32 lines
1.1 KiB
PHP
32 lines
1.1 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../includes/init_praticien.php';
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
function out($ok,$m){ echo json_encode(['ok'=>$ok,'message'=>$m]); exit; }
|
|
|
|
$praticien_id = (int)($_SESSION['reference_id'] ?? 0);
|
|
$csrf=(string)($_POST['csrf'] ?? '');
|
|
if (!hash_equals($_SESSION['cl_csrf'] ?? '', $csrf)) out(false,'CSRF');
|
|
|
|
$file_id = (int)($_POST['file_id'] ?? 0);
|
|
if ($file_id<=0) out(false,'Bad file');
|
|
|
|
$sql = "SELECT f.id, f.path
|
|
FROM client_suivi_files f
|
|
JOIN client_suivi s ON s.id=f.entry_id
|
|
JOIN client_dossiers d ON d.id=s.dossier_id
|
|
WHERE f.id=:id AND d.praticien_id=:p AND d.archived_at IS NULL";
|
|
$st = $pdo->prepare($sql);
|
|
$st->execute([':id'=>$file_id, ':p'=>$praticien_id]);
|
|
$row = $st->fetch(PDO::FETCH_ASSOC);
|
|
if(!$row) out(false,'Not allowed');
|
|
|
|
$pdo->beginTransaction();
|
|
$pdo->prepare("DELETE FROM client_suivi_files WHERE id=:id")->execute([':id'=>$file_id]);
|
|
$pdo->commit();
|
|
|
|
// Supprime le fichier disque (best-effort)
|
|
$abs = rtrim((string)$_SERVER['DOCUMENT_ROOT'],'/').(string)$row['path'];
|
|
if (is_file($abs)) @unlink($abs);
|
|
|
|
out(true,'OK');
|