📂 File Browser

📁 Directories

📄 Files

📄 Source: manage-admins.php

<?php
require_once 'includes/config.php';
require_once 'includes/db.php';
require_once 'includes/auth.php';
require_once 'includes/functions.php';

requireLogin();

$forumId = $_GET['forum_id'] ?? $_POST['forum_id'] ?? '';
$action = $_GET['action'] ?? $_POST['action'] ?? '';
$user = getCurrentUser();

if (!$forumId) {
    header('Location: index.php?error=No forum specified');
    exit();
}

// Check if user is the owner
if (!isForumOwner($forumId, $user['id'])) {
    header('Location: index.php?error=Only the forum owner can manage admins');
    exit();
}

if ($action === 'add_admin' && $_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = sanitize($_POST['username'] ?? '');
    
    if (empty($username)) {
        header('Location: dashboard.php?forum_id=' . $forumId . '&error=Please enter a username');
        exit();
    }
    
    // Validate username format
    if (!preg_match('/^[a-zA-Z0-9_\-]+$/', $username)) {
        header('Location: dashboard.php?forum_id=' . $forumId . '&error=Invalid username format');
        exit();
    }
    
    $adminUser = getUserByUsername($username);
    
    if (!$adminUser) {
        header('Location: dashboard.php?forum_id=' . $forumId . '&error=User "' . htmlspecialchars($username) . '" not found');
        exit();
    }
    
    // Check if user is already an admin
    $forum = getForum($forumId);
    if (in_array($adminUser['id'], $forum['admins'] ?? [])) {
        header('Location: dashboard.php?forum_id=' . $forumId . '&error=' . urlencode($username . ' is already an admin'));
        exit();
    }
    
    // Don't allow adding self as admin (already is)
    if ($adminUser['id'] === $user['id']) {
        header('Location: dashboard.php?forum_id=' . $forumId . '&error=You are already the owner');
        exit();
    }
    
    if (addForumAdmin($forumId, $adminUser['id'])) {
        header('Location: dashboard.php?forum_id=' . $forumId . '&success=Admin added successfully');
    } else {
        header('Location: dashboard.php?forum_id=' . $forumId . '&error=Failed to add admin');
    }
    exit();
}

if ($action === 'remove' && isset($_GET['user_id'])) {
    $userId = $_GET['user_id'];
    
    if (removeForumAdmin($forumId, $userId)) {
        header('Location: dashboard.php?forum_id=' . $forumId . '&success=Admin removed successfully');
    } else {
        header('Location: dashboard.php?forum_id=' . $forumId . '&error=Failed to remove admin');
    }
    exit();
}

header('Location: index.php');
exit();
?>