delete-application.php

<?php
/**
 * Delete Application File Handler
 * Allows staff to delete application photos/documents
 * Includes security checks and database cleanup
 */

session_start();
require_once 'db_connect.php';

// Security check - must be logged in as staff
if (!isset($_SESSION['staff_user'])) {
    http_response_code(403);
    die(json_encode(['success' => false, 'message' => 'Access denied. Please login first.']));
}

// Check request method
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    die(json_encode(['success' => false, 'message' => 'Invalid request method.']));
}

// Get the file path from POST data
$file_path = isset($_POST['file_path']) ? $_POST['file_path'] : '';

if (empty($file_path)) {
    http_response_code(400);
    die(json_encode(['success' => false, 'message' => 'No file specified.']));
}

// Security validation - ensure file is within uploads directory
$real_path = realpath($file_path);
$uploads_path = realpath('uploads/');

if (!$real_path || !$uploads_path || strpos($real_path, $uploads_path) !== 0) {
    http_response_code(403);
    die(json_encode(['success' => false, 'message' => 'Invalid file path.']));
}

// Check if file exists
if (!file_exists($real_path)) {
    http_response_code(404);
    die(json_encode(['success' => false, 'message' => 'File not found.']));
}

// Get serial number from the database for this file
$file_path_escaped = mysqli_real_escape_string($conn, $file_path);
$query = "SELECT serial_no, student_name FROM extended_logs WHERE application_file = '$file_path_escaped' LIMIT 1";
$result = mysqli_query($conn, $query);

if (!$result || mysqli_num_rows($result) === 0) {
    http_response_code(404);
    die(json_encode(['success' => false, 'message' => 'Database record not found.']));
}

$record = mysqli_fetch_assoc($result);
$serial_no = $record['serial_no'];
$student_name = $record['student_name'];

// Log the deletion action - sirf serial number
$staff_user = $_SESSION['staff_user'];
$ip_address = $_SERVER['REMOTE_ADDR'];
$log_query = "INSERT INTO activity_logs (user, action, ip_address, created_at) 
              VALUES ('$staff_user', 'Deleted application file: $serial_no', '$ip_address', NOW())";
mysqli_query($conn, $log_query);

// Delete the physical file
if (unlink($real_path)) {
    // Update database - set application_file to NULL
    $update_query = "UPDATE extended_logs SET application_file = NULL WHERE application_file = '$file_path_escaped'";
    
    if (mysqli_query($conn, $update_query)) {
        // Success
        http_response_code(200);
        echo json_encode([
            'success' => true, 
            'message' => 'File deleted successfully.',
            'serial_no' => $serial_no
        ]);
    } else {
        // File deleted but database update failed
        http_response_code(500);
        echo json_encode([
            'success' => false, 
            'message' => 'File deleted but database update failed: ' . mysqli_error($conn)
        ]);
    }
} else {
    // File deletion failed
    http_response_code(500);
    echo json_encode([
        'success' => false, 
        'message' => 'Failed to delete file. Check permissions.'
    ]);
}

exit();
?>