87 lines
2.7 KiB
PHP
87 lines
2.7 KiB
PHP
<?php
|
|
session_start();
|
|
require_once 'db.php';
|
|
|
|
$action = (string)($_GET['action'] ?? 'dashboard');
|
|
|
|
// API updates for task kanban drag n drop
|
|
if ($action === 'api') {
|
|
$api_action = $_GET['api_action'] ?? '';
|
|
if(!isset($_SESSION['user_id'])) die(json_encode(['status'=>'error','msg'=>'unauthorized']));
|
|
if($api_action === 'update_task_status') {
|
|
$task_id = $_POST['task_id'] ?? null;
|
|
$status = $_POST['status'] ?? null;
|
|
$stmt = $pdo->prepare("UPDATE tasks SET status = ?, status_updated_at = CURRENT_TIMESTAMP WHERE id = ?");
|
|
$stmt->execute([$status, $task_id]);
|
|
echo json_encode(['status'=>'ok']);
|
|
}
|
|
exit;
|
|
}
|
|
|
|
if (!isset($_SESSION['user_id']) && $action !== 'login' && $action !== 'setup') {
|
|
header('Location: ?action=login');
|
|
exit;
|
|
}
|
|
|
|
$user_id = $_SESSION['user_id'] ?? null;
|
|
$current_user = null;
|
|
$unread_notifications = 0;
|
|
if ($user_id) {
|
|
$current_user = get_user($user_id);
|
|
$stmt = $pdo->prepare("SELECT COUNT(*) FROM notifications WHERE user_id = ? AND is_read = 0");
|
|
$stmt->execute([$user_id]);
|
|
$unread_notifications = $stmt->fetchColumn();
|
|
}
|
|
|
|
if ($action === 'logout') {
|
|
session_destroy();
|
|
header('Location: ?action=login');
|
|
exit;
|
|
}
|
|
|
|
if ($action === 'setup') {
|
|
include 'setup.php';
|
|
exit;
|
|
}
|
|
|
|
if ($action === 'login') {
|
|
$error = '';
|
|
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
|
|
$username = trim((string)($_POST['username'] ?? ''));
|
|
$password = trim((string)($_POST['password'] ?? ''));
|
|
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
|
|
$stmt->execute([$username]);
|
|
$user = $stmt->fetch();
|
|
if ($user && password_verify($password, $user['password_hash'])) {
|
|
$_SESSION['user_id'] = $user['id'];
|
|
$_SESSION['is_admin'] = $user['is_admin'];
|
|
header('Location: ?action=dashboard');
|
|
exit;
|
|
} else {
|
|
$error = "Invalid username or password";
|
|
}
|
|
}
|
|
include 'views/login.php';
|
|
exit;
|
|
}
|
|
|
|
$view_file = 'views/' . basename($action) . '.php';
|
|
if (file_exists($view_file)) {
|
|
// AJAX-only POST requests must not have the HTML layout wrapped around them,
|
|
// otherwise the JSON response gets embedded inside the HTML document and
|
|
// JSON.parse() fails on the client side.
|
|
$is_ajax_post = isset($_POST['ajax_submit'])
|
|
|| isset($_POST['delete_attachment_ajax'])
|
|
|| isset($_POST['upload_attachment_ajax']);
|
|
|
|
if ($is_ajax_post) {
|
|
include $view_file; // view handles its own output + exit
|
|
} else {
|
|
include 'views/layout_top.php';
|
|
include $view_file;
|
|
include 'views/layout_bottom.php';
|
|
}
|
|
} else {
|
|
echo "404 Not Found";
|
|
}
|