Create PHP news site with admin dashboard and Shopee ad flow#31
Create PHP news site with admin dashboard and Shopee ad flow#31
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| $id = (int)($_GET['id'] ?? 0); | ||
| $stmt = $pdo->prepare('DELETE FROM articles WHERE id = :id'); | ||
| $stmt->execute([':id' => $id]); |
There was a problem hiding this comment.
The delete endpoint removes articles directly on a GET request without validating a CSRF token. Any site that an authenticated admin visits can trigger /admin/post_delete.php?id=... via an image or link and silently delete content. Side-effecting actions should require a POST with verify_csrf (like the other admin forms) to prevent cross-site deletions.
Useful? React with 👍 / 👎.
| require_once __DIR__ . '/helpers.php'; | ||
| require_once __DIR__ . '/db.php'; | ||
| require_once __DIR__ . '/csrf.php'; | ||
|
|
||
| session_start(); |
There was a problem hiding this comment.
Both auth.php and csrf.php call session_start() unconditionally; admin pages include both, so the second call raises a notice every request. With error_handler.php converting notices into 500 responses (and rendering the error page), the admin screens and login will return HTTP 500 with error output before rendering. Guard session initialization (e.g., check session_status() === PHP_SESSION_NONE) so the session is started only once.
Useful? React with 👍 / 👎.
1 participant
Summary
Testing
Codex Task