86 lines
3.3 KiB
PHP
86 lines
3.3 KiB
PHP
<?php
|
||
require_once __DIR__ . '/../includes/bootstrap.php';
|
||
$staff = require_admin_or_permission('view_audit_log');
|
||
$pdo = get_db();
|
||
|
||
// Leeren ist bewusst strenger gegated als das reine Ansehen (view_audit_log kann auch per
|
||
// individueller Berechtigung an Nicht-Admins vergeben sein) – nur echte Admins dürfen das
|
||
// Protokoll löschen. Der Löschvorgang selbst wird direkt danach neu protokolliert, damit
|
||
// nicht spurlos "aufgeräumt" werden kann.
|
||
if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'clear_log') {
|
||
verify_csrf();
|
||
if ($staff['role'] !== 'admin') {
|
||
flash('error', 'Nur Admins können das Admin-Protokoll leeren.');
|
||
redirect('/staff/audit_log.php');
|
||
}
|
||
$countBefore = (int) $pdo->query('SELECT COUNT(*) FROM admin_audit_log')->fetchColumn();
|
||
$pdo->exec('DELETE FROM admin_audit_log');
|
||
audit_log($staff['id'], "Admin-Protokoll geleert ({$countBefore} Einträge entfernt)");
|
||
flash('success', 'Admin-Protokoll geleert.');
|
||
redirect('/staff/audit_log.php');
|
||
}
|
||
|
||
$page = max(1, (int) ($_GET['p'] ?? 1));
|
||
$perPage = 50;
|
||
$offset = ($page - 1) * $perPage;
|
||
|
||
$total = (int) $pdo->query('SELECT COUNT(*) FROM admin_audit_log')->fetchColumn();
|
||
$stmt = $pdo->prepare(
|
||
"SELECT al.*, s.name AS staff_name FROM admin_audit_log al
|
||
LEFT JOIN staff s ON s.id = al.staff_id
|
||
ORDER BY al.created_at DESC LIMIT ? OFFSET ?"
|
||
);
|
||
$stmt->bindValue(1, $perPage, PDO::PARAM_INT);
|
||
$stmt->bindValue(2, $offset, PDO::PARAM_INT);
|
||
$stmt->execute();
|
||
$entries = $stmt->fetchAll();
|
||
|
||
$totalPages = max(1, (int) ceil($total / $perPage));
|
||
|
||
$pageTitle = 'Admin-Protokoll';
|
||
$activePage = 'audit_log';
|
||
require __DIR__ . '/_header.php';
|
||
?>
|
||
|
||
<div style="display:flex;justify-content:space-between;align-items:flex-start;gap:12px;flex-wrap:wrap">
|
||
<div>
|
||
<h1>Admin-Protokoll</h1>
|
||
<p class="muted">Protokoll administrativer Änderungen (Mitarbeiter, Stammdaten, Einstellungen) – getrennt vom Aktivitätsprotokoll einzelner Tickets.</p>
|
||
</div>
|
||
<?php if ($staff['role'] === 'admin' && $entries): ?>
|
||
<form method="post" onsubmit="return confirm('Admin-Protokoll wirklich vollständig und unwiderruflich leeren?');">
|
||
<?= csrf_field() ?>
|
||
<input type="hidden" name="action" value="clear_log">
|
||
<button type="submit" class="btn btn-outline" style="flex-shrink:0">🗑️ Protokoll leeren</button>
|
||
</form>
|
||
<?php endif; ?>
|
||
</div>
|
||
|
||
<div class="card">
|
||
<?php if (!$entries): ?>
|
||
<div class="empty-state">Noch keine Einträge.</div>
|
||
<?php else: ?>
|
||
<table>
|
||
<thead><tr><th>Zeitpunkt</th><th>Mitarbeiter</th><th>Aktion</th></tr></thead>
|
||
<tbody>
|
||
<?php foreach ($entries as $e): ?>
|
||
<tr>
|
||
<td class="muted" style="white-space:nowrap"><?= format_dt($e['created_at']) ?></td>
|
||
<td><?= e($e['staff_name'] ?? 'System') ?></td>
|
||
<td><?= e($e['action']) ?></td>
|
||
</tr>
|
||
<?php endforeach; ?>
|
||
</tbody>
|
||
</table>
|
||
<?php if ($totalPages > 1): ?>
|
||
<div style="margin-top:14px; font-size:.85rem">
|
||
Seite <?= $page ?> von <?= $totalPages ?>
|
||
<?php if ($page > 1): ?> · <a href="?p=<?= $page - 1 ?>">← Neuer</a><?php endif; ?>
|
||
<?php if ($page < $totalPages): ?> · <a href="?p=<?= $page + 1 ?>">Älter →</a><?php endif; ?>
|
||
</div>
|
||
<?php endif; ?>
|
||
<?php endif; ?>
|
||
</div>
|
||
|
||
<?php require __DIR__ . '/_footer.php'; ?>
|