Show sourcecode
The following files exists in this folder. Click to view.
public_html/crumbs/admin/orders/
api.php
orders.php
sendmail.php
statusdisplay.php
api.php
86 lines UTF-8 Windows (CRLF)
1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586
<?php
session_start();
header('Content-Type: application/json');
$loggedIn = isset($_SESSION['logged_in']) && $_SESSION['logged_in'] == 1;
$isAdmin = isset($_SESSION['is_admin']) && $_SESSION['is_admin'] == 1;
if (!$loggedIn || !$isAdmin) {
http_response_code(403);
echo json_encode(['error' => 'Unauthorized']);
exit;
}
include('../../dbconnection.php');
include('sendmail.php');
if (!$dbconn) {
http_response_code(500);
echo json_encode(['error' => 'Database connection failed']);
exit;
}
$method = $_SERVER['REQUEST_METHOD'];
// GET - Hämta alla ordrar (äldst först)
if ($method === 'GET') {
$sql = "SELECT o.order_id, o.order_time, o.total_price, o.status, o.custom_instructions,
u.username, u.fullname
FROM orders o
JOIN users u ON o.user_id = u.user_id
ORDER BY o.order_id ASC";
$stmt = $dbconn->prepare($sql);
$stmt->execute();
$orders = $stmt->fetchAll(PDO::FETCH_ASSOC);
foreach ($orders as &$order) {
$stmt = $dbconn->prepare(
"SELECT oi.amount, oi.custom_text, p.name, p.price
FROM order_items oi
JOIN products p ON oi.product_id = p.product_id
WHERE oi.order_id = :order_id"
);
$stmt->execute([':order_id' => $order['order_id']]);
$order['items'] = $stmt->fetchAll(PDO::FETCH_ASSOC);
}
unset($order);
echo json_encode($orders);
exit;
}
// POST - Uppdatera orderstatus
if ($method === 'POST') {
$data = json_decode(file_get_contents('php://input'), true);
if (!isset($data['order_id']) || !isset($data['status'])) {
http_response_code(400);
echo json_encode(['error' => 'Missing order_id or status']);
exit;
}
$allowedStatuses = ['pending', 'preparing', 'done', 'delivered'];
if (!in_array($data['status'], $allowedStatuses)) {
http_response_code(400);
echo json_encode(['error' => 'Invalid status']);
exit;
}
$stmt = $dbconn->prepare("UPDATE orders SET status = :status WHERE order_id = :order_id");
$stmt->execute([
':status' => $data['status'],
':order_id' => (int)$data['order_id']
]);
// Skicka mail till kunden när ordern är klar
$mailSent = false;
if ($data['status'] === 'done') {
$mailSent = sendOrderReadyMail($dbconn, $data['order_id']);
}
echo json_encode(['success' => true, 'order_id' => (int)$data['order_id'], 'status' => $data['status'], 'mail_sent' => $mailSent]);
exit;
}
http_response_code(405);
echo json_encode(['error' => 'Method not allowed']);