<?php
session_start();
require_once($_SERVER['DOCUMENT_ROOT'] . '/includes/db_connect.php');
/**
* @return bool|PDO
*/
function get_db_connection() {
static $_instance = null;
if (is_null($_instance)) {
$_instance = new PDO(
'mysql:host=myhost;dbname=mydb',
'login',
'password',
array(PDO::MYSQL_ATTR_INIT_COMMAND => 'SET NAMES UTF8')
);
if (is_null($_instance)) {
return false;
}
}
return $_instance;
}
/**
* Получает ID автора.
* @param $post_id Post id
* @return int
*/
function get_post_author_id($post_id) {
$db = get_db_connection();
$stmt = $db->prepare('SELECT from_user FROM posts WHERE id = :id LIMIT 1');
if (!$result = $stmt->execute(array(':id' => $post_id))) {
return null;
}
if (!$post = $stmt->fetch(\PDO::FETCH_ASSOC)) {
return null;
}
return $post['from_user'];
}
/**
* Получает картинки поста.
* @param $post_id
* @return array
*/
function get_post_images($post_id) {
$db = get_db_connection();
$stmt = $db->prepare('SELECT post_images FROM posts WHERE id = :id AND from_user = \'1\' LIMIT 1');
if (!$result = $stmt->execute(array(':id' => $post_id))) {
return array();
}
return $stmt->fetchAll(\PDO::FETCH_ASSOC);
}
/**
* Удаляет картинки поста.
* @param $post_id
*/
function delete_post_images($post_id) {
foreach (get_post_images($post_id) as $row) {
$images_array = explode(',', $row['post_images']); // В БД у вас похоже тоже ужас.
foreach ($images_array as $image) {
$img_path = $_SERVER['DOCUMENT_ROOT'] . $image;
$pathinfo = pathinfo($img_path);
$small_img_path = $pathinfo['dirname'] . DIRECTORY_SEPARATOR . $pathinfo['filename'] . '_little' . '.' . $pathinfo['extension'];
if (file_exists($img_path)) {
unlink($img_path);
}
if (file_exists($small_img_path)) {
unlink($small_img_path);
}
}
}
}
/**
* Удаляет пост.
* @param $post_id
* @return bool
*/
function delete_post($post_id) {
$db = get_db_connection();
$stmt = $db->prepare('DELETE FROM posts WHERE id = :id');
if (!$result = $stmt->execute(array(':id' => $post_id))) {
return false;
}
delete_post_images($_POST['id']);
return true;
}
/**
* Отправляет ответ.
* @param bool $result
* @param mixed $data
*/
function send_response($result, $data = '') {
header('Content-Type: text/html; charset=utf-8');
print json_encode(array('result' => (bool)$result, 'data' => $data));
exit();
}
/**
* Проверяет доступ пользователя.
* @param $action
* @param $post_id
* @return bool
*/
function check_user_access($action, $post_id) {
switch ($action) {
case 'post_del':
if ($_SESSION['user_type'] != '1' && $_SESSION['search_access'] != '1') { // Почему строка '1'??
return false;
}
$author_id = get_post_author_id($post_id);
return ($author_id != '1' || $_SESSION['user_type'] == '1');
case 'compl_del':
return ($_SESSION['user_type'] == '1' || $_SESSION['compl_access'] == '1');
default:
return false;
}
}
if ($_SESSION['user_type'] == '4' || $_SESSION['is_auth_vk'] != '1') {
send_response(false, 'Доступ запрещен');
}
if (!is_numeric($_POST['id'])) {
send_response(false, 'Неверные параметры запроса');
}
if (!check_user_access($_POST['action'], $_POST['id'])) {
send_response(false, 'Недостаточно прав');
}
if (!delete_post($_POST['id'])) {
send_response(false, 'Неизвестная ошибка');
}
send_response(true);
$('.adm_posts_cont, .rossr_cont').on('click', '.close', function(e) {
e.preventDefault();
var $this = $(this);
var $next = $this.next();
var action_val = $next.find('.action').val();
var id = $next.find('.post_id').val();
var action = 'post_del';
if (action_val == 'post_upd_complaint') {
action = 'compl_del';
}
else if (action_val == 'rossr_upd') {
action = 'rossr_del';
id = $this.next().find('.rossr_id').val();
}
$.ajax({
type: 'POST',
url: '/includes/ajax_actions.php',
data: {action: action, id: id},
dataType: 'json',
xhrFields: {withCredentials: true} // Вместо передачи PHPSESSID
})
.done(function(data) {
if (!data.hasOwnProperty('result')) {
alert('Unknown error');
return;
}
if (!data.result) {
alert('Error: ' + data.data);
return;
}
$this.parent().remove();
})
.error(function() {
alert('Ajax error');
});
});