Controller/NotesController.php

@@ -20,11 +20,9 @@ class NotesController
     {
         $sortBy = $_GET['sort_by'] ?? 'updated_at';
         $sortOrder = strtoupper($_GET['sort_order'] ?? 'DESC');
-        $isAdmin = false;
-        $userid = 2; //$_SESSION['user_id'];
-
+        
         $this->view->setVars([
-            "notes" => $this->notesModel->selectNotesForUser($userid, $isAdmin, $sortBy, $sortOrder)
+            "notes" => $this->notesModel->selectNotesForUser(2, $sortBy, $sortOrder) //$_SESSION['user_id']
         ]);
     }
 

Model/NotesModel.php

@@ -2,45 +2,36 @@
 
 namespace ppa\Model;
 use ppa\Model\ParticipantModel;
+use ppb\Library\Msg;
 use PDOException;
 
 class NotesModel extends Database
 {
-    public function selectNotesForUser($userid, $isAdmin = false, $sortBy = 'updated_at', $sortOrder = 'DESC')
+    public function selectNotesForUser($userid, $sortBy = 'updated_at', $sortOrder = 'DESC')
     {
         $pdo = $this->linkDB();
-        $erg = array();
+		
+		$erg=array();
+		$params=array();
+
+        $sql = "SELECT n.*, u.username AS owner_username 
+            FROM notes n 
+            JOIN users u ON n.user_id = u.id 
+            ORDER BY :sortBy :sortOrder";
+
+        $params[':sortBy']=$sortBy;
+        $params[':sortOrder']=$sortOrder;
 
-        // Whitelist of allowed sort columns
-        $allowedSortColumns = ['id', 'title', 'owner_username', 'updated_at'];
-        $allowedSortOrders = ['ASC', 'DESC'];
-        
-        $sortBy = in_array($sortBy, $allowedSortColumns) ? $sortBy : 'updated_at';
-        $sortOrder = in_array(strtoupper($sortOrder), $allowedSortOrders) ? strtoupper($sortOrder) : 'DESC';
-        
         try {
-            if ($isAdmin) {
-                $sql = "SELECT n.*, u.username AS owner_username 
-                    FROM notes n 
-                    JOIN users u ON n.user_id = u.id 
-                    ORDER BY {$sortBy} {$sortOrder}";
-                $stmt = $pdo->prepare($sql);
-                $stmt->execute();
-            } else {
-                $sql = "SELECT id, title, content, created_at, updated_at 
-                    FROM notes 
-                    WHERE user_id = :userid
-                    ORDER BY {$sortBy} {$sortOrder}";
-                $stmt = $pdo->prepare($sql);
-                $stmt->execute(['userid' => $userid]);
-            }
-            
-            $erg = $stmt->fetchAll(\PDO::FETCH_ASSOC);
-            return $erg;
-            
-        } catch (PDOException $e) {
-            error_log("Database Error in selectNotesForUser: " . $e->getMessage());
-            return false;
-        }
+			$stmt=$pdo->prepare($sql);
+			$stmt->execute($params);
+		} catch (PDOException $e) {
+			new Msg(true, null, $e);
+			return false;
+		}
+        
+        $erg=$stmt->fetchAll(\PDO::FETCH_ASSOC);
+
+		return $erg;
     }
 }

Views/Notes/showNotes.phtml

@@ -13,7 +13,7 @@
     }
     
     function isAdmin() {
-        return false;// isLoggedIn() && isset($_SESSION['role']) && $_SESSION['role'] === 'admin';
+        return isLoggedIn() && isset($_SESSION['role']) && $_SESSION['role'] === 'admin';
     }
     function sanitize($data, $flags = ENT_QUOTES, $encoding = 'UTF-8') {
         return htmlspecialchars((string)$data, $flags, $encoding);