vwemirror/PQS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rewrite api.php: parameterized, no DEBUG output

Browse Source 
- Strip DEBUG echoes. The 'call is set' line was prefixing the updateinfo JSON
  response, breaking JSON.parse on the display walls so the info-panel
  auto-refresh silently never fired.
- Parameterize updatemerc (was SQL-injectable via $_GET[playerid]).
- Use includes/db.php helpers; set JSON content-type on updateinfo.

Verified: updateinfo returns clean "0"/"1"; updatemerc add/remove flips the
flag; empty response on merc toggle.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Cyd
2026-07-01 13:50:51 -05:00
co-authored by Claude Opus 4.8
parent c82978776d
commit 905c46c4c4
1 changed files with 24 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/api.php
+24 -35
View File
@@ -1,38 +1,27 @@
<?php
$dbconnect = mysqli_connect('localhost', 'pqs', 'pqs') or die('Could not connect: ' . mysqli_error($dbconnect));
mysqli_select_db($dbconnect, 'pqs') or die('Could not select database');
/**
* Small AJAX endpoint for the consoles and display walls.
* ?call=updatemerc&wdo=add|remove&playerid=N — toggle a player's merc flag
* ?call=updateinfo — has the info panel changed?
*/
require_once __DIR__ . '/db.php';
if (isset($_GET['call'])) {
$wcall = $_GET['call'];
echo "DEBUG: call is set<br>wcall = $wcall<br>";
switch ($wcall) {
case "updatemerc":
echo "DEBUG: updatemerc is called<br>";
$wdo = "";
if (isset($_GET['wdo'])) $wdo = $_GET['wdo'];
switch ($wdo) {
case "add":
echo "DEBUG: updatemerc add is called<br>";
$sql = "UPDATE pqs_queue SET merc = 1 WHERE id = $_GET[playerid]";
echo "sql:<br>$sql<br>";
mysqli_query($dbconnect, $sql) or die('Update Merc status failed: ' . mysqli_error($dbconnect));
break;
case "remove":
echo "DEBUG: updatemerc remove is called<br>";
$sql = "UPDATE pqs_queue SET merc = 0 WHERE id = $_GET[playerid]";
echo "sql:<br>$sql<br>";
mysqli_query($dbconnect, $sql) or die('Update Merc status failed: ' . mysqli_error($dbconnect));
break;
}
break;
case "updateinfo":
$sql = "SELECT Updated FROM pqs_infopanel";
$getid = mysqli_query($dbconnect, $sql) or die('Query failed: ' . mysqli_error($dbconnect));
$rs1 = mysqli_fetch_array($getid);
$updateinfo = $rs1[0];
mysqli_query($dbconnect, $sql) or die('Query failed: ' . mysqli_error($dbconnect));
echo json_encode($updateinfo);
break;
}
switch ($_GET['call']) {
case 'updatemerc':
$wdo = $_GET['wdo'] ?? '';
$playerid = (int) ($_GET['playerid'] ?? 0);
if ($wdo === 'add') {
pqs_exec("UPDATE pqs_queue SET merc = 1 WHERE id = ?", 'i', [$playerid]);
} elseif ($wdo === 'remove') {
pqs_exec("UPDATE pqs_queue SET merc = 0 WHERE id = ?", 'i', [$playerid]);
}
break;
case 'updateinfo':
$updated = pqs_val("SELECT Updated FROM pqs_infopanel");
header('Content-Type: application/json');
echo json_encode((string) $updated);
break;
}
}
mysqli_close($dbconnect);
?>