Merge pull request #652 from wrongecho/confirm-file-delete

Client file deletion

client_file_add_modal.php

@@ -17,7 +17,7 @@
                             <div class="input-group-prepend">
                                 <span class="input-group-text"><i class="fa fa-fw fa-file"></i></span>
                             </div>
-                            <input type="text" class="form-control" name="new_name" placeholder="leave blank to use existing name">
+                            <input type="text" class="form-control" name="new_name" placeholder="Leave blank to use existing name">
                         </div>
                     </div>
 

client_file_delete_modal.php

@@ -0,0 +1,21 @@
+<script src="js/file_delete_modal.js"></script>
+<div class="modal" id="deleteFileModal" tabindex="-1">
+    <div class="modal-dialog">
+        <div class="modal-content">
+            <div class="modal-body">
+                <div class="mb-4" style="text-align: center;">
+                    <i class="far fa-10x fa-times-circle text-danger mb-3 mt-3"></i>
+                    <h2>Are you sure?</h2>
+                    <h6 class="mb-4 text-secondary">Do you really want to delete this file?</h6>
+                    <h5 class="mb-4 text-secondary text-bold" id="file_delete_name">Name</h5>
+                    <form action="post.php" method="POST">
+                        <input type="hidden" name="file_id" id="file_delete_id" value="id">
+                        <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+                        <button type="button" name="cancel" class="btn btn-outline-secondary btn-lg px-5 mr-4" data-dismiss="modal">Cancel</button>
+                        <input type="submit" name="delete_file" class="btn btn-danger btn-lg px-5" value="Yes, Delete!">
+                    </form>
+                </div>
+            </div>
+        </div>
+    </div>
+</div>

client_files.php

@@ -47,7 +47,7 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_
 
                                 <small><?php echo $file_name; ?></small>
 
-                                <a href="post.php?delete_file=<?php echo $file_id; ?>" class="text-white float-right mr-1"><i class="fa fa-times"></i></a>
+                                <a href="#" data-toggle="modal" data-target="#deleteFileModal" onclick="populateFileDeleteModal(<?php echo "$file_id , '$file_name'" ?>)" class="text-white float-right mr-1"><i class="fa fa-times"></i></a>
                             </div>
                         </div>
                     </div>
@@ -90,7 +90,7 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_
                             <td>
                                 <a href="<?php echo "uploads/clients/$client_id/$file_reference_name"; ?>" download="<?php echo $file_name; ?>" class="text-secondary float-left ml-1"><i class="fa fa-cloud-download-alt"></i></a>
                                 <a href="#" data-toggle="modal" data-target="#shareModal" onclick="populateShareModal(<?php echo "$client_id, 'File', $file_id"; ?>)" class="text-secondary float-left ml-1"><i class="fa fa-share"></i></a>
-                                <a href="post.php?delete_file=<?php echo $file_id; ?>" class="text-secondary float-right mr-1"><i class="fa fa-times"></i></a>
+                                <a href="#" data-toggle="modal" data-target="#deleteFileModal" onclick="populateFileDeleteModal(<?php echo "$file_id , '$file_name'" ?>)" class="text-secondary float-right mr-1"><i class="fa fa-times"></i></a>
                             </td>
                         </tr>
                         <?php
@@ -104,4 +104,6 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_
 <?php
 require_once("client_file_add_modal.php");
 require_once("share_modal.php");
+require_once("client_file_delete_modal.php");
 require_once("footer.php");
+

js/file_delete_modal.js

@@ -0,0 +1,5 @@
+function populateFileDeleteModal(file_id, file_name) {
+    // Dynamically populate the file delete modal with the file id (hidden) and name
+    document.getElementById("file_delete_id").value = file_id;
+    document.getElementById("file_delete_name").innerText = file_name;
+}

post.php

@@ -7087,11 +7087,12 @@ if(isset($_POST['add_file'])){
 
 }
 
-if(isset($_GET['delete_file'])){
+if(isset($_POST['delete_file'])){
 
     validateAdminRole();
+    validateCSRFToken($_POST['csrf_token']);
 
-    $file_id = intval($_GET['delete_file']);
+    $file_id = intval($_POST['file_id']);
 
     $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id");
     $row = mysqli_fetch_array($sql_file);