From 43e0fc7be636bd7a5cfb954f658ac2424227068a Mon Sep 17 00:00:00 2001
From: andre <andre.filipe6@gmail.com>
Date: Fri, 25 Sep 2026 17:41:40 +0100
Subject: [PATCH] =?UTF-8?q?refactor:=20move=20o=20SQL=20restante=20das=20v?=
 =?UTF-8?q?istas=20de=20multi-gin=C3=A1sio=20(fecha=206.3)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Os últimos 3 pontos de SQL direto em vistas, que tinham entrado depois
da auditoria original (trabalho de multi-ginásio): gyms/create.php e
gyms/edit.php partilhavam a mesma query da lista de galerias — agora
db_galleries_options() em functions_galerias.php (e simplificada: o
_gyms_has_col() defensivo já não é preciso, galleries.deleted_at
existe desde a migração de 25/09). reviews/index.php gravava
google_place_id à mão — agora db_gym_set_place_id(), separado do
db_gyms_update() geral para não auditar/validar o resto do registo
por uma só coluna.

Zero vistas com SQL direto agora (grep confirma).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 config/functions_galerias.php | 6 ++++++
 config/functions_gyms.php     | 8 ++++++++
 views/admin/gyms/create.php   | 3 +--
 views/admin/gyms/edit.php     | 3 +--
 views/admin/reviews/index.php | 3 +--
 5 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/config/functions_galerias.php b/config/functions_galerias.php
index 9e862b7..4570373 100644
--- a/config/functions_galerias.php
+++ b/config/functions_galerias.php
@@ -8,6 +8,12 @@ function db_gallery_list(PDO $pdo): array {
     return $pdo->query("SELECT * FROM galleries WHERE deleted_at IS NULL ORDER BY name")->fetchAll(PDO::FETCH_ASSOC);
 }
 
+// id => name pairs for a <select> (gyms create/edit "gallery" picker).
+function db_galleries_options(PDO $pdo): array {
+    return $pdo->query("SELECT id, name FROM galleries WHERE deleted_at IS NULL ORDER BY id")
+               ->fetchAll(PDO::FETCH_KEY_PAIR);
+}
+
 function db_gallery_get(PDO $pdo, int $id): ?array {
     $stmt = $pdo->prepare("SELECT * FROM galleries WHERE id = ? LIMIT 1");
     $stmt->execute([$id]);
diff --git a/config/functions_gyms.php b/config/functions_gyms.php
index 01aec4e..82ffd5a 100644
--- a/config/functions_gyms.php
+++ b/config/functions_gyms.php
@@ -222,6 +222,14 @@ function db_gyms_update(PDO $pdo, int $id, array $d): bool {
     return $__r;
 }
 
+// Single-field setter for views/admin/reviews/index.php — that page only
+// touches google_place_id, not the rest of the gym record db_gyms_update()
+// would validate/audit.
+function db_gym_set_place_id(PDO $pdo, int $id, string $placeId): void {
+    $pdo->prepare("UPDATE gyms SET google_place_id = ?, updated_at = NOW() WHERE id = ?")
+        ->execute([$placeId, $id]);
+}
+
 // Soft delete. The default gym can't go (the root URL needs somewhere to land).
 function db_gyms_delete(PDO $pdo, int $id): bool {
     $st = $pdo->prepare("UPDATE gyms SET deleted_at = NOW(), is_published = 0
diff --git a/views/admin/gyms/create.php b/views/admin/gyms/create.php
index 3c33fb7..a3bc45b 100644
--- a/views/admin/gyms/create.php
+++ b/views/admin/gyms/create.php
@@ -5,8 +5,7 @@ $user = require_admin();
 
 $errors    = [];
 $data      = gym_defaults();
-$galleries = $pdo->query("SELECT id, name FROM galleries" . (_gyms_has_col($pdo, 'galleries', 'deleted_at') ? " WHERE deleted_at IS NULL" : "") . " ORDER BY id")
-                 ->fetchAll(PDO::FETCH_KEY_PAIR);
+$galleries = db_galleries_options($pdo);
 $sources   = db_gyms_list($pdo);
 $copy_from = (int) ($_POST['copy_from'] ?? 0);
 $copy_what = (array) ($_POST['copy'] ?? array_keys(gyms_copy_options()));
diff --git a/views/admin/gyms/edit.php b/views/admin/gyms/edit.php
index e4b8c2e..c1b6ae5 100644
--- a/views/admin/gyms/edit.php
+++ b/views/admin/gyms/edit.php
@@ -9,8 +9,7 @@ if (!$item || $item['deleted_at'] !== null) { header('Location: index.php'); exi
 
 $errors    = [];
 $data      = $item;
-$galleries = $pdo->query("SELECT id, name FROM galleries" . (_gyms_has_col($pdo, 'galleries', 'deleted_at') ? " WHERE deleted_at IS NULL" : "") . " ORDER BY id")
-                 ->fetchAll(PDO::FETCH_KEY_PAIR);
+$galleries = db_galleries_options($pdo);
 
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     csrf_check();
diff --git a/views/admin/reviews/index.php b/views/admin/reviews/index.php
index 9e660e5..2cb1561 100644
--- a/views/admin/reviews/index.php
+++ b/views/admin/reviews/index.php
@@ -21,8 +21,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         } elseif ($key !== '') {
             db_update_setting($pdo, 'google_places_api_key', secret_encrypt($key), $uid);
         }
-        $pdo->prepare("UPDATE gyms SET google_place_id = ?, updated_at = NOW() WHERE id = ?")
-            ->execute([mb_substr(trim((string) ($_POST['google_place_id'] ?? '')), 0, 120), (int) $rgym['id']]);
+        db_gym_set_place_id($pdo, (int) $rgym['id'], mb_substr(trim((string) ($_POST['google_place_id'] ?? '')), 0, 120));
         db_update_setting($pdo, 'google_reviews_min_rating', (string) max(1, min(5, (int) ($_POST['min_rating'] ?? 4))), $uid);
         db_update_setting($pdo, 'google_reviews_max', (string) max(1, min(5, (int) ($_POST['max'] ?? 3))), $uid);
         db_update_setting($pdo, 'google_reviews_cache_hours', (string) max(1, (int) ($_POST['cache_hours'] ?? 24)), $uid);