" . trim($_POST['folder_name']) . " created");
redirect("files.php?client_id=$client_id&folder_id=$folder_id");
}
if (isset($_POST['rename_folder'])) {
validateCSRFToken();
enforceUserPermission('module_support', 2);
$folder_id = intval($_POST['folder_id']);
$folder_name = escapeSql(trim($_POST['folder_name'] ?? ''));
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT folder_name, folder_client_id, parent_folder FROM folders WHERE folder_id = $folder_id"));
if (!$row) {
flashAlert('That folder no longer exists.', 'error');
redirect();
}
$old_folder_name = escapeSql($row['folder_name']);
$client_id = intval($row['folder_client_id']);
enforceClientAccess();
if ($folder_name === '') {
flashAlert('A folder needs a name.', 'error');
redirect();
}
// Moved as well? Only under one of this client's folders, and never into itself or below itself
$parent_folder = intval($row['parent_folder']);
if (isset($_POST['parent_folder'])) {
$new_parent = folderOwnedId($_POST['parent_folder'], $client_id);
if (!in_array($new_parent, folderSubtree(folderTree($client_id), $folder_id), true)) {
$parent_folder = $new_parent;
}
}
mysqli_query($mysqli, "UPDATE folders SET folder_name = '$folder_name', parent_folder = $parent_folder WHERE folder_id = $folder_id");
if ($old_folder_name !== $folder_name) {
logAudit("Folder", "Rename", "$session_name renamed folder $old_folder_name to $folder_name", $client_id, $folder_id);
}
if ($parent_folder !== intval($row['parent_folder'])) {
logAudit("Folder", "Move", "$session_name moved folder $folder_name into " . escapeSql(folderDisplayName($parent_folder)), $client_id, $folder_id);
}
flashAlert("Folder " . trim($_POST['folder_name']) . " saved");
redirect();
}
/*
* Deleting a folder never deletes what is in it: files, documents and
* subfolders move up to the folder it sat in. (Only documents used to be
* moved - files and subfolders were left pointing at a folder that no
* longer existed, and dropped out of sight.)
*/
if (isset($_POST['delete_folder']) || isset($_GET['delete_folder'])) {
validateCSRFToken();
enforceUserPermission('module_support', 3);
$folder_id = intval($_POST['folder_id'] ?? $_GET['delete_folder']);
$row = mysqli_fetch_assoc(mysqli_query($mysqli, "SELECT folder_name, folder_client_id, parent_folder FROM folders WHERE folder_id = $folder_id"));
if (!$row) {
flashAlert('That folder no longer exists.', 'error');
redirect();
}
$folder_name = escapeSql($row['folder_name']);
$client_id = intval($row['folder_client_id']);
enforceClientAccess();
$parent_folder = folderOwnedId($row['parent_folder'], $client_id);
mysqli_query($mysqli, "UPDATE files SET file_folder_id = $parent_folder WHERE file_folder_id = $folder_id AND file_client_id = $client_id");
mysqli_query($mysqli, "UPDATE documents SET document_folder_id = $parent_folder, document_updated_at = document_updated_at WHERE document_folder_id = $folder_id AND document_client_id = $client_id");
mysqli_query($mysqli, "UPDATE folders SET parent_folder = $parent_folder WHERE parent_folder = $folder_id AND folder_client_id = $client_id");
mysqli_query($mysqli, "DELETE FROM folders WHERE folder_id = $folder_id");
logAudit("Folder", "Delete", "$session_name deleted folder $folder_name, its contents moved to " . escapeSql(folderDisplayName($parent_folder)), $client_id);
flashAlert("Folder {$row['folder_name']} deleted", 'error');
redirect("files.php?client_id=$client_id&folder_id=$parent_folder");
}