80 lines
3.4 KiB
PHP
80 lines
3.4 KiB
PHP
<?php
|
||
require_once __DIR__ . '/../../includes/init_praticien.php';
|
||
header('Content-Type: application/json; charset=utf-8');
|
||
|
||
function out($ok,$msg,$extra=[]){ echo json_encode(['ok'=>$ok,'message'=>$msg]+$extra); exit; }
|
||
|
||
$praticien_id = (int)($_SESSION['reference_id'] ?? 0);
|
||
$csrf = (string)($_POST['csrf'] ?? '');
|
||
if (!hash_equals($_SESSION['cl_csrf'] ?? '', $csrf)) out(false, 'CSRF');
|
||
|
||
$dossier_id = (int)($_POST['dossier_id'] ?? 0);
|
||
if ($dossier_id<=0) out(false, 'Bad dossier');
|
||
|
||
// Owner
|
||
$st = $pdo->prepare("SELECT d.id, d.client_id FROM client_dossiers d WHERE d.id=:d AND d.praticien_id=:p AND d.archived_at IS NULL");
|
||
$st->execute([':d'=>$dossier_id, ':p'=>$praticien_id]);
|
||
$dos = $st->fetch(PDO::FETCH_ASSOC);
|
||
if(!$dos) out(false, 'Not allowed');
|
||
|
||
$date_rdv = (string)($_POST['date_rdv'] ?? '');
|
||
$type_rdv = (string)($_POST['type_rdv'] ?? 'autre');
|
||
$titre = trim((string)($_POST['titre'] ?? ''));
|
||
$notes = trim((string)($_POST['notes'] ?? ''));
|
||
$prochaine= trim((string)($_POST['prochaine_action'] ?? ''));
|
||
$duree = (int)($_POST['duree_minutes'] ?? 0);
|
||
|
||
if ($titre==='' || $notes==='') out(false, 'Champs requis');
|
||
|
||
try{
|
||
$pdo->beginTransaction();
|
||
$ins = $pdo->prepare("INSERT INTO client_suivi (dossier_id, rdv_id, date_rdv, type_rdv, titre, notes, prochaine_action, duree_minutes, prive)
|
||
VALUES (:d, NULL, :dt, :ty, :ti, :no, :pa, :du, 1)");
|
||
$ins->execute([
|
||
':d'=>$dossier_id,
|
||
':dt'=> (new DateTime($date_rdv ?: 'now'))->format('Y-m-d H:i:s'),
|
||
':ty'=> in_array($type_rdv,['online','cabinet','tel','autre'],true) ? $type_rdv : 'autre',
|
||
':ti'=> $titre,
|
||
':no'=> $notes,
|
||
':pa'=> ($prochaine !== '' ? $prochaine : null),
|
||
':du'=> ($duree > 0 ? $duree : null),
|
||
]);
|
||
$entry_id = (int)$pdo->lastInsertId();
|
||
|
||
// Upload files
|
||
if (!empty($_FILES['files']) && is_array($_FILES['files']['name'])) {
|
||
$baseDir = $_SERVER['DOCUMENT_ROOT'].'/uploads/suivi/'. $dossier_id;
|
||
if (!is_dir($baseDir)) @mkdir($baseDir, 0775, true);
|
||
|
||
$allowed = ['pdf','jpg','jpeg','png','doc','docx','txt'];
|
||
for($i=0;$i<count($_FILES['files']['name']);$i++){
|
||
$err = (int)($_FILES['files']['error'][$i] ?? UPLOAD_ERR_NO_FILE);
|
||
if ($err !== UPLOAD_ERR_OK) continue;
|
||
$name = (string)($_FILES['files']['name'][$i] ?? '');
|
||
$tmp = (string)($_FILES['files']['tmp_name'][$i] ?? '');
|
||
$size = (int)($_FILES['files']['size'][$i] ?? 0);
|
||
if ($size <= 0 || $size > 8*1024*1024) continue; // 8 Mo
|
||
$ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
|
||
if (!in_array($ext,$allowed,true)) continue;
|
||
|
||
$clean = preg_replace('~[^a-zA-Z0-9._-]+~','_', $name);
|
||
$new = $dossier_id.'_'.time().'_'.bin2hex(random_bytes(4)).'.'.$ext;
|
||
$dest = $baseDir.'/'.$new;
|
||
if (@move_uploaded_file($tmp, $dest)) {
|
||
$rel = '/uploads/suivi/'.$dossier_id.'/'.$new;
|
||
$mime= mime_content_type($dest) ?: null;
|
||
|
||
$pdo->prepare("INSERT INTO client_suivi_files (entry_id, path, mime, size_bytes) VALUES (:e,:p,:m,:s)")
|
||
->execute([':e'=>$entry_id, ':p'=>$rel, ':m'=>$mime, ':s'=>$size]);
|
||
}
|
||
}
|
||
}
|
||
|
||
$pdo->commit();
|
||
out(true, $translations['cl_enregistre_ok'] ?? 'Note enregistrée.');
|
||
}catch(Throwable $e){
|
||
if ($pdo->inTransaction()) $pdo->rollBack();
|
||
error_log('ajax_ajouter_note: '.$e->getMessage());
|
||
out(false, $translations['cl_enregistre_ko'] ?? 'Erreur lors de l’enregistrement.');
|
||
}
|