206 lines
9.1 KiB
PHP
206 lines
9.1 KiB
PHP
|
<?php
|
|||
|
|
/**
|
|||
|
|
* 简航 SimpleNav —— 后台操作处理（全部 POST + CSRF）
|
|||
|
|
*/
|
|||
|
|
declare(strict_types=1);
|
|||
|
|
require_once __DIR__ . '/_auth.php';
|
|||
|
|
require_login();
|
|||
|
|
|
|||
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|||
|
|
header('Location: ' . url('admin/'));
|
|||
|
|
exit;
|
|||
|
|
}
|
|||
|
|
csrf_check();
|
|||
|
|
|
|||
|
|
$pdo = db();
|
|||
|
|
$action = (string)($_POST['action'] ?? '');
|
|||
|
|
$back = 'admin/';
|
|||
|
|
if (!empty($_POST['p'])) {
|
|||
|
|
$back = 'admin/?p=' . preg_replace('/[^a-z]/', '', (string)$_POST['p']);
|
|||
|
|
}
|
|||
|
|
function flash(string $m, string $t = 'ok'): void { $_SESSION['flash'] = ['m' => $m, 't' => $t]; }
|
|||
|
|
function post_id(): int { return (int)($_POST['id'] ?? 0); }
|
|||
|
|
|
|||
|
|
try {
|
|||
|
|
switch ($action) {
|
|||
|
|
|
|||
|
|
/* ---------- 网站 ---------- */
|
|||
|
|
case 'site_save': {
|
|||
|
|
$id = post_id();
|
|||
|
|
$gid = (int)($_POST['group_id'] ?? 0);
|
|||
|
|
$url = norm_url((string)($_POST['url'] ?? ''));
|
|||
|
|
$name = trim((string)($_POST['name'] ?? ''));
|
|||
|
|
$short = trim((string)($_POST['short_name'] ?? ''));
|
|||
|
|
$icon = trim((string)($_POST['icon'] ?? ''));
|
|||
|
|
$visible = isset($_POST['is_visible']) ? 1 : 0;
|
|||
|
|
if ($url === '' || $gid <= 0) {
|
|||
|
|
flash('网址和板块不能为空', 'err');
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
$now = date('Y-m-d H:i:s');
|
|||
|
|
if ($id > 0) {
|
|||
|
|
$st = $pdo->prepare('UPDATE sites SET group_id=?, url=?, name=?, short_name=?, icon=?, is_visible=?, updated_at=? WHERE id=?');
|
|||
|
|
$st->execute([$gid, $url, $name, $short, $icon, $visible, $now, $id]);
|
|||
|
|
flash('已保存网站');
|
|||
|
|
} else {
|
|||
|
|
$max = (int)$pdo->query('SELECT COALESCE(MAX(sort_order),0)+1 FROM sites WHERE group_id=' . $gid)->fetchColumn();
|
|||
|
|
$st = $pdo->prepare('INSERT INTO sites (group_id,url,name,short_name,icon,sort_order,is_visible,created_at,updated_at) VALUES (?,?,?,?,?,?,?,?,?)');
|
|||
|
|
$st->execute([$gid, $url, $name, $short, $icon, $max, $visible, $now, $now]);
|
|||
|
|
flash('已添加网站');
|
|||
|
|
}
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
case 'site_delete': {
|
|||
|
|
$pdo->prepare('DELETE FROM sites WHERE id=?')->execute([post_id()]);
|
|||
|
|
flash('已删除网站');
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
case 'site_toggle': {
|
|||
|
|
$pdo->prepare('UPDATE sites SET is_visible = 1 - is_visible WHERE id=?')->execute([post_id()]);
|
|||
|
|
flash('已切换显示状态');
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
case 'site_move': {
|
|||
|
|
move_sort('sites', post_id(), (string)($_POST['dir'] ?? 'up'), 'group_id');
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/* ---------- 板块 ---------- */
|
|||
|
|
case 'group_save': {
|
|||
|
|
$id = post_id();
|
|||
|
|
$name = trim((string)($_POST['name'] ?? ''));
|
|||
|
|
$display = ($_POST['display'] ?? 'grid') === 'tabs' ? 'tabs' : 'grid';
|
|||
|
|
$visible = isset($_POST['is_visible']) ? 1 : 0;
|
|||
|
|
if ($name === '') { flash('板块名称不能为空', 'err'); break; }
|
|||
|
|
if ($id > 0) {
|
|||
|
|
$pdo->prepare('UPDATE groups SET name=?, display=?, is_visible=? WHERE id=?')
|
|||
|
|
->execute([$name, $display, $visible, $id]);
|
|||
|
|
flash('已保存板块');
|
|||
|
|
} else {
|
|||
|
|
$max = (int)$pdo->query('SELECT COALESCE(MAX(sort_order),0)+1 FROM groups')->fetchColumn();
|
|||
|
|
$pdo->prepare('INSERT INTO groups (name,slug,display,sort_order,is_visible) VALUES (?,?,?,?,?)')
|
|||
|
|
->execute([$name, slugify($name), $display, $max, $visible]);
|
|||
|
|
flash('已添加板块');
|
|||
|
|
}
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
case 'group_delete': {
|
|||
|
|
$pdo->prepare('DELETE FROM groups WHERE id=?')->execute([post_id()]);
|
|||
|
|
flash('已删除板块（含其下网站）');
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
case 'group_toggle': {
|
|||
|
|
$pdo->prepare('UPDATE groups SET is_visible = 1 - is_visible WHERE id=?')->execute([post_id()]);
|
|||
|
|
flash('已切换显示状态');
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
case 'group_move': {
|
|||
|
|
move_sort('groups', post_id(), (string)($_POST['dir'] ?? 'up'), null);
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/* ---------- 搜索引擎 ---------- */
|
|||
|
|
case 'engine_save': {
|
|||
|
|
$id = post_id();
|
|||
|
|
$name = trim((string)($_POST['name'] ?? ''));
|
|||
|
|
$slug = preg_replace('/[^a-z0-9\-_]/i', '', (string)($_POST['slug'] ?? ''));
|
|||
|
|
$search = trim((string)($_POST['search_url'] ?? ''));
|
|||
|
|
$param = trim((string)($_POST['param'] ?? 'q'));
|
|||
|
|
$sugUrl = trim((string)($_POST['suggest_url'] ?? ''));
|
|||
|
|
$sugType = preg_replace('/[^a-z0-9_]/i', '', (string)($_POST['suggest_type'] ?? ''));
|
|||
|
|
$color = preg_match('/^#[0-9a-fA-F]{3,8}$/', (string)($_POST['color'] ?? '')) ? $_POST['color'] : '#2F6BF7';
|
|||
|
|
$active = isset($_POST['is_active']) ? 1 : 0;
|
|||
|
|
if ($name === '' || $slug === '' || $search === '') { flash('名称/标识/搜索地址不能为空', 'err'); break; }
|
|||
|
|
if ($id > 0) {
|
|||
|
|
$pdo->prepare('UPDATE engines SET name=?,slug=?,search_url=?,param=?,suggest_url=?,suggest_type=?,color=?,is_active=? WHERE id=?')
|
|||
|
|
->execute([$name, $slug, $search, $param, $sugUrl, $sugType, $color, $active, $id]);
|
|||
|
|
flash('已保存搜索引擎');
|
|||
|
|
} else {
|
|||
|
|
$max = (int)$pdo->query('SELECT COALESCE(MAX(sort_order),0)+1 FROM engines')->fetchColumn();
|
|||
|
|
$pdo->prepare('INSERT INTO engines (name,slug,search_url,param,suggest_url,suggest_type,color,is_active,sort_order) VALUES (?,?,?,?,?,?,?,?,?)')
|
|||
|
|
->execute([$name, $slug, $search, $param, $sugUrl, $sugType, $color, $active, $max]);
|
|||
|
|
flash('已添加搜索引擎');
|
|||
|
|
}
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
case 'engine_delete': {
|
|||
|
|
$pdo->prepare('DELETE FROM engines WHERE id=?')->execute([post_id()]);
|
|||
|
|
flash('已删除搜索引擎');
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
case 'engine_toggle': {
|
|||
|
|
$pdo->prepare('UPDATE engines SET is_active = 1 - is_active WHERE id=?')->execute([post_id()]);
|
|||
|
|
flash('已切换启用状态');
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
case 'engine_move': {
|
|||
|
|
move_sort('engines', post_id(), (string)($_POST['dir'] ?? 'up'), null);
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
/* ---------- 设置 ---------- */
|
|||
|
|
case 'settings_save': {
|
|||
|
|
$map = [
|
|||
|
|
'site_name' => trim((string)($_POST['site_name'] ?? '')),
|
|||
|
|
'subtitle' => trim((string)($_POST['subtitle'] ?? '')),
|
|||
|
|
'default_engine' => preg_replace('/[^a-z0-9\-_]/i', '', (string)($_POST['default_engine'] ?? '')),
|
|||
|
|
'primary_color' => preg_match('/^#[0-9a-fA-F]{3,8}$/', (string)($_POST['primary_color'] ?? '')) ? $_POST['primary_color'] : '#2F6BF7',
|
|||
|
|
'open_blank' => isset($_POST['open_blank']) ? '1' : '0',
|
|||
|
|
];
|
|||
|
|
$st = $pdo->prepare('INSERT INTO settings (k,v) VALUES (?,?) ON CONFLICT(k) DO UPDATE SET v=excluded.v');
|
|||
|
|
foreach ($map as $k => $v) { $st->execute([$k, $v]); }
|
|||
|
|
flash('设置已保存');
|
|||
|
|
$back = 'admin/?p=settings';
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
case 'password_save': {
|
|||
|
|
$old = (string)($_POST['old_password'] ?? '');
|
|||
|
|
$new = (string)($_POST['new_password'] ?? '');
|
|||
|
|
$u = current_user();
|
|||
|
|
$st = $pdo->prepare('SELECT password_hash FROM users WHERE id=?');
|
|||
|
|
$st->execute([$u['id']]);
|
|||
|
|
$hash = (string)$st->fetchColumn();
|
|||
|
|
if (!password_verify($old, $hash)) { flash('原密码不正确', 'err'); $back = 'admin/?p=settings'; break; }
|
|||
|
|
if (mb_strlen($new) < 4) { flash('新密码至少 4 位', 'err'); $back = 'admin/?p=settings'; break; }
|
|||
|
|
$pdo->prepare('UPDATE users SET password_hash=? WHERE id=?')->execute([password_hash($new, PASSWORD_DEFAULT), $u['id']]);
|
|||
|
|
flash('密码已更新');
|
|||
|
|
$back = 'admin/?p=settings';
|
|||
|
|
break;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
default:
|
|||
|
|
flash('未知操作', 'err');
|
|||
|
|
}
|
|||
|
|
} catch (Throwable $e) {
|
|||
|
|
flash('操作失败：' . $e->getMessage(), 'err');
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
header('Location: ' . url($back));
|
|||
|
|
exit;
|
|||
|
|
|
|||
|
|
/** 上/下移动排序（同组内交换 sort_order） */
|
|||
|
|
function move_sort(string $table, int $id, string $dir, ?string $groupCol): void
|
|||
|
|
{
|
|||
|
|
if ($id <= 0) return;
|
|||
|
|
$pdo = db();
|
|||
|
|
$st = $pdo->prepare("SELECT * FROM {$table} WHERE id=?");
|
|||
|
|
$st->execute([$id]);
|
|||
|
|
$cur = $st->fetch();
|
|||
|
|
if (!$cur) return;
|
|||
|
|
|
|||
|
|
$where = $groupCol ? " AND {$groupCol}=" . (int)$cur[$groupCol] : '';
|
|||
|
|
if ($dir === 'up') {
|
|||
|
|
$sql = "SELECT * FROM {$table} WHERE sort_order < ?{$where} ORDER BY sort_order DESC LIMIT 1";
|
|||
|
|
} else {
|
|||
|
|
$sql = "SELECT * FROM {$table} WHERE sort_order > ?{$where} ORDER BY sort_order ASC LIMIT 1";
|
|||
|
|
}
|
|||
|
|
$st2 = $pdo->prepare($sql);
|
|||
|
|
$st2->execute([$cur['sort_order']]);
|
|||
|
|
$nb = $st2->fetch();
|
|||
|
|
if (!$nb) return;
|
|||
|
|
|
|||
|
|
$upd = $pdo->prepare("UPDATE {$table} SET sort_order=? WHERE id=?");
|
|||
|
|
$upd->execute([$nb['sort_order'], $cur['id']]);
|
|||
|
|
$upd->execute([$cur['sort_order'], $nb['id']]);
|
|||
|
|
}
|