Add invoice notes

[aftechro]

Not sure how and where to find thigns, but i`ll put everything on single file and hope you guys can split the code to right pages/sections. Looked at some files to follow the example, but i dont know how the post.php handles the functions now.

think we dont need the invoice_id as this would be template, so please ignore anything related to invoice_id

SQL:

CREATE TABLE `invoice_notes` (
  `note_id` int(11) NOT NULL AUTO_INCREMENT,
  `note_title` varchar(255) NOT NULL,
  `note_description` text NOT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  PRIMARY KEY (`note_id`)
) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

admin_invoice_notes.php strip the modals and place them on the right locations

<?php

// Default Column Sortby Filter
$sort = "note_title";
$order = "ASC";

require_once "includes/inc_all_admin.php";

// Rebuild URL
$url_query_strings_sort = http_build_query($get_copy);

$sql = mysqli_query(
    $mysqli,
    "SELECT SQL_CALC_FOUND_ROWS * FROM invoice_notes
    WHERE (note_title LIKE '%$q%' OR note_description LIKE '%$q%')
    ORDER BY $sort $order LIMIT $record_from, $record_to"
);

$num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));

?>

<div class="card card-dark">
    <div class="card-header py-2">
        <h3 class="card-title mt-2">
            <i class="fas fa-fw fa-sticky-note mr-2"></i>Invoice Notes
        </h3>
        <div class="card-tools">
            <button type="button" class="btn btn-primary" data-toggle="modal" data-target="#addInvoiceNoteModal">
                <i class="fas fa-plus mr-2"></i>New Note
            </button>
        </div>
    </div>
    <div class="card-body">
        <form autocomplete="off">
            <div class="row">
                <div class="col-md-4">
                    <div class="input-group mb-3 mb-md-0">
                        <input type="search" class="form-control" name="q" value="<?php if (isset($q)) { echo stripslashes(nullable_htmlentities($q)); } ?>" placeholder="Search Notes">
                        <div class="input-group-append">
                            <button class="btn btn-dark"><i class="fa fa-search"></i></button>
                        </div>
                    </div>
                </div>
            </div>
        </form>
        <hr>
        <div class="table-responsive">
            <table class="table table-striped table-borderless table-hover">
                <thead class="text-dark <?php if ($num_rows[0] == 0) { echo 'd-none'; } ?>">
                    <tr>
                        <th>
                            <a class="text-secondary" href="?<?php echo $url_query_strings_sort; ?>&sort=note_title&order=<?php echo $disp; ?>">
                                Note Title <?php if ($sort == 'note_title') { echo $order_icon; } ?>
                            </a>
                        </th>
                        <th>Description</th>
                        <th class="text-center">Action</th>
                    </tr>
                </thead>
                <tbody>
                    <?php while ($row = mysqli_fetch_array($sql)) { 
                        $note_id = intval($row['note_id']);
                        $note_title = nullable_htmlentities($row['note_title']);
                        $note_description = nullable_htmlentities($row['note_description']) ?: "-";
                    ?>
                    <tr>
                        <th>
                            <a class="text-dark" href="#" data-toggle="modal" data-target="#editInvoiceNoteModal<?php echo $note_id; ?>">
                                <i class="fa fa-fw fa-sticky-note text-secondary mr-2"></i><?php echo $note_title; ?>
                            </a>
                        </th>
                        <td><?php echo $note_description; ?></td>
                        <td class="text-center">
                            <div class="dropdown dropleft">
                                <button class="btn btn-secondary btn-sm" type="button" data-toggle="dropdown">
                                    <i class="fas fa-ellipsis-h"></i>
                                </button>
                                <div class="dropdown-menu">
                                    <a class="dropdown-item" href="#" data-toggle="modal" data-target="#editInvoiceNoteModal<?php echo $note_id; ?>">
                                        <i class="fas fa-fw fa-edit mr-2"></i>Edit
                                    </a>
                                    <?php if ($session_user_role == 3) { ?>
                                        <div class="dropdown-divider"></div>
                                        <a class="dropdown-item text-danger text-bold confirm-link" href="post.php?delete_invoice_note=<?php echo $note_id; ?>">
                                            <i class="fas fa-fw fa-trash mr-2"></i>Delete
                                        </a>
                                    <?php } ?>
                                </div>
                            </div>
                        </td>
                    </tr>
                    
                    <!-- Edit Note Modal -->
                    <div class="modal" id="editInvoiceNoteModal<?php echo $note_id; ?>" tabindex="-1">
                        <div class="modal-dialog">
                            <div class="modal-content bg-dark">
                                <div class="modal-header">
                                    <h5 class="modal-title"><i class="fa fa-fw fa-sticky-note mr-2"></i>Editing Note</h5>
                                    <button type="button" class="close text-white" data-dismiss="modal">
                                        <span>&times;</span>
                                    </button>
                                </div>
                                <form action="post.php" method="post" autocomplete="off">
                                    <input type="hidden" name="note_id" value="<?php echo $note_id; ?>">
                                    <div class="modal-body bg-white">
                                        <div class="form-group">
                                            <label>Title <strong class="text-danger">*</strong></label>
                                            <input type="text" class="form-control" name="note_title" value="<?php echo $note_title; ?>" required>
                                        </div>
                                        <div class="form-group">
                                            <label>Description</label>
                                            <textarea class="form-control" name="note_description" rows="3"><?php echo $note_description; ?></textarea>
                                        </div>
                                    </div>
                                    <div class="modal-footer bg-white">
                                        <button type="submit" name="edit_invoice_note" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Save</button>
                                        <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
                                    </div>
                                </form>
                            </div>
                        </div>
                    </div>
                    
                    <?php } ?>
                </tbody>
            </table>
        </div>
        <?php require_once "includes/filter_footer.php"; ?>
    </div>
</div>

<!-- Add Note Modal -->
<div class="modal" id="addInvoiceNoteModal" tabindex="-1">
    <div class="modal-dialog">
        <div class="modal-content bg-dark">
            <div class="modal-header">
                <h5 class="modal-title"><i class="fa fa-fw fa-sticky-note mr-2"></i>New Note</h5>
                <button type="button" class="close text-white" data-dismiss="modal">
                    <span>&times;</span>
                </button>
            </div>
            <form action="post.php" method="post" autocomplete="off">
                <div class="modal-body bg-white">
                    <div class="form-group">
                        <label>Title <strong class="text-danger">*</strong></label>
                        <input type="text" class="form-control" name="note_title" placeholder="Note title" maxlength="200" required autofocus>
                    </div>
                    <div class="form-group">
                        <label>Description</label>
                        <textarea class="form-control" name="note_description" rows="3" placeholder="Note description"></textarea>
                    </div>
                </div>
                <div class="modal-footer bg-white">
                    <button type="submit" name="add_invoice_note" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Create</button>
                    <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
                </div>
            </form>
        </div>
    </div>
</div>

<?php
require_once "includes/footer.php";
?>

post.php

<?php


ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);

/*
 * ITFlow - GET/POST request handler for invoice notes
 */

defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");

require_once 'config.php'; // Ensure database connection is included

// Add Invoice Note
if (isset($_POST['add_invoice_note'])) {
//    $invoice_id = intval($_POST['invoice_id']);
    $note_title = mysqli_real_escape_string($mysqli, $_POST['note_title']);
    $note_description = mysqli_real_escape_string($mysqli, $_POST['note_description']);

    mysqli_query($mysqli, "INSERT INTO invoice_notes (note_title, note_description) VALUES ('$note_title', '$note_description')");

    $note_id = mysqli_insert_id($mysqli);

    // Logging
    logAction("Invoice Note", "Create", "$session_name added a new invoice note: $note_title", 0, $note_id);

    $_SESSION['alert_message'] = "Invoice Note <strong>$note_title</strong> added successfully.";

    header("Location: " . $_SERVER["HTTP_REFERER"]);
    exit();
}

// Edit Invoice Note
if (isset($_POST['edit_invoice_note'])) {
    $note_id = intval($_POST['note_id']);
    $note_title = mysqli_real_escape_string($mysqli, $_POST['note_title']);
    $note_description = mysqli_real_escape_string($mysqli, $_POST['note_description']);

    mysqli_query($mysqli, "UPDATE invoice_notes SET note_title = '$note_title', note_description = '$note_description', updated_at = NOW() WHERE note_id = '$note_id'");

    // Logging
    logAction("Invoice Note", "Edit", "$session_name edited the invoice note: $note_title", 0, $note_id);

    $_SESSION['alert_message'] = "Invoice Note <strong>$note_title</strong> updated successfully.";

    header("Location: " . $_SERVER["HTTP_REFERER"]);
    exit();
}

// Delete Invoice Note
if (isset($_GET['delete_invoice_note'])) {
    $note_id = intval($_GET['delete_invoice_note']);

    // Fetch note details before deletion for logging
    $result = mysqli_query($mysqli, "SELECT note_title FROM invoice_notes WHERE note_id = '$note_id'");
    $row = mysqli_fetch_assoc($result);
    $note_title = $row['note_title'];

    mysqli_query($mysqli, "DELETE FROM invoice_notes WHERE note_id = '$note_id'");

    // Logging
    logAction("Invoice Note", "Delete", "$session_name deleted the invoice note: $note_title", 0, $note_id);

    $_SESSION['alert_message'] = "Invoice Note <strong>$note_title</strong> deleted successfully.";

    header("Location: " . $_SERVER["HTTP_REFERER"]);
    exit();
}


if (isset($_POST['save_note'])) {
    $invoice_id = intval($_POST['invoice_id']);
    $note_title = mysqli_real_escape_string($mysqli, $_POST['note_title']);
    $note_description = mysqli_real_escape_string($mysqli, $_POST['note_description']);

    if (!empty($note_title)) {
        mysqli_query($mysqli, "INSERT INTO invoice_notes (note_title, note_description) VALUES ('$note_title', '$note_description')");

        // Logging
        logAction("Invoice Note", "Create", "$session_name added note: $note_title", $invoice_id, mysqli_insert_id($mysqli));

        $_SESSION['alert_message'] = "Note <strong>$note_title</strong> saved successfully!";
    }

    header("Location: " . $_SERVER["HTTP_REFERER"]);
    exit;
}


?>

invoice.php changes

<?php
// Fetch existing notes for the dropdown
$noteQuery = mysqli_query($mysqli, "SELECT note_id, note_title, note_description FROM invoice_notes");

// Handle selected note
$selected_note_id = isset($_POST['note_id']) ? intval($_POST['note_id']) : null;
$selected_note_title = "";
$selected_note_description = "";

if ($selected_note_id) {
    $selectedNoteQuery = mysqli_query($mysqli, "SELECT note_title, note_description FROM invoice_notes WHERE note_id = '$selected_note_id'");
    if ($selectedNote = mysqli_fetch_assoc($selectedNoteQuery)) {
        $selected_note_title = $selectedNote['note_title'];
        $selected_note_description = $selectedNote['note_description'];
    }
}
?>

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Reliability Rating on New Code (required ≥ B)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[johnnyq]

Im not sure what to do with this, i'm going to close this for now, we'll work on an implementation for 25.03 release