added files for mescole

2026-07-03 09:28:21 +02:00
parent c675eb766e
commit 376252e263
10 changed files with 955 additions and 20 deletions
@@ -0,0 +1,80 @@
+<?php
+include('include/headscript.php');
+header('Content-Type: application/json; charset=utf-8');
+
+$categorie = require __DIR__ . '/config/mescole_file_categories.php';
+
+$idmescola = isset($_POST['idmescola']) ? (int)$_POST['idmescola'] : 0;
+$categoria = $_POST['categoria'] ?? '';
+$titolo    = trim($_POST['titolo'] ?? '');
+
+if ($idmescola <= 0) {
+    echo json_encode(['success' => false, 'message' => 'ID mescola non valido']);
+    exit;
+}
+if (!array_key_exists($categoria, $categorie)) {
+    echo json_encode(['success' => false, 'message' => 'Categoria non valida']);
+    exit;
+}
+if ($titolo === '') {
+    echo json_encode(['success' => false, 'message' => 'Il titolo del file è obbligatorio']);
+    exit;
+}
+if (!isset($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
+    echo json_encode(['success' => false, 'message' => 'File mancante o upload non riuscito']);
+    exit;
+}
+
+// --- Validazioni di sicurezza sul file ---
+$allowedExt = ['pdf', 'doc', 'docx', 'xls', 'xlsx', 'jpg', 'jpeg', 'png'];
+$maxSize    = 15 * 1024 * 1024; // 15 MB
+
+$originalName = $_FILES['file']['name'];
+$tmpPath      = $_FILES['file']['tmp_name'];
+$size         = (int)$_FILES['file']['size'];
+$ext          = strtolower(pathinfo($originalName, PATHINFO_EXTENSION));
+
+if (!in_array($ext, $allowedExt, true)) {
+    echo json_encode(['success' => false, 'message' => 'Estensione file non consentita (' . $ext . ')']);
+    exit;
+}
+if ($size <= 0 || $size > $maxSize) {
+    echo json_encode(['success' => false, 'message' => 'Il file supera la dimensione massima di 15MB']);
+    exit;
+}
+
+$finfo    = finfo_open(FILEINFO_MIME_TYPE);
+$mimeType = finfo_file($finfo, $tmpPath);
+finfo_close($finfo);
+
+// Cartella dedicata per mescola: uploads/mescole/{idmescola}/
+$destDir = __DIR__ . '/uploads/mescole/' . $idmescola . '/';
+if (!is_dir($destDir)) {
+    mkdir($destDir, 0775, true);
+}
+
+// Nome fisico casuale: evita collisioni e path traversal
+$storedName = bin2hex(random_bytes(16)) . '.' . $ext;
+$destPath   = $destDir . $storedName;
+
+if (!move_uploaded_file($tmpPath, $destPath)) {
+    echo json_encode(['success' => false, 'message' => 'Impossibile salvare il file sul server']);
+    exit;
+}
+
+try {
+    $db  = DBHandlerSelect::getInstance();
+    $pdo = $db->getConnection();
+
+    $stmt = $pdo->prepare("
+        INSERT INTO mescole_files (idmescola, categoria, titolo, filename, original_filename, mime_type, filesize, uploaded_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, NOW())
+    ");
+    $stmt->execute([$idmescola, $categoria, $titolo, $storedName, $originalName, $mimeType, $size]);
+
+    echo json_encode(['success' => true, 'id' => $pdo->lastInsertId()]);
+} catch (Throwable $e) {
+    // rollback file se il DB fallisce
+    @unlink($destPath);
+    echo json_encode(['success' => false, 'message' => 'Errore database: ' . $e->getMessage()]);
+}