Medowar
/
forms


			
				
					
						
						
							123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170
							<?php
// submit.php - Handles saving an answer and displaying the result

$answers_dir = __DIR__ . '/data/answers';
if (!is_dir($answers_dir)) {
    mkdir($answers_dir, 0755, true);
}

$is_post = ($_SERVER['REQUEST_METHOD'] === 'POST');
$form_id = $_REQUEST['form_id'] ?? $_GET['id'] ?? '';
$answer_id = $_REQUEST['answer_id'] ?? $_POST['edit_id'] ?? '';

$form_file = __DIR__ . '/data/forms/' . preg_replace('/[^a-zA-Z0-9_-]/', '', $form_id) . '.json';
if (empty($form_id) || !file_exists($form_file)) {
    die('<div style="font-family:sans-serif; text-align:center; padding:50px;"><h2>Formular nicht gefunden</h2></div>');
}

$form_data = json_decode(file_get_contents($form_file), true);
$questions_map = [];
foreach ($form_data['questions'] as $q) {
    $questions_map[$q['id']] = $q['label'];
}

$injected_js = '';

if ($is_post) {
    // Process form submission
    $respondent_name = trim($_POST['respondent_name'] ?? 'Anonym');
    $respondent_email = trim($_POST['respondent_email'] ?? '');
    $answers = $_POST['answers'] ?? [];
    $answers_freetext = $_POST['answers_freetext'] ?? [];
    
    // Resolve free text substitutions
    foreach ($answers as $q_id => $val) {
        if (is_array($val)) {
            $idx = array_search('__freetext__', $val);
            if ($idx !== false) {
                if (!empty($answers_freetext[$q_id])) {
                    $val[$idx] = "Sonstiges: " . ltrim($answers_freetext[$q_id]);
                } else {
                    unset($val[$idx]); // they selected 'Sonstiges' but left it blank
                }
                $answers[$q_id] = array_values($val);
            }
        } else {
            if ($val === '__freetext__') {
                if (!empty($answers_freetext[$q_id])) {
                    $answers[$q_id] = "Sonstiges: " . ltrim($answers_freetext[$q_id]);
                } else {
                    $answers[$q_id] = ''; // blank fallback
                }
            }
        }
    }
    
    $is_edit = !empty($answer_id);
    if (!$is_edit) {
        $answer_id = uniqid('ans_');
    }
    
    $safe_answer_id = preg_replace('/[^a-zA-Z0-9_-]/', '', $answer_id);
    
    $answer_data = [
        'answer_id' => $safe_answer_id,
        'form_id' => $form_id,
        'respondent_name' => $respondent_name,
        'respondent_email' => $respondent_email,
        'submitted_at' => date('c'),
        'answers' => $answers
    ];
    
    file_put_contents("$answers_dir/{$form_id}_{$safe_answer_id}.json", json_encode($answer_data, JSON_PRETTY_PRINT));
    
    // No longer injecting JS to prevent double-submit.
    $injected_js = "";
    
    // Email notification if provided
    if (!empty($respondent_email) && filter_var($respondent_email, FILTER_VALIDATE_EMAIL)) {
        $subject = "Deine Einsendung für: " . $form_data['title'];
        $body = "Hallo $respondent_name,\n\nVielen Dank für deine Einsendung.\nHier sind deine Antworten:\n\n";
        
        foreach ($answers as $q_id => $val) {
            $label = $questions_map[$q_id] ?? 'Frage';
            $val_str = is_array($val) ? implode(', ', $val) : $val;
            $body .= "$label:\n$val_str\n\n";
        }
        
        $host = $_SERVER['HTTP_HOST'];
        $headers = "From: no-reply@" . $host . "\r\n";
        @mail($respondent_email, $subject, $body, $headers);
    }
    
    // Redirect to self as GET to prevent duplicate POSTs on refresh
    header("Location: submit.php?id=" . urlencode($form_id) . "&answer_id=" . urlencode($safe_answer_id) . "&success=1");
    exit;
}

// Display Mode (GET)
$success = isset($_GET['success']);
$safe_answer_id = preg_replace('/[^a-zA-Z0-9_-]/', '', $answer_id);
$answer_file = "$answers_dir/{$form_id}_{$safe_answer_id}.json";

if (empty($safe_answer_id) || !file_exists($answer_file)) {
    die('<div style="font-family:sans-serif; text-align:center; padding:50px;"><h2>Einsendung nicht gefunden</h2></div>');
}

$answer_data = json_decode(file_get_contents($answer_file), true);
?>
<!DOCTYPE html>
<html lang="de">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Einsendung erfolgreich</title>
    <link rel="stylesheet" href="assets/css/style.css">
    <script>
        <?= $injected_js ?> // Output any localstorage writes if we didn't redirect (e.g. if we chose to drop the header(Location))
        
        function clearAndAnswerNew() {
            // we don't need to clear submissions here anymore since we allow doubles
            window.location.href = 'answer.php?id=<?= htmlspecialchars($form_id) ?>';
        }
    </script>
</head>
<body>
    <header class="site-header">
        <div class="container header-inner">
            <div class="brand">
                <span class="brand-title"><?= htmlspecialchars($form_data['title']) ?></span>
            </div>
        </div>
    </header>

    <main class="container">
        <?php if ($success): ?>
            <div class="alert alert-success mt-3 mb-3">
                Deine Antwort wurde erfolgreich gespeichert.
                <?php if (!empty($answer_data['respondent_email'])): ?>
                    <br><small>Eine Kopie deiner Antworten wurde gesendet an <?= htmlspecialchars($answer_data['respondent_email']) ?>.</small>
                <?php endif; ?>
            </div>
        <?php endif; ?>

        <div class="panel">
            <h2 class="card-title">Eingereichte Antworten</h2>
            <br>
            <table class="table-compact responsive-table">
                <tbody>
                    <tr>
                        <td data-label="Antwortender"><strong><?= htmlspecialchars($answer_data['respondent_name']) ?></strong></td>
                    </tr>
                    <?php foreach ($answer_data['answers'] as $q_id => $val): ?>
                        <tr>
                            <td data-label="<?= htmlspecialchars($questions_map[$q_id] ?? 'Frage') ?>">
                                <div><strong style="color:var(--brand-muted); font-size:0.85rem;"><?= htmlspecialchars($questions_map[$q_id] ?? 'Frage') ?></strong></div>
                                <div><?= nl2br(htmlspecialchars(is_array($val) ? implode(', ', $val) : $val)) ?></div>
                            </td>
                        </tr>
                    <?php endforeach; ?>
                </tbody>
            </table>
        </div>

        <div class="panel text-center" style="background:transparent; border:none; box-shadow:none;">
            <a href="answer.php?id=<?= htmlspecialchars($form_id) ?>&edit=<?= htmlspecialchars($answer_data['answer_id']) ?>" class="btn mt-2">Antwort bearbeiten</a>
            <button onclick="clearAndAnswerNew()" class="btn btn-secondary mt-2">Weitere Antwort hinzufügen</button>
        </div>
    </main>
</body>
</html>