1#@!#!123s

��JFIF�� 1#@!#!123s
: / proc / thread-self / root / home / earnlouq / kobilz.co.uk / management /
Filename : post-details.php
back
<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);
ini_set('session.cookie_httponly', 1);
// ini_set('session.cookie_secure', 1); // Enable for HTTPS

session_start();
session_regenerate_id(true);

include('../../config/xconfig.php');
include('include/checklogin.php');

// Check login
check_login();

$title = "Blog Post Details";

// Generate CSRF token
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
$csrf_token = $_SESSION['csrf_token'];

$msg = '';
$msg_type = '';

// Validate blog post ID
$bid = filter_input(INPUT_GET, 'bid', FILTER_VALIDATE_INT);
if ($bid === false || $bid <= 0) {
    header('Location: blog.php');
    exit();
}

// Fetch blog post details
$stmt = $con->prepare("
    SELECT id, title, slug, content, image_url, author, created_at, updated_at
    FROM blog
    WHERE id = ?
");
$stmt->bind_param('i', $bid);
if (!$stmt->execute()) {
    die('Fetch blog post failed: ' . $stmt->error);
}
$result = $stmt->get_result();
if ($result->num_rows === 0) {
    $msg = 'Blog post not found.';
    $msg_type = 'error';
    $post = null;
} else {
    $post = $result->fetch_assoc();
}
$stmt->close();

// Handle update form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'update') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $csrf_token) {
        $msg = 'Invalid CSRF token.';
        $msg_type = 'error';
    } else {
        // Collect inputs
        $title = filter_input(INPUT_POST, 'title', FILTER_SANITIZE_SPECIAL_CHARS);
        $slug = filter_input(INPUT_POST, 'slug', FILTER_SANITIZE_SPECIAL_CHARS);
        $content = $_POST['content']; // CKEditor HTML, no sanitization (admin-only)
        $author = filter_input(INPUT_POST, 'author', FILTER_SANITIZE_SPECIAL_CHARS);
        $updated_at = date('Y-m-d H:i:s');
        $image_url = filter_input(INPUT_POST, 'image_url', FILTER_SANITIZE_SPECIAL_CHARS);
        $remove_image = isset($_POST['remove_image']) && $_POST['remove_image'] === '1';

        // Image upload handling
        $upload_dir = '../admin/blog/';
        $new_image_url = $image_url; // Default to existing image_url
        if ($remove_image) {
            // Clear image
            if ($image_url && file_exists($upload_dir . basename($image_url))) {
                unlink($upload_dir . basename($image_url));
            }
            $new_image_url = '';
        } elseif (!empty($_FILES['image_file']['name'])) {
            // Process new image
            $file = $_FILES['image_file'];
            $allowed_extensions = ['jpg', 'jpeg', 'png', 'gif'];
            $max_size = 5 * 1024 * 1024; // 5MB
            $ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
            $mime_types = ['image/jpeg', 'image/png', 'image/gif'];

            if ($file['error'] !== UPLOAD_ERR_OK) {
                $msg = 'Image upload error: ' . $file['error'];
                $msg_type = 'error';
            } elseif (!in_array($ext, $allowed_extensions)) {
                $msg = 'Invalid image format. Allowed: jpg, jpeg, png, gif.';
                $msg_type = 'error';
            } elseif ($file['size'] > $max_size) {
                $msg = 'Image size exceeds 5MB.';
                $msg_type = 'error';
            } elseif (!in_array(mime_content_type($file['tmp_name']), $mime_types)) {
                $msg = 'Invalid image type.';
                $msg_type = 'error';
            } else {
                // Generate unique filename
                $filename = 'blog_' . time() . '_' . bin2hex(random_bytes(4)) . '.' . $ext;
                $dest_path = $upload_dir . $filename;

                // Delete old image if exists
                if ($image_url && file_exists($upload_dir . basename($image_url))) {
                    unlink($upload_dir . basename($image_url));
                }

                // Move uploaded file
                if (move_uploaded_file($file['tmp_name'], $dest_path)) {
                    $new_image_url = 'admin/blog/' . $filename;
                } else {
                    $msg = 'Failed to upload image.';
                    $msg_type = 'error';
                }
            }
        }

        // Validation
        $slug_pattern = '/^[a-z0-9-]+$/';
        if (empty($title)) {
            $msg = 'Title is required.';
            $msg_type = 'error';
        } elseif (empty($slug)) {
            $msg = 'Slug is required.';
            $msg_type = 'error';
        } elseif (!preg_match($slug_pattern, $slug)) {
            $msg = 'Slug must contain only lowercase letters, numbers, and hyphens.';
            $msg_type = 'error';
        } elseif (empty(trim(strip_tags($content)))) {
            $msg = 'Content is required.';
            $msg_type = 'error';
        } elseif (empty($author)) {
            $msg = 'Author is required.';
            $msg_type = 'error';
        } elseif ($msg_type !== 'error') {
            // Check if slug is unique (excluding current post)
            $stmt = $con->prepare("SELECT id FROM blog WHERE slug = ? AND id != ?");
            $stmt->bind_param('si', $slug, $bid);
            $stmt->execute();
            $result = $stmt->get_result();
            if ($result->num_rows > 0) {
                $msg = "A blog post with the slug '$slug' already exists.";
                $msg_type = 'error';
            } else {
                // Update blog post
                $stmt = $con->prepare("
                    UPDATE blog SET title = ?, slug = ?, content = ?, image_url = ?, 
                                   author = ?, updated_at = ?
                    WHERE id = ?
                ");
                $stmt->bind_param('ssssssi', $title, $slug, $content, $new_image_url, 
                                  $author, $updated_at, $bid);
                if ($stmt->execute()) {
                    $msg = 'Blog post updated successfully.';
                    $msg_type = 'success';
                    // Refresh post data
                    $stmt = $con->prepare("
                        SELECT id, title, slug, content, image_url, author, created_at, updated_at
                        FROM blog
                        WHERE id = ?
                    ");
                    $stmt->bind_param('i', $bid);
                    $stmt->execute();
                    $result = $stmt->get_result();
                    $post = $result->fetch_assoc();
                } else {
                    $msg = 'Failed to update blog post: ' . $stmt->error;
                    $msg_type = 'error';
                }
            }
            $stmt->close();
        }
    }
}

// Handle delete action
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'delete') {
    if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $csrf_token) {
        $msg = 'Invalid CSRF token.';
        $msg_type = 'error';
    } else {
        // Delete image file if exists
        if ($post['image_url'] && file_exists('../admin/blog/' . basename($post['image_url']))) {
            unlink('../admin/blog/' . basename($post['image_url']));
        }
        $stmt = $con->prepare("DELETE FROM blog WHERE id = ?");
        $stmt->bind_param('i', $bid);
        if ($stmt->execute()) {
            header('Location: blog.php');
            exit();
        } else {
            $msg = 'Failed to delete blog post: ' . $stmt->error;
            $msg_type = 'error';
        }
        $stmt->close();
    }
}

include('include/header.php');
include('include/sidebar.php');
?>

<div class="content-wrapper">
    <div class="container-xxl flex-grow-1 container-p-y">
        <h4 class="fw-bold py-3 mb-4"><span class="text-muted fw-light">Blog /</span> Edit Blog Post</h4>

        <?php if ($post) { ?>
            <div class="card mb-4">
                <h5 class="card-header">Blog Post Details</h5>
                <div class="card-body">
                    <?php if ($msg) { ?>
                        <div class="alert alert-<?php echo $msg_type === 'success' ? 'success' : 'danger'; ?>">
                            <h6 class="alert-heading fw-bold mb-1"><?php echo ucfirst($msg_type); ?></h6>
                            <p class="mb-0"><?php echo htmlspecialchars($msg); ?></p>
                        </div>
                    <?php } ?>
                    <form method="post" enctype="multipart/form-data">
                        <input type="hidden" name="action" value="update">
                        <input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($csrf_token); ?>">
                        <input type="hidden" name="image_url" value="<?php echo htmlspecialchars($post['image_url'] ?: ''); ?>">
                        <div class="row">
                            <div class="mb-3 col-md-6">
                                <label class="form-label" for="title">Title</label>
                                <input type="text" class="form-control" id="title" name="title" 
                                       value="<?php echo htmlspecialchars($post['title']); ?>" required />
                            </div>
                            <div class="mb-3 col-md-6">
                                <label class="form-label" for="slug">Slug</label>
                                <input type="text" class="form-control" id="slug" name="slug" 
                                       value="<?php echo htmlspecialchars($post['slug']); ?>" required />
                            </div>
                            <div class="mb-3 col-12">
                                <label class="form-label" for="content">Content</label>
                                <textarea class="form-control" id="content" name="content" 
                                          rows="10" required><?php echo htmlspecialchars($post['content']); ?></textarea>
                            </div>
                            <div class="mb-3 col-md-6">
                                <label class="form-label" for="image_file">Blog Image</label>
                                <input type="file" class="form-control" id="image_file" name="image_file" 
                                       accept=".jpg,.jpeg,.png,.gif" />
                                <?php if ($post['image_url']) { ?>
                                    <div class="mt-2">
                                        <img src="../<?php echo htmlspecialchars($post['image_url']); ?>" 
                                             alt="Blog Image" style="max-width:100px; height:auto;">
                                        <div class="form-check mt-2">
                                            <input class="form-check-input" type="checkbox" name="remove_image" 
                                                   value="1" id="remove_image">
                                            <label class="form-check-label" for="remove_image">
                                                Remove current image
                                            </label>
                                        </div>
                                    </div>
                                <?php } ?>
                            </div>
                            <div class="mb-3 col-md-6">
                                <label class="form-label" for="author">Author</label>
                                <input type="text" class="form-control" id="author" name="author" 
                                       value="<?php echo htmlspecialchars($post['author']); ?>" required />
                            </div>
                            <div class="mb-3 col-md-6">
                                <label class="form-label" for="created_at">Created At</label>
                                <input type="text" class="form-control" id="created_at" 
                                       value="<?php echo htmlspecialchars(date('d-m-Y', strtotime($post['created_at']))); ?>" 
                                       disabled />
                            </div>
                            <div class="mb-3 col-md-6">
                                <label class="form-label" for="updated_at">Updated At</label>
                                <input type="text" class="form-control" id="updated_at" 
                                       value="<?php echo $post['updated_at'] ? htmlspecialchars(date('d-m-Y', strtotime($post['updated_at']))) : 'N/A'; ?>" 
                                       disabled />
                            </div>
                        </div>
                        <div class="mt-2">
                            <button type="submit" class="btn btn-primary me-2">Save changes</button>
                        </div>
                    </form>
                </div>
            </div>
            <div class="card">
                <h5 class="card-header">Delete Blog Post</h5>
                <div class="card-body">
                    <div class="mb-3 col-12 mb-0">
                        <div class="alert alert-warning">
                            <h6 class="alert-heading fw-bold mb-1">Are you sure you want to delete this blog post?</h6>
                            <p class="mb-0">Once you delete this blog post, there is no going back. Please be certain.</p>
                        </div>
                    </div>
                    <form action="" method="POST" onsubmit="return confirm('Are you sure you want to delete this blog post?');">
                        <input type="hidden" name="action" value="delete">
                        <input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($csrf_token); ?>">
                        <button type="submit" class="btn btn-danger">Delete Blog Post</button>
                    </form>
                </div>
            </div>
        <?php } else { ?>
            <div class="alert alert-danger">
                <h6 class="alert-heading fw-bold mb-1">Error</h6>
                <p class="mb-0"><?php echo htmlspecialchars($msg); ?></p>
            </div>
        <?php } ?>
    </div>
</div>


<!-- Include CKEditor 4 -->
<script src="https://cdn.ckeditor.com/4.21.0/standard/ckeditor.js"></script>

<!-- Initialize CKEditor -->
<script>
    CKEDITOR.replace('content', {
        height: 300,
        removePlugins: 'elementspath',
        resize_enabled: true,
        toolbar: [
            { name: 'document', items: ['Source', '-', 'Preview'] },
            { name: 'basicstyles', items: ['Bold', 'Italic', 'Underline', 'Strike'] },
            { name: 'paragraph', items: ['NumberedList', 'BulletedList', '-', 'Outdent', 'Indent', '-', 'Blockquote'] },
            { name: 'links', items: ['Link', 'Unlink'] },
            { name: 'insert', items: ['Image', 'Table', 'HorizontalRule'] },
            { name: 'styles', items: ['Format', 'Font', 'FontSize'] },
            { name: 'colors', items: ['TextColor', 'BGColor'] }
        ]
    });
</script>
<?php include('include/footer.php'); ?>