From f99f48b62fb82f39cdcc5a1a54906b6de6710a0a Mon Sep 17 00:00:00 2001
From: DevSoftTech Server <info.devsofttech@gmail.com>
Date: Sat, 11 Apr 2026 04:49:59 +0530
Subject: [PATCH] fix: restrict scan delete to 24h or same date

---
 app/Controllers/Opd.php                      | 33 +++++++++++++++++---
 app/Views/billing/opd_scan_carousel_list.php |  6 +++-
 app/Views/billing/opd_scan_last_list.php     |  6 +++-
 3 files changed, 39 insertions(+), 6 deletions(-)

diff --git a/app/Controllers/Opd.php b/app/Controllers/Opd.php
index 661feed..84b900f 100644
--- a/app/Controllers/Opd.php
+++ b/app/Controllers/Opd.php
@@ -5027,11 +5027,19 @@ class Opd extends BaseController
                 $ext = '.' . $ext;
             }
 
+            $insertDateRaw = (string) ($row['insert_date'] ?? '');
+            $insertTs = $insertDateRaw !== '' ? strtotime($insertDateRaw) : false;
+            $nowTs = time();
+            $isWithin24Hours = ($insertTs !== false) && (($nowTs - $insertTs) <= 86400);
+            $isSameDate = ($insertTs !== false) && (date('Y-m-d', $insertTs) === date('Y-m-d', $nowTs));
+            $canDeleteLimited = $isWithin24Hours || $isSameDate;
+
             $list[] = [
                 'id' => (int) ($row['id'] ?? 0),
                 'path' => $publicPath,
                 'is_pdf' => $ext === '.pdf',
                 'insert_date' => !empty($row['insert_date']) ? date('d/m/Y-H:i', strtotime((string) $row['insert_date'])) : '',
+                'can_delete_limited' => $canDeleteLimited ? 1 : 0,
                 'scan_type' => (string) ($row['scan_type'] ?? ''),
                 'document_type' => (string) ($row['document_type'] ?? ''),
                 'content_description' => (string) ($row['content_description'] ?? ''),
@@ -5065,7 +5073,6 @@ class Opd extends BaseController
             ->get()
             ->getResultArray();
 
-        $today = date('Y-m-d');
         $slides = [];
         foreach ($rows as $row) {
             $rawPath = (string) ($row['full_path'] ?? '');
@@ -5082,15 +5089,19 @@ class Opd extends BaseController
             }
 
             $insertDate = (string) ($row['insert_date'] ?? '');
-            $insertYmd = $insertDate !== '' ? date('Y-m-d', strtotime($insertDate)) : '';
-            $canDeleteToday = $insertYmd === $today;
+            $insertTs = $insertDate !== '' ? strtotime($insertDate) : false;
+            $nowTs = time();
+            $isWithin24Hours = ($insertTs !== false) && (($nowTs - $insertTs) <= 86400);
+            $isSameDate = ($insertTs !== false) && (date('Y-m-d', $insertTs) === date('Y-m-d', $nowTs));
+            $canDeleteLimited = $isWithin24Hours || $isSameDate;
 
             $slides[] = [
                 'id' => (int) ($row['id'] ?? 0),
                 'path' => $publicPath,
                 'is_pdf' => $ext === 'pdf',
                 'insert_date' => $insertDate !== '' ? date('d-m-Y H:i', strtotime($insertDate)) : '',
-                'can_delete_today' => $canDeleteToday ? 1 : 0,
+                'can_delete_today' => $canDeleteLimited ? 1 : 0,
+                'can_delete_limited' => $canDeleteLimited ? 1 : 0,
             ];
         }
 
@@ -5252,6 +5263,20 @@ class Opd extends BaseController
             ]);
         }
 
+        $insertDate = (string) ($row['insert_date'] ?? '');
+        $insertTs = $insertDate !== '' ? strtotime($insertDate) : false;
+        $nowTs = time();
+        $isWithin24Hours = ($insertTs !== false) && (($nowTs - $insertTs) <= 86400);
+        $isSameDate = ($insertTs !== false) && (date('Y-m-d', $insertTs) === date('Y-m-d', $nowTs));
+        if (! ($isWithin24Hours || $isSameDate)) {
+            return $this->response->setJSON([
+                'update' => 0,
+                'error_text' => 'Delete allowed only within 24 hours or same current date uploads',
+                'csrfName' => csrf_token(),
+                'csrfHash' => csrf_hash(),
+            ]);
+        }
+
         $fullPath = (string) ($row['full_path'] ?? '');
         if ($fullPath !== '' && is_file($fullPath)) {
             @unlink($fullPath);
diff --git a/app/Views/billing/opd_scan_carousel_list.php b/app/Views/billing/opd_scan_carousel_list.php
index 2caaa4c..1a873ec 100644
--- a/app/Views/billing/opd_scan_carousel_list.php
+++ b/app/Views/billing/opd_scan_carousel_list.php
@@ -25,7 +25,11 @@
                         <div class="small text-muted">
                             Uploaded: <?= esc($item['insert_date'] ?? '') ?>
                         </div>
-                        <button type="button" class="btn btn-outline-danger btn-sm" onclick="deleteOpdScanFromList(<?= (int) ($item['id'] ?? 0) ?>, <?= (int) ($opdid ?? 0) ?>)">Delete</button>
+                        <?php if ((int) ($item['can_delete_limited'] ?? $item['can_delete_today'] ?? 0) === 1) : ?>
+                            <button type="button" class="btn btn-outline-danger btn-sm" onclick="deleteOpdScanFromList(<?= (int) ($item['id'] ?? 0) ?>, <?= (int) ($opdid ?? 0) ?>)">Delete</button>
+                        <?php else : ?>
+                            <span class="badge bg-secondary">Delete: within 24h or same date</span>
+                        <?php endif; ?>
                     </div>
                 </div>
             <?php endforeach; ?>
diff --git a/app/Views/billing/opd_scan_last_list.php b/app/Views/billing/opd_scan_last_list.php
index 0939c97..6252a4c 100644
--- a/app/Views/billing/opd_scan_last_list.php
+++ b/app/Views/billing/opd_scan_last_list.php
@@ -30,7 +30,11 @@
                         <div class="small text-muted mt-1" style="line-height:1.2"><?= nl2br(esc((string) ($item['content_description'] ?? ''))) ?></div>
                     <?php } ?>
                     <div class="small text-muted mt-1"><?= esc($item['insert_date'] ?? '') ?></div>
-                    <button type="button" class="btn btn-link btn-sm text-danger p-0" onclick="removeOpdScanImage(<?= (int) ($item['id'] ?? 0) ?>)">Delete</button>
+                    <?php if ((int) ($item['can_delete_limited'] ?? 0) === 1) { ?>
+                        <button type="button" class="btn btn-link btn-sm text-danger p-0" onclick="removeOpdScanImage(<?= (int) ($item['id'] ?? 0) ?>)">Delete</button>
+                    <?php } else { ?>
+                        <span class="badge bg-secondary">Delete: within 24h or same date</span>
+                    <?php } ?>
                 </div>
             </div>
         <?php } ?>