1<?php
2require_once __DIR__ . '/../includes/bootstrap.php';
3if (!$USER) json_out(['error'=>'Not logged in'],401);
4if (!csrf_ok()) json_out(['error'=>'CSRF'],403);
5
6$pid = (int)post('post_id');
7$content = sanitise(post('content'));
8$reason = sanitise(post('reason'));
9
10if (!$pid || !$content) json_out(['error'=>'Missing fields'],400);
11if (strlen($content) > 20000) json_out(['error'=>'Post too long'],400);
12
13$post = DB::row('SELECT * FROM posts WHERE id=?',[$pid]);
14if (!$post) json_out(['error'=>'Not found'],404);
15if ($post['user_id']!==$USER['id'] && !is_admin()) json_out(['error'=>'Forbidden'],403);
16
17$now = DB::now();
18DB::run("UPDATE posts SET content=?,edited=1,edit_reason=?,updated_at=$now WHERE id=?",
19 [$content, $reason ?: null, $pid]);
20
21json_out(['ok'=>true,'content'=>$content]);