tim
be814a3ba5
Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
130 lines
3.4 KiB
PHP
130 lines
3.4 KiB
PHP
<?php
|
|
require_once('../config.lib.php');
|
|
require_https();
|
|
require_once("../session.lib.php");
|
|
if (!isset($_SESSION['editor'])) {
|
|
$is_admin = FALSE;
|
|
session_write_close();
|
|
header("Location: /publish/login");
|
|
return;
|
|
}
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1" />
|
|
<title>x.x.x [edit]</title>
|
|
<link rel="icon" href="favicon.png" />
|
|
<link rel="shortcut icon" href="favicon.png" />
|
|
<link rel="stylesheet" type="text/css" href="../style.css" />
|
|
<link rel='stylesheet' type='text/css' href='../publish/style.css' />
|
|
<script type="text/javascript" src="../utilities.js"></script>
|
|
<link rel="alternate" type="application/rss+xml" title="xxx.org.za RSS feed" href="/feed" />
|
|
<?php include_once('./editor.inc.php'); ?>
|
|
</head>
|
|
<?php
|
|
flush();
|
|
require_once("../get_data.lib.php");
|
|
open_db('open');
|
|
require_once("../navigation.lib.php");
|
|
require_once('./post.lib.php');
|
|
$editable = TRUE;
|
|
$id = get_id();
|
|
?>
|
|
<body>
|
|
<div id='container'>
|
|
<?php include_once("../sidebar.inc.php"); ?>
|
|
<div id='main'>
|
|
<div id='maintext'>
|
|
|
|
<H1>edit</H1>
|
|
|
|
<?php
|
|
|
|
/* Authenticated admin user allowed to: check the queue
|
|
edit article on the queue
|
|
optionally preview
|
|
post article to database
|
|
--------------------------
|
|
choose existing article
|
|
edit existing article
|
|
optionally preview
|
|
update article in database
|
|
--------------------------
|
|
write new article
|
|
preview (required)
|
|
post article to database
|
|
--------------------------
|
|
Ordinary web users can: write article
|
|
preview (required)
|
|
submit to the queue
|
|
|
|
*/
|
|
|
|
$action = NULL;
|
|
if (isset($_POST['action'])) {
|
|
$action = strtolower($_POST['action']);
|
|
// We can trigger only choose and edit via GET variables.
|
|
} else if (isset($_GET['action'])) {
|
|
if ($_GET['action'] == 'choose') {
|
|
$action = 'choose';
|
|
} else if ($_GET['action'] == 'edit') {
|
|
$action = 'edit';
|
|
}
|
|
}
|
|
if (!isset($action) && $id) {
|
|
$action = 'edit';
|
|
}
|
|
// A POST without a valid CSRF token only gets a preview
|
|
if (isset($_POST['action']) && !csrf_valid()) {
|
|
$validate['csrf'] = 'Your session has expired. Please check the story, then send it again.';
|
|
$action = 'preview';
|
|
}
|
|
|
|
switch ($action) {
|
|
case 'submit': // to queue
|
|
case 'save': // resave to queue
|
|
case 'post': // to database
|
|
if (validate_data() && count($validate) === 0) {
|
|
$id = save_data($id);
|
|
echo display_stories();
|
|
} else {
|
|
$action = 'preview';
|
|
include('./preview.inc.php');
|
|
}
|
|
break;
|
|
case 'edit': // edit the chosen story
|
|
// admin only.
|
|
include('./modify.inc.php');
|
|
break;
|
|
case 'preview': // preview before posting
|
|
validate_data();
|
|
include('./preview.inc.php');
|
|
break;
|
|
case 'delete': // edit the chosen story
|
|
// admin only.
|
|
echo delete_story($id);
|
|
break;
|
|
case 'choose': // choose a story to edit
|
|
default:
|
|
// admin only: either from queue
|
|
// or from database
|
|
include('./choose.inc.php'); // need queue select!
|
|
break;
|
|
|
|
}
|
|
|
|
?>
|
|
|
|
</div> <!-- maintext -->
|
|
</div> <!-- main -->
|
|
</div> <!-- container -->
|
|
<?php include_once("../bottombar.inc.php"); ?>
|
|
|
|
<?php open_db('close'); ?>
|
|
<!-- Finis -->
|
|
|
|
</body>
|
|
</html>
|