🐚 WEB SHELL ACTIVATED

📁 File Browser

Current directory: /home/klas4s23/domains/585455.klas4s23.mid-ica.nl/public_html/Gastenboek/uploads

📄 Viewing: ./../../chathub/../l7-pro-2-e-learning-2023-Epolleke/php/update_list.php

<?php
session_start();
header('Content-Type: application/json');
require_once 'config.php';

// Check if user is logged in
if (!isset($_SESSION['user_id'])) {
    http_response_code(401);
    echo json_encode(['success' => false, 'error' => 'Unauthorized']);
    exit();
}

$input = json_decode(file_get_contents('php://input'), true);

if (!isset($input['list_id'])) {
    http_response_code(400);
    echo json_encode(['success' => false, 'error' => 'List ID is required']);
    exit();
}

$list_id = (int)$input['list_id'];
$user_id = $_SESSION['user_id'];

try {
    $pdo = getDbConnection();
    // Check if user owns this list
    $stmt = $pdo->prepare("SELECT user_id FROM word_lists WHERE list_id = :list_id");
    $stmt->execute([':list_id' => $list_id]);
    $list = $stmt->fetch(PDO::FETCH_ASSOC);
    
    if (!$list) {
        http_response_code(404);
        echo json_encode(['success' => false, 'error' => 'List not found']);
        exit();
    }
    
    if ($list['user_id'] != $user_id) {
        http_response_code(403);
        echo json_encode(['success' => false, 'error' => 'You do not have permission to modify this list']);
        exit();
    }
    
    // Build update query dynamically
    $updates = [];
    $params = [':list_id' => $list_id];
    
    if (isset($input['list_name'])) {
        $updates[] = "list_name = :list_name";
        $params[':list_name'] = trim($input['list_name']);
    }
    
    if (isset($input['description'])) {
        $updates[] = "description = :description";
        $params[':description'] = trim($input['description']);
    }
    
    if (isset($input['is_public'])) {
        $updates[] = "is_public = :is_public";
        $params[':is_public'] = $input['is_public'] ? 1 : 0;
    }
    
    if (empty($updates)) {
        http_response_code(400);
        echo json_encode(['success' => false, 'error' => 'No fields to update']);
        exit();
    }
    
    $sql = "UPDATE word_lists SET " . implode(", ", $updates) . " WHERE list_id = :list_id";
    $stmt = $pdo->prepare($sql);
    $stmt->execute($params);
    
    echo json_encode([
        'success' => true,
        'message' => 'Word list updated successfully'
    ]);
    
} catch(PDOException $e) {
    http_response_code(500);
    echo json_encode(['success' => false, 'error' => 'Database error: ' . $e->getMessage()]);
}
?>

🎯 Available Actions