nexus

api/topic_action.php


1<?php
2require_once __DIR__ . '/../includes/bootstrap.php';
3must_admin();
4if (!csrf_ok()) go('/');
5$id     = (int)post('id');
6$action = post('action');
7// Validate referer to prevent open redirect
8$rawRef  = $_SERVER['HTTP_REFERER'] ?? '';
9$baseUrl = (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'];
10$ref     = (strpos($rawRef, $baseUrl) === 0) ? $rawRef : u('/');
11$map    = [
12    'pin'       => 'UPDATE topics SET pinned=1 WHERE id=?',
13    'unpin'     => 'UPDATE topics SET pinned=0 WHERE id=?',
14    'close'     => 'UPDATE topics SET closed=1 WHERE id=?',
15    'open'      => 'UPDATE topics SET closed=0 WHERE id=?',
16    'archive'   => 'UPDATE topics SET archived=1 WHERE id=?',
17    'unarchive' => 'UPDATE topics SET archived=0 WHERE id=?',
18];
19if ($id && isset($map[$action])) DB::run($map[$action], [$id]);
20header('Location: ' . $ref);
21exit;