<?php
require_once __DIR__ . '/../inc/header.php';
require_login();
$pdo=db();
$id=(int)($_GET['id']??0);
$client_id=(int)($_GET['client_id']??0);

if($_SERVER['REQUEST_METHOD']==='POST'){
  csrf_check();
  $st=$pdo->prepare("SELECT stored_path FROM client_files WHERE id=?");
  $st->execute([$id]);
  $f=$st->fetch();
  if($f){
    $abs = $_SERVER['DOCUMENT_ROOT'] . $f['stored_path'];
    if (is_file($abs)) @unlink($abs);
    $pdo->prepare("DELETE FROM client_files WHERE id=?")->execute([$id]);
  }
  flash_set('success','Archivo eliminado.');
  redirect('clientes/view.php?id='.$client_id);
}
http_response_code(405);
exit('Método no permitido');
