0) {
$checkStmt = $pdo->prepare("SELECT role FROM users WHERE id=?");
$checkStmt->execute([$id]);
$checkRow = $checkStmt->fetch();
if ($checkRow && $checkRow['role'] === 'owner') {
$isOwnerEdit = true;
$role = 'owner'; // Force owner role, ignore POST value
}
}
if ($id > 0) {
// Update
if ($password !== '') {
$hash = password_hash($password, PASSWORD_BCRYPT);
$stmt = $pdo->prepare("UPDATE users SET login=?, password_hash=?, full_name=?, role=?, phone=?, email=?, is_active=? WHERE id=?");
$stmt->execute([$login, $hash, $fullName, $role, $phone, $email, $isActive, $id]);
} else {
$stmt = $pdo->prepare("UPDATE users SET login=?, full_name=?, role=?, phone=?, email=?, is_active=? WHERE id=?");
$stmt->execute([$login, $fullName, $role, $phone, $email, $isActive, $id]);
}
$message = $isOwnerEdit ? 'Профиль обновлён.' : 'Сотрудник обновлён.';
auth_log($session['user_id'], 'user_update', "ID: $id");
} else {
$hash = password_hash($password, PASSWORD_BCRYPT);
$stmt = $pdo->prepare("INSERT INTO users (login, password_hash, full_name, role, phone, email, is_active) VALUES (?,?,?,?,?,?,?)");
$stmt->execute([$login, $hash, $fullName, $role, $phone, $email, $isActive]);
$message = 'Сотрудник создан.';
auth_log($session['user_id'], 'user_create', "Login: $login");
}
} catch (\PDOException $e) {
$message = 'Ошибка: ' . ($e->getCode() === '23000' ? 'Логин уже занят.' : $e->getMessage());
}
}
}
// Delete user
if (isset($_GET['delete'])) {
$id = (int)$_GET['delete'];
$csrf = $_GET['csrf'] ?? '';
if (auth_csrf_verify($csrf)) {
$stmt = $pdo->prepare("DELETE FROM users WHERE id=? AND role!='owner'");
$stmt->execute([$id]);
$message = 'Сотрудник удалён.';
auth_log($session['user_id'], 'user_delete', "ID: $id");
}
}
// Get edit user
$editUser = null;
$isEditingOwner = false;
if (isset($_GET['edit'])) {
$stmt = $pdo->prepare("SELECT * FROM users WHERE id=?");
$stmt->execute([(int)$_GET['edit']]);
$editUser = $stmt->fetch();
if ($editUser && $editUser['role'] === 'owner') {
$isEditingOwner = true;
}
}
// Get all users (except owner for editing, but show owner in list)
$users = $pdo->query("SELECT id, login, full_name, role, phone, email, is_active, created_at FROM users ORDER BY role, full_name")->fetchAll();
$csrf = auth_csrf_token();
require __DIR__ . '/../../inc/header.php';
?>
| Логин |
ФИО |
Роль |
Телефон |
Email |
Статус |
Создан |
Действия |
|
|
|
|
|
|
|
✏️
🗑️
|