Enhanced PHP File Manager

⬆️ Go Up (..)

📊 Server Information

Server:

LiteSpeed

System:

Linux 5.14.0-503.34.1.el9_5.x86_64

PHP Version:

8.2.30

User:

u329947844

Directory:

/home/u329947844/domains/ecommer.in/public_html/billing/bakery/branch

Free Space:

10.27 TB

🔧 Quick Actions

✏️ Editing: orders_edit.php

```php
<?php
// orders_edit.php
session_start();
require_once 'config/db_config.php'; // expects $pdo (PDO)

// ---- Initialize $script early to avoid undefined variable ----
$script = '';

// ---- Auth (admins and branch users) ----
if (!isset($_SESSION['user_id']) || !isset($_SESSION['role'])) {
    header("Location: login.php");
    exit();
}

// ---- CSRF token ----
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
$csrf = $_SESSION['csrf_token'];

// ---- Helpers ----
function h(string $v): string { return htmlspecialchars($v, ENT_QUOTES, 'UTF-8'); }

// ---- Get order ID ----
$order_id = $_GET['id'] ?? null;
if (!is_numeric($order_id)) {
    $_SESSION['error'] = "Invalid order ID.";
    header("Location: orders.php");
    exit();
}

// ---- Fetch order details ----
try {
    $stmt = $pdo->prepare("
        SELECT o.order_id, o.customer_name, o.customer_contact, o.order_date, o.total_amount, o.status, o.branch_id, b.branch_name
        FROM orders o
        JOIN branches b ON o.branch_id = b.branch_id
        WHERE o.order_id = :order_id
    ");
    $stmt->execute(['order_id' => $order_id]);
    $order = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$order) {
        $_SESSION['error'] = "Order not found.";
        header("Location: orders.php");
        exit();
    }

// Restrict branch users to their branch
    if ($_SESSION['role'] === 'branch' && $order['branch_id'] != $_SESSION['branch_id']) {
        $_SESSION['error'] = "Unauthorized access to this order.";
        header("Location: orders.php");
        exit();
    }
} catch (PDOException $e) {
    $_SESSION['error'] = "Error fetching order: " . h($e->getMessage());
    header("Location: orders.php");
    exit();
}

// ---- Fetch order items ----
try {
    $stmt = $pdo->prepare("
        SELECT oi.item_id, oi.quantity, oi.price, oi.subtotal, f.food_id, f.food_name, f.image_url
        FROM order_items oi
        JOIN foods f ON oi.food_id = f.food_id
        WHERE oi.order_id = :order_id
    ");
    $stmt->execute(['order_id' => $order_id]);
    $order_items = $stmt->fetchAll(PDO::FETCH_ASSOC);
} catch (PDOException $e) {
    $_SESSION['error'] = "Error fetching order items: " . h($e->getMessage());
    header("Location: orders.php");
    exit();
}

// ---- Fetch available foods for adding items ----
try {
    $food_where_clause = $_SESSION['role'] === 'branch' ? "WHERE branch_id = :branch_id" : "";
    $stmt = $pdo->prepare("SELECT food_id, food_name, price FROM foods $food_where_clause ORDER BY food_name");
    if ($_SESSION['role'] === 'branch') {
        $stmt->execute(['branch_id' => $_SESSION['branch_id']]);
    } else {
        $stmt->execute();
    }
    $foods = $stmt->fetchAll(PDO::FETCH_ASSOC);
} catch (PDOException $e) {
    $_SESSION['error'] = "Error fetching foods: " . h($e->getMessage());
    $foods = [];
}

// ---- Handle form submission ----
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['csrf']) && $_POST['csrf'] === $csrf) {
    try {
        $pdo->beginTransaction();

// Validate inputs
        $customer_name = trim($_POST['customer_name'] ?? '');
        $customer_contact = trim($_POST['customer_contact'] ?? '');
        $status = $_POST['status'] ?? '';
        $item_ids = $_POST['item_id'] ?? [];
        $food_ids = $_POST['food_id'] ?? [];
        $quantities = $_POST['quantity'] ?? [];
        $prices = $_POST['price'] ?? [];
        $new_food_ids = $_POST['new_food_id'] ?? [];
        $new_quantities = $_POST['new_quantity'] ?? [];

if (!in_array($status, ['pending', 'processing', 'completed', 'cancelled'])) {
            throw new Exception("Invalid status.");
        }

// Calculate total amount
        $total_amount = 0;
        $updated_items = [];
        foreach ($food_ids as $index => $food_id) {
            if (!is_numeric($food_id) || !is_numeric($quantities[$index]) || !is_numeric($prices[$index]) || $quantities[$index] < 1) {
                throw new Exception("Invalid item data.");
            }
            $subtotal = $quantities[$index] * $prices[$index];
            $total_amount += $subtotal;
            $updated_items[$index] = [
                'item_id' => $item_ids[$index] ?? null,
                'food_id' => $food_id,
                'quantity' => $quantities[$index],
                'price' => $prices[$index],
                'subtotal' => $subtotal
            ];
        }

// New items
        foreach ($new_food_ids as $index => $food_id) {
            if (!is_numeric($food_id) || !is_numeric($new_quantities[$index]) || $new_quantities[$index] < 1) {
                throw new Exception("Invalid new item data.");
            }
            // Fetch food price
            $stmt = $pdo->prepare("SELECT price FROM foods WHERE food_id = :food_id");
            $stmt->execute(['food_id' => $food_id]);
            $price = $stmt->fetchColumn();
            if ($price === false) {
                throw new Exception("Invalid food ID.");
            }
            $subtotal = $new_quantities[$index] * $price;
            $total_amount += $subtotal;
            $updated_items[] = [
                'item_id' => null,
                'food_id' => $food_id,
                'quantity' => $new_quantities[$index],
                'price' => $price,
                'subtotal' => $subtotal
            ];
        }

// Update order
        $stmt = $pdo->prepare("
            UPDATE orders
            SET customer_name = :customer_name, customer_contact = :customer_contact, status = :status, total_amount = :total_amount
            WHERE order_id = :order_id
        ");
        $stmt->execute([
            'customer_name' => $customer_name ?: null,
            'customer_contact' => $customer_contact,
            'status' => $status,
            'total_amount' => $total_amount,
            'order_id' => $order_id
        ]);

// Delete removed items
        $existing_item_ids = array_filter(array_column($updated_items, 'item_id'), 'is_numeric');
        if ($existing_item_ids) {
            $placeholders = implode(',', array_fill(0, count($existing_item_ids), '?'));
            $stmt = $pdo->prepare("DELETE FROM order_items WHERE order_id = ? AND item_id NOT IN ($placeholders)");
            $stmt->execute(array_merge([$order_id], $existing_item_ids));
        } else {
            $stmt = $pdo->prepare("DELETE FROM order_items WHERE order_id = ?");
            $stmt->execute([$order_id]);
        }

// Insert/update items
        foreach ($updated_items as $item) {
            if ($item['item_id']) {
                // Update existing item
                $stmt = $pdo->prepare("
                    UPDATE order_items
                    SET food_id = :food_id, quantity = :quantity, price = :price, subtotal = :subtotal
                    WHERE item_id = :item_id AND order_id = :order_id
                ");
                $stmt->execute([
                    'food_id' => $item['food_id'],
                    'quantity' => $item['quantity'],
                    'price' => $item['price'],
                    'subtotal' => $item['subtotal'],
                    'item_id' => $item['item_id'],
                    'order_id' => $order_id
                ]);
            } else {
                // Insert new item
                $stmt = $pdo->prepare("
                    INSERT INTO order_items (order_id, food_id, quantity, price, subtotal)
                    VALUES (:order_id, :food_id, :quantity, :price, :subtotal)
                ");
                $stmt->execute([
                    'order_id' => $order_id,
                    'food_id' => $item['food_id'],
                    'quantity' => $item['quantity'],
                    'price' => $item['price'],
                    'subtotal' => $item['subtotal']
                ]);
            }
        }

$pdo->commit();
        $_SESSION['success'] = "Order updated successfully.";
        header("Location: orders.php?updated=1");
        exit();
    } catch (Exception $e) {
        $pdo->rollBack();
        $_SESSION['error'] = "Error updating order: " . h($e->getMessage());
    }
}

// ---- JavaScript for dynamic item management ----
$script .= '
<script>
document.addEventListener("DOMContentLoaded", function () {
    // Calculate total amount
    function updateTotal() {
        let total = 0;
        document.querySelectorAll(".item-subtotal").forEach(function (el) {
            total += parseFloat(el.textContent.replace("$", "")) || 0;
        });
        document.getElementById("total_amount").textContent = "$" + total.toFixed(2);
    }

// Update subtotal when quantity or price changes
    document.querySelectorAll(".quantity-input, .price-input").forEach(function (input) {
        input.addEventListener("input", function () {
            const row = this.closest("tr");
            const quantity = parseFloat(row.querySelector(".quantity-input").value) || 0;
            const price = parseFloat(row.querySelector(".price-input").value) || 0;
            const subtotal = quantity * price;
            row.querySelector(".item-subtotal").textContent = "$" + subtotal.toFixed(2);
            updateTotal();
        });
    });

// Remove item
    document.querySelectorAll(".remove-item").forEach(function (btn) {
        btn.addEventListener("click", function () {
            this.closest("tr").remove();
            updateTotal();
        });
    });

// Add new item
    document.getElementById("add-item").addEventListener("click", function () {
        const foodSelect = document.getElementById("new_food_id");
        const foodId = foodSelect.value;
        const foodText = foodSelect.options[foodSelect.selectedIndex].text;
        const price = parseFloat(foodSelect.options[foodSelect.selectedIndex].dataset.price) || 0;
        const table = document.getElementById("items-table").querySelector("tbody");
        const row = document.createElement("tr");
        row.innerHTML = `
            <td>
                <input type="hidden" name="new_food_id[]" value="${foodId}">
                ${foodText}
            </td>
            <td><input type="number" name="new_quantity[]" class="form-control form-control-sm quantity-input" value="1" min="1"></td>
            <td><input type="number" name="price[]" class="form-control form-control-sm price-input" value="${price.toFixed(2)}" step="0.01" min="0"></td>
            <td class="item-subtotal">$${price.toFixed(2)}</td>
            <td><button type="button" class="btn btn-danger btn-sm remove-item">Remove</button></td>
        `;
        table.appendChild(row);
        row.querySelector(".quantity-input").addEventListener("input", function () {
            const quantity = parseFloat(this.value) || 0;
            const price = parseFloat(row.querySelector(".price-input").value) || 0;
            row.querySelector(".item-subtotal").textContent = "$" + (quantity * price).toFixed(2);
            updateTotal();
        });
        row.querySelector(".price-input").addEventListener("input", function () {
            const quantity = parseFloat(row.querySelector(".quantity-input").value) || 0;
            const price = parseFloat(this.value) || 0;
            row.querySelector(".item-subtotal").textContent = "$" + (quantity * price).toFixed(2);
            updateTotal();
        });
        row.querySelector(".remove-item").addEventListener("click", function () {
            row.remove();
            updateTotal();
        });
        updateTotal();
    });
});
</script>';

<?php include './partials/layouts/layoutTop.php'; ?>

<div class="dashboard-main-body">
    <div class="d-flex flex-wrap align-items-center justify-content-between gap-2 mb-16">
        <h6 class="fw-semibold mb-0 text-lg">Edit Order #<?php echo (int)$order['order_id']; ?></h6>
        <ul class="d-flex align-items-center gap-1 small">
            <li class="fw-medium">
                <a href="index.php" class="d-flex align-items-center gap-1 hover-text-primary text-sm">
                    <iconify-icon icon="solar:home-smile-angle-outline" class="icon text-md"></iconify-icon>
                    Dashboard
                </a>
            </li>
            <li>-</li>
            <li class="fw-medium">
                <a href="orders.php" class="hover-text-primary text-sm">Orders</a>
            </li>
            <li>-</li>
            <li class="fw-medium text-sm">Edit Order</li>
        </ul>
    </div>

<?php if (!empty($_SESSION['error'])): ?>
        <div class="alert alert-danger alert-dismissible fade show mb-24" role="alert">
            <?= h($_SESSION['error']); unset($_SESSION['error']); ?>
            <button type="button" class="btn-close" data-bs-dismiss="alert" aria-label="Close"></button>
        </div>
    <?php endif; ?>

<div class="card h-100">
        <div class="card-header compact-header">
            <h6 class="mb-0 fw-semibold text-md important-text-2">Edit Order Details</h6>
        </div>
        <div class="card-body compact-body">
            <form method="POST" action="orders_edit.php?id=<?= (int)$order_id; ?>">
                <input type="hidden" name="csrf" value="<?= h($csrf); ?>">
                <div class="row mb-3">
                    <div class="col-md-6">
                        <label for="customer_name" class="form-label text-sm">Customer Name</label>
                        <input type="text" class="form-control form-control-sm" id="customer_name" name="customer_name" value="<?= h($order['customer_name'] ?: ''); ?>" placeholder="Enter customer name">
                    </div>
                    <div class="col-md-6">
                        <label for="customer_contact" class="form-label text-sm">Customer Contact</label>
                        <input type="text" class="form-control form-control-sm" id="customer_contact" name="customer_contact" value="<?= h($order['customer_contact']); ?>" required>
                    </div>
                </div>
                <div class="row mb-3">
                    <div class="col-md-6">
                        <label for="status" class="form-label text-sm">Status</label>
                        <select class="form-select form-select-sm" id="status" name="status" required>
                            <option value="pending" <?= $order['status'] === 'pending' ? 'selected' : ''; ?>>Pending</option>
                            <option value="processing" <?= $order['status'] === 'processing' ? 'selected' : ''; ?>>Processing</option>
                            <option value="completed" <?= $order['status'] === 'completed' ? 'selected' : ''; ?>>Completed</option>
                            <option value="cancelled" <?= $order['status'] === 'cancelled' ? 'selected' : ''; ?>>Cancelled</option>
                        </select>
                    </div>
                    <div class="col-md-6">
                        <label class="form-label text-sm">Branch</label>
                        <input type="text" class="form-control form-control-sm" value="<?= h($order['branch_name']); ?>" disabled>
                    </div>
                </div>

<h6 class="fw-semibold mb-2 text-sm">Order Items</h6>
                <div class="table-responsive">
                    <table class="table bordered-table sm-table small-table mb-3" id="items-table">
                        <thead>
                            <tr>
                                <th>Food</th>
                                <th>Quantity</th>
                                <th>Price</th>
                                <th>Subtotal</th>
                                <th>Action</th>
                            </tr>
                        </thead>
                        <tbody>
                            <?php foreach ($order_items as $item): ?>
                                <tr>
                                    <td>
                                        <input type="hidden" name="item_id[]" value="<?= (int)$item['item_id']; ?>">
                                        <input type="hidden" name="food_id[]" value="<?= (int)$item['food_id']; ?>">
                                        <div class="d-flex align-items-center">
                                            <img src="<?= h($item['image_url'] ?? 'assets/images/food/default.png'); ?>" alt="" class="flex-shrink-0 me-12 radius-8" style="width: 40px; height: 40px;">
                                            <span class="text-sm"><?= h($item['food_name']); ?></span>
                                        </div>
                                    </td>
                                    <td>
                                        <input type="number" name="quantity[]" class="form-control form-control-sm quantity-input" value="<?= (int)$item['quantity']; ?>" min="1">
                                    </td>
                                    <td>
                                        <input type="number" name="price[]" class="form-control form-control-sm price-input" value="<?= number_format($item['price'], 2); ?>" step="0.01" min="0">
                                    </td>
                                    <td class="item-subtotal">$<?= number_format($item['subtotal'], 2); ?></td>
                                    <td>
                                        <button type="button" class="btn btn-danger btn-sm remove-item">Remove</button>
                                    </td>
                                </tr>
                            <?php endforeach; ?>
                        </tbody>
                    </table>
                </div>

<div class="mb-3">
                    <label for="new_food_id" class="form-label text-sm">Add Food Item</label>
                    <div class="input-group input-group-sm">
                        <select class="form-select" id="new_food_id">
                            <?php foreach ($foods as $food): ?>
                                <option value="<?= (int)$food['food_id']; ?>" data-price="<?= number_format($food['price'], 2); ?>">
                                    <?= h($food['food_name']); ?> ($<?= number_format($food['price'], 2); ?>)
                                </option>
                            <?php endforeach; ?>
                        </select>
                        <button type="button" class="btn btn-primary btn-sm" id="add-item">Add Item</button>
                    </div>
                </div>

<div class="mb-3">
                    <h6 class="fw-semibold text-sm">Total Amount: <span id="total_amount">$<?= number_format($order['total_amount'], 2); ?></span></h6>
                </div>

<div class="d-flex gap-2">
                    <button type="submit" class="btn btn-primary btn-sm">Update Order</button>
                    <a href="orders.php" class="btn btn-outline-secondary btn-sm">Cancel</a>
                </div>
            </form>
        </div>
    </div>
</div>

<?php include './partials/layouts/layoutBottom.php'; ?>

<?php
// Echo $script to ensure it’s included in the output
echo $script;
?>
```

❌ Cancel

🗂️ Enhanced PHP File Manager

📊 Server Information

🔧 Quick Actions

✏️ Editing: orders_edit.php

📤 Upload File

📁 Create Folder

📄 Create File

✏️ Rename Item

🗑️ Delete Confirmation