Files
itflow/api/v1/form_input.php
johnnyq ecbb974fff API stage 3, calendar events, trips, accounts and money, contracts, and files and folders: calendars can be read, and calendar events read with their attendees, created once or repeating for a client or nobody, changed, sent as invitations, skipped for a day of a series and deleted, following calendarEventCan(); trips can be read, logged, changed and deleted through tripSave() and tripDelete(), anyone their own and someone else's with Financial; accounts can be read with their balances, added, changed, archived, unarchived and deleted while nothing is on them, other income and transfers read, recorded, changed and deleted, and recurring expenses read, set up, changed, paused and resumed, recorded now, moved on past missed runs and deleted, keeping reconciled lines as they were; contracts can be read with their prepaid hours and signing state, added, changed, made active, renewed, cancelled and deleted, sent for signature or the link sent again, the request withdrawn, prepaid hours added with a draft invoice or deleted, tickets' time drawn or put back, and the billing recurring invoice made, linked or unlinked; a client's files can be read, uploaded as base64, downloaded, renamed, moved, archived, unarchived and deleted once archived, and folders read, made, renamed, moved and deleted with their contents moved up; new api/v1/form_input.php builds a save function's input from the API's field names; the upload allow-list moves from agent/post/file.php into fileUploadExtensions() so Upload Files and the API check the same list; enforce_api_rbac.php maps the new resources, lets events, calendars and trips check their own rules, puts the new state changes at Modify and treats files/download as a read; 26.11.9 changelog entries
2026-11-13 23:51:10 -05:00

39 lines
1.3 KiB
PHP

<?php
/*
* API - the save functions behind ITFlow's forms take the form's fields ($in); an
* API call sends them by their column names. apiFormInput() builds $in from what was sent,
* and on an update from the record's own values ($row) for what wasn't. $map is
* API field => [$in key, $row column].
*/
if (!function_exists('apiDeny')) {
http_response_code(404);
exit();
}
if (!function_exists('apiFormInput')) {
function apiFormInput(array $map, $row = null) {
$in = [];
foreach ($map as $field => [$key, $column]) {
if (array_key_exists($field, $_POST)) {
$in[$key] = is_scalar($_POST[$field]) ? (string) $_POST[$field] : '';
} elseif ($row && $column !== null && array_key_exists($column, $row)) {
$in[$key] = (string) $row[$column];
}
}
return $in;
}
/** 400 with the save function's words, as a sentence. */
function apiFormRefuse($error) {
global $return_arr;
http_response_code(400);
$error = rtrim(html_entity_decode(strip_tags((string) $error), ENT_QUOTES | ENT_HTML5, 'UTF-8'));
$return_arr['success'] = "False";
$return_arr['message'] = preg_match('/[.!?]$/', $error) ? $error : "$error.";
echo json_encode($return_arr);
exit();
}
}