89 lines
2.7 KiB
PHP
89 lines
2.7 KiB
PHP
<?php
|
|
/**
|
|
* API: Subir archivo de orden médica desde el modal de agendamiento
|
|
*
|
|
* POST (multipart/form-data) con campo 'file'
|
|
* Devuelve: { success, local_file, file_name, file_size, mime }
|
|
*/
|
|
require_once __DIR__ . '/../../config/config.php';
|
|
require_once __DIR__ . '/../../classes/Database.php';
|
|
|
|
header('Content-Type: application/json; charset=utf-8');
|
|
header('X-Content-Type-Options: nosniff');
|
|
|
|
requireAuthentication();
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
http_response_code(405);
|
|
echo json_encode(['success' => false, 'error' => 'Método no permitido']);
|
|
exit;
|
|
}
|
|
|
|
if (empty($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
|
|
$errCode = $_FILES['file']['error'] ?? -1;
|
|
echo json_encode(['success' => false, 'error' => 'No se recibió ningún archivo (código ' . $errCode . ')']);
|
|
exit;
|
|
}
|
|
|
|
$file = $_FILES['file'];
|
|
|
|
// Validar tamaño máximo: 10 MB
|
|
if ($file['size'] > 10 * 1024 * 1024) {
|
|
echo json_encode(['success' => false, 'error' => 'El archivo supera el tamaño máximo permitido (10 MB)']);
|
|
exit;
|
|
}
|
|
|
|
// Validar tipo MIME real (no confiar solo en la extensión del cliente)
|
|
$allowedMimes = [
|
|
'image/jpeg',
|
|
'image/png',
|
|
'image/gif',
|
|
'image/webp',
|
|
'application/pdf',
|
|
'application/msword',
|
|
'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
|
|
];
|
|
|
|
$finfo = finfo_open(FILEINFO_MIME_TYPE);
|
|
$mime = finfo_file($finfo, $file['tmp_name']);
|
|
finfo_close($finfo);
|
|
|
|
if (!in_array($mime, $allowedMimes, true)) {
|
|
echo json_encode(['success' => false, 'error' => 'Tipo de archivo no permitido (' . $mime . ')']);
|
|
exit;
|
|
}
|
|
|
|
// Generar nombre único y seguro
|
|
$origExt = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
|
|
$origExt = preg_replace('/[^a-z0-9]/', '', $origExt);
|
|
if (!$origExt) $origExt = 'bin';
|
|
|
|
$newName = 'orden_' . date('Ymd_His') . '_' . bin2hex(random_bytes(4)) . '.' . $origExt;
|
|
|
|
$uploadDir = realpath(__DIR__ . '/../../uploads/media');
|
|
if (!$uploadDir) {
|
|
// Intentar crear el directorio si no existe
|
|
@mkdir(__DIR__ . '/../../uploads/media', 0755, true);
|
|
$uploadDir = realpath(__DIR__ . '/../../uploads/media');
|
|
}
|
|
|
|
if (!$uploadDir || !is_writable($uploadDir)) {
|
|
echo json_encode(['success' => false, 'error' => 'El directorio de uploads no está disponible']);
|
|
exit;
|
|
}
|
|
|
|
$destPath = $uploadDir . DIRECTORY_SEPARATOR . $newName;
|
|
|
|
if (!move_uploaded_file($file['tmp_name'], $destPath)) {
|
|
echo json_encode(['success' => false, 'error' => 'Error al guardar el archivo en el servidor']);
|
|
exit;
|
|
}
|
|
|
|
echo json_encode([
|
|
'success' => true,
|
|
'local_file' => $newName,
|
|
'file_name' => $file['name'],
|
|
'file_size' => $file['size'],
|
|
'mime' => $mime,
|
|
]);
|