inTransaction()) {
db()->rollBack();
}
} catch (Throwable $ignored) {
}
http_response_code(500);
echo '
Ein Fehler ist aufgetreten. Die Änderung wurde nicht gespeichert. Bitte erneut versuchen oder den Administrator informieren.
';
}
/* =====================================================================
Anmeldung
===================================================================== */
function page_login(): void
{
if (current_user()) {
redirect('index.php');
}
$err = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_check();
if (($_SESSION['login_lock'] ?? 0) > time()) {
$err = 'Zu viele Fehlversuche. Bitte in 5 Minuten erneut versuchen.';
} else {
$st = db()->prepare('SELECT * FROM users WHERE username = ? AND active = 1');
$st->execute([trim((string)($_POST['username'] ?? ''))]);
$u = $st->fetch();
if ($u && password_verify((string)($_POST['password'] ?? ''), $u['password_hash'])) {
session_regenerate_id(true);
$_SESSION['uid'] = (int)$u['id'];
$_SESSION['seen'] = time();
unset($_SESSION['login_fail'], $_SESSION['login_lock']);
if (password_needs_rehash($u['password_hash'], PASSWORD_DEFAULT)) {
db()->prepare('UPDATE users SET password_hash = ? WHERE id = ?')
->execute([password_hash((string)$_POST['password'], PASSWORD_DEFAULT), $u['id']]);
}
redirect('index.php');
}
sleep(1);
$_SESSION['login_fail'] = ($_SESSION['login_fail'] ?? 0) + 1;
if ($_SESSION['login_fail'] >= 5) {
$_SESSION['login_lock'] = time() + 300;
$_SESSION['login_fail'] = 0;
}
$err = 'Benutzername oder Passwort ist falsch.';
}
}
layout_head('Anmelden');
?>
query(
'SELECT i.id, i.department_id, i.period, i.status,
(SELECT COALESCE(SUM(quantity * price), 0) FROM inventory_items WHERE inventory_id = i.id) AS total
FROM inventories i ORDER BY i.period DESC'
)->fetchAll();
$grid = [];
foreach ($rows as $r) {
$grid[$r['period']][(int)$r['department_id']] = $r;
}
$cur = date('Y-m');
layout_head('Übersicht');
echo '
Inventur ' . e(period_label($cur)) . ' ';
echo '
';
echo '
Verlauf ';
if (!$grid) {
echo '
Noch keine Inventuren. Sobald eine Abteilung ihre erste Inventur startet, erscheint sie hier.
';
} else {
echo '
';
}
layout_foot();
}
/* =====================================================================
Abteilung: Inventurliste
===================================================================== */
function page_dept(int $deptId): void
{
$d = require_dept($deptId);
$st = db()->prepare(
'SELECT i.*, u.name AS closer,
(SELECT COUNT(*) FROM inventory_items WHERE inventory_id = i.id) AS n,
(SELECT COALESCE(SUM(quantity * price), 0) FROM inventory_items WHERE inventory_id = i.id) AS total
FROM inventories i LEFT JOIN users u ON u.id = i.closed_by
WHERE i.department_id = ? ORDER BY i.period DESC'
);
$st->execute([$deptId]);
$invs = $st->fetchAll();
$c = db()->prepare('SELECT COUNT(*) FROM articles WHERE department_id = ? AND active = 1');
$c->execute([$deptId]);
$nArt = (int)$c->fetchColumn();
layout_head($d['name'], $d, 'Monatsinventuren');
?>
Bisherige Inventuren
Noch keine Inventur angelegt. Wähle oben einen Monat und öffne die erste Inventur.
prepare(
'UPDATE articles SET name = ?, category = ?, unit = ?, price = ?, active = ?
WHERE id = ? AND department_id = ?'
);
$pdo->beginTransaction();
foreach ((array)($_POST['a'] ?? []) as $id => $row) {
if (!is_array($row)) {
continue;
}
$name = clean_text($row['name'] ?? '', 150);
if ($name === '') {
continue;
}
$up->execute([
$name,
clean_text($row['category'] ?? '', 80),
clean_text($row['unit'] ?? '', 30) ?: 'Stk',
parse_num($row['price'] ?? 0),
!empty($row['active']) ? 1 : 0,
(int)$id,
$deptId,
]);
}
sync_open_inventories($deptId);
$pdo->commit();
flash('Artikel gespeichert.');
} elseif ($action === 'add') {
$name = clean_text($_POST['name'] ?? '', 150);
if ($name === '') {
flash('Bitte einen Artikelnamen eingeben.', 'err');
} else {
$pdo->prepare('INSERT INTO articles (department_id, name, category, unit, price) VALUES (?,?,?,?,?)')
->execute([$deptId, $name, clean_text($_POST['category'] ?? '', 80),
clean_text($_POST['unit'] ?? '', 30) ?: 'Stk', parse_num($_POST['price'] ?? 0)]);
sync_open_inventories($deptId);
flash('Artikel „' . $name . '“ angelegt.');
}
}
redirect($self);
}
$st = $pdo->prepare("SELECT * FROM articles WHERE department_id = ? ORDER BY active DESC, category = '', category, name");
$st->execute([$deptId]);
$arts = $st->fetchAll();
$cats = array_values(array_unique(array_filter(array_column($arts, 'category'))));
sort($cats);
layout_head('Artikel ' . $d['name'], $d, 'Artikel');
datalists($cats);
?>
Alle Artikel ()
Noch keine Artikel. Lege oben den ersten Artikel an.
';
foreach ($cats as $c) {
echo '
';
}
echo '';
foreach (['Stk', 'kg', 'g', 'l', 'ml', 'Fl.', 'Kiste', 'Karton', 'Pkg', 'Dose', 'Rolle', 'Paar', 'Satz'] as $u) {
echo '';
}
echo ' ';
}
/* =====================================================================
Monatsinventur
===================================================================== */
function load_inventory(int $deptId, string $period): ?array
{
$st = db()->prepare(
'SELECT i.*, u.name AS closer FROM inventories i LEFT JOIN users u ON u.id = i.closed_by
WHERE i.department_id = ? AND i.period = ?'
);
$st->execute([$deptId, $period]);
return $st->fetch() ?: null;
}
function page_inventory(int $deptId, string $period): void
{
$d = require_dept($deptId);
if (!valid_period($period)) {
flash('Bitte einen gültigen Monat wählen.', 'err');
redirect('index.php?p=dept&d=' . $deptId);
}
$pdo = db();
$inv = load_inventory($deptId, $period);
$self = 'index.php?p=inventory&d=' . $deptId . '&m=' . $period;
$u = current_user();
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_check();
$action = (string)($_POST['action'] ?? '');
if ($action === 'start' && !$inv) {
$pdo->prepare('INSERT INTO inventories (department_id, period, created_by) VALUES (?,?,?)')
->execute([$deptId, $period, $u['id']]);
sync_inventory((int)$pdo->lastInsertId(), $deptId);
flash('Inventur ' . period_label($period) . ' gestartet.');
redirect($self);
}
if ($action === 'reopen' && $inv && is_admin()) {
$pdo->prepare("UPDATE inventories SET status = 'open', closed_at = NULL, closed_by = NULL WHERE id = ?")
->execute([$inv['id']]);
flash('Inventur wieder geöffnet. Preise werden mit dem aktuellen Artikelstamm abgeglichen.');
redirect($self);
}
if ($inv && $inv['status'] === 'open' && in_array($action, ['save', 'add', 'close'], true)) {
$pdo->beginTransaction();
$st = $pdo->prepare('SELECT id, article_id, price FROM inventory_items WHERE inventory_id = ?');
$st->execute([$inv['id']]);
$items = [];
foreach ($st->fetchAll() as $r) {
$items[(int)$r['id']] = $r;
}
$upItem = $pdo->prepare('UPDATE inventory_items SET quantity = ?, price = ? WHERE id = ? AND inventory_id = ?');
$upArt = $pdo->prepare('UPDATE articles SET price = ? WHERE id = ? AND department_id = ?');
$prices = (array)($_POST['pr'] ?? []);
foreach ((array)($_POST['q'] ?? []) as $iid => $qv) {
$iid = (int)$iid;
if (!isset($items[$iid])) {
continue;
}
$old = (float)$items[$iid]['price'];
$pr = array_key_exists($iid, $prices) ? parse_num($prices[$iid]) : $old;
$upItem->execute([parse_num($qv), $pr, $iid, $inv['id']]);
if ($items[$iid]['article_id'] !== null && abs($pr - $old) > 0.0001) {
$upArt->execute([$pr, $items[$iid]['article_id'], $deptId]);
}
}
$msg = 'Gespeichert.';
if ($action === 'add') {
$name = clean_text($_POST['new_name'] ?? '', 150);
if ($name !== '') {
$cat = clean_text($_POST['new_category'] ?? '', 80);
$unit = clean_text($_POST['new_unit'] ?? '', 30) ?: 'Stk';
$pr = parse_num($_POST['new_price'] ?? 0);
$pdo->prepare('INSERT INTO articles (department_id, name, category, unit, price) VALUES (?,?,?,?,?)')
->execute([$deptId, $name, $cat, $unit, $pr]);
$aid = (int)$pdo->lastInsertId();
$pdo->prepare('INSERT INTO inventory_items (inventory_id, article_id, name, category, unit, quantity, price) VALUES (?,?,?,?,?,?,?)')
->execute([$inv['id'], $aid, $name, $cat, $unit, parse_num($_POST['new_qty'] ?? 0), $pr]);
$msg = 'Artikel „' . $name . '“ hinzugefügt, Mengen gespeichert.';
}
}
if ($action === 'close') {
$pdo->prepare("UPDATE inventories SET status = 'closed', closed_at = NOW(), closed_by = ? WHERE id = ?")
->execute([$u['id'], $inv['id']]);
$msg = 'Inventur ' . period_label($period) . ' abgeschlossen.';
}
$pdo->commit();
flash($msg);
redirect($self . ($action === 'add' ? '#neu' : ''));
}
redirect($self);
}
if ($inv && $inv['status'] === 'open') {
sync_inventory((int)$inv['id'], $deptId);
}
layout_head($d['name'] . ' ' . period_label($period), $d, 'Inventur ' . period_label($period));
echo '';
if (!$inv) {
$c = $pdo->prepare('SELECT COUNT(*) FROM articles WHERE department_id = ? AND active = 1');
$c->execute([$deptId]);
$n = (int)$c->fetchColumn();
?>
Für gibt es noch keine Inventur.
0
? 'Beim Start werden alle ' . $n . ' aktiven Artikel mit ihrem aktuellen Preis übernommen.'
: 'Es sind noch keine Artikel angelegt. Du kannst sie direkt während der Inventur hinzufügen.' ?>
prepare("SELECT * FROM inventory_items WHERE inventory_id = ? ORDER BY category = '', category, name");
$st->execute([$inv['id']]);
$items = $st->fetchAll();
if ($inv['status'] === 'open') {
$cats = array_values(array_unique(array_filter(array_column($items, 'category'))));
sort($cats);
datalists($cats);
?>
Menge eintragen, mit Enter springst du zum nächsten Artikel. Preisänderungen werden auch im Artikelstamm übernommen.
Abgeschlossen am '
. e(date('d.m.Y \u\m H:i', strtotime($inv['closed_at']))) . ' von ' . e($inv['closer'] ?? 'unbekannt') . '';
render_items($items, false);
echo '';
}
layout_foot();
}
function render_items(array $items, bool $edit): void
{
$total = 0.0;
$cat = null;
echo '';
}
/* =====================================================================
CSV-Export (Excel-kompatibel)
===================================================================== */
function page_export(int $invId): void
{
$st = db()->prepare('SELECT * FROM inventories WHERE id = ?');
$st->execute([$invId]);
$inv = $st->fetch();
if (!$inv) {
not_found();
}
$d = require_dept((int)$inv['department_id']);
$st = db()->prepare("SELECT * FROM inventory_items WHERE inventory_id = ? ORDER BY category = '', category, name");
$st->execute([$invId]);
$items = $st->fetchAll();
$slug = preg_replace('/[^A-Za-z0-9]+/', '-', strtr($d['name'], ['ä' => 'ae', 'ö' => 'oe', 'ü' => 'ue', 'Ä' => 'Ae', 'Ö' => 'Oe', 'Ü' => 'Ue', 'ß' => 'ss']));
header('Content-Type: text/csv; charset=UTF-8');
header('Content-Disposition: attachment; filename="Inventur_' . $slug . '_' . $inv['period'] . '.csv"');
$safe = static function (string $s): string {
return preg_match('/^[=+\-@\t\r]/', $s) ? "'" . $s : $s;
};
$out = fopen('php://output', 'w');
fwrite($out, "\xEF\xBB\xBF");
fputcsv($out, ['Abteilung', 'Monat', 'Kategorie', 'Artikel', 'Einheit', 'Menge', 'Preis je Einheit (EUR)', 'Wert (EUR)'], ';', '"', '');
$total = 0.0;
foreach ($items as $it) {
$q = (float)$it['quantity'];
$p = (float)$it['price'];
$total += $q * $p;
fputcsv($out, [
$d['name'], period_label($inv['period']), $safe($it['category']), $safe($it['name']), $safe($it['unit']),
number_format($q, 3, ',', ''), number_format($p, 2, ',', ''), number_format($q * $p, 2, ',', ''),
], ';', '"', '');
}
fputcsv($out, ['', '', '', 'Gesamtwert', '', '', '', number_format($total, 2, ',', '')], ';', '"', '');
fclose($out);
exit;
}
/* =====================================================================
Benutzerverwaltung (Admin)
===================================================================== */
function page_users(): void
{
if (!is_admin()) {
forbidden();
}
$pdo = db();
$me = current_user();
$self = 'index.php?p=users';
$deptIds = array_map('intval', array_column(departments(), 'id'));
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
csrf_check();
$action = (string)($_POST['action'] ?? '');
if ($action === 'add') {
$username = trim((string)($_POST['username'] ?? ''));
$name = clean_text($_POST['name'] ?? '', 100);
$pw = (string)($_POST['password'] ?? '');
$role = ($_POST['role'] ?? '') === 'admin' ? 'admin' : 'staff';
$dept = (int)($_POST['department_id'] ?? 0);
if (!preg_match('/^[A-Za-z0-9._-]{3,40}$/', $username)) {
flash('Benutzername: 3–40 Zeichen, nur Buchstaben, Ziffern, Punkt, Bindestrich, Unterstrich.', 'err');
} elseif ($name === '') {
flash('Bitte einen Namen eingeben.', 'err');
} elseif (mb_strlen($pw) < 10) {
flash('Das Passwort muss mindestens 10 Zeichen haben.', 'err');
} elseif ($role === 'staff' && !in_array($dept, $deptIds, true)) {
flash('Bitte eine Abteilung wählen.', 'err');
} else {
$c = $pdo->prepare('SELECT COUNT(*) FROM users WHERE username = ?');
$c->execute([$username]);
if ((int)$c->fetchColumn() > 0) {
flash('Diesen Benutzernamen gibt es schon.', 'err');
} else {
$pdo->prepare('INSERT INTO users (username, name, password_hash, role, department_id) VALUES (?,?,?,?,?)')
->execute([$username, $name, password_hash($pw, PASSWORD_DEFAULT), $role, $role === 'staff' ? $dept : null]);
flash('Benutzer „' . $username . '“ angelegt.');
}
}
} elseif ($action === 'toggle') {
$id = (int)($_POST['id'] ?? 0);
if ($id === (int)$me['id']) {
flash('Du kannst dich nicht selbst sperren.', 'err');
} else {
$pdo->prepare('UPDATE users SET active = 1 - active WHERE id = ?')->execute([$id]);
flash('Status geändert.');
}
} elseif ($action === 'setpw') {
$id = (int)($_POST['id'] ?? 0);
$pw = (string)($_POST['password'] ?? '');
if (mb_strlen($pw) < 10) {
flash('Das Passwort muss mindestens 10 Zeichen haben.', 'err');
} else {
$pdo->prepare('UPDATE users SET password_hash = ? WHERE id = ?')->execute([password_hash($pw, PASSWORD_DEFAULT), $id]);
flash('Passwort neu gesetzt.');
}
}
redirect($self);
}
$users = $pdo->query(
'SELECT u.*, d.name AS dept_name FROM users u LEFT JOIN departments d ON d.id = u.department_id
ORDER BY u.active DESC, u.role, d.sort, u.name'
)->fetchAll();
layout_head('Benutzer');
?>
Benutzer
prepare('UPDATE users SET password_hash = ? WHERE id = ?')->execute([password_hash($new, PASSWORD_DEFAULT), $u['id']]);
session_regenerate_id(true);
flash('Passwort geändert.');
}
redirect('index.php?p=password');
}
layout_head('Passwort ändern');
?>
Passwort ändern
