nexus

api/karma.php

<?php
require_once __DIR__ . '/../includes/bootstrap.php';
must_admin();
if (!csrf_ok()) json_out(['error' => 'CSRF'], 403);

$uid    = (int)post('user_id');
$action = post('action'); // set | add | subtract
$amount = (int)post('amount');
$reason = sanitise(post('reason'));

if (!$uid)                              json_out(['error' => 'Invalid user'],    400);
if (!in_array($action, ['set','add','subtract'])) json_out(['error' => 'Invalid action'], 400);
if ($amount < 0)                        json_out(['error' => 'Amount must be >= 0'], 400);
if ($amount > 999999)                   json_out(['error' => 'Amount too large'], 400);

$user = DB::row('SELECT id, username, karma FROM users WHERE id=?', [$uid]);
if (!$user) json_out(['error' => 'User not found'], 404);

$old = (int)$user['karma'];

switch ($action) {
    case 'set':
        $new = $amount;
        DB::run('UPDATE users SET karma=? WHERE id=?', [$new, $uid]);
        break;
    case 'add':
        DB::run('UPDATE users SET karma=karma+? WHERE id=?', [$amount, $uid]);
        $new = $old + $amount;
        break;
    case 'subtract':
        $new = max(0, $old - $amount);
        DB::run('UPDATE users SET karma=? WHERE id=?', [$new, $uid]);
        break;
}

// Add an audit notification to the user
if ($reason) {
    add_notification($uid, 'karma_admin', [
        'from'   => $USER['username'],
        'change' => ($new - $old),
        'new'    => $new,
        'reason' => $reason,
    ]);
}

json_out(['ok' => true, 'old' => $old, 'new' => $new, 'username' => $user['username']]);

1 <?php
2 require_once __DIR__ . '/../includes/bootstrap.php';
3 must_admin();
4 if (!csrf_ok()) json_out(['error' => 'CSRF'], 403);
5 
6 $uid    = (int)post('user_id');
7 $action = post('action'); // set | add | subtract
8 $amount = (int)post('amount');
9 $reason = sanitise(post('reason'));
10 
11 if (!$uid)                              json_out(['error' => 'Invalid user'],    400);
12 if (!in_array($action, ['set','add','subtract'])) json_out(['error' => 'Invalid action'], 400);
13 if ($amount < 0)                        json_out(['error' => 'Amount must be >= 0'], 400);
14 if ($amount > 999999)                   json_out(['error' => 'Amount too large'], 400);
15 
16 $user = DB::row('SELECT id, username, karma FROM users WHERE id=?', [$uid]);
17 if (!$user) json_out(['error' => 'User not found'], 404);
18 
19 $old = (int)$user['karma'];
20 
21 switch ($action) {
22     case 'set':
23         $new = $amount;
24         DB::run('UPDATE users SET karma=? WHERE id=?', [$new, $uid]);
25         break;
26     case 'add':
27         DB::run('UPDATE users SET karma=karma+? WHERE id=?', [$amount, $uid]);
28         $new = $old + $amount;
29         break;
30     case 'subtract':
31         $new = max(0, $old - $amount);
32         DB::run('UPDATE users SET karma=? WHERE id=?', [$new, $uid]);
33         break;
34 }
35 
36 // Add an audit notification to the user
37 if ($reason) {
38     add_notification($uid, 'karma_admin', [
39         'from'   => $USER['username'],
40         'change' => ($new - $old),
41         'new'    => $new,
42         'reason' => $reason,
43     ]);
44 }
45 
46 json_out(['ok' => true, 'old' => $old, 'new' => $new, 'username' => $user['username']]);