nexus

api/topic_action.php

<?php
require_once __DIR__ . '/../includes/bootstrap.php';
must_admin();
if (!csrf_ok()) go('/');
$id     = (int)post('id');
$action = post('action');
// Validate referer to prevent open redirect
$rawRef  = $_SERVER['HTTP_REFERER'] ?? '';
$baseUrl = (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'];
$ref     = (strpos($rawRef, $baseUrl) === 0) ? $rawRef : u('/');
$map    = [
    'pin'       => 'UPDATE topics SET pinned=1 WHERE id=?',
    'unpin'     => 'UPDATE topics SET pinned=0 WHERE id=?',
    'close'     => 'UPDATE topics SET closed=1 WHERE id=?',
    'open'      => 'UPDATE topics SET closed=0 WHERE id=?',
    'archive'   => 'UPDATE topics SET archived=1 WHERE id=?',
    'unarchive' => 'UPDATE topics SET archived=0 WHERE id=?',
];
if ($id && isset($map[$action])) DB::run($map[$action], [$id]);
header('Location: ' . $ref);
exit;

1 <?php
2 require_once __DIR__ . '/../includes/bootstrap.php';
3 must_admin();
4 if (!csrf_ok()) go('/');
5 $id     = (int)post('id');
6 $action = post('action');
7 // Validate referer to prevent open redirect
8 $rawRef  = $_SERVER['HTTP_REFERER'] ?? '';
9 $baseUrl = (isset($_SERVER['HTTPS']) ? 'https' : 'http') . '://' . $_SERVER['HTTP_HOST'];
10 $ref     = (strpos($rawRef, $baseUrl) === 0) ? $rawRef : u('/');
11 $map    = [
12     'pin'       => 'UPDATE topics SET pinned=1 WHERE id=?',
13     'unpin'     => 'UPDATE topics SET pinned=0 WHERE id=?',
14     'close'     => 'UPDATE topics SET closed=1 WHERE id=?',
15     'open'      => 'UPDATE topics SET closed=0 WHERE id=?',
16     'archive'   => 'UPDATE topics SET archived=1 WHERE id=?',
17     'unarchive' => 'UPDATE topics SET archived=0 WHERE id=?',
18 ];
19 if ($id && isset($map[$action])) DB::run($map[$action], [$id]);
20 header('Location: ' . $ref);
21 exit;