From b2746ddfa583965a67a098be5202532ccd951976 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 16 Aug 2019 00:12:47 -0400 Subject: [PATCH] Another Fix setup where user_companies was not creating a record due to user_id being out of the loop --- add_client_modal.php | 2 +- add_company_modal.php | 2 +- add_user_modal.php | 19 ++++- companies.php | 2 +- edit_client_modal.php | 2 +- edit_company_modal.php | 2 +- edit_user_modal.php | 2 +- post.php | 185 +++++++++++++++++++++-------------------- setup.php | 22 ++++- 9 files changed, 140 insertions(+), 98 deletions(-) diff --git a/add_client_modal.php b/add_client_modal.php index 8a445509..6782192d 100644 --- a/add_client_modal.php +++ b/add_client_modal.php @@ -2,7 +2,7 @@
-
New Client
+
New Client
diff --git a/add_company_modal.php b/add_company_modal.php index 3a08b32f..21e3457e 100644 --- a/add_company_modal.php +++ b/add_company_modal.php @@ -2,7 +2,7 @@
-
New Company
+
New Company
diff --git a/add_user_modal.php b/add_user_modal.php index 5caedd1e..783ffd6d 100644 --- a/add_user_modal.php +++ b/add_user_modal.php @@ -2,7 +2,7 @@
-
New User
+
New User
@@ -63,6 +63,23 @@
+ + +
+ + +
+ + +
diff --git a/companies.php b/companies.php index 00ff374c..9e09815f 100644 --- a/companies.php +++ b/companies.php @@ -23,7 +23,7 @@ if(!empty($_GET['sb'])){ $sb = $_GET['sb']; }else{ - $sb = "company_id"; + $sb = "companies.company_id"; } if(isset($_GET['o'])){ diff --git a/edit_client_modal.php b/edit_client_modal.php index 2a4c50b6..548b1086 100644 --- a/edit_client_modal.php +++ b/edit_client_modal.php @@ -2,7 +2,7 @@
-
+
diff --git a/edit_company_modal.php b/edit_company_modal.php index 8bc8ce9a..2b82a4f8 100644 --- a/edit_company_modal.php +++ b/edit_company_modal.php @@ -2,7 +2,7 @@
-
+
diff --git a/edit_user_modal.php b/edit_user_modal.php index 2e401569..73a27916 100644 --- a/edit_user_modal.php +++ b/edit_user_modal.php @@ -2,7 +2,7 @@
-
+
diff --git a/post.php b/post.php index 23a93bd0..00621bf6 100644 --- a/post.php +++ b/post.php @@ -15,6 +15,102 @@ use PHPMailer\PHPMailer\Exception; $todays_date = date('Y-m-d'); +if(isset($_POST['add_user'])){ + + $name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['name'])); + $email = strip_tags(mysqli_real_escape_string($mysqli,$_POST['email'])); + $password = md5(mysqli_real_escape_string($mysqli,$_POST['password'])); + $client_id = intval($_POST['client']); + + if($_FILES['file']['tmp_name']!='') { + $path = "uploads/users/"; + $path = $path . time() . basename( $_FILES['file']['name']); + $file_name = basename($path); + move_uploaded_file($_FILES['file']['tmp_name'], $path); + } + + mysqli_query($mysqli,"INSERT INTO users SET name = '$name', email = '$email', password = '$password', avatar = '$path', created_at = NOW(), client_id = $client_id"); + + $_SESSION['alert_message'] = "User added"; + + header("Location: users.php"); + +} + +if(isset($_POST['edit_user'])){ + + $user_id = intval($_POST['user_id']); + $name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['name'])); + $email = strip_tags(mysqli_real_escape_string($mysqli,$_POST['email'])); + $current_password_hash = mysqli_real_escape_string($mysqli,$_POST['current_password_hash']); + $password = mysqli_real_escape_string($mysqli,$_POST['password']); + if($current_password_hash == $password){ + $password = $current_password_hash; + }else{ + $password = md5($password); + } + $path = strip_tags(mysqli_real_escape_string($mysqli,$_POST['current_avatar_path'])); + + if($_FILES['file']['tmp_name']!='') { + //delete old avatar file + unlink($path); + //Update with new path + $path = "uploads/users/"; + $path = $path . basename( $_FILES['file']['name']); + $file_name = basename($path); + move_uploaded_file($_FILES['file']['tmp_name'], $path); + } + + mysqli_query($mysqli,"UPDATE users SET name = '$name', email = '$email', password = '$password', avatar = '$path', updated_at = NOW() WHERE user_id = $user_id"); + + $_SESSION['alert_message'] = "User updated"; + + header("Location: users.php"); + +} + +if(isset($_POST['add_company'])){ + + $name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['name'])); + + mysqli_query($mysqli,"INSERT INTO companies SET company_name = '$name', company_created_at = NOW()"); + + $config_api_key = keygen(); + $company_id = mysqli_insert_id($mysqli); + + mysqli_query($mysqli,"INSERT INTO settings SET company_id = $company_id, config_company_name = '$name', config_invoice_prefix = 'INV-', config_invoice_next_number = 1, config_invoice_overdue_reminders = '1,3,7', config_quote_prefix = 'QUO-', config_quote_next_number = 1, config_api_key = '$config_api_key', config_recurring_auto_send_invoice = 1, config_default_net_terms = 7, config_send_invoice_reminders = 0, config_enable_cron = 0"); + + $_SESSION['alert_message'] = "Company added"; + + header("Location: companies.php"); + +} + +if(isset($_POST['edit_company'])){ + $company_id = intval($_POST['company_id']); + $name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['name'])); + + mysqli_query($mysqli,"UPDATE companies SET company_name = '$name', company_updated_at = NOW() WHERE company_id = $company_id"); + + $_SESSION['alert_message'] = "Company modified"; + + header("Location: companies.php"); + +} + +if(isset($_GET['delete_company'])){ + $company_id = intval($_GET['delete_company']); + + mysqli_query($mysqli,"DELETE FROM companies WHERE company_id = $company_id"); + + mysqli_query($mysqli,"DELETE FROM settings WHERE company_id = $company_id"); + + $_SESSION['alert_message'] = "Company deleted"; + + header("Location: " . $_SERVER["HTTP_REFERER"]); + +} + if(isset($_POST['verify'])){ require_once("rfc6238.php"); @@ -250,95 +346,6 @@ if(isset($_GET['download_database'])){ } -if(isset($_POST['add_user'])){ - - $name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['name'])); - $email = strip_tags(mysqli_real_escape_string($mysqli,$_POST['email'])); - $password = md5(mysqli_real_escape_string($mysqli,$_POST['password'])); - $client_id = intval($_POST['client']); - - if($_FILES['file']['tmp_name']!='') { - $path = "uploads/users/"; - $path = $path . time() . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); - } - - mysqli_query($mysqli,"INSERT INTO users SET name = '$name', email = '$email', password = '$password', avatar = '$path', created_at = NOW(), client_id = $client_id"); - - $_SESSION['alert_message'] = "User added"; - - header("Location: users.php"); - -} - -if(isset($_POST['edit_user'])){ - - $user_id = intval($_POST['user_id']); - $name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['name'])); - $email = strip_tags(mysqli_real_escape_string($mysqli,$_POST['email'])); - $current_password_hash = mysqli_real_escape_string($mysqli,$_POST['current_password_hash']); - $password = mysqli_real_escape_string($mysqli,$_POST['password']); - if($current_password_hash == $password){ - $password = $current_password_hash; - }else{ - $password = md5($password); - } - $path = strip_tags(mysqli_real_escape_string($mysqli,$_POST['current_avatar_path'])); - - if($_FILES['file']['tmp_name']!='') { - //delete old avatar file - unlink($path); - //Update with new path - $path = "uploads/users/"; - $path = $path . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); - } - - mysqli_query($mysqli,"UPDATE users SET name = '$name', email = '$email', password = '$password', avatar = '$path', updated_at = NOW() WHERE user_id = $user_id"); - - $_SESSION['alert_message'] = "User updated"; - - header("Location: users.php"); - -} - -if(isset($_POST['add_company'])){ - - $name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['name'])); - - mysqli_query($mysqli,"INSERT INTO companies SET company_name = '$name', company_created_at = NOW()"); - - $_SESSION['alert_message'] = "Company added"; - - header("Location: companies.php"); - -} - -if(isset($_POST['edit_company'])){ - $company_id = intval($_POST['company_id']); - $name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['name'])); - - mysqli_query($mysqli,"UPDATE companies SET company_name = '$name', company_updated_at = NOW() WHERE company_id = $company_id"); - - $_SESSION['alert_message'] = "Company modified"; - - header("Location: companies.php"); - -} - -if(isset($_GET['delete_company'])){ - $company_id = intval($_GET['delete_company']); - - mysqli_query($mysqli,"DELETE FROM companies WHERE company_id = $company_id"); - - $_SESSION['alert_message'] = "Company deleted"; - - header("Location: " . $_SERVER["HTTP_REFERER"]); - -} - if(isset($_POST['add_client'])){ $name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['name'])); diff --git a/setup.php b/setup.php index 1f6e5116..6e24f798 100644 --- a/setup.php +++ b/setup.php @@ -91,6 +91,10 @@ if(isset($_POST['add_company_settings'])){ include("config.php"); + $sql = mysqli_query($mysqli,"SELECT user_id FROM users"); + $row = mysqli_fetch_array($sql); + $user_id = $row['user_id']; + $config_company_name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['config_company_name'])); $config_company_address = strip_tags(mysqli_real_escape_string($mysqli,$_POST['config_company_address'])); $config_company_city = strip_tags(mysqli_real_escape_string($mysqli,$_POST['config_company_city'])); @@ -100,7 +104,7 @@ if(isset($_POST['add_company_settings'])){ $config_company_phone = preg_replace("/[^0-9]/", '',$config_company_phone); $config_company_site = strip_tags(mysqli_real_escape_string($mysqli,$_POST['config_company_site'])); $config_api_key = keygen(); - $user_id = mysqli_insert_id($mysqli); + mysqli_query($mysqli,"INSERT INTO companies SET company_name = '$config_company_name', company_created_at = NOW()"); @@ -203,6 +207,20 @@ if(isset($_POST['add_company_settings'])){
+ + +
+ + +
+
@@ -242,7 +260,7 @@ if(isset($_POST['add_company_settings'])){
- +