File manager - Edit - /home/webapp69.cm.in.th/u69319090044/shop/api_expire.php
Back
<?php // api_expire.php - AJAX handler to expire orders when countdown timer ends require_once 'includes/helper.php'; require_once 'classes/Database.php'; start_secure_session(); // Verify user is logged in if (!isset($_SESSION['user_id'])) { http_response_code(403); echo json_encode(['success' => false, 'message' => 'Forbidden']); exit(); } if ($_SERVER['REQUEST_METHOD'] === 'POST') { $orderId = (int)($_POST['order_id'] ?? 0); $token = $_POST['csrf_token'] ?? ''; if (!validate_csrf_token($token)) { http_response_code(400); echo json_encode(['success' => false, 'message' => 'Invalid CSRF token']); exit(); } if ($orderId <= 0) { http_response_code(400); echo json_encode(['success' => false, 'message' => 'Invalid Order ID']); exit(); } try { $db = Database::getInstance()->getConnection(); $db->beginTransaction(); // Check order status before doing anything $stmt = $db->prepare("SELECT status, user_id FROM orders WHERE id = ? FOR UPDATE"); $stmt->execute([$orderId]); $order = $stmt->fetch(); if ($order && $order['user_id'] == $_SESSION['user_id'] && $order['status'] === 'pending') { // 1. Set state to expired $stmt = $db->prepare("UPDATE orders SET status = 'expired' WHERE id = ?"); $stmt->execute([$orderId]); // 2. Return product inventory stock level $stmt = $db->prepare("SELECT product_id, quantity FROM order_items WHERE order_id = ?"); $stmt->execute([$orderId]); $items = $stmt->fetchAll(); foreach ($items as $item) { $stmt = $db->prepare("UPDATE products SET stock = stock + ? WHERE id = ?"); $stmt->execute([$item['quantity'], $item['product_id']]); } $db->commit(); echo json_encode(['success' => true, 'message' => 'Order successfully marked as expired']); exit(); } $db->rollBack(); echo json_encode(['success' => false, 'message' => 'Order already processed or access denied']); } catch (Exception $e) { $db->rollBack(); http_response_code(500); echo json_encode(['success' => false, 'message' => $e->getMessage()]); } } else { http_response_code(405); echo json_encode(['success' => false, 'message' => 'Method not allowed']); }
| ver. 1.4 |
Github
|
.
| PHP 7.4.33 | Generation time: 0.37 |
proxy
|
phpinfo
|
Settings