dashboard

index.php

@@ -65,6 +65,29 @@ if ($action === 'login') {
     exit;
 }
 
+// Handle POST actions that need a redirect BEFORE layout outputs any HTML.
+// Adding new redirect-based POST keys here keeps header() calls safe.
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && $user_id) {
+    // Mood setter
+    if (isset($_POST['set_mood'])) {
+        try { $pdo->exec("ALTER TABLE users ADD COLUMN mood TEXT DEFAULT NULL"); } catch(Exception $e) {}
+        try { $pdo->exec("ALTER TABLE users ADD COLUMN mood_updated_at DATETIME DEFAULT NULL"); } catch(Exception $e) {}
+        try { $pdo->exec("CREATE TABLE IF NOT EXISTS activity_log (id INTEGER PRIMARY KEY AUTOINCREMENT, user_id INTEGER, action TEXT NOT NULL, detail TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP, FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE)"); } catch(Exception $e) {}
+        $mood = trim((string)($_POST['mood'] ?? ''));
+        $allowed = ['😊','😢','😠','😴','🤩','😟','😎','🤔','😐','🥳'];
+        if (in_array($mood, $allowed) || $mood === '') {
+            $pdo->prepare("UPDATE users SET mood=?, mood_updated_at=CURRENT_TIMESTAMP WHERE id=?")
+                ->execute([$mood ?: null, $user_id]);
+            try {
+                $pdo->prepare("INSERT INTO activity_log (user_id, action, detail) VALUES (?, 'mood_set', ?)")
+                    ->execute([$user_id, $mood ?: 'cleared']);
+            } catch(Exception $e) {}
+        }
+        header('Location: ?action=dashboard');
+        exit;
+    }
+}
+
 $view_file = 'views/' . basename($action) . '.php';
 if (file_exists($view_file)) {
     // AJAX-only POST requests must not have the HTML layout wrapped around them,