fun/Task-Management
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

major change

Browse Source
This commit is contained in:
root
2026-03-27 00:03:48 +07:00
parent 9b1d5753cb
commit f89fcbee1c
9 changed files with 2143 additions and 463 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
index.php
View File

@@ -66,7 +66,6 @@ if ($action === 'login') {
}
// Handle POST actions that need a redirect BEFORE layout outputs any HTML.
// Adding new redirect-based POST keys here keeps header() calls safe.
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $user_id) {
// Mood setter
if (isset($_POST['set_mood'])) {
@@ -86,19 +85,74 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && $user_id) {
header('Location: ?action=dashboard');
exit;
}
// Profile picture upload
if (isset($_POST['upload_profile_pic'])) {
// Ensure column exists
try { $pdo->exec("ALTER TABLE users ADD COLUMN profile_pic TEXT DEFAULT NULL"); } catch(Exception $e) {}
if (isset($_FILES['profile_pic']) && $_FILES['profile_pic']['error'] === 0) {
$allowed_types = ['image/jpeg','image/png','image/gif','image/webp'];
if (in_array($_FILES['profile_pic']['type'], $allowed_types)) {
$ext = pathinfo($_FILES['profile_pic']['name'], PATHINFO_EXTENSION);
$filename = 'avatar_' . $user_id . '_' . time() . '.' . $ext;
$dest = 'uploads/' . $filename;
if (move_uploaded_file($_FILES['profile_pic']['tmp_name'], $dest)) {
// Delete old pic
$old = $pdo->prepare("SELECT profile_pic FROM users WHERE id=?");
$old->execute([$user_id]);
$old_pic = $old->fetchColumn();
if ($old_pic && file_exists($old_pic)) @unlink($old_pic);
$pdo->prepare("UPDATE users SET profile_pic=? WHERE id=?")->execute([$dest, $user_id]);
}
}
}
header('Location: ?action=' . ($_POST['redirect_to'] ?? 'dashboard'));
exit;
}
// Delete profile picture
if (isset($_POST['delete_profile_pic'])) {
try { $pdo->exec("ALTER TABLE users ADD COLUMN profile_pic TEXT DEFAULT NULL"); } catch(Exception $e) {}
$old = $pdo->prepare("SELECT profile_pic FROM users WHERE id=?");
$old->execute([$user_id]);
$old_pic = $old->fetchColumn();
if ($old_pic && file_exists($old_pic)) @unlink($old_pic);
$pdo->prepare("UPDATE users SET profile_pic=NULL WHERE id=?")->execute([$user_id]);
header('Location: ?action=' . ($_POST['redirect_to'] ?? 'dashboard'));
exit;
}
// Change password
if (isset($_POST['change_password'])) {
$cur = trim($_POST['current_password'] ?? '');
$new = trim($_POST['new_password'] ?? '');
$cnf = trim($_POST['confirm_password'] ?? '');
$user = get_user($user_id);
$pw_error = '';
if (!password_verify($cur, $user['password_hash'])) {
$pw_error = 'Current password is incorrect.';
} elseif (strlen($new) < 6) {
$pw_error = 'New password must be at least 6 characters.';
} elseif ($new !== $cnf) {
$pw_error = 'Passwords do not match.';
} else {
$pdo->prepare("UPDATE users SET password_hash=? WHERE id=?")
->execute([password_hash($new, PASSWORD_DEFAULT), $user_id]);
}
$_SESSION['pw_change_msg'] = $pw_error ?: 'success';
header('Location: ?action=' . ($_POST['redirect_to'] ?? 'dashboard'));
exit;
}
}
$view_file = 'views/' . basename($action) . '.php';
if (file_exists($view_file)) {
// AJAX-only POST requests must not have the HTML layout wrapped around them,
// otherwise the JSON response gets embedded inside the HTML document and
// JSON.parse() fails on the client side.
$is_ajax_post = isset($_POST['ajax_submit'])
|| isset($_POST['delete_attachment_ajax'])
|| isset($_POST['upload_attachment_ajax']);
if ($is_ajax_post) {
include $view_file; // view handles its own output + exit
include $view_file;
} else {
include 'views/layout_top.php';
include $view_file;