43 lines
1.6 KiB
PHP
43 lines
1.6 KiB
PHP
<?php
|
|
// api/settings.php
|
|
require_once dirname(__DIR__) . '/config/config.php';
|
|
require_once dirname(__DIR__) . '/models/Setting.php';
|
|
|
|
header('Content-Type: application/json');
|
|
|
|
// Only allow Admin or Manager
|
|
if (!isset($_SESSION['user_id']) || !in_array($_SESSION['role'], ['admin', 'manager'])) {
|
|
echo json_encode(['status' => 'error', 'message' => 'Unauthorized']);
|
|
exit;
|
|
}
|
|
|
|
$action = $_REQUEST['action'] ?? '';
|
|
|
|
if ($action === 'save') {
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
echo json_encode(['status' => 'error', 'message' => 'Invalid method']);
|
|
exit;
|
|
}
|
|
|
|
// CSRF Check
|
|
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
|
|
echo json_encode(['status' => 'error', 'message' => 'Invalid CSRF Token']);
|
|
exit;
|
|
}
|
|
|
|
$settingsData = $_POST['settings'] ?? [];
|
|
|
|
if (!empty($settingsData) && is_array($settingsData)) {
|
|
$settingModel = new Setting();
|
|
if ($settingModel->updateBulk($settingsData)) {
|
|
echo json_encode(['status' => 'success', 'message' => 'บันทึกการตั้งค่าเรียบร้อย']);
|
|
} else {
|
|
echo json_encode(['status' => 'error', 'message' => 'ไม่สามารถบันทึกข้อมูลลงฐานข้อมูลได้']);
|
|
}
|
|
} else {
|
|
echo json_encode(['status' => 'error', 'message' => 'ไม่มีข้อมูลให้บันทึก']);
|
|
}
|
|
} else {
|
|
echo json_encode(['status' => 'error', 'message' => 'Unknown action']);
|
|
}
|