path: root/prog/inventar/index.php

<?php
// create table stvari (id integer primary key autoincrement, lastnik, ime, opis, vrednost, omejitev, kol, lokacija, slika, datum default CURRENT_TIMESTAMP);
require_once "h.php";
if (!empty($_REQUEST["src"])) {
	header("Content-Type: text/plain");
	die(file_get_contents($_SERVER["SCRIPT_FILENAME"]));
}
if ((isset($_REQUEST["prijava"]) && (empty($_SERVER["PHP_AUTH_USER"]) || $auth[$_SERVER['PHP_AUTH_USER']] != $_SERVER['PHP_AUTH_PW'])) || (isset($_SERVER['PHP_AUTH_USER']) && $auth[$_SERVER['PHP_AUTH_USER']] != $_SERVER['PHP_AUTH_PW'])) {
	header("WWW-Authenticate: Basic realm=inventar");
	header("HTTP/1.0 401 Neprijavljen");
	die("401");
}
?>
<style>
table, td, tr, th {
	border: 1px solid red;
}
img {
	width: 1cm;
}
img:hover {
	width: 5cm;
}
</style>
<form>
<input autofocus placeholder="where expression" name=q value="<?= @htmlspecialchars($_REQUEST["q"]) ?>" />
<input type=submit />
</form>
<table>
<?php
if (empty($_SERVER['PHP_AUTH_USER']))
	echo '<a href=?prijava=1>prijava</a> <small> <a href="mailto:anton@sijanec.eu?subject=registracija na inventar&body=rad bi imel profil na inventarju">registracija</a></small>';
else
	echo "<form method=post><input type=submit name=dodaj value='dodaj stvar kot {$_SERVER['PHP_AUTH_USER']}' /></form>";
$passed = [];
if (!empty($_POST["izbriši"]))
	$db->exec("delete from stvari where lastnik = '{$_SERVER["PHP_AUTH_USER"]}' and id = '{$_POST["id"]}'");
if (!empty($_POST["dodaj"]) && !empty($_SERVER["PHP_AUTH_USER"]))
	$db->exec("insert into stvari (lastnik) values ('{$_SERVER["PHP_AUTH_USER"]}')");
foreach ($_POST as $k => $v)
	if (is_numeric($k)) {
		foreach ($_POST as $k2 => $v2) {
			$sp = strpos($k2, "" . $k);
			if ($sp)
				$passed[] = substr($k2, 0, $sp);
		}
		$par = [];
		foreach ($passed as $p) {
			if (strpos(strtolower($p), "id") === false)
				$par[] = "'" . SQLite3::escapeString($p) . "' = '" . SQLite3::escapeString($_POST[$p . $k]) . "'";
		}
		$s = "update stvari set " . implode(", ", $par) . " where lastnik='{$_SERVER["PHP_AUTH_USER"]}' and id={$k}";
		echo $s;
		$db->exec($s);
	}
if (!empty($_REQUEST["q"]))
	$ret = $ro->query("select * from stvari where " . $_REQUEST["q"] . " order by datum desc");
else
	$ret = $ro->query("select * from stvari order by datum desc");
$i = 0;
foreach ($ret as $row) {
	if ($i == 0)
		foreach ($row as $k => $v)
			if ($k != "id" && !is_numeric($k))
				echo "<th>$k</th>";
	echo "<form method=post><tr>";
	foreach ($row as $k => $v) {
		if ($k == "id" || is_numeric($k))
			continue;
		echo "<td id=$k$i>";
		$ok = false;
		foreach (["input", "name"] as $w)
			if (strpos(strtolower($v), $w) === FALSE)
				$ok = true;
		if ($k == "slika" && !empty($v))
			echo "<img src=$v></img>";
		if ($k == "datum")
			echo "<a id=id{$row["id"]} href=#id{$row["id"]}>";
		if ($k == "lastnik" && $v == @$_SERVER['PHP_AUTH_USER']) {
			echo "<input type=submit value=shrani name={$row["id"]} />";
			echo "<input type=hidden name=id value={$row["id"]} />";
			echo "<input type=submit value=izbriši name=izbriši /></td>";
		}
		if ($row["lastnik"] == @$_SERVER['PHP_AUTH_USER'] && $k != "lastnik") {
			echo "<input name=$k{$row["id"]} value='" . htmlspecialchars($v) . "' />";
		} else
			if ($row["lastnik"] != @$_SERVER['PHP_AUTH_USER'] && $k != "slika")
				echo "$v</td>";
	}
	echo "</form></tr>";
	$i++;
}