View Code - 20260920

punch.php | 20260920_164915.php Initial Domain Snapshot

<?php
// /erp/attendance/punch.php  (corrected safe version)
header('Content-Type: application/json; charset=utf-8');

function find_file_upwards($start_dir, $rel_path, $max_levels = 8) {
  $dir = realpath($start_dir);
  for ($i = 0; $i < $max_levels && $dir; $i++) {
    $candidate = $dir . '/' . ltrim($rel_path, '/');
    if (file_exists($candidate)) return $candidate;
    $parent = dirname($dir);
    if ($parent === $dir) break;
    $dir = $parent;
  }
  return false;
}

try {
  $cwd = __DIR__;

// locate and include auth
  $auth_path = find_file_upwards($cwd, 'modules/auth/auth.php', 8);
  if (!$auth_path) { http_response_code(500); echo json_encode(['error'=>'internal','msg'=>'Auth include not found']); exit; }
  require_once $auth_path;
  if (!function_exists('require_login') || !function_exists('auth_user')) { http_response_code(500); echo json_encode(['error'=>'internal','msg'=>'Auth functions missing']); exit; }

// enforce login
  require_login();
  $u = auth_user();
  $company_id = (int)($u['company_id'] ?? 0);
  $user_id = (int)($u['id'] ?? 0);

// locate and include DB
  $db_path = find_file_upwards($cwd, 'core/db.php', 8);
  if ($db_path) require_once $db_path;
  $pdo = $GLOBALS['pdo'] ?? null;
  if (!$pdo && function_exists('getDB')) $pdo = getDB();
  if (!$pdo) { http_response_code(500); echo json_encode(['error'=>'internal','msg'=>'DB include not found or DB not initialized']); exit; }

// read input robustly
  $body = file_get_contents('php://input');
  $raw = null;
  if ($body !== false && trim($body) !== '') {
    $decoded = json_decode($body, true);
    if (json_last_error() === JSON_ERROR_NONE && is_array($decoded)) {
      $raw = $decoded;
    }
  }
  // fallback to $_POST if JSON not provided (e.g., form submit)
  if (!is_array($raw) || empty($raw)) {
    $raw = $_POST ?? [];
  }

// Safely read values with defaults
  $employee_id = isset($raw['employee_id']) ? (int)$raw['employee_id'] : 0;
  $method = isset($raw['method']) && in_array($raw['method'], ['face','manual','badge','web']) ? $raw['method'] : 'face';
  $direction = isset($raw['direction']) && in_array($raw['direction'], ['in','out','other']) ? $raw['direction'] : 'in';
  $device_id = isset($raw['device_id']) ? trim($raw['device_id']) : ( $_SERVER['HTTP_USER_AGENT'] ?? 'web' );
  $photo_b64 = isset($raw['photo']) ? $raw['photo'] : null;
  $ip = $_SERVER['REMOTE_ADDR'] ?? null;

if ($employee_id <= 0) {
    http_response_code(400);
    echo json_encode(['error'=>'employee_id required']);
    exit;
  }

// Save photo if provided
  $photo_path = null;
  if (!empty($photo_b64)) {
    $data = preg_replace('#^data:image/[^;]+;base64,#', '', $photo_b64);
    $bin = base64_decode($data);
    if ($bin !== false) {
      // choose a safe upload dir relative to project
      $base_dir = dirname(__DIR__, 1) . '/uploads/attendance_photos/' . $company_id . '/' . date('Y/m/d');
      if (!is_dir($base_dir)) @mkdir($base_dir, 0755, true);
      $fname = uniqid('att_') . '.jpg';
      $fpath = $base_dir . '/' . $fname;
      if (@file_put_contents($fpath, $bin) !== false) {
        $photo_path = 'uploads/attendance_photos/' . $company_id . '/' . date('Y/m/d') . '/' . $fname;
      }
    }
  }

// insert into fc_attendance
  $sql = "INSERT INTO fc_attendance (company_id, employee_id, punch_time, method, direction, device_id, photo_path, ip_address, raw_payload, created_at)
          VALUES (:cid, :eid, NOW(), :method, :direction, :device, :photo, :ip, :raw, NOW())";
  $st = $pdo->prepare($sql);
  $st->execute([
    ':cid'=>$company_id,
    ':eid'=>$employee_id,
    ':method'=>$method,
    ':direction'=>$direction,
    ':device'=>$device_id,
    ':photo'=>$photo_path,
    ':ip'=>$ip,
    ':raw'=>json_encode($raw)
  ]);

$aid = $pdo->lastInsertId();
  echo json_encode(['ok'=>1, 'attendance_id'=>$aid, 'photo'=>$photo_path]);

} catch (Throwable $e) {
  error_log("punch.php error: ".$e->getMessage());
  http_response_code(500);
  echo json_encode(['error'=>'internal','msg'=>$e->getMessage()]);
}