From cef27cf6d67a96c482292c143a47d79f12fa2865 Mon Sep 17 00:00:00 2001 From: Atlaskor Date: Tue, 25 Nov 2025 23:03:48 +0000 Subject: [PATCH] Add admin_posts.php --- admin_posts.php | 579 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 579 insertions(+) create mode 100644 admin_posts.php diff --git a/admin_posts.php b/admin_posts.php new file mode 100644 index 0000000..c19f8a4 --- /dev/null +++ b/admin_posts.php @@ -0,0 +1,579 @@ + PDO::ERRMODE_EXCEPTION, + PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC, + ]); + } catch (PDOException $e) { + $dbError = $e->getMessage(); + } +} + +// --- Handle CRUD actions --- +if ($loggedIn && $pdo && $_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action'])) { + if (!hash_equals($csrfToken, $_POST['csrf_token'] ?? '')) { + $message = 'Invalid CSRF token.'; + } else { + $action = $_POST['action']; + + if ($action === 'create') { + $title = trim($_POST['title'] ?? ''); + $meta = trim($_POST['meta'] ?? ''); + $body = trim($_POST['body'] ?? ''); + $is_published = isset($_POST['is_published']) ? 1 : 0; + + if ($title && $body) { + $stmt = $pdo->prepare(" + INSERT INTO posts (title, meta, body, is_published) + VALUES (:title, :meta, :body, :is_published) + "); + $stmt->execute([ + ':title' => $title, + ':meta' => $meta ?: null, + ':body' => $body, + ':is_published' => $is_published, + ]); + $message = 'Post created.'; + } else { + $message = 'Title and body are required.'; + } + } + + if ($action === 'update') { + $id = (int)($_POST['id'] ?? 0); + $title = trim($_POST['title'] ?? ''); + $meta = trim($_POST['meta'] ?? ''); + $body = trim($_POST['body'] ?? ''); + $is_published = isset($_POST['is_published']) ? 1 : 0; + + if ($id > 0 && $title && $body) { + $stmt = $pdo->prepare(" + UPDATE posts + SET title = :title, + meta = :meta, + body = :body, + is_published = :is_published + WHERE id = :id + LIMIT 1 + "); + $stmt->execute([ + ':id' => $id, + ':title' => $title, + ':meta' => $meta ?: null, + ':body' => $body, + ':is_published' => $is_published, + ]); + $message = "Post #{$id} updated."; + } else { + $message = 'Title and body are required.'; + } + } + } +} + +// Handle delete via GET (with CSRF) +if ($loggedIn && $pdo && isset($_GET['delete'], $_GET['token'])) { + if (hash_equals($csrfToken, $_GET['token'])) { + $id = (int)$_GET['delete']; + if ($id > 0) { + $stmt = $pdo->prepare("DELETE FROM posts WHERE id = :id LIMIT 1"); + $stmt->execute([':id' => $id]); + $message = "Post #{$id} deleted."; + } + } else { + $message = 'Invalid CSRF token for delete.'; + } +} + +// Fetch posts + maybe a single post to edit +$posts = []; +$editPost = null; + +if ($loggedIn && $pdo) { + // List + $stmt = $pdo->query(" + SELECT id, title, meta, is_published, created_at + FROM posts + ORDER BY created_at DESC, id DESC + "); + $posts = $stmt->fetchAll(); + + // Edit + if (isset($_GET['edit'])) { + $id = (int)$_GET['edit']; + if ($id > 0) { + $stmt = $pdo->prepare(" + SELECT id, title, meta, body, is_published + FROM posts + WHERE id = :id + LIMIT 1 + "); + $stmt->execute([':id' => $id]); + $editPost = $stmt->fetch(); + } + } +} +?> + + + + + +Mediakor — Admin Posts + + + + + +
+

Mediakor Admin

+
Command Feed • Login
+ +
+ +
+ + +
+ +
+
+

+ Tip: edit $adminPassword in admin_posts.php or set MK_ADMIN_PASSWORD in your Docker env. +

+
+ +
+
+
+
+

Mediakor Admin

+
+ Manage posts that power the Command Feed on your homepage. +
+
+
+
Logged in as Operator
+ ← View Site · + Logout +
+
+ + +
+ + + +
+ DB Error: +
+ + + +
+ +
+

+
+ + + + + + + + + + + + + + + +
+ /> + +
+ +
+ + + Cancel edit + +
+
+
+ + +
+

Existing Posts

+ +

+ No posts found yet. Create one using the form on the left. +

+ + + + + + + + + + + + + + + + + + + + + + + + +
IDTitleMetaStateCreatedActions
+ + Published + + Hidden + + + Edit + + Delete + +
+ +
+
+ +
+
+ + + +