diff --git a/admin/links.php b/admin/links.php index 10272b0..c6a3295 100644 --- a/admin/links.php +++ b/admin/links.php @@ -9,6 +9,98 @@ if (!isset($_SESSION['user_id']) || $_SESSION['user_role'] !== 'admin') { require_once __DIR__ . '/../db/config.php'; $pdo = db(); +// CSRF Protection +if (empty($_SESSION['csrf_token'])) { + $_SESSION['csrf_token'] = bin2hex(random_bytes(32)); +} + +if ($_SERVER['REQUEST_METHOD'] === 'POST') { + header('Content-Type: application/json'); + $response = ['success' => false, 'message' => 'Invalid request.']; + + if (!isset($_POST['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) { + $response['message'] = 'CSRF token validation failed.'; + echo json_encode($response); + exit; + } + + $action = $_POST['action'] ?? ''; + $link_id = $_POST['link_id'] ?? null; + + if (!$link_id || !is_numeric($link_id)) { + $response['message'] = 'Invalid Link ID.'; + echo json_encode($response); + exit; + } + + switch ($action) { + case 'delete': + try { + $stmt = $pdo->prepare("DELETE FROM links WHERE id = ?"); + $stmt->execute([$link_id]); + if ($stmt->rowCount()) { + $response = ['success' => true, 'message' => 'Link deleted successfully.']; + } else { + $response['message'] = 'Link not found or could not be deleted.'; + } + } catch (PDOException $e) { + $response['message'] = 'Database error: ' . $e->getMessage(); + } + break; + + case 'toggle_status': + $current_status = $_POST['current_status'] ?? ''; + $new_status = ($current_status === 'paused') ? 'approved' : 'paused'; // Toggle between paused and approved + + try { + $stmt = $pdo->prepare("UPDATE links SET status = ? WHERE id = ?"); + $stmt->execute([$new_status, $link_id]); + if ($stmt->rowCount()) { + $response = ['success' => true, 'message' => 'Link status updated successfully to ' . $new_status . '.', 'new_status' => $new_status]; + } else { + $response['message'] = 'Link not found or status could not be updated.'; + } + } catch (PDOException $e) { + $response['message'] = 'Database error: ' . $e->getMessage(); + } + break; + + // Add 'edit' case later + case 'edit': + $title = trim($_POST['title'] ?? ''); + $url = trim($_POST['url'] ?? ''); + $description = trim($_POST['description'] ?? ''); + $subcategory_id = $_POST['subcategory_id'] ?? null; + $status = $_POST['status'] ?? 'pending'; + + if (empty($title) || empty($url) || !filter_var($url, FILTER_VALIDATE_URL) || !is_numeric($subcategory_id)) { + $response['message'] = 'Invalid input for editing link.'; + echo json_encode($response); + exit; + } + + try { + $stmt = $pdo->prepare("UPDATE links SET title = ?, url = ?, description = ?, subcategory_id = ?, status = ? WHERE id = ?"); + $stmt->execute([$title, $url, $description, $subcategory_id, $status, $link_id]); + if ($stmt->rowCount()) { + $response = ['success' => true, 'message' => 'Link updated successfully.']; + } else { + $response['message'] = 'Link not found or no changes made.'; + } + } catch (PDOException $e) { + $response['message'] = 'Database error: ' . $e->getMessage(); + } + break; + + default: + $response['message'] = 'Unknown action.'; + break; + } + + echo json_encode($response); + exit; +} + $links = $pdo->query("SELECT l.*, u.username, s.name as subcategory_name, c.name as category_name FROM links l JOIN users u ON l.user_id = u.id @@ -16,6 +108,8 @@ $links = $pdo->query("SELECT l.*, u.username, s.name as subcategory_name, c.name JOIN categories c ON s.category_id = c.id ORDER BY l.created_at DESC")->fetchAll(); +// Fetch subcategories for the edit form +$subcategories = $pdo->query("SELECT sc.id, sc.name AS subcategory_name, c.name AS category_name FROM subcategories sc JOIN categories c ON sc.category_id = c.id ORDER BY c.name, sc.name")->fetchAll(); ?> @@ -70,15 +164,17 @@ $links = $pdo->query("SELECT l.*, u.username, s.name as subcategory_name, c.name