Initial commit

แบบประเมินของไอที ประจำปี/actions/delete_assessment.php

@@ -0,0 +1,36 @@
+<?php
+session_start();
+if (!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true || !isset($_SESSION['is_admin']) || !$_SESSION['is_admin']) {
+    header("location: ../index.php");
+    exit;
+}
+
+require_once '../includes/db_assessment.php';
+
+if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST['id'])) {
+    $id = $_POST['id'];
+
+    // Get info for logging
+    $stmt = $pdo_assess->prepare("SELECT fullname, assess_year FROM it_assessments WHERE id = ?");
+    $stmt->execute([$id]);
+    $assessment = $stmt->fetch();
+
+    if ($assessment) {
+        // Delete
+        $del_stmt = $pdo_assess->prepare("DELETE FROM it_assessments WHERE id = ?");
+        $del_stmt->execute([$id]);
+
+        // Log the action
+        $admin_cid = $_SESSION['cid'];
+        $admin_name = $_SESSION['fullname'] ?? 'Admin';
+        $action_detail = "ลบข้อมูลประเมินของ: " . $assessment['fullname'] . " (ปี " . $assessment['assess_year'] . ")";
+        logAdminAction($pdo_assess, $admin_cid, $admin_name, 'DELETE_ASSESSMENT', $action_detail);
+
+        $_SESSION['success_msg'] = "ลบข้อมูลแบบประเมินเรียบร้อยแล้ว";
+    }
+}
+
+// Redirect back to summary, retaining the year filter if possible
+$year = $_POST['filter_year'] ?? '';
+header("Location: ../summary.php" . ($year ? "?year=$year" : ""));
+exit;

แบบประเมินของไอที ประจำปี/actions/get_summary_data.php

@@ -0,0 +1,67 @@
+<?php
+session_start(); ob_start();
+if (!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true || !isset($_SESSION['is_admin']) || !$_SESSION['is_admin']) {
+    ob_clean(); header("Content-Type: application/json; charset=utf-8"); echo json_encode(["data" => []]);
+    exit;
+}
+require_once '../includes/db_assessment.php';
+require_once '../includes/db_hosoffice.php';
+
+$filter_year = $_GET['year'] ?? (date('Y')+543);
+$rules = $pdo_assess->query("SELECT id FROM it_rules ORDER BY order_no ASC")->fetchAll(PDO::FETCH_ASSOC);
+$slas = $pdo_assess->query("SELECT id FROM it_slas ORDER BY order_no ASC")->fetchAll(PDO::FETCH_ASSOC);
+
+$assessments = [];
+try {
+    $stmt = $pdo_assess->prepare("SELECT * FROM it_assessments WHERE assess_year = :year ORDER BY created_at DESC");
+    $stmt->execute(['year' => $filter_year]);
+    $assessments = $stmt->fetchAll(PDO::FETCH_ASSOC);
+} catch (Exception $e) { }
+
+$data = [];
+$no = 1;
+foreach ($assessments as $row) {
+    $rules_data = json_decode($row['rules_data'], true) ?: [];
+    $sla_data = json_decode($row['sla_data'], true) ?: [];
+    
+    $rowData = [];
+    $rowData[] = '<div class="text-center">'.$no++.'</div>';
+    $rowData[] = '<div class="text-center">'.htmlspecialchars($row['assess_year']).'</div>';
+    $rowData[] = htmlspecialchars($row['fullname']);
+    $rowData[] = htmlspecialchars($row['position']);
+    $rowData[] = htmlspecialchars($row['department']);
+    
+    if($row['computer_use'] == '1'){
+        $rowData[] = '<div class="text-center"><span class="badge bg-success">ใช้</span></div>';
+    } else {
+        $rowData[] = '<div class="text-center"><span class="badge bg-secondary">ไม่ใช้</span></div>';
+    }
+    
+    foreach($rules as $r){
+        $r_id = $r['id'];
+        $k = $rules_data[$r_id]['k'] ?? '-';
+        $u = $rules_data[$r_id]['u'] ?? '-';
+        $p = $rules_data[$r_id]['p'] ?? '-';
+        $rowData[] = '<div class="text-center">'.($k == 'yes' ? '✔️' : ($k == 'no' ? '❌' : '-')).'</div>';
+        $rowData[] = '<div class="text-center">'.($u == 'yes' ? '✔️' : ($u == 'no' ? '❌' : '-')).'</div>';
+        $rowData[] = '<div class="text-center">'.($p == 'yes' ? '✔️' : ($p == 'no' ? '❌' : '-')).'</div>';
+    }
+    
+    foreach($slas as $s){
+        $s_id = $s['id'];
+        $score = $sla_data[$s_id]['score'] ?? '-';
+        $comment = $sla_data[$s_id]['comment'] ?? '-';
+        $rowData[] = '<div class="text-center">'.htmlspecialchars($score).'</div>';
+        $rowData[] = htmlspecialchars($comment);
+    }
+    
+    $rowData[] = '<div class="text-center">'.date('d/m/Y H:i', strtotime($row['created_at'])).'</div>';
+    
+    $deleteForm = '<div class="text-center"><form method="POST" action="actions/delete_assessment.php" onsubmit="return confirm(\'ยืนยันการลบข้อมูลประเมินของ '.htmlspecialchars($row['fullname']).' ใช่หรือไม่?\');"><input type="hidden" name="id" value="'.$row['id'].'"><input type="hidden" name="filter_year" value="'.htmlspecialchars($filter_year).'"><button type="submit" class="btn btn-sm btn-danger py-0 px-2" title="ลบข้อมูล">ลบ</button></form></div>';
+    
+    $rowData[] = $deleteForm;
+    
+    $data[] = $rowData;
+}
+
+ob_clean(); header("Content-Type: application/json; charset=utf-8"); echo json_encode(["data" => $data]);

แบบประเมินของไอที ประจำปี/actions/get_unassessed_data.php

@@ -0,0 +1,57 @@
+<?php
+session_start(); ob_start();
+if (!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true || !isset($_SESSION['is_admin']) || !$_SESSION['is_admin']) {
+    ob_clean(); header("Content-Type: application/json; charset=utf-8"); echo json_encode(["data" => [], "count" => 0]);
+    exit;
+}
+require_once '../includes/db_assessment.php';
+require_once '../includes/db_hosoffice.php';
+
+$filter_year = $_GET['year'] ?? (date('Y')+543);
+
+$assessments = [];
+try {
+    $stmt = $pdo_assess->prepare("SELECT hr_cid FROM it_assessments WHERE assess_year = :year");
+    $stmt->execute(['year' => $filter_year]);
+    $completed_cids = $stmt->fetchAll(PDO::FETCH_COLUMN);
+} catch (Exception $e) { 
+    $completed_cids = [];
+}
+
+$data = [];
+try {
+    $sql = "SELECT a.HR_CID, e.HR_PREFIX_NAME, a.HR_FNAME, a.HR_LNAME,
+                   p.HR_POSITION_NAME, 
+                   COALESCE(d.HR_DEPARTMENT_SUB_SUB_NAME, d2.HR_DEPARTMENT_SUB_NAME, '-') as DEPARTMENT_NAME
+            FROM hr_person a  
+            LEFT OUTER JOIN hr_prefix e ON a.HR_PREFIX_ID=e.HR_PREFIX_ID 
+            LEFT OUTER JOIN hr_position p ON a.HR_POSITION_ID=p.HR_POSITION_ID
+            LEFT OUTER JOIN hr_department_sub d2 ON a.HR_DEPARTMENT_SUB_ID=d2.HR_DEPARTMENT_SUB_ID
+            LEFT OUTER JOIN hr_department_sub_sub d ON a.HR_DEPARTMENT_SUB_SUB_ID=d.HR_DEPARTMENT_SUB_SUB_ID
+            WHERE a.HR_STATUS_ID = '01'";
+            
+    if (count($completed_cids) > 0) {
+        $in_marks = str_repeat('?,', count($completed_cids) - 1) . '?';
+        $sql .= " AND a.HR_CID NOT IN ($in_marks)";
+        $sql .= " ORDER BY DEPARTMENT_NAME, a.HR_FNAME";
+        $stmt_un = $pdo_hos->prepare($sql);
+        $stmt_un->execute($completed_cids);
+    } else {
+        $sql .= " ORDER BY DEPARTMENT_NAME, a.HR_FNAME";
+        $stmt_un = $pdo_hos->query($sql);
+    }
+    $unassessed_users = $stmt_un->fetchAll(PDO::FETCH_ASSOC);
+    
+    $no = 1;
+    foreach($unassessed_users as $u) {
+        $fullname = trim(($u['HR_PREFIX_NAME'] ?? '') . $u['HR_FNAME'] . ' ' . $u['HR_LNAME']);
+        $data[] = [
+            '<div class="text-center">'.$no++.'</div>',
+            htmlspecialchars($fullname),
+            htmlspecialchars($u['HR_POSITION_NAME'] ?? '-'),
+            htmlspecialchars($u['DEPARTMENT_NAME'] ?? '-')
+        ];
+    }
+} catch (Exception $e) { }
+
+ob_clean(); header("Content-Type: application/json; charset=utf-8"); echo json_encode(["data" => $data, "count" => count($data)]);

แบบประเมินของไอที ประจำปี/actions/logout.php

@@ -0,0 +1,6 @@
+<?php
+session_start();
+$_SESSION = array();
+session_destroy();
+header("location: ../index.php");
+exit;

แบบประเมินของไอที ประจำปี/actions/process_login.php

@@ -0,0 +1,80 @@
+<?php
+session_start();
+
+if (isset($_SESSION["loggedin"]) && $_SESSION["loggedin"] === true) {
+    header("location: ../form.php");
+    exit;
+}
+
+require_once '../includes/db_hosoffice.php';
+
+if ($_SERVER["REQUEST_METHOD"] == "POST") {
+
+    $user = trim($_POST['username'] ?? '');
+    $pass = trim($_POST['password'] ?? '');
+
+    if (empty($user) || empty($pass)) {
+        $_SESSION['login_error'] = "กรุณากรอก Username และ Password";
+        header("location: ../index.php");
+        exit;
+    }
+
+    $pass_md5 = MD5($pass);
+
+    $sql = "SELECT a.HR_CID, a.HR_PASSWORD, a.HR_STATUS_ID, e.HR_PREFIX_NAME, a.HR_FNAME, a.HR_LNAME,
+                   p.HR_POSITION_NAME, d.HR_DEPARTMENT_SUB_SUB_NAME
+            FROM hr_person a  
+            LEFT OUTER JOIN hr_prefix e ON a.HR_PREFIX_ID=e.HR_PREFIX_ID 
+            LEFT OUTER JOIN hr_position p ON a.HR_POSITION_ID=p.HR_POSITION_ID
+            LEFT OUTER JOIN hr_department_sub_sub d ON a.HR_DEPARTMENT_SUB_SUB_ID=d.HR_DEPARTMENT_SUB_SUB_ID
+            WHERE a.HR_USERNAME = :user LIMIT 1";
+
+    try {
+        $stmt = $pdo_hos->prepare($sql);
+        $stmt->execute(['user' => $user]);
+        $row = $stmt->fetch(PDO::FETCH_ASSOC);
+
+        if (!$row) {
+            $_SESSION['login_error'] = "ไม่พบบัญชีผู้ใช้นี้";
+            header("location: ../index.php");
+            exit;
+        }
+
+        if (strtolower($row['HR_PASSWORD']) !== strtolower($pass_md5)) {
+            $_SESSION['login_error'] = "รหัสผ่านไม่ถูกต้อง";
+            header("location: ../index.php");
+            exit;
+        }
+
+        if ($row['HR_STATUS_ID'] !== '01') {
+            $_SESSION['login_error'] = "บัญชีผู้ใช้นี้ถูกปิดการใช้งานไปแล้ว";
+            header("location: ../index.php");
+            exit;
+        }
+
+        unset($_SESSION['login_error']);
+
+        $_SESSION['loggedin'] = true;
+        $_SESSION['fullname'] = $row['HR_PREFIX_NAME'] . $row['HR_FNAME'] . " " . $row['HR_LNAME'];
+        $_SESSION['cid'] = $row['HR_CID'];
+        $_SESSION['position'] = $row['HR_POSITION_NAME'] ?? '';
+        $_SESSION['department'] = $row['HR_DEPARTMENT_SUB_SUB_NAME'] ?? '';
+        
+        // Include db_assessment.php to get $super_admins
+        require_once '../includes/db_assessment.php';
+        $_SESSION['is_admin'] = in_array($row['HR_CID'], $super_admins);
+        
+        // Admin check (optional, if you want admins to go to summary.php instead of form.php)
+        // For now, redirect everyone to the form. 
+        header("location: ../form.php");
+        exit;
+    } catch (PDOException $e) {
+        $_SESSION['login_error'] = "เกิดข้อผิดพลาดของระบบฐานข้อมูล";
+        // log error securely $e->getMessage()
+        header("location: ../index.php");
+        exit;
+    }
+} else {
+    header("location: ../index.php");
+    exit;
+}

แบบประเมินของไอที ประจำปี/actions/save_assessment.php

@@ -0,0 +1,76 @@
+<?php
+session_start();
+if (!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true) {
+    header("location: ../index.php");
+    exit;
+}
+
+require_once '../includes/db_assessment.php';
+
+if ($_SERVER["REQUEST_METHOD"] == "POST") {
+    
+    $cid = $_SESSION['cid'];
+    $assess_year = $_POST['assess_year'];
+    $fullname = $_POST['fullname'] ?? '';
+    $position = $_POST['position'] ?? '';
+    $department = $_POST['department'] ?? '';
+    $computer_use = $_POST['computer_use'] ?? '2';
+
+    $rules_json = null;
+    $sla_json = null;
+
+    if ($computer_use == '1') {
+        $rules_data = [];
+        $sla_data = [];
+        
+        foreach ($_POST as $key => $val) {
+            // Check for rules: r_{id}_k, r_{id}_u, r_{id}_p
+            if (preg_match('/^r_(\d+)_(k|u|p)$/', $key, $matches)) {
+                $id = $matches[1];
+                $type = $matches[2];
+                $rules_data[$id][$type] = $val;
+            }
+            // Check for sla: sla_{id}_score, sla_{id}_comment
+            elseif (preg_match('/^sla_(\d+)_(score|comment)$/', $key, $matches)) {
+                $id = $matches[1];
+                $type = $matches[2];
+                $sla_data[$id][$type] = $val;
+            }
+        }
+        $rules_json = json_encode($rules_data, JSON_UNESCAPED_UNICODE);
+        $sla_json = json_encode($sla_data, JSON_UNESCAPED_UNICODE);
+    }
+
+    $sql = "INSERT INTO it_assessments (assess_year, hr_cid, fullname, position, department, computer_use, rules_data, sla_data) 
+            VALUES (:assess_year, :hr_cid, :fullname, :position, :department, :computer_use, :rules_data, :sla_data)";
+    
+    $params = [
+        ':assess_year' => $assess_year,
+        ':hr_cid' => $cid,
+        ':fullname' => $fullname,
+        ':position' => $position,
+        ':department' => $department,
+        ':computer_use' => $computer_use,
+        ':rules_data' => $rules_json,
+        ':sla_data' => $sla_json
+    ];
+
+    try {
+        $stmt = $pdo_assess->prepare($sql);
+        $stmt->execute($params);
+        $_SESSION['success_msg'] = "บันทึกข้อมูลเรียบร้อยแล้ว";
+    } catch (PDOException $e) {
+        if ($e->errorInfo[1] == 1062) {
+            $_SESSION['error_msg'] = "ท่านได้ทำแบบประเมินสำหรับปีนี้ไปแล้ว";
+        } else {
+            $_SESSION['error_msg'] = "เกิดข้อผิดพลาดในการบันทึกข้อมูล: " . $e->getMessage();
+        }
+    }
+
+    header("location: ../form.php");
+    exit;
+
+} else {
+    header("location: ../form.php");
+    exit;
+}

แบบประเมินของไอที ประจำปี/actions/tmp_test.php

@@ -0,0 +1,57 @@
+<?php
+//session_start();
+if (!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true || !isset($_SESSION['is_admin']) || !$_SESSION['is_admin']) {
+    echo json_encode(["data" => [], "count" => 0]);
+    exit;
+}
+require_once '../includes/db_assessment.php';
+require_once '../includes/db_hosoffice.php';
+
+$filter_year = $_GET['year'] ?? (date('Y')+543);
+
+$assessments = [];
+try {
+    $stmt = $pdo_assess->prepare("SELECT hr_cid FROM it_assessments WHERE assess_year = :year");
+    $stmt->execute(['year' => $filter_year]);
+    $completed_cids = $stmt->fetchAll(PDO::FETCH_COLUMN);
+} catch (Exception $e) { 
+    $completed_cids = [];
+}
+
+$data = [];
+try {
+    $sql = "SELECT a.HR_CID, e.HR_PREFIX_NAME, a.HR_FNAME, a.HR_LNAME,
+                   p.HR_POSITION_NAME, 
+                   COALESCE(d.HR_DEPARTMENT_SUB_SUB_NAME, d2.HR_DEPARTMENT_SUB_NAME, '-') as DEPARTMENT_NAME
+            FROM hr_person a  
+            LEFT OUTER JOIN hr_prefix e ON a.HR_PREFIX_ID=e.HR_PREFIX_ID 
+            LEFT OUTER JOIN hr_position p ON a.HR_POSITION_ID=p.HR_POSITION_ID
+            LEFT OUTER JOIN hr_department_sub d2 ON a.HR_DEPARTMENT_SUB_ID=d2.HR_DEPARTMENT_SUB_ID
+            LEFT OUTER JOIN hr_department_sub_sub d ON a.HR_DEPARTMENT_SUB_SUB_ID=d.HR_DEPARTMENT_SUB_SUB_ID
+            WHERE a.HR_STATUS_ID = '01'";
+            
+    if (count($completed_cids) > 0) {
+        $in_marks = str_repeat('?,', count($completed_cids) - 1) . '?';
+        $sql .= " AND a.HR_CID NOT IN ($in_marks)";
+        $sql .= " ORDER BY DEPARTMENT_NAME, a.HR_FNAME";
+        $stmt_un = $pdo_hos->prepare($sql);
+        $stmt_un->execute($completed_cids);
+    } else {
+        $sql .= " ORDER BY DEPARTMENT_NAME, a.HR_FNAME";
+        $stmt_un = $pdo_hos->query($sql);
+    }
+    $unassessed_users = $stmt_un->fetchAll(PDO::FETCH_ASSOC);
+    
+    $no = 1;
+    foreach($unassessed_users as $u) {
+        $fullname = trim(($u['HR_PREFIX_NAME'] ?? '') . $u['HR_FNAME'] . ' ' . $u['HR_LNAME']);
+        $data[] = [
+            '<div class="text-center">'.$no++.'</div>',
+            htmlspecialchars($fullname),
+            htmlspecialchars($u['HR_POSITION_NAME'] ?? '-'),
+            htmlspecialchars($u['DEPARTMENT_NAME'] ?? '-')
+        ];
+    }
+} catch (Exception $e) { }
+
+echo json_encode(["data" => $data, "count" => count($data)]);