diff --git a/api/chat.php b/api/chat.php
index 5f9f542..d193a7a 100644
--- a/api/chat.php
+++ b/api/chat.php
@@ -7,6 +7,20 @@ $method = $_SERVER['REQUEST_METHOD'];
if ($method === 'GET') {
try {
+ // Limpiar mensajes y archivos de más de 6 horas
+ $oldImages = db()->prepare("SELECT message FROM messages WHERE type = 'image' AND created_at < DATE_SUB(NOW(), INTERVAL 6 HOUR)");
+ $oldImages->execute();
+ $filesToDelete = $oldImages->fetchAll(PDO::FETCH_ASSOC);
+
+ foreach ($filesToDelete as $fileRow) {
+ $filePath = __DIR__ . '/../' . $fileRow['message'];
+ if (file_exists($filePath) && is_file($filePath)) {
+ unlink($filePath);
+ }
+ }
+
+ db()->query("DELETE FROM messages WHERE created_at < DATE_SUB(NOW(), INTERVAL 6 HOUR)");
+
$stmt = db()->prepare("SELECT m.*, ul.custom_color FROM messages m LEFT JOIN user_likes ul ON m.username = ul.username ORDER BY m.created_at DESC LIMIT 50");
$stmt->execute();
$messages = $stmt->fetchAll(PDO::FETCH_ASSOC);
@@ -18,6 +32,9 @@ if ($method === 'GET') {
$input = json_decode(file_get_contents('php://input'), true);
$username = $input['username'] ?? 'Anónimo';
$message = $input['message'] ?? '';
+ $type = $input['type'] ?? 'text';
+ $ip = $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'];
+ $ip = explode(',', $ip)[0];
if (empty($message)) {
echo json_encode(['error' => 'Mensaje vacío']);
@@ -25,8 +42,8 @@ if ($method === 'GET') {
}
try {
- $stmt = db()->prepare("INSERT INTO messages (username, message) VALUES (?, ?)");
- $stmt->execute([$username, $message]);
+ $stmt = db()->prepare("INSERT INTO messages (username, ip_address, message, type) VALUES (?, ?, ?, ?)");
+ $stmt->execute([$username, $ip, $message, $type]);
echo json_encode(['success' => true]);
} catch (Exception $e) {
echo json_encode(['error' => $e->getMessage()]);
diff --git a/api/like_song.php b/api/like_song.php
index 9364376..ed45010 100644
--- a/api/like_song.php
+++ b/api/like_song.php
@@ -25,8 +25,10 @@ try {
// 3. Post to chat
$message = "¡Le dio un ❤️ a la canción: $song_title!";
- $stmtChat = $pdo->prepare("INSERT INTO messages (username, message) VALUES (?, ?)");
- $stmtChat->execute([$username, $message]);
+ $ip = $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'];
+ $ip = explode(',', $ip)[0];
+ $stmtChat = $pdo->prepare("INSERT INTO messages (username, ip_address, message) VALUES (?, ?, ?)");
+ $stmtChat->execute([$username, $ip, $message]);
// 3. Get total likes for this song
$stmtCount = $pdo->prepare("SELECT likes_count FROM song_likes WHERE song_title = ?");
diff --git a/api/upload.php b/api/upload.php
new file mode 100644
index 0000000..f8d0104
--- /dev/null
+++ b/api/upload.php
@@ -0,0 +1,57 @@
+ 'Método no permitido']);
+ exit;
+}
+
+if (!isset($_FILES['image'])) {
+ echo json_encode(['error' => 'No se recibió ninguna imagen']);
+ exit;
+}
+
+$file = $_FILES['image'];
+$allowedTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
+$maxSize = 5 * 1024 * 1024; // 5MB
+
+// Límite de imágenes por usuario (basado en IP)
+$ip = $_SERVER['HTTP_CF_CONNECTING_IP'] ?? $_SERVER['HTTP_X_FORWARDED_FOR'] ?? $_SERVER['REMOTE_ADDR'];
+$ip = explode(',', $ip)[0];
+
+try {
+ $stmt = db()->prepare("SELECT COUNT(*) FROM messages WHERE ip_address = ? AND type = 'image' AND created_at > DATE_SUB(NOW(), INTERVAL 6 HOUR)");
+ $stmt->execute([$ip]);
+ $count = $stmt->fetchColumn();
+
+ if ($count >= 10) {
+ echo json_encode(['error' => 'Has alcanzado el límite de 10 imágenes cada 6 horas para evitar abusos']);
+ exit;
+ }
+} catch (Exception $e) {
+ // Si falla la verificación, continuamos pero logueamos
+ error_log("Error checking upload limit: " . $e->getMessage());
+}
+
+if (!in_array($file['type'], $allowedTypes)) {
+ echo json_encode(['error' => 'Formato de imagen no permitido (solo JPG, PNG, GIF, WEBP)']);
+ exit;
+}
+
+if ($file['size'] > $maxSize) {
+ echo json_encode(['error' => 'La imagen es demasiado grande (máximo 5MB)']);
+ exit;
+}
+
+$ext = pathinfo($file['name'], PATHINFO_EXTENSION);
+$filename = uniqid('img_', true) . '.' . $ext;
+$targetPath = __DIR__ . '/../uploads/' . $filename;
+
+if (move_uploaded_file($file['tmp_name'], $targetPath)) {
+ $url = 'uploads/' . $filename;
+ echo json_encode(['success' => true, 'url' => $url]);
+} else {
+ echo json_encode(['error' => 'Error al guardar la imagen']);
+}
diff --git a/index.php b/index.php
index 274f24e..d2e5a4b 100644
--- a/index.php
+++ b/index.php
@@ -30,6 +30,7 @@ $facebook_link = "https://www.facebook.com/profile.php?id=61587890927489";
+