($partner->soldto, "-")).$soldto_search.'___shipto___'.substr($partner->shipto, 0, strpos($partner->shipto, "-")).'%___location___'.substr($partner->location, 0, strpos($partner->location, "-")).'%';
$whereclause = ' AND accounthierarchy like "'.$condition.'"';
break;
}
//SET PARAMETERS FOR QUERY
$id = $post_content['rowID'] ?? ''; //check for rowID
$command = ($id == '')? 'insert' : 'update'; //IF rowID = empty then INSERT
if (isset($post_content['delete'])){$command = 'delete';} //change command to delete
$date = date('Y-m-d H:i:s');
//CREATE EMPTY STRINGS
$clause = '';
$clause_insert ='';
$input_insert = '';
//remove blanks from array
if (isset($post_content['servicetool'])){
$post_content['servicetool'] = array_map('trim', $post_content['servicetool']);
$post_content['servicetool'] = array_filter($post_content['servicetool'], 'strlen');
}
if (isset($post_content['assigned_users'])){
$post_content['assigned_users'] = array_map('trim', $post_content['assigned_users']);
$post_content['assigned_users'] = array_filter($post_content['assigned_users'], 'strlen');
}
if ($id != ''){
//DEFINE ACCOUNTHIERARCHY
$stmt = $pdo->prepare('SELECT * FROM contracts WHERE rowID = ?');
$stmt->execute([$id]);
$contract_data = $stmt->fetch();
$contract_old = json_decode($contract_data['accounthierarchy']);
$salesid_new = (($post_content['salesid'] != '' && $post_content['salesid'] != $contract_old->salesid)? $post_content['salesid'] : $contract_old->salesid);
$soldto_new = (($post_content['soldto'] != '' && $post_content['soldto'] != $contract_old->soldto)? $post_content['soldto'] : $contract_old->soldto);
$shipto_new = (($post_content['shipto'] != '' && $post_content['shipto'] != $contract_old->shipto)? $post_content['shipto'] : $contract_old->shipto);
$location_new = (($post_content['location'] != '' && $post_content['location'] != $contract_old->location)? $post_content['location'] : $contract_old->location);
if ($permission == 4){
//ADMIN+ ONLY ARE ALLOWED TO CHANGE SALES AND SOLD
$account = array(
"salesid"=>$salesid_new,
"soldto"=>$soldto_new,
"shipto"=>$shipto_new,
"location"=>$location_new
);
}
elseif ($permission == 3) {
//ADMIN ONLY ARE ALLOWED TO CHANGE SOLD
$account = array(
"salesid"=>$contract_old->salesid,
"soldto"=>$soldto_new,
"shipto"=>$shipto_new,
"location"=>$location_new
);
}
else {
$account = array(
"salesid"=>$contract_old->salesid,
"soldto"=>$contract_old->soldto,
"shipto"=>$shipto_new,
"location"=>$location_new
);
}
//CHECK FOR CHANGES IN ASSIGNED_USERS
if (isset($post_content['assigned_users'])){
$assigned_users_current = json_decode($contract_data['assigned_users'],true);
$assigned_users_new = $post_content['assigned_users'];
// Find deleted items (items in current but not in new)
$deletedItems = array_diff($assigned_users_current, $assigned_users_new);
// Find added items (items in new but not in current)
$addedItems = array_diff($assigned_users_new, $assigned_users_current);
//When deleted items are found
if (!empty($deletedItems)){
foreach ($deletedItems as $item){
//CALL TO API FOR General information
$api_url = '/v2/users/username='.$item;
$responses = ioApi($api_url,'',$clientsecret);
if (!empty($responses)){
$response = json_decode($responses,true);
//If response is not null update the service flag of the user
if (count($response) != 0){
$id_removed_user = $response[0]['id'];
//Remove serviceflag from user
$sql = 'UPDATE users SET service = "" WHERE id = ? ';
$stmt = $pdo->prepare($sql);
$stmt->execute([$id_removed_user]);
}
}
}
}
}
}
else {
//ID is empty => INSERT / NEW RECORD
if ($permission == 4){
$account = array(
"salesid"=>$post_content['salesid'],
"soldto"=>$post_content['soldto'],
"shipto"=>$post_content['shipto'],
"location"=>$post_content['location']
);
}
elseif ($permission == 3){
$account = array(
"salesid"=>$partner->salesid,
"soldto"=>$post_content['soldto'],
"shipto"=>$post_content['shipto'],
"location"=>$post_content['location']
);
}else {
$account = array(
"salesid"=>$partner->salesid,
"soldto"=>$partner->soldto,
"shipto"=>$post_content['shipto'],
"location"=>$post_content['location']
);
}
}
// CREATE ACCOUNTHIERARCHY JSON FROM ACCOUNT ARRAY
$post_content['accounthierarchy'] = json_encode($account, JSON_UNESCAPED_UNICODE);
if ($command == 'insert' && !isset($post_content['delete'])){
$post_content['created'] = $date;
$post_content['createdby'] = $username;
}
//remove blanks from array
if (isset($post_content['servicetool'])){
$post_content['servicetool'] = json_encode($post_content['servicetool'], JSON_UNESCAPED_UNICODE);
}
if (isset($post_content['assigned_users'])){
//Check for all users in array if exist then update service or create
foreach ($post_content['assigned_users'] as $user_assigned){
//CALL TO API FOR General information
$responses = ioApi('/v2/users/username='.$user_assigned,'',$clientsecret);
if (!empty($responses)){
$response = json_decode($responses,true);
//If response is not null update the service flag of the user
if (count($response) != 0){
$id_exist_user = $response[0]['id'];
$generate_service = bin2hex(random_bytes(25));
//Remove serviceflag from user
$sql = 'UPDATE users SET service = ? WHERE id = ? ';
$stmt = $pdo->prepare($sql);
$stmt->execute([$generate_service,$id_exist_user]);
} else {
//Decode the account structure of the contract and create user
$ah_array = json_decode($post_content['accounthierarchy'],true);
$data = json_encode(array("username" => $user_assigned, "email"=> $user_assigned,"view" => 2 ,"settings"=>"service","service"=> 1,"userkey"=> 1, "salesid" => $ah_array['salesid'], "soldto" => $ah_array['soldto'],"shipto" => $ah_array['shipto'],"location" => $ah_array['location']), JSON_UNESCAPED_UNICODE);
//call the API to create user
ioApi('/v2/users',$data,$clientsecret);
}
}
}
// UPDATE TO JSON
$post_content['assigned_users'] = json_encode($post_content['assigned_users'], JSON_UNESCAPED_UNICODE);
}
//CREATE NEW ARRAY AND MAP TO CLAUSE
if(isset($post_content) && $post_content!=''){
foreach ($post_content as $key => $var){
if ($key == 'submit' || $key == 'delete' || $key == 'rowID'|| $key == 'id' || str_contains($key, 'old_')|| $key == 'salesid' || $key == 'soldto' || $key == 'shipto' || $key == 'location'){
//do nothing
}
else {
$criterias[$key] = $var;
$clause .= ' , '.$key.' = ?';
$clause_insert .= ' , '.$key.'';
$input_insert .= ', ?'; // ? for each insert item
$execute_input[]= $var; // Build array for input
}
}
}
//CLEAN UP INPUT
$clause = substr($clause, 2); //Clean clause - remove first comma
$clause_insert = substr($clause_insert, 2); //Clean clause - remove first comma
$input_insert = substr($input_insert, 1); //Clean clause - remove first comma
//QUERY AND VERIFY ALLOWED
if ($command == 'update' && !isset($post_content['delete']) && isAllowed('contract',$profile,$permission,'U') === 1){
$sql = 'UPDATE contracts SET '.$clause.' WHERE rowID = ? '.$whereclause.'';
$execute_input[] = $id;
$stmt = $pdo->prepare($sql);
$stmt->execute($execute_input);
}
elseif ($command == 'insert' && !isset($post_content['delete']) && isAllowed('contract',$profile,$permission,'C') === 1){
$sql = 'INSERT INTO contracts ('.$clause_insert.') VALUES ('.$input_insert.')';
$stmt = $pdo->prepare($sql);
$stmt->execute($execute_input);
}
elseif ($command == 'delete' && isAllowed('contract',$profile,$permission,'D') === 1){
$stmt = $pdo->prepare('DELETE FROM contracts WHERE rowID = ? '.$whereclause.'');
$stmt->execute([ $id ]);
//Add deletion to changelog
changelog($dbname,'contracts',$id,'Delete','Delete',$username);
} else
{
//do nothing
}
?>

248
api/v2/post/equipments.php Normal file
View File

@@ -0,0 +1,248 @@
<?php
defined($security_key) or exit;
//------------------------------------------
// equipments
//------------------------------------------
//Connect to DB
$pdo = dbConnect($dbname);
//CONTENT FROM API (POST)
$post_content = json_decode($input,true);
//SoldTo is empty
if (empty($partner->soldto) || $partner->soldto == ''){$soldto_search = '%';} else {$soldto_search = '-%';}
//default whereclause
$whereclause = '';
switch ($permission) {
case '4':
$whereclause = '';
break;
case '3':
$whereclause = '';
break;
case '2':
$condition = '__salesid___'.$partner->salesid.'___soldto___'.substr($partner->soldto, 0, strpos($partner->soldto, "-")).$soldto_search;
$whereclause = ' AND accounthierarchy like "'.$condition.'"';
break;
default:
$condition = '__salesid___'.$partner->salesid.'___soldto___'.substr($partner->soldto, 0, strpos($partner->soldto, "-")).$soldto_search.'___shipto___'.substr($partner->shipto, 0, strpos($partner->shipto, "-")).'%___location___'.substr($partner->location, 0, strpos($partner->location, "-")).'%';
$whereclause = ' AND accounthierarchy like "'.$condition.'"';
break;
}
//SET PARAMETERS FOR QUERY
$id = $post_content['rowID'] ?? ''; //check for rowID
$command = ($id == '')? 'insert' : 'update'; //IF rowID = empty then INSERT
if (isset($post_content['delete'])){$command = 'delete';} //change command to delete
$date = date('Y-m-d H:i:s');
//CREATE EMPTY STRINGS
$owner_equipment = 0;
$clause = '';
$clause_insert ='';
$input_insert = '';
if ($id != ''){
//DEFINE ACCOUNTHIERARCHY
$stmt = $pdo->prepare('SELECT * FROM equipment WHERE rowID = ?');
$stmt->execute([$id]);
$equipment_data = $stmt->fetch();
$equipment_old = json_decode($equipment_data['accounthierarchy']);
$salesid_new = (($post_content['salesid'] != '' && $post_content['salesid'] != $equipment_old->salesid)? $post_content['salesid'] : $equipment_old->salesid);
$soldto_new = (($post_content['soldto'] != '' && $post_content['soldto'] != $equipment_old->soldto)? $post_content['soldto'] : $equipment_old->soldto);
$shipto_new = (($post_content['shipto'] != '' && $post_content['shipto'] != $equipment_old->shipto)? $post_content['shipto'] : $equipment_old->shipto);
$location_new = (($post_content['location'] != '' && $post_content['location'] != $equipment_old->location)? $post_content['location'] : $equipment_old->location);
$section_new = (($post_content['section'] != '' && $post_content['section'] != $equipment_old->section)? $post_content['section'] : $equipment_old->section);
$owner_equipment = (($equipment_data['createdby'] == $username)? 1 : 0);
if ($permission == 4){
//ADMIN+ ONLY ARE ALLOWED TO CHANGE SALES AND SOLD
$account = array(
"salesid"=>$salesid_new,
"soldto"=>$soldto_new,
"shipto"=>$shipto_new,
"location"=>$location_new,
"section"=>$section_new
);
}
elseif ($permission == 3) {
//ADMIN ONLY ARE ALLOWED TO CHANGE SOLD
$account = array(
"salesid"=>$equipment_old->salesid,
"soldto"=>$soldto_new,
"shipto"=>$shipto_new,
"location"=>$location_new,
"section"=>$section_new
);
}
else {
$account = array(
"salesid"=>$equipment_old->salesid,
"soldto"=>$equipment_old->soldto,
"shipto"=>$shipto_new,
"location"=>$location_new,
"section"=>$section_new
);
}
}
else {
//ID is empty => INSERT / NEW RECORD
if ($permission == 4){
$account = array(
"salesid"=>$post_content['salesid'],
"soldto"=>$post_content['soldto'],
"shipto"=>$post_content['shipto'],
"location"=>$post_content['location'],
"section"=>$post_content['section']
);
}
elseif ($permission == 3){
$account = array(
"salesid"=>$partner->salesid,
"soldto"=>$post_content['soldto'],
"shipto"=>$post_content['shipto'],
"location"=>$post_content['location'],
"section"=>$post_content['section']
);
}else {
$account = array(
"salesid"=>$partner->salesid,
"soldto"=>$partner->soldto,
"shipto"=>$post_content['shipto'],
"location"=>$post_content['location'],
"section"=>$post_content['section']
);
}
}
//CHECK IF PARTNER HAS PARTNER RECORD - IF NOT CREATE AND USE
foreach ($account as $key => $value){
if ($key != "section"){
//CHECK for id- pattern
if (empty($value) ||$value == '' || preg_match('/\-.*/',$value)){
//Do Nothing
}
else {
//No partner ID found
switch ($key) {
case 'salesid':
$p_type = 'SalesID';
break;
case 'soldto':
$p_type = 'SoldTo';
break;
case 'shipto':
$p_type = 'ShipTo';
break;
case 'location':
$p_type = 'Location';
break;
}
//Create partner and push to array account
$account[$key] = createPartner($partner->salesid,$partner->soldto,$value,$p_type,$userkey);
}
}
}
// CREATE ACCOUNTHIERARCHY JSON FROM ACCOUNT ARRAY
$accounthierarchy = json_encode($account, JSON_UNESCAPED_UNICODE);
//ADD STANDARD PARAMETERS TO ARRAY BASED ON INSERT OR UPDATE
if ($command == 'update'){
//RESET WARRANTY AND SERVICE DATES WHEN STATUS IS CHANGED TO SEND(3)
if (isset($post_content['status']) && $post_content['status'] == 3 && $equipment_data['status'] != 3)
{
$post_content['service_date'] = $date;
$post_content['warranty_date'] = $date;
}
//UPDATE CHANGELOG BASED ON STATUS CHANGE
if (isset($post_content['status']) && $post_content['status'] != $equipment_data['status'])
{
changelog($dbname,'equipment',$equipment_data['rowID'],'status',$post_content['status'],$username);
}
//UPDATE CHANGELOG BASED ON ORDER_REF change
if (isset($post_content['order_ref']) && $post_content['order_ref'] != $equipment_data['order_ref'])
{
changelog($dbname,'equipment',$equipment_data['rowID'],'order_ref',$post_content['order_ref'],$username);
}
$post_content['accounthierarchy'] = $accounthierarchy;
//CHECK for special permissions
if (isAllowed('equipment_manage_edit',$profile,$permission,'U') === 0 && $owner_equipment === 0 ){
$post_content['status'] = $equipment_data['status'];
$post_content['serialnumber'] = $equipment_data['serialnumber'];
$post_content['service_date'] = $equipment_data['service_date'];
$post_content['warranty_date'] = $equipment_data['warranty_date'];
}
}
elseif ($command == 'insert'){
$post_content['created'] = $date;
$post_content['createdby'] = $username;
$post_content['accounthierarchy'] = $accounthierarchy;
$post_content['service_date'] = $date;
$post_content['warranty_date'] = $date;
}
else {
//do nothing
}
//CREAT NEW ARRAY AND MAP TO CLAUSE
if(isset($post_content) && $post_content!=''){
foreach ($post_content as $key => $var){
if ($key == 'submit' || $key == 'rowID' || str_contains($key, 'old_') || $key == 'salesid' || $key == 'soldto' || $key == 'shipto' || $key == 'location' || $key == 'section' || str_contains($key, 'productcode') || str_contains($key, 'productname')){
//do nothing
}
else {
$criterias[$key] = $var;
$clause .= ' , '.$key.' = ?';
$clause_insert .= ' , '.$key.'';
$input_insert .= ', ?'; // ? for each insert item
$execute_input[]= $var; // Build array for input
}
}
}
//CLEAN UP INPUT
$clause = substr($clause, 2); //Clean clause - remove first comma
$clause_insert = substr($clause_insert, 2); //Clean clause - remove first comma
$input_insert = substr($input_insert, 1); //Clean clause - remove first comma
//QUERY AND VERIFY ALLOWED
if ($command == 'update' && (isAllowed('equipment_manage',$profile,$permission,'U') === 1 || isAllowed('equipments_mass_update',$profile,$permission,'U') === 1 || $owner_equipment === 1)){
$sql = 'UPDATE equipment SET '.$clause.' WHERE rowID = ? '.$whereclause.'';
$execute_input[] = $id;
$stmt = $pdo->prepare($sql);
$stmt->execute($execute_input);
}
elseif ($command == 'insert' && isAllowed('equipment_manage',$profile,$permission,'C') === 1){
$sql = 'INSERT INTO equipment ('.$clause_insert.') VALUES ('.$input_insert.')';
$stmt = $pdo->prepare($sql);
$stmt->execute($execute_input);
}
elseif ($command == 'delete' && (isAllowed('equipment_manage',$profile,$permission,'D') === 1 || $owner_equipment === 1)){
//delete equipment
$stmt = $pdo->prepare('DELETE FROM equipment WHERE rowID = ? '.$whereclause.'');
$stmt->execute([ $id ]);
//delete history related to equipment
$stmt = $pdo->prepare('DELETE FROM history WHERE equipmentid = ?');
$stmt->execute([ $id ]);
//Add deletion to changelog
changelog($dbname,'equipment',$id,'Delete','Delete',$username);
} else
{
//do nothing
}
?>

279
api/v2/post/users.php Normal file
View File

@@ -0,0 +1,279 @@
<?php
defined($security_key) or exit;
//------------------------------------------
// users
//------------------------------------------
//Connect to DB
$pdo = dbConnect($dbname);
//CONTENT FROM API (POST)
$post_content = json_decode($input,true);
$owner_user = 0;
//SoldTo is empty
if (empty($partner->soldto) || $partner->soldto == ''){$soldto_search = '%';} else {$soldto_search = '-%';}
//default whereclause to check if data is owned by user
$whereclause = '';
switch ($permission) {
case '4':
$whereclause = '';
break;
case '3':
$whereclause = '';
break;
case '2':
$condition = '__salesid___'.$partner->salesid.'___soldto___'.substr($partner->soldto, 0, strpos($partner->soldto, "-")).$soldto_search;
$whereclause = ' AND partnerhierarchy like "'.$condition.'"';
break;
default:
$condition = '__salesid___'.$partner->salesid.'___soldto___'.substr($partner->soldto, 0, strpos($partner->soldto, "-")).$soldto_search.'___shipto___'.substr($partner->shipto, 0, strpos($partner->shipto, "-")).'%___location___'.substr($partner->location, 0, strpos($partner->location, "-")).'%';
$whereclause = ' AND partnerhierarchy like "'.$condition.'"';
break;
}
//SET PARAMETERS FOR QUERY
$id = (isset($post_content['id'])) ? $post_content['id']: ''; //check for rowID
$command = ($id == '')? 'insert' : 'update'; //IF rowID = empty then INSERT
if (isset($post_content['delete'])){$command = 'delete';} //change command to delete
if (isset($post_content['reset'])){$command = 'reset';} //change command to reset
$date = date('Y-m-d H:i:s');
//CREATE EMPTY STRINGS
$clause = '';
$clause_insert ='';
$input_insert = '';
//GET EXISTING USER DATA
if ($id != '' && $command != 'reset'){
//Define Query
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$id]);
$user_data = $stmt->fetch();
$owner_user = (($user_data['username'] == $username)? 1 : 0);
$user_name_old = $user_data['username'];
$view_old = $user_data['view'];
$partnerhierarchy_old = json_decode($user_data['partnerhierarchy']);
$salesid_new = ((isset($post_content['salesid']) && $post_content['salesid'] != '' && $post_content['salesid'] != $partnerhierarchy_old->salesid)? $post_content['salesid'] : $partnerhierarchy_old->salesid);
$soldto_new = ((isset($post_content['soldto']) && $post_content['soldto'] != '' && $post_content['soldto'] != $partnerhierarchy_old->soldto)? $post_content['soldto'] : $partnerhierarchy_old->soldto);
$shipto_new = (($post_content['shipto'] != '' && $post_content['shipto'] != $partnerhierarchy_old->shipto)? $post_content['shipto'] : $partnerhierarchy_old->shipto);
$location_new = (($post_content['location'] != '' && $post_content['location'] != $partnerhierarchy_old->location)? $post_content['location'] : $partnerhierarchy_old->location);
if ($permission == 4){
//ADMIN+ ONLY ARE ALLOWED TO CHANGE SALES AND SOLD
$account = array(
"salesid"=>$salesid_new,
"soldto"=>$soldto_new,
"shipto"=>$shipto_new,
"location"=>$location_new
);
}elseif ($permission == 3) {
//ADMIN ONLY ARE ALLOWED TO CHANGE SOLD
$account = array(
"salesid"=>$partner->salesid,
"soldto"=>$soldto_new,
"shipto"=>$shipto_new,
"location"=>$location_new
);
}
else {
$account = array(
"salesid"=>$partner->salesid,
"soldto"=>$partner->soldto,
"shipto"=>$shipto_new,
"location"=>$location_new
);
}
} elseif ($command == 'insert') {
//ID is empty => INSERT / NEW RECORD
if ($permission == 4){
//ADMIN+ ONLY ARE ALLOWED TO CHANGE SALES AND SOLD
$account = array(
"salesid"=>$post_content['salesid'],
"soldto"=>$post_content['soldto'],
"shipto"=>$post_content['shipto'],
"location"=>$post_content['location']
);
}
elseif ($permission == 3){
//ADMIN ONLY ARE ALLOWED TO CHANGE SOLD
$account = array(
"salesid"=>$partner->salesid,
"soldto"=>$post_content['soldto'],
"shipto"=>$post_content['shipto'],
"location"=>$post_content['location']
);
}
else {
$account = array(
"salesid"=>$partner->salesid,
"soldto"=>$partner->soldto,
"shipto"=>$post_content['shipto'],
"location"=>$post_content['location']
);
}
} elseif ($id != '' && $command == 'reset'){
//Reset user requested
//Get username
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt->execute([$id]);
$user_data = $stmt->fetch();
//generate resetkey
$post_content['resetkey'] = generate_jwt($headers, $payload);
//STEP 1- create resetkey
$headers = array('alg'=>'HS256','typ'=>'JWT');
$payload = array('username'=>$user_data['username'], 'exp'=>(time() + 1800));
$resetkey = generate_jwt($headers, $payload);
//STEP 2- Store resetkey
$sql = 'UPDATE users SET resetkey = ? WHERE id = ? '.$whereclause.'';
$stmt = $pdo->prepare($sql);
$stmt->execute([$resetkey,$id]);
//STEP 3 - Send to user
include_once './assets/mail/email_template_reset.php';
send_mail($user_data['email'],$subject,$message,'','');
}
$accounthierarchy = json_encode($account, JSON_UNESCAPED_UNICODE);
//Create resetkey & tokens
$headers = array('alg'=>'HS256','typ'=>'JWT');
$payload = array('username'=>$post_content['username'], 'exp'=>(time() + 1800));
$post_content['service'] = (isset($post_content['service']) && $post_content['service'] == 1) ? bin2hex(random_bytes(25)) : '';
$post_content['userkey'] = (isset($post_content['userkey']) && $post_content['userkey'] == 1) ? bin2hex(random_bytes(25)) : '';
//ADD STANDARD PARAMETERS TO ARRAY BASED ON INSERT OR UPDATE
if ($command == 'update'){
$post_content['partnerhierarchy'] = $accounthierarchy;
}
elseif ($command == 'insert'){
$post_content['resetkey'] = $resetkey = generate_jwt($headers, $payload);
$post_content['password'] = generate_jwt($headers, $payload);
$post_content['partnerhierarchy'] = $accounthierarchy;
$post_content['salesID'] = $partner->salesid;
}
else {
//do nothing
}
//CREAT NEW ARRAY AND MAP TO CLAUSE
if(isset($post_content) && $post_content!=''){
foreach ($post_content as $key => $var){
if ($key == 'submit' || $key == 'id' || str_contains($key, 'old_') || $key == 'salesid' || $key == 'soldto' || $key == 'shipto' || $key == 'location'){
//do nothing
}
else {
$criterias[$key] = $var;
$clause .= ' , '.$key.' = ?';
$clause_insert .= ' , '.$key.'';
$input_insert .= ', ?'; // ? for each insert item
$execute_input[]= $var; // Build array for input
}
}
}
//CLEAN UP INPUT
$clause = substr($clause, 2); //Clean clause - remove first comma
$clause_insert = substr($clause_insert, 2); //Clean clause - remove first comma
$input_insert = substr($input_insert, 1); //Clean clause - remove first comma
//QUERY AND VERIFY ALLOWED
if ($command == 'update' && (isAllowed('user',$profile,$permission,'U') === 1 || $owner_user === 1)){
$sql = 'UPDATE users SET '.$clause.' WHERE id = ? '.$whereclause.'';
$execute_input[] = $id;
$stmt = $pdo->prepare($sql);
$stmt->execute($execute_input);
//Update the username in all tables when changed
if ($post_content['username'] != $user_name_old){
$sql_like = '%'.$user_name_old.'%';
$sql1= 'UPDATE equipment SET createdby = REPLACE(createdby, ? , ?) WHERE createdby LIKE ?';
$sql2= 'UPDATE communication SET createdby = REPLACE(createdby, ? , ?) WHERE createdby LIKE ?';
$sql3= 'UPDATE contracts SET createdby = REPLACE(createdby, ? , ?) WHERE createdby LIKE ?';
$sql4= 'UPDATE feedback SET createdby = REPLACE(createdby, ? , ?) WHERE createdby LIKE ?';
$sql5= 'UPDATE history SET createdby = REPLACE(createdby, ? , ?) WHERE createdby LIKE ?';
$sql6= 'UPDATE opportunities SET createdby = REPLACE(createdby, ? , ?) WHERE createdby LIKE ?';
$sql7= 'UPDATE orders SET createdby = REPLACE(createdby, ? , ?) WHERE createdby LIKE ?';
$sql8= 'UPDATE products SET createdby = REPLACE(createdby, ? , ?) WHERE createdby LIKE ?';
$sql_users = 'UPDATE account SET createdby = REPLACE(createdby, ? , ?) WHERE createdby LIKE ?';
$sql_partner = 'UPDATE partner SET createdby = REPLACE(createdby, ? , ?) WHERE createdby LIKE ?';
//SQL_users
$stmt = $pdo->prepare($sql_users);
$stmt->execute([$user_name_old,$post_content['username'], $sql_like]);
//SQL_partners
$stmt = $pdo->prepare($sql_partner);
$stmt->execute([$user_name_old,$post_content['username'], $sql_like]);
$pdo = dbConnect($dbname);
//SQL1
$stmt = $pdo->prepare($sql1);
$stmt->execute([$user_name_old,$post_content['username'], $sql_like]);
//SQL2
$stmt = $pdo->prepare($sql2);
$stmt->execute([$user_name_old,$post_content['username'], $sql_like]);
//SQL3
$stmt = $pdo->prepare($sql3);
$stmt->execute([$user_name_old,$post_content['username'], $sql_like]);
//SQL4
$stmt = $pdo->prepare($sql4);
$stmt->execute([$user_name_old,$post_content['username'], $sql_like]);
//SQL5
$stmt = $pdo->prepare($sql5);
$stmt->execute([$user_name_old,$post_content['username'], $sql_like]);
//SQL6
$stmt = $pdo->prepare($sql6);
$stmt->execute([$user_name_old,$post_content['username'], $sql_like]);
//SQL7
$stmt = $pdo->prepare($sql7);
$stmt->execute([$user_name_old,$post_content['username'], $sql_like]);
//SQL8
$stmt = $pdo->prepare($sql8);
$stmt->execute([$user_name_old,$post_content['username'], $sql_like]);
}
}
elseif ($command == 'insert' && isAllowed('user',$profile,$permission,'C') === 1){
//check if user exists
$stmt = $pdo->prepare('SELECT * FROM users WHERE username = ?');
$stmt->execute([$post_content['username']]);
$user_exist = $stmt->fetch();
$exists = (isset($user_exist['username']))? 1 : 0;
if($user_exist == 0 ){
$sql = 'INSERT INTO users ('.$clause_insert.') VALUES ('.$input_insert.')';
$stmt = $pdo->prepare($sql);
$stmt->execute($execute_input);
//STEP 2- Send to user
include_once './assets/mail/email_template_new.php';
send_mail($post_content['email'],$subject,$message,'','');
} else {
//------------------------------------------
//JSON_ENCODE
//------------------------------------------
$messages = json_encode($exists, JSON_UNESCAPED_UNICODE);
//Send results
echo $messages;
}
}
elseif ($command == 'delete' && isAllowed('user',$profile,$permission,'D') === 1){
//delete equipment
$stmt = $pdo->prepare('DELETE FROM users WHERE id = ? '.$whereclause.'');
$stmt->execute([ $id ]);
//Add deletion to changelog
changelog($dbname,'users',$id,'Delete','Delete',$username);
} else
{
//do nothing
}
?>