File manager

File manager - Edit - /home/webapp69.cm.in.th/u69319090037/Shop/api/functions/helpers.php

Back
<?php /** * Helper Functions * CMTC Shopping / // Start session if not started if (session_status() == PHP_SESSION_NONE) { session_start(); } /* * Get Dynamic Base URL * Supports any subfolder (e.g. /u69319090037/shop/ on Host or /shop037.2/ on localhost) * @param string $path * @return string / function base_url($path = '') { static $baseUrl = null; if ($baseUrl === null) { $scriptName = str_replace('\\', '/', $_SERVER['SCRIPT_NAME'] ?? ''); // Check known subfolder positions if (preg_match('#^(.?)/(views\|api\|functions\|includes)/#', $scriptName, $matches)) { $root = rtrim($matches[1], '/'); } elseif (preg_match('#^(.?)/[^/]+\.php$#', $scriptName, $matches)) { $root = rtrim($matches[1], '/'); } else { $root = ''; } $baseUrl = $root; } $cleanPath = ltrim($path, '/'); return $cleanPath === '' ? $baseUrl : ($baseUrl . '/' . $cleanPath); } /* * Get full URL for product image * Supports both filename ('prod_123.jpg') and full relative path ('uploads/products/prod_123.jpg') * @param string\|null $imagePath * @return string / function product_image_url($imagePath) { if (empty($imagePath)) { return ''; } if (strpos($imagePath, 'http://') === 0 \|\| strpos($imagePath, 'https://') === 0) { return $imagePath; } $clean = ltrim(str_replace('\\', '/', $imagePath), '/'); if (strpos($clean, 'uploads/') === 0) { return base_url($clean); } return base_url('uploads/products/' . $clean); } /* * Sanitize output to prevent XSS * @param string $str * @return string / function sanitize($str) { return htmlspecialchars($str ?? '', ENT_QUOTES, 'UTF-8'); } /* * Generate CSRF Token * @return string / function get_csrf_token() { if (empty($_SESSION['csrf_token'])) { $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); } return $_SESSION['csrf_token']; } /* * Validate CSRF Token * @param string $token * @return bool / function validate_csrf_token($token) { if (empty($_SESSION['csrf_token']) \|\| empty($token)) { return false; } return hash_equals($_SESSION['csrf_token'], $token); } /* * Format Price to Thai Baht format * @param float $price * @return string / function format_price($price) { return "฿" . number_format($price, 2); } /* * Format Thai Date * @param string $datetime * @param bool $include_time * @return string / function format_thai_date($datetime, $include_time = true) { if (empty($datetime)) return "-"; $time = strtotime($datetime); $months = [ 1 => 'ม.ค.', 2 => 'ก.พ.', 3 => 'มี.ค.', 4 => 'เม.ย.', 5 => 'พ.ค.', 6 => 'มิ.ย.', 7 => 'ก.ค.', 8 => 'ส.ค.', 9 => 'ก.ย.', 10 => 'ต.ค.', 11 => 'พ.ย.', 12 => 'ธ.ค.' ]; $year = date('Y', $time) + 543; $day = date('j', $time); $month = $months[intval(date('n', $time))]; $date_str = "$day $month $year"; if ($include_time) { $date_str .= " " . date('H:i', $time) . " น."; } return $date_str; } /* * Write Activity Log * @param PDO $db * @param string $action * @param string $details * @return bool / function log_activity($db, $action, $details) { try { $user_id = $_SESSION['user_id'] ?? null; $ip = $_SERVER['REMOTE_ADDR'] ?? ''; $ua = $_SERVER['HTTP_USER_AGENT'] ?? ''; $stmt = $db->prepare("INSERT INTO activity_logs (user_id, action, details, ip_address, user_agent) VALUES (?, ?, ?, ?, ?)"); return $stmt->execute([$user_id, $action, $details, $ip, $ua]); } catch (Exception $e) { error_log("Failed to write activity log: " . $e->getMessage()); return false; } } /* * Check if current user has permission code * @param PDO $db * @param string $permission_code * @return bool / function has_permission($db, $permission_code) { if (!isset($_SESSION['role_id'])) { return false; } // Administrator has all permissions (ส่วนแอดมินก็เหมือนเดิม) if ($_SESSION['role_id'] == 1) { return true; } // Customers (role_id = 3) can sell items, so they can manage products, stock, and orders. if ($_SESSION['role_id'] == 3) { return in_array($permission_code, ['manage_orders', 'manage_products', 'manage_stock', 'view_reports']); } try { $stmt = $db->prepare(" SELECT COUNT() FROM role_permissions rp JOIN permissions p ON rp.permission_id = p.id WHERE rp.role_id = ? AND p.code = ? "); $stmt->execute([$_SESSION['role_id'], $permission_code]); return $stmt->fetchColumn() > 0; } catch (Exception $e) { return false; } } /** * Force Authentication / function require_login() { if (!isset($_SESSION['user_id'])) { header("Location: " . base_url('login.php')); exit(); } } /* * Force Permission Check * @param PDO $db * @param string $permission_code / function require_permission($db, $permission_code) { require_login(); if (!has_permission($db, $permission_code)) { header("Location: " . base_url('views/403.php')); exit(); } } /* * Handle Single Secure Image Upload * Supports JPG, JPEG, PNG, WEBP, GIF * @param array $file $_FILES item * @param string $targetSubDir Subfolder inside /uploads/ (e.g. 'products', 'news', 'slips') * @param string $prefix File name prefix (e.g. 'prod', 'avatar') * @param int $maxSizeBytes Max file size in bytes (default 5MB) * @return array ['success' => bool, 'filename' => string, 'url' => string, 'error' => string] / function upload_image($file, $targetSubDir = 'products', $prefix = 'img', $maxSizeBytes = 5242880) { if (!isset($file) \|\| $file['error'] !== UPLOAD_ERR_OK) { return ['success' => false, 'error' => 'ไม่พบไฟล์หรือเกิดข้อผิดพลาดในการอัปโหลด']; } if ($file['size'] > $maxSizeBytes) { $maxMB = round($maxSizeBytes / (1024 1024), 1); return ['success' => false, 'error' => "ขนาดไฟล์ใหญ่เกินกำหนด (ไม่เกิน {$maxMB} MB)"]; } $ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION)); $allowed_exts = ['jpg', 'jpeg', 'png', 'webp', 'gif']; if (!in_array($ext, $allowed_exts)) { return ['success' => false, 'error' => 'รองรับเฉพาะไฟล์รูปภาพนามสกุล JPG, JPEG, PNG, WEBP, GIF เท่านั้น']; } // Verify MIME type using finfo or getimagesize $tmp_name = $file['tmp_name']; $allowed_mimes = ['image/jpeg', 'image/png', 'image/webp', 'image/gif']; $is_valid_mime = false; if (function_exists('finfo_open')) { $finfo = finfo_open(FILEINFO_MIME_TYPE); $mime = finfo_file($finfo, $tmp_name); finfo_close($finfo); $is_valid_mime = in_array($mime, $allowed_mimes); } elseif (function_exists('getimagesize')) { $img_info = @getimagesize($tmp_name); if ($img_info && in_array($img_info['mime'], $allowed_mimes)) { $is_valid_mime = true; } } else { // Fallback to extension check $is_valid_mime = true; } if (!$is_valid_mime) { return ['success' => false, 'error' => 'ไฟล์ที่อัปโหลดไม่ใช่รูปภาพที่ถูกต้อง']; } // Target directory $upload_base = dirname(__DIR__) . '/uploads'; $target_dir = $upload_base . '/' . trim($targetSubDir, '/'); if (!is_dir($target_dir)) { mkdir($target_dir, 0777, true); } $unique_name = $prefix . '_' . date('Ymd_His') . '_' . bin2hex(random_bytes(4)) . '.' . $ext; $target_path = $target_dir . '/' . $unique_name; if (move_uploaded_file($tmp_name, $target_path)) { $relative_url = 'uploads/' . trim($targetSubDir, '/') . '/' . $unique_name; return [ 'success' => true, 'filename' => $unique_name, 'relative_path' => $relative_url, 'url' => base_url($relative_url), 'error' => '' ]; } return ['success' => false, 'error' => 'ไม่สามารถบันทึกไฟล์ลงเซิร์ฟเวอร์ได้']; } /** * Handle API JSON Response * @param bool $success * @param string $message * @param array $data * @param int $code */ function api_response($success, $message = '', $data = [], $code = 200) { header("Content-Type: application/json; charset=UTF-8"); http_response_code($code); echo json_encode([ 'success' => $success, 'message' => $message, 'data' => $data ], JSON_UNESCAPED_UNICODE); exit(); } ?>

| ver. 1.4 | Github | . | PHP 7.4.33 | Generation time: 0.22 | proxy | phpinfo | Settings