cimacrestyle/public/uploadaddphotos.php

<?php
ob_start();

require_once('../Connections/cmctrfdb.php');
require_once('../webassist/mysqli/rsobj.php');

if (session_status() === PHP_SESSION_NONE) {
    session_start();
}

header('Content-Type: application/json');

ini_set('display_errors', 0);
error_reporting(E_ALL);

// =======================
// Database connection
// =======================
$conn = new mysqli($servername, $username, $password, $dbname);

if ($conn->connect_error) {
    jsonResponse([
        'success' => false,
        'message' => 'Database connection failed.'
    ], 500);
}

// =======================
// Language messages
// =======================
$lang = $_SESSION['langselect'] ?? 'it';

$messages = [
    'it' => [
        'invalid_method' => 'Metodo di richiesta non valido.',
        'missing_data' => 'Nessun file caricato o ID TRF mancante.',
        'missing_trf' => 'ID TRF mancante.',
        'no_file' => 'Nessuna immagine selezionata.',
        'upload_error' => 'Errore durante il caricamento.',
        'too_large' => 'Immagine troppo grande. Dimensione massima consentita: 8 MB.',
        'invalid_extension' => 'Estensione non valida. Sono consentiti solo JPG, JPEG e PNG.',
        'invalid_type' => 'Tipo immagine non valido. Sono consentiti solo JPG, JPEG e PNG.',
        'invalid_image' => 'File immagine non valido.',
        'unsupported_type' => 'Tipo immagine non supportato.',
        'process_error' => 'Impossibile elaborare l’immagine.',
        'save_error' => 'Impossibile salvare l’immagine ridimensionata.',
        'db_prepare_error' => 'Errore preparazione database.',
        'db_insert_error' => 'Errore inserimento database.',
        'gd_missing' => 'Estensione PHP GD non disponibile sul server.'
    ],
    'en' => [
        'invalid_method' => 'Invalid request method.',
        'missing_data' => 'No file uploaded or TRF ID missing.',
        'missing_trf' => 'Missing TRF ID.',
        'no_file' => 'No image selected.',
        'upload_error' => 'Upload error.',
        'too_large' => 'Image too large. Maximum allowed size is 8 MB.',
        'invalid_extension' => 'Invalid file extension. Only JPG, JPEG and PNG are allowed.',
        'invalid_type' => 'Invalid image type. Only JPG, JPEG and PNG are allowed.',
        'invalid_image' => 'Invalid image file.',
        'unsupported_type' => 'Unsupported image type.',
        'process_error' => 'Unable to process image.',
        'save_error' => 'Unable to save resized image.',
        'db_prepare_error' => 'Database prepare failed.',
        'db_insert_error' => 'Database insertion failed.',
        'gd_missing' => 'PHP GD extension is not available on the server.'
    ]
];

$msg = $messages[$lang] ?? $messages['it'];

// =======================
// Helper JSON response
// =======================
function jsonResponse($response, $statusCode = 200)
{
    $output = ob_get_clean();

    if (!empty(trim($output))) {
        error_log("Unexpected output detected in uploadaddphotos.php: " . $output);
    }

    http_response_code($statusCode);
    echo json_encode($response);
    exit;
}

// =======================
// Upload settings
// =======================
$uploadDir = 'uploadimages/';
$uploadDirPath = __DIR__ . '/uploadimages/';

$maxUploadSize = 8 * 1024 * 1024; // 8 MB
$maxWidth = 1600;
$maxHeight = 1600;
$jpgQuality = 82;

$allowedExtensions = ['jpg', 'jpeg', 'png'];
$allowedMimeTypes = ['image/jpeg', 'image/png'];

// =======================
// Method check
// =======================
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    jsonResponse([
        'success' => false,
        'message' => $msg['invalid_method']
    ], 405);
}

// =======================
// Basic checks
// =======================
if (empty($_POST['idtrf'])) {
    jsonResponse([
        'success' => false,
        'message' => $msg['missing_trf']
    ], 400);
}

$idtrf = intval($_POST['idtrf']);

if (empty($_FILES['file']) || empty($_FILES['file']['name'])) {
    jsonResponse([
        'success' => false,
        'message' => $msg['no_file']
    ], 400);
}

if (!is_dir($uploadDirPath)) {
    mkdir($uploadDirPath, 0755, true);
}

if (
    !function_exists('imagecreatefromjpeg') ||
    !function_exists('imagecreatefrompng') ||
    !function_exists('imagecreatetruecolor') ||
    !function_exists('imagecopyresampled') ||
    !function_exists('imagejpeg')
) {
    jsonResponse([
        'success' => false,
        'message' => $msg['gd_missing']
    ], 500);
}

$file = $_FILES['file'];

$originalName = $file['name'];
$tmpName = $file['tmp_name'];
$fileSize = $file['size'];
$error = $file['error'];

if ($error !== UPLOAD_ERR_OK) {
    jsonResponse([
        'success' => false,
        'message' => $msg['upload_error']
    ], 400);
}

if ($fileSize > $maxUploadSize) {
    jsonResponse([
        'success' => false,
        'message' => $msg['too_large']
    ], 400);
}

// =======================
// Extension check
// =======================
$extension = strtolower(pathinfo($originalName, PATHINFO_EXTENSION));

if (!in_array($extension, $allowedExtensions)) {
    jsonResponse([
        'success' => false,
        'message' => $msg['invalid_extension']
    ], 400);
}

// =======================
// Real MIME check
// =======================
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mimeType = finfo_file($finfo, $tmpName);
finfo_close($finfo);

if (!in_array($mimeType, $allowedMimeTypes)) {
    jsonResponse([
        'success' => false,
        'message' => $msg['invalid_type']
    ], 400);
}

// =======================
// Image validation
// =======================
$imageInfo = getimagesize($tmpName);

if ($imageInfo === false) {
    jsonResponse([
        'success' => false,
        'message' => $msg['invalid_image']
    ], 400);
}

$originalWidth = $imageInfo[0];
$originalHeight = $imageInfo[1];

// =======================
// Create source image
// =======================
if ($mimeType === 'image/jpeg') {
    $sourceImage = imagecreatefromjpeg($tmpName);
} elseif ($mimeType === 'image/png') {
    $sourceImage = imagecreatefrompng($tmpName);
} else {
    jsonResponse([
        'success' => false,
        'message' => $msg['unsupported_type']
    ], 400);
}

if (!$sourceImage) {
    jsonResponse([
        'success' => false,
        'message' => $msg['process_error']
    ], 400);
}

// =======================
// Resize calculation
// =======================
$ratio = min($maxWidth / $originalWidth, $maxHeight / $originalHeight, 1);

$newWidth = (int)($originalWidth * $ratio);
$newHeight = (int)($originalHeight * $ratio);

// =======================
// Create resized image
// =======================
$resizedImage = imagecreatetruecolor($newWidth, $newHeight);

// White background for PNG transparency
$white = imagecolorallocate($resizedImage, 255, 255, 255);
imagefill($resizedImage, 0, 0, $white);

imagecopyresampled(
    $resizedImage,
    $sourceImage,
    0,
    0,
    0,
    0,
    $newWidth,
    $newHeight,
    $originalWidth,
    $originalHeight
);

// =======================
// New filename
// =======================
$newFilename = $idtrf . '-' . time() . '-' . uniqid() . '-addphoto.jpg';
$uploadFilePath = $uploadDirPath . $newFilename;

// =======================
// Save as JPG
// =======================
$saved = imagejpeg($resizedImage, $uploadFilePath, $jpgQuality);

imagedestroy($sourceImage);
imagedestroy($resizedImage);

if (!$saved || !file_exists($uploadFilePath)) {
    jsonResponse([
        'success' => false,
        'message' => $msg['save_error']
    ], 500);
}

// =======================
// Insert into database
// =======================
$stmt = $conn->prepare("INSERT INTO additionalphotos (idtrf, filenameadditionalphotos) VALUES (?, ?)");

if ($stmt === false) {
    if (file_exists($uploadFilePath)) {
        unlink($uploadFilePath);
    }

    jsonResponse([
        'success' => false,
        'message' => $msg['db_prepare_error'] . ' ' . $conn->error
    ], 500);
}

$stmt->bind_param("is", $idtrf, $newFilename);

if ($stmt->execute()) {
    $stmt->close();
    $conn->close();

    jsonResponse([
        'success' => true,
        'filename' => $newFilename
    ]);
} else {
    $errorMessage = $stmt->error;

    $stmt->close();

    if (file_exists($uploadFilePath)) {
        unlink($uploadFilePath);
    }

    $conn->close();

    jsonResponse([
        'success' => false,
        'message' => $msg['db_insert_error'] . ' ' . $errorMessage
    ], 500);
}