Create PHP news site with admin dashboard and Shopee ad flow#33
Create PHP news site with admin dashboard and Shopee ad flow#33
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| $stmt = $pdo->prepare('SELECT * FROM articles WHERE slug = :slug LIMIT 1'); | ||
| $stmt->execute([':slug' => $slug]); | ||
| $post = $stmt->fetch(); |
There was a problem hiding this comment.
The article page loads whatever row matches the slug without filtering on status, so hitting /{slug} will render drafts or other unpublished records if their slug is known or guessed. That bypasses the admin publish flag and caches the content for 45 seconds, exposing drafts to anonymous visitors. Add a status='public' condition (and avoid caching otherwise) before rendering the page.
Useful? React with 👍 / 👎.
| o.addEventListener('click', function(){ | ||
| openFlow(S.currentSlug); | ||
| }); |
There was a problem hiding this comment.
The ad overlay click handler only opens the article and redirects to the Shopee link, but never calls trackEvent//api/track.php with the ad_click event. As a result the events table stays empty for ad clicks and admin stats/Telegram aggregation (used in admin/dashboard.php, admin/stats.php, and api/stats.php) will always report zero even when users interact with the overlay. Trigger the tracking call (with the slug and CSRF token already emitted on the page) when the overlay is clicked before redirecting.
Useful? React with 👍 / 👎.
| $id = (int)($_GET['id'] ?? 0); | ||
| $stmt = $pdo->prepare('DELETE FROM articles WHERE id = :id'); | ||
| $stmt->execute([':id' => $id]); |
There was a problem hiding this comment.
The delete endpoint deletes posts on a simple GET request with no CSRF verification. Any page can trigger GET /admin/post_delete.php?id=… (e.g., via an image tag) in the admin’s browser, deleting content as soon as they are logged in despite the confirmation on the listing page. Align it with the other admin forms by requiring POST plus csrf_token before executing the delete.
Useful? React with 👍 / 👎.
1 participant
Summary
Testing
Codex Task