nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
9bb92bc20a942eaa5d4b03b3671652d589f52ea3
wms-app/app/include_topbar.php
T
Thanakorn ae98dcdcdd Harden web root, secrets and realtime auth 
- .htaccess: refuse .git, .env, docker, nodejs, sdlc*, scripts, archives and
  app internals; security headers, HSTS over TLS, optional HTTPS redirect
- uploads served through app/file.php to signed-in users only
- Apache/PHP hardening config for the container (ServerTokens, expose_php)
- least-privilege DB account and APP_SECRET_KEY via docker/php/provision.php;
  SMTP passwords re-encrypted with a random IV (secret_box.php)
- Socket.IO rooms from a PHP-signed token; /emit and cron refuse empty secrets
- escape notification text; CLI guards on build scripts; no fixed demo password
2026-09-24 14:53:40 +07:00

451 lines
19 KiB
PHP
Raw Blame History

<?php
require_once __DIR__ . '/config.php';
require_once __DIR__ . '/dbconn.php';
require_once __DIR__ . '/assets/utils/classes/UsageGuard.php';
require_once __DIR__ . '/assets/utils/otp_policy.php';
// Redirect to login if the user has not completed full authentication.
// login_company_id is only written by login_confirm.php after OTP is verified —
// using it (not "otp") ensures half-logged-in sessions are also redirected.
if(empty($_SESSION["login_company_id"])){
// Discard the markup include_header.php has already buffered so the browser
// receives a clean redirect rather than a partially rendered page body.
while (ob_get_level() > 0) {
ob_end_clean();
}
header('Location: '.$server_url.'login/index.php');
exit;
}
require 'preset.php';
require_once __DIR__ . '/assets/utils/app_access.php';
// Accounting pages require accounting app access; the menus below only hide the
// links, this stops a WMS-only user who opens the URL directly.
$_page_app = app_access_app_for($_SERVER['SCRIPT_NAME'] ?? '');
if ($_page_app !== null && !app_access_allows($_SESSION['login_app_access'] ?? 'wms', $_page_app)) {
while (ob_get_level() > 0) {
ob_end_clean();
}
header('Location: '.$server_url.'dashboard/index.php');
exit;
}
// ── User display data from session ────────────────────────────────────────────
$topbar_name = htmlspecialchars(trim(($_SESSION['login_name'] ?? '') . ' ' . ($_SESSION['login_surname'] ?? '')), ENT_QUOTES, 'UTF-8');
$topbar_username = htmlspecialchars($_SESSION['login_username'] ?? '', ENT_QUOTES, 'UTF-8');
$topbar_picture = $_SESSION['login_profile_picture'] ?? '';
$topbar_avatar_src = $topbar_picture
? htmlspecialchars($server_url . 'uploads/profile/' . $topbar_picture, ENT_QUOTES, 'UTF-8')
: htmlspecialchars($server_url . 'assets/images/avatar-1.jpg', ENT_QUOTES, 'UTF-8');
// ── App switcher ──────────────────────────────────────────────────────────────
$topbar_app_access = $_SESSION['login_app_access'] ?? 'wms';
// Detect which app this page belongs to.
// Master-data pages (/accounting/, /inventory/, /contact/, /setting/) are neutral — don't change the session.
$_wms_paths = ['/dashboard/', '/ics/', '/order/', '/po/', '/reports/'];
$_ac_paths = ['/ac_dashboard/', '/revenue/', '/expense/', '/finance/', '/journal/'];
$topbar_current_app = null; // null = neutral page (master data / setting)
foreach ($_wms_paths as $_p) {
if (str_contains($_SERVER['PHP_SELF'], $_p)) { $topbar_current_app = 'wms'; break; }
}
if (!$topbar_current_app) {
foreach ($_ac_paths as $_p) {
if (str_contains($_SERVER['PHP_SELF'], $_p)) { $topbar_current_app = 'accounting'; break; }
}
}
// Only persist to session when on a definitive app page
if ($topbar_current_app) {
$_SESSION['login_current_app'] = $topbar_current_app;
}
// Default session on first visit or neutral pages
if (empty($_SESSION['login_current_app'])) {
$_SESSION['login_current_app'] = ($topbar_app_access === 'accounting') ? 'accounting' : 'wms';
}
$topbar_show_wms = in_array($topbar_app_access, ['all', 'wms']);
$topbar_show_accounting = in_array($topbar_app_access, ['all', 'accounting']);
$_usage = (new UsageGuard($pdo1, (int)$_SESSION['login_company_id'], $packages))->getStatus();
$_usage_max_pct = max($_usage['daily_pct'], $_usage['weekly_pct']);
$_usage_warn = $_usage_max_pct >= 80 && $_usage_max_pct < 100;
$_usage_full = $_usage_max_pct >= 100;
?>
<?php if (($_SESSION['login_current_app'] ?? 'wms') === 'accounting'): ?>
<style id="theme-accounting">
:root {
--bs-primary: #0284c7;
--bs-primary-rgb: 2, 132, 199;
--bs-primary-bg-subtle: #e0f2fe;
--bs-primary-border-subtle: #bae6fd;
--bs-primary-text-emphasis: #0369a1;
--bs-focus-ring-color: rgba(2, 132, 199, .25);
}
/* Sidebar active/hover — hardcoded in theme */
.sidebar .nav-link:hover,
.sidebar .nav-link.active {
color: #0284c7 !important;
background-color: rgba(2, 132, 199, 0.09) !important;
}
/* Buttons */
.btn-primary {
--bs-btn-bg: #0284c7;
--bs-btn-border-color: #0284c7;
--bs-btn-hover-bg: #0369a1;
--bs-btn-hover-border-color: #0369a1;
--bs-btn-active-bg: #0369a1;
--bs-btn-active-border-color: #0369a1;
--bs-btn-disabled-bg: #0284c7;
--bs-btn-disabled-border-color: #0284c7;
--bs-btn-focus-shadow-rgb: 2, 132, 199;
}
.btn-outline-primary {
--bs-btn-color: #0284c7;
--bs-btn-border-color: #0284c7;
--bs-btn-hover-bg: #0284c7;
--bs-btn-hover-border-color: #0284c7;
--bs-btn-active-bg: #0284c7;
--bs-btn-active-border-color: #0284c7;
--bs-btn-disabled-color: #0284c7;
--bs-btn-disabled-border-color: #0284c7;
}
.pagination {
--bs-pagination-active-bg: #0284c7;
--bs-pagination-active-border-color: #0284c7;
}
.nav-pills { --bs-nav-pills-link-active-bg: #0284c7; }
.dropdown-menu { --bs-dropdown-link-active-bg: #0284c7; }
.list-group {
--bs-list-group-active-bg: #0284c7;
--bs-list-group-active-border-color: #0284c7;
}
.progress, .progress-stacked { --bs-progress-bar-bg: #0284c7; }
.table-primary {
--bs-table-color: #0284c7;
--bs-table-bg: rgba(2, 132, 199, 0.09);
--bs-table-border-color: rgba(2, 132, 199, 0.15);
--bs-table-striped-bg: rgba(2, 132, 199, 0.12);
--bs-table-active-bg: rgba(2, 132, 199, 0.15);
--bs-table-hover-bg: rgba(2, 132, 199, 0.12);
}
thead.border-light th {
background-color: rgba(2, 132, 199, 0.09) !important;
color: #0284c7 !important;
border-color: rgba(2, 132, 199, 0.15) !important;
}
</style>
<?php endif; ?>
<div id="overlay" class="overlay"></div>
<!-- Global Variables -->
<div id="session-context"
data-company-id="<?php echo htmlspecialchars($_SESSION['login_company_id'] ?? 0, ENT_QUOTES, 'UTF-8'); ?>"
data-user-id="<?php echo htmlspecialchars($_SESSION['login_user_id'] ?? 0, ENT_QUOTES, 'UTF-8'); ?>"
data-otp="<?php echo htmlspecialchars($_SESSION['otp'] ?? '', ENT_QUOTES, 'UTF-8'); ?>"
data-role="<?php echo htmlspecialchars($_SESSION['login_role'] ?? 'viewer', ENT_QUOTES, 'UTF-8'); ?>">
</div>
<!-- Switch Branch Modal -->
<div class="modal fade" id="switchBranchModal" tabindex="-1" aria-hidden="true">
<div class="modal-dialog modal-dialog-centered" style="max-width: 360px;">
<div class="modal-content">
<div class="modal-header border-dashed">
<h6 class="modal-title mb-0"><i class="ti ti-building me-2"></i>Switch Branch</h6>
<button type="button" class="btn-close" data-bs-dismiss="modal"></button>
</div>
<div class="modal-body p-0">
<div id="branch_list" class="d-flex flex-column">
<div class="text-center text-muted small py-4">Loading...</div>
</div>
</div>
</div>
</div>
</div>
<!-- TOPBAR -->
<nav id="topbar" class="navbar bg-white border-bottom fixed-top topbar px-3">
<button id="toggleBtn" class="d-none d-lg-inline-flex btn btn-light btn-icon btn-sm ">
<i class="ti ti-layout-sidebar-left-expand"></i>
</button>
<!-- MOBILE -->
<button id="mobileBtn" class="btn btn-light btn-icon btn-sm d-lg-none me-2">
<i class="ti ti-layout-sidebar-left-expand"></i>
</button>
<div>
<!-- Navbar nav -->
<ul class="list-unstyled d-flex align-items-center mb-0 gap-1">
<!-- App switcher -->
<?php if ($topbar_show_wms && $topbar_show_accounting): ?>
<li class="dropdown">
<a class="position-relative btn-icon btn-sm btn-light btn rounded-circle" data-bs-toggle="dropdown"
aria-expanded="false" href="#" role="button" title="Switch App">
<i class="ti ti-layout-grid" style="font-size:18px;"></i>
</a>
<div class="dropdown-menu dropdown-menu-end p-2" style="min-width:170px;">
<?php $_sess_app = $_SESSION['login_current_app'] ?? 'wms'; ?>
<a href="<?php echo $server_url?>dashboard/index.php"
class="dropdown-item rounded d-flex align-items-center gap-2 py-2 <?php echo $_sess_app === 'wms' ? 'active' : ''; ?>">
<i class="ti ti-box"></i>
<span>WMS</span>
<?php if ($_sess_app === 'wms'): ?>
<i class="ti ti-check ms-auto text-success"></i>
<?php endif; ?>
</a>
<a href="<?php echo $server_url?>ac_dashboard/index.php"
class="dropdown-item rounded d-flex align-items-center gap-2 py-2 <?php echo $_sess_app === 'accounting' ? 'active' : ''; ?>">
<i class="ti ti-calculator"></i>
<span>Accounting</span>
<?php if ($_sess_app === 'accounting'): ?>
<i class="ti ti-check ms-auto text-success"></i>
<?php endif; ?>
</a>
</div>
</li>
<?php endif; ?>
<!-- Email OTP off (the default): a password-only sign-in must never be invisible to whoever is using it -->
<?php if (!otp_required()): ?>
<li class="d-none d-md-block">
<span class="badge bg-warning text-dark d-flex align-items-center gap-1 px-2 py-1"
style="font-size:11px; cursor:default;"
title="OTP_REQUIRED is not true in config.php">
<i class="ti ti-shield-off"></i>
OTP off
</span>
</li>
<?php endif; ?>
<!-- Usage limit warning -->
<?php if ($_usage_full || $_usage_warn): ?>
<li>
<span class="badge <?php echo $_usage_full ? 'bg-danger' : 'bg-warning text-dark'; ?> d-flex align-items-center gap-1 px-2 py-1"
style="font-size:11px; cursor:default;"
title="Daily: <?php echo $_usage['daily_count']; ?>/<?php echo $_usage['daily_limit'] ?: '∞'; ?> | Weekly: <?php echo $_usage['weekly_count']; ?>/<?php echo $_usage['weekly_limit'] ?: '∞'; ?>">
<i class="ti <?php echo $_usage_full ? 'ti-circle-x' : 'ti-alert-triangle'; ?>"></i>
<?php if ($_usage_full): ?>
Limit reached — reports locked
<?php else: ?>
<?php echo $_usage_max_pct; ?>% usage
<?php endif; ?>
</span>
</li>
<?php endif; ?>
<!-- Bell notifications -->
<li class="dropdown">
<a class="position-relative btn-icon btn-sm btn-light btn rounded-circle" href="#" role="button"
data-bs-toggle="dropdown" aria-expanded="false" onclick="clear_notif_badge()">
<i class="ti ti-bell" style="font-size:18px;"></i>
<span id="notif_badge" class="badge bg-danger position-absolute top-0 start-100 translate-middle rounded-pill d-none"
style="font-size:9px;min-width:16px;padding:2px 4px;"></span>
</a>
<div class="dropdown-menu dropdown-menu-end p-0" style="min-width:300px;">
<div class="px-3 py-2 border-bottom d-flex align-items-center justify-content-between">
<span class="fw-semibold small">Notifications</span>
<a href="javascript:;" class="small text-muted" onclick="clear_all_notifs()">Clear all</a>
</div>
<div id="notif_list" style="max-height:360px;overflow-y:auto;">
<div class="text-center text-muted small py-4">No notifications</div>
</div>
</div>
</li>
<!-- User dropdown -->
<li class="ms-3 dropdown">
<a class="position-relative btn-icon btn-sm btn-primary btn rounded-circle" href="#" role="button" data-bs-toggle="dropdown" aria-expanded="false">
<svg xmlns="http://www.w3.org/2000/svg" width="20" height="20" viewBox="0 0 24 24" fill="none"
stroke="white" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round">
<path stroke="none" d="M0 0h24v24H0z" fill="none"/>
<path d="M10.325 4.317c.426 -1.756 2.924 -1.756 3.35 0a1.724 1.724 0 0 0 2.573 1.066c1.543 -.94 3.31 .826 2.37 2.37a1.724 1.724 0 0 0 1.065 2.572c1.756 .426 1.756 2.924 0 3.35a1.724 1.724 0 0 0 -1.066 2.573c.94 1.543 -.826 3.31 -2.37 2.37a1.724 1.724 0 0 0 -2.572 1.065c-.426 1.756 -2.924 1.756 -3.35 0a1.724 1.724 0 0 0 -2.573 -1.066c-1.543 .94 -3.31 -.826 -2.37 -2.37a1.724 1.724 0 0 0 -1.065 -2.572c-1.756 -.426 -1.756 -2.924 0 -3.35a1.724 1.724 0 0 0 1.066 -2.573c-.94 -1.543 .826 -3.31 2.37 -2.37c1 .608 2.296 .07 2.572 -1.065z"/>
<path d="M9 12a3 3 0 1 0 6 0a3 3 0 0 0 -6 0"/>
</svg>
</a>
<div class="dropdown-menu dropdown-menu-end p-0" style="min-width: 200px;">
<div>
<div class="d-flex gap-3 align-items-center border-dashed border-bottom px-3 py-3">
<img src="<?php echo $topbar_avatar_src; ?>" alt=""
class="avatar avatar-md rounded-circle" />
<div>
<h4 class="mb-0 small"><?php echo $topbar_name; ?></h4>
<p class="mb-0 small">@<?php echo $topbar_username; ?></p>
</div>
</div>
<div class="p-3 d-flex flex-column gap-1 small lh-lg">
<a href="javascript:;" onclick="switch_branch();">
<span>Switch Branch</span>
</a>
<a href="<?php echo $server_url?>setting/profile.php">
<span>Setting</span>
</a>
<a href="<?php echo $server_url?>inventory/product.php">
<span>Master Data</span>
</a>
<a href="javascript:;" onclick="log_out();">
<span>Log Out</span>
</a>
</div>
</div>
</div>
</li>
</ul>
</div>
</nav>
<!-- top bar script -->
<script>
// Global Variables
var server_url = '<?php echo $server_url; ?>';
var prop_limit = '<?php echo $prop['limit']; ?>';
var user_role = document.getElementById('session-context')?.dataset.role || 'viewer';
var company_id = parseInt(document.getElementById('session-context')?.dataset.companyId || '0', 10);
var user_id = parseInt(document.getElementById('session-context')?.dataset.userId || '0', 10);
// ── Bell notifications ────────────────────────────────────────────────────────
var _notif_items = [];
var _notif_unread = 0;
var _notif_icon_map = {
success: 'ti-circle-check text-success',
info: 'ti-info-circle text-info',
warning: 'ti-alert-triangle text-warning',
danger: 'ti-circle-x text-danger',
};
function add_notification(title, message, type) {
var time = new Date().toLocaleTimeString([], { hour: '2-digit', minute: '2-digit' });
_notif_items.unshift({ title: title, message: message, type: type || 'info', time: time });
if (_notif_items.length > 20) _notif_items.pop();
_notif_unread++;
_render_notif_badge();
_render_notif_list();
}
function clear_notif_badge() {
_notif_unread = 0;
_render_notif_badge();
}
function clear_all_notifs() {
_notif_items = [];
_notif_unread = 0;
_render_notif_badge();
_render_notif_list();
}
function _render_notif_badge() {
var badge = document.getElementById('notif_badge');
if (!badge) return;
if (_notif_unread > 0) {
badge.textContent = _notif_unread > 99 ? '99+' : _notif_unread;
badge.classList.remove('d-none');
} else {
badge.classList.add('d-none');
}
}
function _render_notif_list() {
var el = document.getElementById('notif_list');
if (!el) return;
if (_notif_items.length === 0) {
el.innerHTML = '<div class="text-center text-muted small py-4">No notifications</div>';
return;
}
// Notification text arrives over the socket: escape it, never render it as markup.
var esc = function (v) {
return String(v).replace(/[&<>"']/g, function (c) {
return { '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c];
});
};
el.innerHTML = _notif_items.map(function(n) {
var icon = _notif_icon_map[n.type] || _notif_icon_map.info;
return '<div class="d-flex align-items-start gap-2 px-3 py-2 border-bottom">' +
'<i class="ti ' + icon + ' fs-5 flex-shrink-0 mt-1"></i>' +
'<div class="flex-grow-1 overflow-hidden">' +
(n.title ? '<div class="fw-semibold small text-truncate">' + esc(n.title) + '</div>' : '') +
(n.message ? '<div class="small text-muted text-truncate">' + esc(n.message) + '</div>' : '') +
'<div class="small text-muted opacity-75 mt-1">' + n.time + '</div>' +
'</div></div>';
}).join('');
}
// ── Log out ───────────────────────────────────────────────────────────────────
function log_out() {
return ajax_request({
url: server_url + 'login/api/engine/back.php',
autoPrepare: true,
checkRequired: 0,
action: 'read',
onSuccess: function(res) {
try { sessionStorage.clear(); } catch (e) {}
window.location.href = server_url + 'index.php';
}
});
}
// ── Switch Branch ─────────────────────────────────────────────────────────────
function switch_branch() {
$('#switchBranchModal').modal('show');
ajax_request({
url: server_url + 'setting/api/engine/switch_branch.php',
autoPrepare: true,
checkRequired: 0,
action: 'read',
onSuccess: function(res) {
var current = res.current;
var companies = res.output || [];
if (companies.length <= 1) {
$('#branch_list').html(
'<div class="text-center text-muted small py-4">You only belong to one branch.</div>'
);
return;
}
var html = '';
companies.forEach(function(c) {
var is_active = c.company_id == current;
html += '<a href="javascript:;" class="d-flex align-items-center gap-3 px-3 py-2 border-bottom ' +
(is_active ? 'bg-light' : '') + '" onclick="do_switch_branch(' + c.company_id + ')">' +
'<span class="d-flex align-items-center justify-content-center rounded-circle bg-label-primary flex-shrink-0" style="width:36px;height:36px;">' +
'<i class="ti ti-building small"></i></span>' +
'<div class="flex-grow-1 overflow-hidden">' +
'<p class="mb-0 small fw-semibold text-truncate">' + $('<span>').text(c.channel_name).html() + '</p>' +
'<p class="mb-0 x-small text-muted">' + $('<span>').text(c.company_name).html() + $('<span>').text(c.branch || c.role).html() + '</p>' +
'</div>' +
(is_active ? '<i class="ti ti-check text-success ms-auto"></i>' : '') +
'</a>';
});
$('#branch_list').html(html);
}
});
}
function do_switch_branch(company_id) {
ajax_request({
url: server_url + 'setting/api/engine/switch_branch.php',
autoPrepare: true,
checkRequired: 0,
action: 'update',
// Sent under its own key: prepare_form_data() always fills company_id with
// the CURRENT company, and only options.data reaches the payload.
data: { target_company_id: company_id },
onSuccess: function(res) {
window.location.reload();
}
});
}
</script>
Reference in New Issue View Git Blame Copy Permalink