81 lines
3.2 KiB
PHP
81 lines
3.2 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../includes/init_praticien.php';
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
function out($ok,$m,$x=[]){ echo json_encode(['ok'=>$ok,'message'=>$m]+$x); exit; }
|
|
|
|
$praticien_id = (int)($_SESSION['reference_id'] ?? 0);
|
|
$csrf=(string)($_POST['csrf'] ?? '');
|
|
if (!hash_equals($_SESSION['cl_csrf'] ?? '', $csrf)) out(false,'CSRF');
|
|
|
|
$note_id = (int)($_POST['note_id'] ?? 0);
|
|
if ($note_id<=0) out(false,'Bad note');
|
|
|
|
// Vérif propriétaire + dossier_id
|
|
$sql = "SELECT s.id, s.dossier_id, d.praticien_id
|
|
FROM client_suivi s JOIN client_dossiers d ON d.id=s.dossier_id
|
|
WHERE s.id=:id AND d.praticien_id=:p AND d.archived_at IS NULL";
|
|
$st = $pdo->prepare($sql);
|
|
$st->execute([':id'=>$note_id, ':p'=>$praticien_id]);
|
|
$own = $st->fetch(PDO::FETCH_ASSOC);
|
|
if(!$own) out(false,'Not allowed');
|
|
|
|
$date_rdv = (string)($_POST['date_rdv'] ?? '');
|
|
$type_rdv = (string)($_POST['type_rdv'] ?? 'autre');
|
|
$titre = trim((string)($_POST['titre'] ?? ''));
|
|
$notes = trim((string)($_POST['notes'] ?? ''));
|
|
$prochaine= trim((string)($_POST['prochaine_action'] ?? ''));
|
|
$duree = (int)($_POST['duree_minutes'] ?? 0);
|
|
|
|
if ($titre==='' || $notes==='') out(false,'Champs requis');
|
|
|
|
try{
|
|
$pdo->beginTransaction();
|
|
|
|
$upd = $pdo->prepare("UPDATE client_suivi
|
|
SET date_rdv=:dt, type_rdv=:ty, titre=:ti, notes=:no, prochaine_action=:pa, duree_minutes=:du
|
|
WHERE id=:id");
|
|
$upd->execute([
|
|
':dt'=> (new DateTime($date_rdv ?: 'now'))->format('Y-m-d H:i:s'),
|
|
':ty'=> in_array($type_rdv,['online','cabinet','tel','autre'],true) ? $type_rdv : 'autre',
|
|
':ti'=> $titre, ':no'=> $notes,
|
|
':pa'=> ($prochaine !== '' ? $prochaine : null),
|
|
':du'=> ($duree > 0 ? $duree : null),
|
|
':id'=> $note_id
|
|
]);
|
|
|
|
// Uploads additionnels
|
|
if (!empty($_FILES['files']) && is_array($_FILES['files']['name'])) {
|
|
$baseDir = $_SERVER['DOCUMENT_ROOT'].'/uploads/suivi/'. (int)$own['dossier_id'];
|
|
if (!is_dir($baseDir)) @mkdir($baseDir, 0775, true);
|
|
|
|
$allowed = ['pdf','jpg','jpeg','png','doc','docx','txt'];
|
|
for($i=0;$i<count($_FILES['files']['name']);$i++){
|
|
$err = (int)($_FILES['files']['error'][$i] ?? UPLOAD_ERR_NO_FILE);
|
|
if ($err !== UPLOAD_ERR_OK) continue;
|
|
$name = (string)($_FILES['files']['name'][$i] ?? '');
|
|
$tmp = (string)($_FILES['files']['tmp_name'][$i] ?? '');
|
|
$size = (int)($_FILES['files']['size'][$i] ?? 0);
|
|
if ($size <= 0 || $size > 8*1024*1024) continue; // 8 Mo
|
|
$ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
|
|
if (!in_array($ext,$allowed,true)) continue;
|
|
|
|
$new = (int)$own['dossier_id'].'_'.time().'_'.bin2hex(random_bytes(4)).'.'.$ext;
|
|
$dest = $baseDir.'/'.$new;
|
|
if (@move_uploaded_file($tmp, $dest)) {
|
|
$rel = '/uploads/suivi/'.(int)$own['dossier_id'].'/'.$new;
|
|
$mime= mime_content_type($dest) ?: null;
|
|
|
|
$pdo->prepare("INSERT INTO client_suivi_files (entry_id, path, mime, size_bytes) VALUES (:e,:p,:m,:s)")
|
|
->execute([':e'=>$note_id, ':p'=>$rel, ':m'=>$mime, ':s'=>$size]);
|
|
}
|
|
}
|
|
}
|
|
|
|
$pdo->commit();
|
|
out(true,'OK');
|
|
}catch(Throwable $e){
|
|
if($pdo->inTransaction()) $pdo->rollBack();
|
|
error_log('ajax_editer_note: '.$e->getMessage());
|
|
out(false,'Erreur');
|
|
}
|