We go above and beyond to make your travel dreams reality hidden gems and must-see attractions
diff --git a/src/processors/blog/autosave.php b/src/processors/blog/autosave.php index 81040696..3d8e2c8d 100644 --- a/src/processors/blog/autosave.php +++ b/src/processors/blog/autosave.php @@ -5,6 +5,11 @@ require_once($rootPath . "/src/config/connection.php"); require_once($rootPath . "/src/config/functions.php"); session_start(); +// Enable error reporting for debugging +error_reporting(E_ALL); +ini_set('display_errors', 0); // Don't display, but log them +ini_set('log_errors', 1); + if (!isset($_SESSION['user_id'])) { http_response_code(401); echo "Not authorized"; @@ -32,36 +37,42 @@ echo $author_id; $cover_image_path = null; // Only attempt upload if a file was submitted -if (!empty($_FILES['cover_image']['name'])) { +if (!empty($_FILES['cover_image']['name']) && $_FILES['cover_image']['error'] === UPLOAD_ERR_OK) { $uploadDir = $rootPath . "/uploads/blogs/" . $article_id . "/"; - if (!is_dir($uploadDir)) { - mkdir($uploadDir, 0755, true); + + // Create directory if it doesn't exist (match working pattern) + if (!file_exists($uploadDir)) { + mkdir($uploadDir, 0777, true); } - // Validate file using existing function - $file_result = validateFileUpload($_FILES['cover_image'], 'profile_picture'); - if ($file_result === false) { + // Simple validation - check extension + $extension = strtolower(pathinfo($_FILES['cover_image']['name'], PATHINFO_EXTENSION)); + $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif', 'webp']; + + if (!in_array($extension, $allowedExtensions)) { http_response_code(400); - echo "Invalid file upload"; + echo "Invalid file type. Allowed: jpg, jpeg, png, gif, webp"; exit; } // Use fixed filename "cover" to avoid creating multiple copies on autosave - $extension = $file_result['extension']; $filename = "cover." . $extension; // Delete old cover if it exists with different extension - array_map('unlink', glob($uploadDir . "cover.*")); + $oldCovers = glob($uploadDir . "cover.*"); + if ($oldCovers) { + foreach ($oldCovers as $oldCover) { + @unlink($oldCover); + } + } $targetPath = $uploadDir . $filename; $cover_image_path = "/uploads/blogs/" . $article_id . "/" . $filename; // Move the uploaded file - if (move_uploaded_file($_FILES['cover_image']['tmp_name'], $targetPath)) { - // File moved successfully, $cover_image_path is set - } else { + if (!move_uploaded_file($_FILES['cover_image']['tmp_name'], $targetPath)) { http_response_code(500); - echo "Failed to move uploaded file."; + echo "Failed to move uploaded file"; exit; } } diff --git a/src/processors/blog/submit_blog.php b/src/processors/blog/submit_blog.php index 4fa4b94e..a0872b6a 100644 --- a/src/processors/blog/submit_blog.php +++ b/src/processors/blog/submit_blog.php @@ -26,8 +26,8 @@ if (isset($_FILES['cover_image']) && $_FILES['cover_image']['error'] === UPLOAD_ $upload_dir = $rootPath . '/uploads/blogs/' . $folder_id . '/'; // Create directory if it doesn't exist - if (!is_dir($upload_dir)) { - mkdir($upload_dir, 0755, true); + if (!file_exists($upload_dir)) { + mkdir($upload_dir, 0777, true); } // Validate and process the file diff --git a/src/processors/delete_event.php b/src/processors/delete_event.php index 152ae71f..b1225752 100644 --- a/src/processors/delete_event.php +++ b/src/processors/delete_event.php @@ -1,46 +1,76 @@ - 'error', 'message' => 'Event ID is required']); +// Start session if not already started +if (session_status() === PHP_SESSION_NONE) { + session_start(); +} + +// Check admin status +if (empty($_SESSION['user_id'])) { + ob_end_clean(); + echo json_encode(['status' => 'error', 'message' => 'Unauthorized access']); exit; } -// Get event details to delete associated files -$stmt = $conn->prepare("SELECT image, promo FROM events WHERE event_id = ?"); -$stmt->bind_param("i", $event_id); -$stmt->execute(); -$result = $stmt->get_result(); - -if ($result->num_rows > 0) { - $event = $result->fetch_assoc(); - - // Delete image files - if ($event['image'] && file_exists($rootPath . '/' . $event['image'])) { - unlink($rootPath . '/' . $event['image']); - } - if ($event['promo'] && file_exists($rootPath . '/' . $event['promo'])) { - unlink($rootPath . '/' . $event['promo']); - } - - // Delete from database - $delete_stmt = $conn->prepare("DELETE FROM events WHERE event_id = ?"); - $delete_stmt->bind_param("i", $event_id); - - if ($delete_stmt->execute()) { - echo json_encode(['status' => 'success', 'message' => 'Event deleted successfully']); - } else { - echo json_encode(['status' => 'error', 'message' => 'Failed to delete event']); - } - $delete_stmt->close(); -} else { - echo json_encode(['status' => 'error', 'message' => 'Event not found']); +$user_role = getUserRole(); +if (!in_array($user_role, ['admin', 'superadmin'])) { + ob_end_clean(); + echo json_encode(['status' => 'error', 'message' => 'Unauthorized access']); + exit; } -$stmt->close(); +try { + $event_id = intval($_POST['event_id'] ?? 0); + + if ($event_id <= 0) { + throw new Exception('Invalid event ID'); + } + + // Get event details to delete associated files + $stmt = $conn->prepare("SELECT image, promo FROM events WHERE event_id = ?"); + $stmt->bind_param("i", $event_id); + $stmt->execute(); + $result = $stmt->get_result(); + + if ($result->num_rows > 0) { + $event = $result->fetch_assoc(); + + // Delete image files + if ($event['image'] && file_exists($rootPath . '/' . $event['image'])) { + unlink($rootPath . '/' . $event['image']); + } + if ($event['promo'] && file_exists($rootPath . '/' . $event['promo'])) { + unlink($rootPath . '/' . $event['promo']); + } + + // Delete from database + $delete_stmt = $conn->prepare("DELETE FROM events WHERE event_id = ?"); + $delete_stmt->bind_param("i", $event_id); + + if ($delete_stmt->execute()) { + ob_end_clean(); + echo json_encode(['status' => 'success', 'message' => 'Event deleted successfully']); + } else { + ob_end_clean(); + echo json_encode(['status' => 'error', 'message' => 'Failed to delete event']); + } + $delete_stmt->close(); + } else { + ob_end_clean(); + echo json_encode(['status' => 'error', 'message' => 'Event not found']); + } + + $stmt->close(); + +} catch (Exception $e) { + ob_end_clean(); + echo json_encode(['status' => 'error', 'message' => $e->getMessage()]); +} diff --git a/src/processors/process_application.php b/src/processors/process_application.php index f9263c82..b3347e0b 100644 --- a/src/processors/process_application.php +++ b/src/processors/process_application.php @@ -174,28 +174,34 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { if ($stmt->execute()) { // Insert into the membership fees table - $payment_amount = calculateProrata(210); // Assuming a fixed membership fee, adjust as needed - $payment_date = date('Y-m-d'); - $membership_start_date = $payment_date; - // $membership_end_date = date('Y-12-31'); - - // Get today's date $today = new DateTime(); + $month = (int)$today->format('n'); + $year = (int)$today->format('Y'); + $payment_date = $today->format('Y-m-d'); + $membership_start_date = $payment_date; - // Determine the target February - if ($today->format('n') > 2) { - // If we're past February, target is next year's Feb 28/29 - $year = $today->format('Y') + 1; + if ($month == 12 || $month == 1 || $month == 2) { + // December, January, February: charge full fee, valid till end of next Feb + $payment_amount = getPriceByDescription('membership_fees'); + // If Dec, Jan, Feb, set end to next year's Feb + $end_year = ($month == 12) ? $year + 2 : $year + 1; + $membership_end_date = (new DateTime("$end_year-02-01")) + ->modify('last day of this month') + ->format('Y-m-d'); } else { - // Otherwise, this year's February - $year = $today->format('Y'); + // Prorata for Mar-Nov + $payment_amount = calculateProrata(getPriceByDescription('pro_rata')); + // End of next Feb if after Feb, else this Feb + if ($month > 2) { + $end_year = $year + 1; + } else { + $end_year = $year; + } + $membership_end_date = (new DateTime("$end_year-02-01")) + ->modify('last day of this month') + ->format('Y-m-d'); } - // Handle leap year (Feb 29) automatically - $membership_end_date = (new DateTime("$year-02-01")) - ->modify('last day of this month') - ->format('Y-m-d'); - $stmt = $conn->prepare("INSERT INTO membership_fees (user_id, payment_amount, payment_date, membership_start_date, membership_end_date, payment_status, payment_id) VALUES (?, ?, ?, ?, ?, 'PENDING', ?)"); $stmt->bind_param("idssss", $user_id, $payment_amount, $payment_date, $membership_start_date, $membership_end_date, $eft_id); diff --git a/src/processors/process_event.php b/src/processors/process_event.php index 3a4e2575..cc352ab4 100644 --- a/src/processors/process_event.php +++ b/src/processors/process_event.php @@ -78,19 +78,17 @@ if (!$name || !$type || !$location || !$date || !$time || !$feature || !$descrip $image_path = null; if (!empty($_FILES['image']['name'])) { $upload_dir = $rootPath . '/assets/images/events/'; - if (!is_dir($upload_dir)) { - mkdir($upload_dir, 0755, true); + if (!file_exists($upload_dir)) { + mkdir($upload_dir, 0777, true); } $file_name = uniqid() . '_' . basename($_FILES['image']['name']); $target_file = $upload_dir . $file_name; - $finfo = finfo_open(FILEINFO_MIME_TYPE); - $file_type = finfo_file($finfo, $_FILES['image']['tmp_name']); - finfo_close($finfo); - // Validate image file - $allowed_types = ['image/jpeg', 'image/png', 'image/gif', 'image/webp']; - if (!in_array($file_type, $allowed_types)) { + // Validate file extension + $ext = strtolower(pathinfo($file_name, PATHINFO_EXTENSION)); + $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'webp']; + if (!in_array($ext, $allowed_extensions)) { echo json_encode(['status' => 'error', 'message' => 'Invalid image file type. Only JPEG, PNG, GIF, and WebP are allowed']); exit; } @@ -110,19 +108,17 @@ if (!empty($_FILES['image']['name'])) { $promo_path = null; if (!empty($_FILES['promo']['name'])) { $upload_dir = $rootPath . '/assets/images/events/'; - if (!is_dir($upload_dir)) { - mkdir($upload_dir, 0755, true); + if (!file_exists($upload_dir)) { + mkdir($upload_dir, 0777, true); } $file_name = uniqid() . '_promo_' . basename($_FILES['promo']['name']); $target_file = $upload_dir . $file_name; - $finfo = finfo_open(FILEINFO_MIME_TYPE); - $file_type = finfo_file($finfo, $_FILES['promo']['tmp_name']); - finfo_close($finfo); - // Validate image file - $allowed_types = ['image/jpeg', 'image/png', 'image/gif', 'image/webp']; - if (!in_array($file_type, $allowed_types)) { + // Validate file extension + $ext = strtolower(pathinfo($file_name, PATHINFO_EXTENSION)); + $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'webp']; + if (!in_array($ext, $allowed_extensions)) { echo json_encode(['status' => 'error', 'message' => 'Invalid promo image file type. Only JPEG, PNG, GIF, and WebP are allowed']); exit; } diff --git a/src/processors/process_signature.php b/src/processors/process_signature.php index 9ff21efb..c504b12c 100644 --- a/src/processors/process_signature.php +++ b/src/processors/process_signature.php @@ -36,7 +36,7 @@ if (isset($_POST['signature'])) { $filePath = $rootPath . '/uploads/signatures/' . $fileName; // Ensure the directory exists - if (!is_dir($rootPath . '/uploads/signatures')) { + if (!file_exists($rootPath . '/uploads/signatures')) { mkdir($rootPath . '/uploads/signatures', 0777, true); } diff --git a/src/processors/process_trip.php b/src/processors/process_trip.php index 2d8ef848..7f4a2901 100644 --- a/src/processors/process_trip.php +++ b/src/processors/process_trip.php @@ -136,8 +136,8 @@ try { $upload_dir = $rootPath . '/assets/images/trips/'; // Create directory if it doesn't exist - if (!is_dir($upload_dir)) { - mkdir($upload_dir, 0755, true); + if (!file_exists($upload_dir)) { + mkdir($upload_dir, 0777, true); } $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'webp']; diff --git a/src/processors/save_album.php b/src/processors/save_album.php index 8338ea59..2c8a031e 100644 --- a/src/processors/save_album.php +++ b/src/processors/save_album.php @@ -52,26 +52,25 @@ try { // Create album directory $albumDir = $rootPath . '/assets/uploads/gallery/' . $album_id; - if (!is_dir($albumDir)) { - if (!mkdir($albumDir, 0755, true)) { - throw new Exception('Failed to create album directory'); - } + if (!file_exists($albumDir)) { + mkdir($albumDir, 0777, true); } // Handle cover image upload $coverImagePath = null; - if (isset($_FILES['cover_image']) && $_FILES['cover_image']['error'] !== UPLOAD_ERR_NO_FILE) { - $allowedMimes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp']; + if (isset($_FILES['cover_image']) && $_FILES['cover_image']['error'] === UPLOAD_ERR_OK) { $maxSize = 5 * 1024 * 1024; // 5MB $fileName = $_FILES['cover_image']['name']; $fileTmpName = $_FILES['cover_image']['tmp_name']; $fileSize = $_FILES['cover_image']['size']; - $fileMime = mime_content_type($fileTmpName); + + // Validate file extension + $ext = strtolower(pathinfo($fileName, PATHINFO_EXTENSION)); + $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif', 'webp']; - // Validate file - if (!in_array($fileMime, $allowedMimes)) { - throw new Exception('Invalid cover image file type'); + if (!in_array($ext, $allowedExtensions)) { + throw new Exception('Invalid cover image file type. Allowed: jpg, jpeg, png, gif, webp'); } if ($fileSize > $maxSize) { @@ -96,8 +95,7 @@ try { } // Handle photo uploads - if (isset($_FILES['photos']) && $_FILES['photos']['error'][0] !== UPLOAD_ERR_NO_FILE) { - $allowedMimes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp']; + if (isset($_FILES['photos']) && $_FILES['photos']['error'][0] === UPLOAD_ERR_OK) { $maxSize = 5 * 1024 * 1024; // 5MB $displayOrder = 1; @@ -111,11 +109,13 @@ try { $fileName = $_FILES['photos']['name'][$i]; $fileTmpName = $_FILES['photos']['tmp_name'][$i]; $fileSize = $_FILES['photos']['size'][$i]; - $fileMime = mime_content_type($fileTmpName); + + // Validate file extension + $ext = strtolower(pathinfo($fileName, PATHINFO_EXTENSION)); + $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif', 'webp']; - // Validate file - if (!in_array($fileMime, $allowedMimes)) { - throw new Exception('Invalid file type: ' . $fileName); + if (!in_array($ext, $allowedExtensions)) { + throw new Exception('Invalid file type: ' . $fileName . '. Allowed: jpg, jpeg, png, gif, webp'); } if ($fileSize > $maxSize) { diff --git a/src/processors/submit_pop.php b/src/processors/submit_pop.php index cf6db027..4bc4415b 100644 --- a/src/processors/submit_pop.php +++ b/src/processors/submit_pop.php @@ -43,14 +43,9 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') { $filename = str_replace(' ', '_', $eft_id) . '.pdf'; $target_file = $target_dir . $filename; - // Make sure target directory exists and writable - if (!is_dir($target_dir)) { - mkdir($target_dir, 0755, true); - } - - if (!is_writable($target_dir)) { - echo "