Merge branch 'CommentV1API' into master

www/API/v1/comment.php

@@ -1 +1,311 @@
- 
+<?php
+	// Gasteizko Margolariak API v1 //
+	
+	//Posible comment target
+	define('TARGET_PHOTO', 'photo');
+	define('TARGET_POST', 'post');
+	define('TARGET_ACTIVITY', 'activity');
+	
+	//Default target
+	define('DEF_TARGET', TARGET_ALL);
+		
+	//$_GET valid parameters
+	define('GET_CLIENT', 'client');
+	define('GET_USER', 'user');
+	define('GET_TARGET', 'target');
+	define('GET_ID', 'id');
+	define('GET_PERMALINK', 'permalink');
+	define('GET_TEXT', 'text');
+	define('GET_USERNAME', 'username');
+	
+	/****************************************************
+	* This function is called from almost everywhere at *
+	* the beggining of the page. It initializes the     *
+	* session variables, connect to the db, enabling    *
+	* the variable $con for futher use everywhere in    *
+	* the php code, and populates the arrays $user      *
+	* and $permission, with info about the user.        *
+	*                                                   *
+	* @return: (db connection): The connection handler. *
+	****************************************************/
+	function startdb(){
+		//Include the db configuration file. It's somehow like this
+		/*
+		<?php
+			$host = 'XXXX';
+			$db_name = 'XXXX';
+			$username_ro = 'XXXX';
+			$username_rw = 'XXXX';
+			$pass_ro = 'XXXX';
+			$pass_rw = 'XXXX';
+		?>
+		*/
+		include('../../.htpasswd');
+		
+		//Connect to to database
+		$con = mysqli_connect($host, $username_rw, $pass_rw, $db_name);
+		
+		//Set encoding options
+		mysqli_set_charset($con, 'utf-8');
+		header('Content-Type: text/html; charset=utf8');
+		mysqli_query($con, 'SET NAMES utf8;');
+		
+		//Return the db connection
+		return $con;
+	}
+	
+	//Connect to the database
+	$con = startdb('rw');
+	
+	//Get data from URL
+	$client = mysqli_real_escape_string($con, $_GET[GET_CLIENT]);
+	$user = mysqli_real_escape_string($con, $_GET[GET_USER]);
+	$target = strtolower(mysqli_real_escape_string($con, $_GET[GET_TARGET]));
+	$id = strtolower(mysqli_real_escape_string($con, $_GET[GET_ID]));
+	$permalink = strtolower(mysqli_real_escape_string($con, $_GET[GET_PERMALINK]));
+	$ink = strtolower(mysqli_real_escape_string($con, $_GET[GET_PERMALINK]));
+	$permalink = strtolower(mysqli_real_escape_string($con, $_GET[GET_PERMALINK]));
+	$username = mysqli_real_escape_string($con, $_GET[GET_USERNAME]);
+	$text = mysqli_real_escape_string($con, $_GET[GET_TEXT]);
+	
+	//Validate data
+	if (strlen($client) < 1){
+		//Bad request
+		http_response_code(400);
+		exit();
+	}
+	if (strlen($user) < 1){
+		$user = '';
+	}
+	if (strlen($target) < 1){
+		//Bad request
+		http_response_code(400);
+		exit();
+	}
+	if ($target != TARGET_PHOTO && $target != TARGET_POST && $target != TARGET_ACTIVITY){
+		//Bad request
+		http_response_code(400);
+		exit();
+	}
+	if (strlen($username) < 1){
+		//Bad request
+		http_response_code(400);
+		exit();
+	}
+	
+	
+	//Check id and/or permalink. Several cases:
+	
+	//1st case: id and permalink empty: Error.
+	if (strlen($id) < 1 && strlen($permalink) < 1){
+		//Bad request
+		http_response_code(400);
+		exit();
+	}
+	
+	//2nd case: Comment for post, permalink and no id.
+	elseif ($target == TARGET_POST && strlen($id) < 1 && strlen($permalink) >= 1){
+	
+		//Check if post exists...
+		$q = mysqli_query($con, "SELECT id, comments FROM post WHERE visible = 1 AND permalink = '$permalink';");
+		if (mysqli_num_rows($q) == 0){
+			//Bad request
+			http_response_code(400);
+			exit();
+		}
+		else{
+		
+			//... and if it does, check if can be commented.
+			$r = mysqli_fetch_array($q);
+			$item_id = $r['id'];
+			if ($r['comments'] != 1){
+				//'Forbidden' status code
+				http_response_code(403);
+				exit();
+			}
+		}
+	}
+	
+	//3rd case: Comment for post, id and no permalink.
+	elseif ($target == TARGET_POST && strlen($id) >= 1 && strlen($permalink) < 1){
+	
+		//Check if post exists...
+		$q = mysqli_query($con, "SELECT id, comments FROM post WHERE visible = 1 AND id = $id;");
+		if (mysqli_num_rows($q) == 0){
+			//Bad request
+			http_response_code(400);
+			exit();
+		}
+		else{
+		
+			//... and if it does, check if can be commented.
+			$r = mysqli_fetch_array($q);
+			$item_id = $r['id'];
+			if ($r['comments'] != 1){
+				//'Forbidden' status code
+				http_response_code(403);
+				exit();
+			}
+		}
+	}
+	
+	//4th case: Comment for post, permalink and id.
+	elseif ($target == TARGET_POST && strlen($id) >= 1 && strlen($permalink) >= 1){
+	
+		//Check if post exists...
+		$q = mysqli_query($con, "SELECT id, comments FROM post WHERE visible = 1 AND permalink = '$permalink' AND id = $id ;");
+		if (mysqli_num_rows($q) == 0){
+			//Bad request
+			http_response_code(400);
+			exit();
+		}
+		else{
+		
+			//... and if it does, check if can be commented.
+			$r = mysqli_fetch_array($q);
+			$item_id = $r['id'];
+			if ($r['comments'] != 1){
+				//'Forbidden' status code
+				http_response_code(403);
+				exit();
+			}
+		}
+	}
+	
+	//5th case: Comment for photo, permalink and no id.
+	elseif ($target == TARGET_PHOTO && strlen($id) < 1 && strlen($permalink) >= 1){
+	
+		//Check if photo exists.
+		$q = mysqli_query($con, "SELECT id FROM photo WHERE approved = 1 AND permalink = '$permalink';");
+		if (mysqli_num_rows($q) == 0){
+			//Bad request
+			http_response_code(400);
+			exit();
+		}
+		else{
+			$item_id = $r['id'];
+		}
+	}
+	
+	//6th case: Comment for photo, id and no permalink.
+	elseif ($target == TARGET_PHOTO && strlen($id) >= 1 && strlen($permalink) < 1){
+	
+		//Check if photo exists.
+		$q = mysqli_query($con, "SELECT id FROM photo WHERE approved = 1 AND id = $id;");
+		if (mysqli_num_rows($q) == 0){
+			//Bad request
+			http_response_code(400);
+			exit();
+		}
+		else{
+			$item_id = $r['id'];
+		}
+	}
+	
+	//7th case: Comment for photo, permalink and id.
+	elseif ($target == TARGET_PHOTO && strlen($id) >= 1 && strlen($permalink) >= 1){
+	
+		//Check if photo exists.
+		$q = mysqli_query($con, "SELECT id FROM photo WHERE approved = 1 AND permalink = '$permalink' AND id = $id;");
+		if (mysqli_num_rows($q) == 0){
+			//Bad request
+			http_response_code(400);
+			exit();
+		}
+		else{
+			$item_id = $r['id'];
+		}
+	}
+	
+	//8nd case: Comment for activity, permalink and no id.
+	elseif ($target == TARGET_ACTIVITY && strlen($id) < 1 && strlen($permalink) >= 1){
+	
+		//Check if activity exists...
+		$q = mysqli_query($con, "SELECT id, comments FROM activity WHERE visible = 1 AND permalink = '$permalink';");
+		if (mysqli_num_rows($q) == 0){
+			//Bad request
+			http_response_code(400);
+			exit();
+		}
+		else{
+		
+			//... and if it does, check if can be commented.
+			$r = mysqli_fetch_array($q);
+			$item_id = $r['id'];
+			if ($r['comments'] != 1){
+				//'Forbidden' status code
+				http_response_code(403);
+				exit();
+			}
+		}
+	}
+	
+	//9rd case: Comment for activity, id and no permalink.
+	elseif ($target == TARGET_ACTIVITY && strlen($id) >= 1 && strlen($permalink) < 1){
+	
+		//Check if activity exists...
+		$q = mysqli_query($con, "SELECT id, comments FROM activity WHERE visible = 1 AND id = $id;");
+		if (mysqli_num_rows($q) == 0){
+			//Bad request
+			http_response_code(400);
+			exit();
+		}
+		else{
+		
+			//... and if it does, check if can be commented.
+			$r = mysqli_fetch_array($q);
+			$item_id = $r['id'];
+			if ($r['comments'] != 1){
+				//'Forbidden' status code
+				http_response_code(403);
+				exit();
+			}
+		}
+	}
+	
+	//10th case: Comment for activity, permalink and id.
+	elseif ($target == TARGET_ACTIVITY && strlen($id) >= 1 && strlen($permalink) >= 1){
+	
+		//Check if activity exists...
+		$q = mysqli_query($con, "SELECT id, comments FROM activity WHERE visible = 1 AND permalink = '$permalink' AND id = $id ;");
+		if (mysqli_num_rows($q) == 0){
+			//Bad request
+			http_response_code(400);
+			exit();
+		}
+		else{
+		
+			//... and if it does, check if can be commented.
+			$r = mysqli_fetch_array($q);
+			$item_id = $r['id'];
+			if ($r['comments'] != 1){
+				//'Forbidden' status code
+				http_response_code(403);
+				exit();
+			}
+		}
+	}
+	
+	//If code gets here, there were no errors. Build query.
+	$query = "INSERT INTO ";
+	$section = "";
+	switch ($target){
+		case TARGET_POST:
+			$query = $query . "post_comment (post";
+			$section = "blog";
+			break;
+		case TARGET_PHOTO:
+			$query = $query . "photo_comment (photo";
+			$section = "gallery";
+			break;
+		case TARGET_ACTIVITY:
+			$query = $query . "activity_comment (activity";
+			$section = "activity";
+			break;
+	}
+	$query = $query . ", text, username, app) VALUES ($item_id, \"$text\", \"$username\", \"client\");";
+	//echo($query);
+	mysqli_query($con, $query);
+	mysqli_query($con, "UPDATE version SET version = version + 1 WHERE section = '$section';");
+
+?>