added file uploads

application/Preorder/PreorderController.php

@@ -1985,4 +1985,56 @@ class PreorderController extends mfBaseController {
         unlink($filename);
         exit;
     }
+
+    protected function uploadDocumentsAction() {
+        if (empty($_FILES['files']) || empty($_POST['preorderId']) || empty($_POST['descriptions'])) {
+            self::sendError('Erforderliche Daten fehlen (Dateien, preorderId oder Beschreibungen).');
+        }
+
+        $preorderId = $_POST['preorderId'];
+        $descriptions = $_POST['descriptions'];
+
+        if (count($_FILES['files']['name']) !== count($descriptions)) {
+            self::sendError('Anzahl der Dateien und Beschreibungen stimmt nicht überein.');
+        }
+
+        $preorder = new Preorder($preorderId);
+        if (!$preorder->id) {
+            self::sendError('Bestellung nicht gefunden.');
+        }
+
+        $fileObjects = json_decode($preorder->files, true);
+        if (!is_array($fileObjects)) $fileObjects = [];
+
+        foreach ($_FILES['files']['name'] as $index => $name) {
+            if ($_FILES['files']['error'][$index] !== UPLOAD_ERR_OK) continue;
+
+            $_FILES['file'] = [
+                'name' => $name,
+                'type' => $_FILES['files']['type'][$index],
+                'tmp_name' => $_FILES['files']['tmp_name'][$index],
+                'error' => $_FILES['files']['error'][$index],
+                'size' => $_FILES['files']['size'][$index]
+            ];
+
+            $description = trim($descriptions[$index]);
+            if (empty($description)) continue;
+
+            try {
+                $uploaded = mfUpload::handleFormUpload("file", false, "/PreorderDocuments");
+                $fileObjects[] = ["id" => $uploaded->id, "description" => $description];
+            } catch (Exception $e) {}
+        }
+
+        $db = FronkDB::singleton();
+        $escapedFilesJson = $db->escape(json_encode($fileObjects));
+        $sql = "UPDATE `" . FRONKDB_DBNAME . "`.Preorder SET files = '$escapedFilesJson' WHERE id = " . (int)$preorder->id;
+        $db->query($sql);
+
+        self::returnJson([
+            'success' => true,
+            'message' => "Datei(en) erfolgreich hochgeladen.",
+            'fileObjects' => $fileObjects
+        ]);
+    }
 }