482 lines
18 KiB
PHP
482 lines
18 KiB
PHP
<?php
|
|
include('php/inc_functions.php');
|
|
require_once('php/inc_fx_messages.php');
|
|
|
|
$vPage = 'enregistrer.php';
|
|
global $db;
|
|
|
|
// Initialiser la variable option pour l'utiliser dans le switch plus bas
|
|
if (isset($_REQUEST['action']))
|
|
$action = $_REQUEST['action'];
|
|
elseif (isset($_POST['action']))
|
|
$action = $_POST['action'];
|
|
else
|
|
$action = 'Aucune action définie';
|
|
|
|
// MSIN-4401 — Actions autorisées en session compte promoteur (com_info), sans usa_id :
|
|
// prefs rapport, dossard récupéré (remis), validation questions, toggles listes rapports (actif).
|
|
// Les autres actions restent réservées au canal superadm (usa_id).
|
|
if (session_status() !== PHP_SESSION_ACTIVE) {
|
|
session_start();
|
|
}
|
|
|
|
$intComCompte = intval($_SESSION['com_info']['com_id'] ?? ($_SESSION['com_id'] ?? 0));
|
|
// Actions appelées depuis le site compte / rapports promoteur (sans usa_id).
|
|
$tabCompteActions = array(
|
|
'chksave',
|
|
'triechange',
|
|
'triecheckall',
|
|
'groupechange',
|
|
'remis', // dossard récupéré (compte / gestion V2)
|
|
'validequestion', // validation questions adhésion (inc_tableau_mail_questions)
|
|
'actif', // oui/non listes rapports custom (+ cadeaux MEC)
|
|
);
|
|
$blnComptePromoteur = in_array($action, $tabCompteActions, true)
|
|
&& $intComCompte > 0
|
|
&& empty($_SESSION['usa_id']);
|
|
|
|
if ($blnComptePromoteur) {
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
|
|
if ($action === 'remis') {
|
|
// Forcer l'identité + cibles (évite spoofing POST).
|
|
$strParNom = trim(
|
|
(string)($_SESSION['com_info']['com_prenom'] ?? '')
|
|
. ' '
|
|
. (string)($_SESSION['com_info']['com_nom'] ?? '')
|
|
);
|
|
if ($strParNom === '') {
|
|
$strParNom = 'compte#' . $intComCompte;
|
|
}
|
|
$_REQUEST['par_id'] = $intComCompte;
|
|
$_REQUEST['par'] = $strParNom;
|
|
$_REQUEST['table'] = urlencode(base64_encode('resultats_participants'));
|
|
$_REQUEST['field'] = 'no_bib_remis';
|
|
$_REQUEST['key'] = 'par_id';
|
|
if (isset($_POST['par_id'])) {
|
|
$_POST['par_id'] = $_REQUEST['par_id'];
|
|
}
|
|
if (isset($_POST['par'])) {
|
|
$_POST['par'] = $_REQUEST['par'];
|
|
}
|
|
if (isset($_POST['table'])) {
|
|
$_POST['table'] = $_REQUEST['table'];
|
|
}
|
|
if (isset($_POST['field'])) {
|
|
$_POST['field'] = $_REQUEST['field'];
|
|
}
|
|
if (isset($_POST['key'])) {
|
|
$_POST['key'] = $_REQUEST['key'];
|
|
}
|
|
|
|
// Droit sur l'événement du participant (Legacy com_eve_promoteur OU V2 bib_remis).
|
|
$intParCible = intval($_REQUEST['id'] ?? 0);
|
|
$blnOkRemis = false;
|
|
if ($intParCible > 0) {
|
|
$intEveCible = intval($db->fxGetVar(
|
|
'SELECT eve_id FROM resultats_participants WHERE par_id = ' . $intParCible . ' LIMIT 1'
|
|
));
|
|
if ($intEveCible > 0) {
|
|
$strEvePromoteur = (string)$db->fxGetVar(
|
|
'SELECT com_eve_promoteur FROM inscriptions_comptes WHERE com_id = ' . $intComCompte . ' LIMIT 1'
|
|
);
|
|
$arrEvePromo = array_filter(array_map('intval', explode(',', $strEvePromoteur)));
|
|
if (in_array($intEveCible, $arrEvePromo, true)) {
|
|
$blnOkRemis = true;
|
|
} else {
|
|
if (!function_exists('fxEveAccesHasPermission')) {
|
|
require_once dirname(__DIR__) . '/php/inc_fx_eve_acces.php';
|
|
}
|
|
$blnOkRemis = fxEveAccesHasPermission(
|
|
$intComCompte,
|
|
$intEveCible,
|
|
'inscriptions_gestion.bib_remis'
|
|
);
|
|
}
|
|
}
|
|
}
|
|
if (!$blnOkRemis) {
|
|
echo json_encode(array(
|
|
'state' => 'error',
|
|
'message' => 'Accès refusé pour ce dossard récupéré.',
|
|
'code' => 'forbidden',
|
|
));
|
|
exit;
|
|
}
|
|
} elseif ($action === 'actif') {
|
|
// Listes rapports custom : table = men_id encodé — vérifier le droit rapport.
|
|
$intMenuRapport = intval(base64_decode(urldecode((string)($_REQUEST['table'] ?? ''))));
|
|
if ($intMenuRapport <= 0 || !fxSuperadmReportMenuAllowed($intMenuRapport)) {
|
|
echo json_encode(array(
|
|
'state' => 'error',
|
|
'message' => 'Accès refusé pour cette action.',
|
|
'code' => 'forbidden',
|
|
));
|
|
exit;
|
|
}
|
|
} elseif ($action === 'validequestion') {
|
|
// Page compte mail questions — le promoteur doit avoir un accès événement (legacy ou V2).
|
|
$blnOkQuestion = false;
|
|
$strEvePromoteur = (string)$db->fxGetVar(
|
|
'SELECT com_eve_promoteur FROM inscriptions_comptes WHERE com_id = ' . $intComCompte . ' LIMIT 1'
|
|
);
|
|
if (trim($strEvePromoteur) !== '') {
|
|
$blnOkQuestion = true;
|
|
} else {
|
|
if (!function_exists('fxEveAccesComHasV2')) {
|
|
require_once dirname(__DIR__) . '/php/inc_fx_eve_acces.php';
|
|
}
|
|
$blnOkQuestion = fxEveAccesComHasV2($intComCompte);
|
|
}
|
|
if (!$blnOkQuestion) {
|
|
echo json_encode(array(
|
|
'state' => 'error',
|
|
'message' => 'Accès refusé pour cette validation.',
|
|
'code' => 'forbidden',
|
|
));
|
|
exit;
|
|
}
|
|
} else {
|
|
// Prefs rapport : ne jamais laisser le promoteur écrire un autre com_id
|
|
$_REQUEST['key'] = $intComCompte;
|
|
if (isset($_POST['key'])) {
|
|
$_POST['key'] = $_REQUEST['key'];
|
|
}
|
|
}
|
|
} else {
|
|
fxSuperadmAjaxAuthOrJsonExit();
|
|
}
|
|
|
|
// Switch pour gérer les enregistrement à faire
|
|
switch ($action) {
|
|
case 'actif': // Code pour changer actif/inactif
|
|
$intMenu = base64_decode(urldecode($_REQUEST['table']));
|
|
$tabRetour['pnq_cadeau'] = '';
|
|
|
|
$sqlMenu = "SELECT men_table FROM adm_menus WHERE men_id = " . intval($intMenu);
|
|
$strTable = $db->fxGetVar($sqlMenu);
|
|
//$strTable = $intMenu;
|
|
|
|
$sqlUpdate = "UPDATE " . $db->fxEscape($strTable) . " SET " . $db->fxEscape($_REQUEST['field']) . " = " . intval($_REQUEST['valeur']) . " WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);
|
|
$qryUpdate = $db->fxQuery($sqlUpdate);
|
|
|
|
if ($qryUpdate === false) {
|
|
$tabRetour['state'] = 'erreur';
|
|
} else {
|
|
$tabRetour['state'] = 'success';
|
|
}
|
|
|
|
// PATCH TEMPO MSIN-633 - Mettre à jour la date de récupération du cadeau
|
|
if (strstr($_REQUEST['field'], 'pnq_cadeau')) {
|
|
fxcreer_log($_REQUEST['field'] . "," . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']), 10, 0, 0, 0, intval($_REQUEST['id']));
|
|
$strDate = $tabRetour['pnq_cadeau'] = fxGetDateTime();
|
|
|
|
$sqlUpdate = "UPDATE resultats_participants SET " . $db->fxEscape($_REQUEST['field']) . "_date = '" . $strDate . "' WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);
|
|
$qryUpdate = $db->fxQuery($sqlUpdate);
|
|
}
|
|
|
|
//header("Location: " . $_SERVER['HTTP_REFERER']);
|
|
echo json_encode($tabRetour);
|
|
break;
|
|
case 'actif2': // Code pour changer actif/inactif
|
|
$strTable = base64_decode(urldecode($_REQUEST['table']));
|
|
|
|
$sqlUpdate = "UPDATE " . $db->fxEscape($strTable) . " SET " . $db->fxEscape($_REQUEST['field']) . " = " . intval($_REQUEST['valeur']) . " WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);
|
|
|
|
|
|
$qryUpdate = $db->fxQuery($sqlUpdate);
|
|
|
|
if ($qryUpdate === false) {
|
|
$tabRetour['state'] = 'erreur';
|
|
|
|
|
|
} else {
|
|
$tabRetour['state'] = 'success';
|
|
|
|
}
|
|
|
|
echo json_encode($tabRetour);
|
|
break;
|
|
case 'delete2': // Code pour changer actif/inactif
|
|
$strTable = base64_decode(urldecode($_REQUEST['table']));
|
|
$intMenu = base64_decode(urldecode($_REQUEST['table']));
|
|
|
|
|
|
$sqlMenu = "SELECT men_table FROM adm_menus WHERE men_id = " . intval($intMenu);
|
|
$strTable = $db->fxGetVar($sqlMenu);
|
|
//$strTable = $intMenu;
|
|
$sqlUpdate = "delete from " . $db->fxEscape($strTable) . " WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);
|
|
|
|
$qryUpdate = $db->fxQuery($sqlUpdate);
|
|
;
|
|
if ($qryUpdate === false) {
|
|
$tabRetour['state'] = 'erreur';
|
|
|
|
|
|
} else {
|
|
$tabRetour['state'] = 'success';
|
|
|
|
}
|
|
|
|
echo json_encode($tabRetour);
|
|
break;
|
|
case 'validequestion': // changer la valeur du label
|
|
if ($_REQUEST['valeur'] == 1) {
|
|
$sqlUpdate = "UPDATE memberships_reponses SET mr_valider_date=now(), mr_valider = '" . $_REQUEST['valeur'] . "' WHERE mr_id = " . intval($_REQUEST['key']);
|
|
|
|
} else {
|
|
$sqlUpdate = "UPDATE memberships_reponses SET mr_valider_date=null, mr_valider = '" . $_REQUEST['valeur'] . "' WHERE mr_id = " . intval($_REQUEST['key']);
|
|
|
|
}
|
|
|
|
$qryUpdate = $db->fxQuery($sqlUpdate);
|
|
|
|
if ($qryUpdate === false) {
|
|
$tabRetour['state'] = 'erreur';
|
|
|
|
|
|
} else {
|
|
$tabRetour['state'] = 'success';
|
|
|
|
}
|
|
|
|
echo json_encode($tabRetour);
|
|
break;
|
|
case 'banquequestion': // changer la valeur du label
|
|
|
|
$sqlUpdate = "UPDATE inscriptions_questions SET que_banque_label = '" . $_REQUEST['valeur'] . "' WHERE que_id = " . intval($_REQUEST['id']);
|
|
|
|
$qryUpdate = $db->fxQuery($sqlUpdate);
|
|
|
|
if ($qryUpdate === false) {
|
|
$tabRetour['state'] = 'erreur';
|
|
|
|
|
|
} else {
|
|
$tabRetour['state'] = 'success';
|
|
|
|
}
|
|
|
|
echo json_encode($tabRetour);
|
|
break;
|
|
case 'remis': // Code pour changer actif/inactif
|
|
$strTable = base64_decode(urldecode($_REQUEST['table']));
|
|
$intParCibleAudit = intval($_REQUEST['id'] ?? 0);
|
|
$intNewRemis = intval($_REQUEST['valeur'] ?? 0);
|
|
// MSIN-4464 — ancienne valeur avant UPDATE (si whitelist no_bib_remis / last_touch).
|
|
$strOldRemis = '';
|
|
$intEveRemis = 0;
|
|
if ($intParCibleAudit > 0) {
|
|
$rowRemisAvant = $db->fxGetRow(
|
|
'SELECT no_bib_remis, eve_id FROM resultats_participants WHERE par_id = '
|
|
. $intParCibleAudit . ' LIMIT 1'
|
|
);
|
|
if (is_array($rowRemisAvant)) {
|
|
$strOldRemis = (string)intval($rowRemisAvant['no_bib_remis'] ?? 0);
|
|
$intEveRemis = intval($rowRemisAvant['eve_id'] ?? 0);
|
|
}
|
|
}
|
|
|
|
$sqlUpdate = "UPDATE " . $db->fxEscape($strTable) . " SET no_bib_remis_par_id='" . intval($_REQUEST['par_id']) . "',no_bib_remis_par='" . $db->fxEscape($_REQUEST['par']) . "',no_bib_remis_date = now(),par_maj = par_maj," . $db->fxEscape($_REQUEST['field']) . " = " . intval($_REQUEST['valeur']) . " WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);
|
|
|
|
|
|
$qryUpdate = $db->fxQuery($sqlUpdate);
|
|
|
|
if ($qryUpdate === false) {
|
|
$tabRetour['state'] = 'erreur';
|
|
} else {
|
|
|
|
$sqlResult = "SELECT * FROM " . $db->fxEscape($strTable) . " WHERE " . $db->fxEscape($_REQUEST['key']) . " = " . intval($_REQUEST['id']);
|
|
$infoParticipant = $db->fxGetRow($sqlResult);
|
|
|
|
|
|
$tabRetour['state'] = 'success';
|
|
$tabRetour['result'] = $infoParticipant;
|
|
|
|
if ($intParCibleAudit > 0) {
|
|
if (!function_exists('fxFicheAuditRecordChange')) {
|
|
require_once dirname(__DIR__) . '/php/inc_fx_fiche_audit.php';
|
|
}
|
|
fxFicheAuditRecordChange(
|
|
$intParCibleAudit,
|
|
'no_bib_remis',
|
|
$strOldRemis,
|
|
(string)$intNewRemis,
|
|
'bib_remis',
|
|
$intEveRemis
|
|
);
|
|
}
|
|
|
|
}
|
|
|
|
echo json_encode($tabRetour);
|
|
|
|
break;
|
|
case 'change-var': // Code pour changer une variable
|
|
$strKey = $db->fxEscape($_REQUEST['key']);
|
|
$intVal = intval($_REQUEST['valeur']);
|
|
$intExists = intval($db->fxGetVar(
|
|
"SELECT COUNT(*) FROM variables WHERE var_nom = '" . $strKey . "'"
|
|
));
|
|
|
|
if ($intExists > 0) {
|
|
$sqlUpdate = "UPDATE variables SET var_valeur = " . $intVal
|
|
. " WHERE var_nom = '" . $strKey . "'";
|
|
} else {
|
|
$sqlUpdate = "INSERT INTO variables (var_nom, var_valeur) VALUES ('"
|
|
. $strKey . "', " . $intVal . ")";
|
|
}
|
|
|
|
$qryUpdate = $db->fxQuery($sqlUpdate);
|
|
|
|
if ($qryUpdate === false) {
|
|
$tabRetour['state'] = 'erreur';
|
|
} else {
|
|
$tabRetour['state'] = 'success';
|
|
}
|
|
|
|
echo json_encode($tabRetour);
|
|
break;
|
|
case 'update-panier':
|
|
fxUpdateInfosPanier($_REQUEST['table'], $_REQUEST['id']);
|
|
|
|
//header("Location: " . $_SERVER['HTTP_REFERER']);
|
|
break;
|
|
case 'influences_on':
|
|
$arrReturn = array(
|
|
'state' => 'Erreur lors du chargement de la liste.'
|
|
);
|
|
|
|
if (!empty($_REQUEST['influenced'])) { // vérifier si les paramètres sonr définis
|
|
$arrInfluenced = explode(',', urldecode(trim($_REQUEST['influenced'])));
|
|
$strKey = (!empty($_REQUEST['key'])) ? trim($_REQUEST['key']) : '';
|
|
$intValue = (!empty($_REQUEST['value'])) ? intval(trim($_REQUEST['value'])) : '';
|
|
$intMenu = (!empty($_REQUEST['men_id'])) ? trim($_REQUEST['men_id']) : 0;
|
|
|
|
foreach ($arrInfluenced as $strSelect) { // bouble parmi les champs à modifier
|
|
// Trouver la requête à modifier
|
|
$sqlQuery = "SELECT lab_list FROM adm_labels WHERE lab_code = '" . $db->fxEscape($strSelect) . "' AND men_id = " . intval($intMenu);
|
|
$strQuery = $db->fxGetVar($sqlQuery);
|
|
|
|
$sqlData = str_replace('%' . $strKey . '%', $intValue, $strQuery); // remplacer la clé par la valeur
|
|
$arrData = $db->fxGetResults($sqlData); // trouver le résultat
|
|
|
|
if ($arrData != null) { // si aucune errveur, indiquer "success"
|
|
$arrReturn['state'] = 'success';
|
|
$arrReturn['data'] = array($strSelect => $arrData);
|
|
}
|
|
}
|
|
}
|
|
|
|
echo json_encode($arrReturn);
|
|
break;
|
|
case 'chksave':
|
|
|
|
$result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'chk_col', $_REQUEST['chk_col'], 1, 1);
|
|
$result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'chk_ques', $_REQUEST['chk_ques'], 1, 1);
|
|
$arrReturn['state'] = 'success';
|
|
|
|
|
|
echo json_encode($arrReturn);
|
|
break;
|
|
|
|
case 'triecheckall':
|
|
|
|
$result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie', 'N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N,N', 1, 1);
|
|
|
|
|
|
$result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_ordre', '0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0', 1, 1);
|
|
$tabRetour['state'] = 'success';
|
|
|
|
|
|
echo json_encode($tabRetour);
|
|
|
|
break;
|
|
case 'groupechange':
|
|
|
|
$result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_groupe', $_REQUEST['groupe'] , 1, 1);
|
|
$tabRetour['state'] = 'success';
|
|
|
|
|
|
echo json_encode($tabRetour);
|
|
|
|
break;
|
|
|
|
case 'triechange':
|
|
|
|
$result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie', ' ', 0, 1);
|
|
$keytrie = explode(',', $result);
|
|
|
|
switch ($_REQUEST['trie']) {
|
|
case 'A':
|
|
$mem_trie = 'D';
|
|
break;
|
|
case 'D':
|
|
$mem_trie = 'N';
|
|
break;
|
|
case 'N':
|
|
$mem_trie = 'A';
|
|
break;
|
|
}
|
|
$keytrie[$_REQUEST['index'] - 1] = $mem_trie;
|
|
$mem_string = implode(',', $keytrie);
|
|
$result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie', $mem_string, 1, 1);
|
|
|
|
if ($mem_trie == 'N') {
|
|
$result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_ordre', ' ', 0, 1);
|
|
$keytrie = explode(',', $result);
|
|
$mem_ordre = $keytrie[$_REQUEST['index'] - 1];
|
|
$keytrie[$_REQUEST['index'] - 1] = 0;
|
|
for ($intCtrcol = 0; $intCtrcol <= count($keytrie); $intCtrcol++) {
|
|
if ($keytrie[$intCtrcol] > $mem_ordre)
|
|
$keytrie[$intCtrcol] = $keytrie[$intCtrcol] - 1;
|
|
}
|
|
|
|
$mem_string = implode(',', $keytrie);
|
|
$result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_ordre', $mem_string, 1, 1);
|
|
|
|
}
|
|
if ($mem_trie == 'A') {
|
|
$result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_ordre', ' ', 0, 1);
|
|
$keytrie = explode(',', $result);
|
|
$mem_ordre = $keytrie[$_REQUEST['index'] - 1];
|
|
|
|
$memmax = max($keytrie);
|
|
$keytrie[$_REQUEST['index'] - 1] = $memmax + 1;
|
|
$mem_string = implode(',', $keytrie);
|
|
$result = conf_getFiltreData($_REQUEST['key'], 'rapp_chronoquestion', 'trie_ordre', $mem_string, 1, 1);
|
|
|
|
}
|
|
//echo '<br><pre>';
|
|
//print_r($keytrie);
|
|
//echo '</pre>';
|
|
|
|
|
|
$arrReturn['state'] = 'success';
|
|
|
|
|
|
echo json_encode($arrReturn);
|
|
|
|
|
|
break;
|
|
case 'delete':
|
|
$arrReturn = array(
|
|
'state' => 'Erreur lors de la suppression de l\'item.'
|
|
);
|
|
|
|
$qryDelete = fxSetForm('del', $_REQUEST['men_id'], $_REQUEST, '');
|
|
|
|
if ($qryDelete !== false) {
|
|
$arrReturn['state'] = 'success';
|
|
}
|
|
|
|
echo json_encode($arrReturn);
|
|
break;
|
|
case 'delete_file':
|
|
$arrReturn = fxDeleteFile($_REQUEST['men_id'], $_REQUEST['key'], $_REQUEST['file']);
|
|
|
|
echo json_encode($arrReturn);
|
|
break;
|
|
default:
|
|
echo "Une erreur s'est produite au niveau de '" . $action . "'";
|
|
} |