Create PHP news site with admin dashboard and Shopee ad flow#32
Create PHP news site with admin dashboard and Shopee ad flow#32
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| require_once __DIR__ . '/helpers.php'; | ||
| require_once __DIR__ . '/db.php'; | ||
| require_once __DIR__ . '/csrf.php'; | ||
|
|
||
| session_start(); |
There was a problem hiding this comment.
auth.php requires csrf.php (which calls session_start() on load) and then immediately calls session_start() again. With the global error handler turning notices/warnings into a 500 error page, every admin request that loads auth.php will emit a session-start notice and render the error page before any logic or redirects run. Guard the call with session_status() or remove the duplicate start.
Useful? React with 👍 / 👎.
| cache_set($cacheKey, $post, 45); | ||
| } | ||
| } |
There was a problem hiding this comment.
post.php fetches an article solely by slug and renders it even when its status is still draft. Anyone who guesses or receives the slug (or follows the rewrite /slug) can read unpublished content, and the draft is cached for 45s. The SELECT should constrain to status='public' (or enforce auth) before rendering/caching.
Useful? React with 👍 / 👎.
| $id = (int)($_GET['id'] ?? 0); | ||
| $stmt = $pdo->prepare('DELETE FROM articles WHERE id = :id'); | ||
| $stmt->execute([':id' => $id]); |
There was a problem hiding this comment.
post_delete.php performs the DELETE directly from a GET id without verifying a CSRF token. A malicious page loaded by a logged-in admin can fire a GET to this URL (e.g., via an image tag) and delete posts without server-side verification. This endpoint should require POST and call verify_csrf before executing the deletion.
Useful? React with 👍 / 👎.
1 participant
Summary
Testing
Codex Task