diff --git a/source/admin.php b/source/admin.php
index d64f3f0..8cd3f96 100644
--- a/source/admin.php
+++ b/source/admin.php
@@ -3,13 +3,10 @@ require_once 'includes/db.php';
require_once 'includes/auth.php';
checkAuth();
-checkAdmin(); // Tylko admin tu wejdzie
+checkAdmin();
$message = '';
-// ---------------------------------------------------------
-// 0. INICJALIZACJA DOMYŚLNYCH USTAWIEŃ FIRM (jeśli nie istnieją)
-// ---------------------------------------------------------
$default_settings = [
'company_1_name' => 'Moje Przedsiębiorstwo IT',
'company_1_details' => 'ul. Główna 1, 00-000 Warszawa | NIP: 0987654321',
@@ -18,119 +15,108 @@ $default_settings = [
];
foreach ($default_settings as $key => $val) {
- // INSERT IGNORE dodaje wpis tylko wtedy, gdy taki klucz jeszcze nie istnieje w tabeli
$stmt = $pdo->prepare("INSERT IGNORE INTO " . DB_PREFIX . "settings (setting_key, setting_value) VALUES (?, ?)");
$stmt->execute([$key, $val]);
}
-// ---------------------------------------------------------
-// 1. WGRYWANIE LOGO
-// ---------------------------------------------------------
-if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_FILES['logo'])) {
- if ($_FILES['logo']['error'] === 0) {
- $upload_dir = 'uploads/';
- if (!is_dir($upload_dir)) mkdir($upload_dir, 0777, true);
-
- $file_ext = strtolower(pathinfo($_FILES['logo']['name'], PATHINFO_EXTENSION));
- if(in_array($file_ext, ['jpg', 'jpeg', 'png', 'gif', 'svg'])) {
- $new_name = 'logo_' . time() . '.' . $file_ext;
- $dest_path = $upload_dir . $new_name;
-
- if (move_uploaded_file($_FILES['logo']['tmp_name'], $dest_path)) {
- $stmt = $pdo->prepare("REPLACE INTO " . DB_PREFIX . "settings (setting_key, setting_value) VALUES ('logo_path', ?)");
- $stmt->execute([$dest_path]);
- $message = "
Pomyślnie zaktualizowano logo!
";
+if ($_SERVER["REQUEST_METHOD"] === "POST") {
+ requireCsrfToken();
+
+ if (isset($_FILES['logo'])) {
+ if ($_FILES['logo']['error'] === 0) {
+ $upload_dir = 'uploads/';
+ if (!is_dir($upload_dir)) {
+ mkdir($upload_dir, 0755, true);
+ }
+
+ $tmpPath = $_FILES['logo']['tmp_name'];
+ $mime = mime_content_type($tmpPath);
+ $allowedMimes = [
+ 'image/jpeg' => 'jpg',
+ 'image/png' => 'png',
+ 'image/gif' => 'gif',
+ ];
+
+ if (isset($allowedMimes[$mime]) && @getimagesize($tmpPath) !== false) {
+ $new_name = 'logo_' . bin2hex(random_bytes(8)) . '.' . $allowedMimes[$mime];
+ $dest_path = $upload_dir . $new_name;
+
+ if (move_uploaded_file($tmpPath, $dest_path)) {
+ $stmt = $pdo->prepare("REPLACE INTO " . DB_PREFIX . "settings (setting_key, setting_value) VALUES ('logo_path', ?)");
+ $stmt->execute([$dest_path]);
+ $message = "
Pomyślnie zaktualizowano logo.
";
+ } else {
+ $message = "
Nie udało się zapisać pliku.
";
+ }
} else {
- $message = "
Błąd: Nie udało się zapisać pliku. Sprawdź uprawnienia folderu 'uploads'.
";
+ $message = "
Dozwolone są tylko prawidłowe pliki JPG, PNG i GIF.
";
}
- } else {
- $message = "
Błąd: Dozwolone są tylko pliki graficzne (JPG, PNG, GIF, SVG).
";
}
- }
-}
+ } elseif (isset($_POST['action']) && $_POST['action'] === 'update_company_settings') {
+ $settings_to_update = ['company_1_name', 'company_1_details', 'company_2_name', 'company_2_details'];
-// ---------------------------------------------------------
-// 1B. ZAPISYWANIE DANYCH FIRM
-// ---------------------------------------------------------
-if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'update_company_settings') {
- $settings_to_update = ['company_1_name', 'company_1_details', 'company_2_name', 'company_2_details'];
-
- try {
- $pdo->beginTransaction();
- $update_stmt = $pdo->prepare("UPDATE " . DB_PREFIX . "settings SET setting_value = ? WHERE setting_key = ?");
+ try {
+ $pdo->beginTransaction();
+ $update_stmt = $pdo->prepare("UPDATE " . DB_PREFIX . "settings SET setting_value = ? WHERE setting_key = ?");
- foreach ($settings_to_update as $key) {
- if (isset($_POST[$key])) {
- $update_stmt->execute([trim($_POST[$key]), $key]);
+ foreach ($settings_to_update as $key) {
+ if (isset($_POST[$key])) {
+ $update_stmt->execute([trim($_POST[$key]), $key]);
+ }
}
+ $pdo->commit();
+ $message = "
Ustawienia firmowe zostały zapisane.
";
+ } catch (PDOException $e) {
+ $pdo->rollBack();
+ error_log($e->getMessage());
+ $message = "
Nie udało się zapisać ustawień.
";
}
- $pdo->commit();
- $message = "
Ustawienia firmowe zostały zapisane!
";
- } catch (PDOException $e) {
- $pdo->rollBack();
- $message = "
Błąd zapisu: " . $e->getMessage() . "
";
- }
-}
-
-// ---------------------------------------------------------
-// 2. DODAWANIE UŻYTKOWNIKA
-// ---------------------------------------------------------
-if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST['add_user'])) {
- $new_user = trim($_POST['new_username']);
- $new_pass = $_POST['new_password'];
- $new_role = $_POST['new_role'];
+ } elseif (isset($_POST['add_user'])) {
+ $new_user = trim($_POST['new_username'] ?? '');
+ $new_pass = $_POST['new_password'] ?? '';
+ $new_role = $_POST['new_role'] ?? 'user';
+
+ if ($new_user !== '' && $new_pass !== '') {
+ try {
+ $new_email = trim($_POST['new_email'] ?? '');
+ $hashed_pass = password_hash($new_pass, PASSWORD_BCRYPT);
+ $stmt = $pdo->prepare("INSERT INTO " . DB_PREFIX . "users (username, email, password, role) VALUES (?, ?, ?, ?)");
+ $stmt->execute([$new_user, $new_email !== '' ? $new_email : null, $hashed_pass, $new_role === 'admin' ? 'admin' : 'user']);
+ $message = "
Dodano nowego użytkownika: " . e($new_user) . "
";
+ } catch (PDOException $e) {
+ error_log($e->getMessage());
+ $message = "
Nie udało się dodać użytkownika.
";
+ }
+ }
+ } elseif (isset($_POST['reset_password'])) {
+ $user_id = (int)($_POST['user_id'] ?? 0);
+ $new_pass = $_POST['new_password'] ?? '';
- if (!empty($new_user) && !empty($new_pass)) {
- try {
+ if ($user_id > 0 && $new_pass !== '') {
$hashed_pass = password_hash($new_pass, PASSWORD_BCRYPT);
- $stmt = $pdo->prepare("INSERT INTO " . DB_PREFIX . "users (username, password, role) VALUES (?, ?, ?)");
- $stmt->execute([$new_user, $hashed_pass, $new_role]);
- $message = "
Dodano nowego użytkownika: $new_user
";
- } catch (PDOException $e) {
- $message = "
Błąd: Użytkownik o takiej nazwie prawdopodobnie już istnieje.
";
+ $stmt = $pdo->prepare("UPDATE " . DB_PREFIX . "users SET password = ? WHERE id = ?");
+ $stmt->execute([$hashed_pass, $user_id]);
+ $message = "
Zmieniono hasło dla wybranego użytkownika.
";
+ }
+ } elseif (isset($_POST['delete_user'])) {
+ $id_to_delete = (int)($_POST['user_id'] ?? 0);
+ if ($id_to_delete !== (int)$_SESSION['user_id']) {
+ $stmt = $pdo->prepare("DELETE FROM " . DB_PREFIX . "users WHERE id = ?");
+ $stmt->execute([$id_to_delete]);
+ $message = "
Użytkownik został pomyślnie usunięty.
";
+ } else {
+ $message = "
Nie możesz usunąć własnego konta administratora.
";
}
}
}
-// ---------------------------------------------------------
-// 3. RESET HASŁA UŻYTKOWNIKA
-// ---------------------------------------------------------
-if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST['reset_password'])) {
- $user_id = (int)$_POST['user_id'];
- $new_pass = $_POST['new_password'];
-
- if (!empty($new_pass)) {
- $hashed_pass = password_hash($new_pass, PASSWORD_BCRYPT);
- $stmt = $pdo->prepare("UPDATE " . DB_PREFIX . "users SET password = ? WHERE id = ?");
- $stmt->execute([$hashed_pass, $user_id]);
- $message = "
Zmieniono hasło dla wybranego użytkownika.
";
- }
-}
-
-// ---------------------------------------------------------
-// 4. USUWANIE UŻYTKOWNIKA
-// ---------------------------------------------------------
-if (isset($_GET['delete'])) {
- $id_to_delete = (int)$_GET['delete'];
- if ($id_to_delete != $_SESSION['user_id']) {
- $stmt = $pdo->prepare("DELETE FROM " . DB_PREFIX . "users WHERE id = ?");
- $stmt->execute([$id_to_delete]);
- $message = "
Użytkownik został pomyślnie usunięty.
";
- } else {
- $message = "
Odmowa: Nie możesz usunąć własnego konta administratora!
";
- }
-}
-
-// ---------------------------------------------------------
-// POBIERANIE DANYCH DO WIDOKU
-// ---------------------------------------------------------
-$users = $pdo->query("SELECT id, username, role FROM " . DB_PREFIX . "users")->fetchAll();
+$users = $pdo->query("SELECT id, username, email, role, oauth_provider, last_login_at FROM " . DB_PREFIX . "users ORDER BY username ASC")->fetchAll();
$settings = [];
try {
$settings = $pdo->query("SELECT setting_key, setting_value FROM " . DB_PREFIX . "settings")->fetchAll(PDO::FETCH_KEY_PAIR);
-} catch(PDOException $e) {
- // Zabezpieczenie na wypadek awarii tabeli settings
+} catch (PDOException $e) {
+ error_log($e->getMessage());
}
$current_logo = $settings['logo_path'] ?? '';
@@ -141,7 +127,7 @@ $current_logo = $settings['logo_path'] ?? '';
-
Panel Administratora - <?php echo defined('APP_NAME') ? APP_NAME : 'System'; ?>
+
Panel administratora - <?php echo e(defined('APP_NAME') ? APP_NAME : 'System'); ?>