MyVivarium-2/maintenance.php at main · robinson-vidva/MyVivarium-2 · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
<?php

/**
 * Maintenance Management Script
 *
 * This script handles the addition of maintenance records, allowing for the selection of cages and optional comments.
 */

// Start a new session or resume the existing session
require 'session_config.php';

// Include the database connection file
require 'dbcon.php';

// Include the role capability matrix
require_once 'services/roles.php';

// Disable error display in production (errors logged to server logs)
error_reporting(E_ALL);
ini_set('display_errors', 0);

// Check if the user is not logged in, redirect them to index.php with the current URL for redirection after login
if (!isset($_SESSION['username'])) {
    $currentUrl = urlencode($_SERVER['REQUEST_URI']);
    header("Location: index.php?redirect=$currentUrl");
    exit; // Exit to ensure no further code is executed
}

// Role gate: view-only IACUC members may not log maintenance notes. (Vivarium
// managers and veterinarians still can.)
if (!role_can_add_note($_SESSION['role'] ?? null)) {
    $_SESSION['message'] = 'Your role does not have permission to add maintenance records.';
    header("Location: hc_dash.php");
    exit;
}

// Generate a CSRF token if it doesn't exist
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

// Capture the 'from' query parameter for redirection purposes
$redirectFrom = isset($_GET['from']) ? $_GET['from'] : 'hc_dash';
$_SESSION['redirect_from'] = $redirectFrom;

// Query to retrieve cage IDs
$cageQuery = "SELECT cage_id FROM cages";
$cageResult = $con->query($cageQuery);

// Initialize an array to hold all cage options
$cageOptions = [];
while ($cageRow = $cageResult->fetch_assoc()) {
    $cageOptions[] = htmlspecialchars($cageRow['cage_id']);
}

// Process the form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    // Validate CSRF token
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF token validation failed');
    }

    // Retrieve and sanitize form data
    $selectedCages = $_POST['cage_id'];
    $comments = $_POST['comments'];
    $userId = $_SESSION['user_id']; // Assume user session is started and user_id is stored in session

    $stmt = $con->prepare("INSERT INTO maintenance (cage_id, user_id, comments) VALUES (?, ?, ?)");

    foreach ($selectedCages as $index => $cage_id) {
        $comment = !empty($comments[$index]) ? $comments[$index] : null;
        $stmt->bind_param("sis", $cage_id, $userId, $comment);
        $stmt->execute();
    }

    // Set success message and redirect based on the originating page
    $_SESSION['message'] = 'Maintenance records added successfully.';
    $redirectUrl = $redirectFrom === 'bc_dash' ? 'bc_dash.php' : 'hc_dash.php';
    header("Location: $redirectUrl");
    exit();
}

// Include the header file
require 'header.php';
?>

<!DOCTYPE html>
<html lang="en">

<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Cage Maintenance</title>
    <!-- Select2 CSS loaded via header.php -->
    <!-- jQuery loaded via header.php -->
    <script src="https://cdnjs.cloudflare.com/ajax/libs/select2/4.0.13/js/select2.min.js"></script>
    <!-- Bootstrap 5.3 loaded via header.php -->
    <style>
        .container {
            max-width: 900px;
            background-color: var(--bs-tertiary-bg);
            padding: 20px;
            border-radius: 8px;
            margin-top: 20px;
            box-shadow: 0 2px 4px rgba(0, 0, 0, 0.1);
        }

        .form-label {
            font-weight: bold;
        }

        .btn-primary {
            margin-right: 10px;
        }

        .card-header {
            display: flex;
            justify-content: space-between;
            align-items: center;
        }

        .action-buttons {
            display: flex;
        }

        .mb-3 {
            margin-bottom: 1rem;
        }

        .form-control {
            margin-bottom: 1rem;
        }

        .action-icons a {
            margin-right: 10px;
            margin-bottom: 10px;
        }
    </style>
</head>

<body>

    <div class="container content mt-4">

        <div class="row">
            <div class="col-md-12">
                <div class="card">
                    <div class="card-header d-flex justify-content-between align-items-center">
                        <h1 class="mb-0">Add Cage Maintenance Record</h1>
                        <div class="action-buttons">
                            <!-- Button to go back to the previous page -->
                            <a href="javascript:void(0);" onclick="goBack()" class="btn btn-primary btn-sm btn-icon" data-bs-toggle="tooltip" data-bs-placement="top" title="Go Back">
                                <i class="fas fa-arrow-circle-left"></i>
                            </a>
                            <!-- Button to save the form -->
                            <a href="javascript:void(0);" onclick="document.getElementById('editForm').submit();" class="btn btn-success btn-sm btn-icon" data-bs-toggle="tooltip" data-bs-placement="top" title="Save">
                                <i class="fas fa-save"></i>
                            </a>
                        </div>
                    </div>

                    <div class="card-body">
                        <form method="post">
                            <input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($_SESSION['csrf_token']); ?>">
                            <div class="mb-3">
                                <label for="cage_id" class="form-label">Select Cages (multi select)</label>
                                <select id="cage_id" name="cage_id[]" multiple="multiple" style="width: 100%;" required>
                                    <?php foreach ($cageOptions as $cage_id) : ?>
                                        <option value="<?php echo $cage_id; ?>"><?php echo $cage_id; ?></option>
                                    <?php endforeach; ?>
                                </select>
                            </div>
                            <div id="comments-section"></div>
                            <button type="submit" class="btn btn-primary">Submit</button>
                        </form>
                    </div>
                </div>
            </div>
        </div>
    </div>

    <script>
        function goBack() {
            window.history.back();
        }

        $(document).ready(function() {
            $('#cage_id').select2();

            $('#cage_id').on('change', function() {
                let selectedCages = $(this).val();
                let commentsSection = $('#comments-section');
                commentsSection.empty();

                if (selectedCages.length > 0) {
                    selectedCages.forEach(function(cage_id, index) {
                        commentsSection.append(`
                            <div class="mb-3">
                                <label for="comments[${index}]" class="form-label">Comment for ${cage_id}:</label>
                                <textarea name="comments[]" class="form-control" placeholder="Optional comment"></textarea>
                                <input type="hidden" name="cage_id_hidden[]" value="${cage_id}">
                            </div>
                        `);
                    });
                }
            });
        });
    </script>

    <?php include 'footer.php'; ?> <!-- Include footer file -->
</body>

</html>