<?php
require_once 'common/functions.php';
require_once 'db/db.php';
if (!loggedIn() || !isset($_POST['id'])) {
//if not logged in or no id set, go away
die(json_encode('Operação não permitida'));
}
$id = (int) $_POST['id'];
$text = $_POST['text'];
$edition_date = time();
$edited = 1;
// if a comment is edited, edited == 1
if (!isCommentFromUser($id, $db)) {
//if the comment isn't from the user who wants to edit it, go away
die(json_encode('Operação não permitida'));
}
$stmt = $db->prepare('UPDATE comment SET text = :text, edition_date = :edition_date, edited = :edited WHERE rowid = :id');
$stmt->bindparam(':id', $id);
$stmt->bindparam(':text', strip_tags($text));
$stmt->bindparam(':edition_date', $edition_date);
$stmt->bindparam(':edited', $edited);
if (!$stmt->execute()) {
$error = $db->errorInfo();
echo json_encode("Erro: " . $error[2]);
} else {
echo json_encode('ok');
}
<?php
require_once 'common/functions.php';
require_once 'db/db.php';
if (!loggedIn() || !isset($_GET['id'])) {
//if not logged in or no id set, go away
die(json_encode('Operação não permitida'));
}
$id = (int) $_GET['id'];
$news_id = (int) $_GET['news_id'];
if (user() && !isCommentFromUser($id, $db) || (editor() || admin()) && !isCommentFromUser($id, $db) && !isNewsFromUser($news_id, $db)) {
//if it's an user and the comment isn't his, or an editor/admin and the comment isn't in his news and it's not his comment, go away
die(json_encode('Operação não permitida'));
}
$stmt = $db->prepare('DELETE FROM comment WHERE rowid= :id');
$stmt->bindparam(':id', $id);
if (!$stmt->execute()) {
$error = $db->errorInfo();
echo json_encode("Erro: " . $error[2]);
} else {
echo json_encode('ok');
}
<?php
require_once 'common/functions.php';
require_once 'db/db.php';
$id = $_GET['id'];
$stmt = $db->prepare('SELECT comment.rowid, text, username, date, edition_date, edited FROM comment, user WHERE user.id=comment.user_id AND news_id = :id ORDER BY comment.rowid DESC');
$stmt->bindparam(':id', $id);
$stmt->execute();
$comments = $stmt->fetchall();
$ret = array();
foreach ($comments as $key => $value) {
$value['date_format'] = displayDate($value['date']);
$value['edition_date_format'] = displayDate($value['edition_date']);
$value['editable'] = isCommentFromUser($value['rowid'], $db);
$value['text'] = nl2br(stripslashes($value['text']));
if (editor() || admin()) {
$value['deletable'] = isNewsFromUser($id, $db) || isCommentFromUser($value['rowid'], $db);
} else {
$value['deletable'] = isCommentFromUser($value['rowid'], $db);
}
array_push($ret, $value);
}
echo json_encode($ret);
