📄 File: delete.php

Path: /home2/outerorb/emp.outerorbittech.in/admin/delete.php

Size: 3.38 KB

Permissions: 0666

<?php
require __DIR__ . '/../includes/helpers.php';
require_admin();
ensure_employees_table();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    redirect_with_message('dashboard.php', 'Invalid request.', 'error');
}

if (!isset($_POST['csrf_token']) || !verify_csrf($_POST['csrf_token'])) {
    redirect_with_message('dashboard.php', 'Session expired. Try again.', 'error');
}

$id        = isset($_POST['id'])  ? (int) $_POST['id']  : 0;
$forceDelete = isset($_POST['force_delete']) && $_POST['force_delete'] === '1';

// -----------------------------------------------------------------------
// Bulk soft-delete: ids[] posted from the dashboard "Delete Selected" form
// -----------------------------------------------------------------------
if (isset($_POST['ids']) && is_array($_POST['ids'])) {
    $ids = array_values(array_filter(array_map('intval', $_POST['ids'])));
    if (empty($ids)) {
        redirect_with_message('dashboard.php', 'No records selected.', 'error');
    }

    $pdo = db();
    $moved = 0;
    foreach ($ids as $bulkId) {
        $row = $pdo->prepare('SELECT id, deleted_at, department FROM employees WHERE id = ? LIMIT 1');
        $row->execute([$bulkId]);
        $row = $row->fetch();
        if (!$row || $row['deleted_at'] !== null) {
            continue; // skip missing or already trashed
        }
        if (!admin_can_access_department($row['department'] ?? null)) {
            continue; // skip records outside this admin's scope
        }
        $pdo->prepare('UPDATE employees SET deleted_at = NOW() WHERE id = ?')->execute([$bulkId]);
        $moved++;
    }

    redirect_with_message('dashboard.php', $moved . ' record(s) moved to Trash.');
}

// -----------------------------------------------------------------------
// Single-record delete (existing behaviour)
// -----------------------------------------------------------------------
if (!$id) {
    redirect_with_message('dashboard.php', 'Invalid record.', 'error');
}

$pdo = db();
$stmt = $pdo->prepare('SELECT id, deleted_at, aadhaar_path, pan_path, qualification_path, tenth_marksheet_path, twelfth_marksheet_path, bank_proof_path, photo_path, department FROM employees WHERE id = ? LIMIT 1');
$stmt->execute([$id]);
$emp = $stmt->fetch();

if (!$emp) {
    redirect_with_message('dashboard.php', 'Record not found.', 'error');
}

enforce_department_access($emp);

// Permanent delete (only allowed for trashed records)
if ($forceDelete) {
    if ($emp['deleted_at'] === null) {
        redirect_with_message('dashboard.php', 'Record must be in Trash before permanent deletion.', 'error');
    }

    $pdo->prepare('DELETE FROM employees WHERE id = ?')->execute([$id]);

    foreach (['aadhaar_path', 'pan_path', 'qualification_path', 'tenth_marksheet_path', 'twelfth_marksheet_path', 'bank_proof_path', 'photo_path'] as $col) {
        $resolved = resolve_upload_path($emp[$col] ?? null);
        if ($resolved) {
            @unlink($resolved);
        }
    }

    redirect_with_message('trash.php', 'Record permanently deleted.');
}

// Soft delete: move to Trash without removing files
if ($emp['deleted_at'] !== null) {
    redirect_with_message('trash.php', 'Record is already in Trash.', 'success');
}

$pdo->prepare('UPDATE employees SET deleted_at = NOW() WHERE id = ?')->execute([$id]);

redirect_with_message('dashboard.php', 'Record moved to Trash.');

← Back to Directory Edit File 🔒 Chmod