70 lines
No EOL
2.4 KiB
PHP
70 lines
No EOL
2.4 KiB
PHP
<?php
|
|
/**
|
|
* Module F: Media Elimination Engine
|
|
* Target Path: htdocs/api/v1/media/delete.php
|
|
*/
|
|
|
|
// Inherit global variables and database connection instance
|
|
require_once __DIR__ . '/../../../config.php';
|
|
|
|
// Instagram legacy clients send a POST payload request to execute deletions
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
http_response_code(405);
|
|
die(json_encode(["status" => "fail", "message" => "Method not allowed. Use POST pipeline."]));
|
|
}
|
|
|
|
// 1. Session Identity Handshake Verification
|
|
$sessionCookie = $_COOKIE['sessionid'] ?? '';
|
|
if (empty($sessionCookie) || strpos($sessionCookie, 'nostolga_sess_') !== 0) {
|
|
http_response_code(401);
|
|
die(json_encode(["status" => "fail", "message" => "Unauthorized client session context."]));
|
|
}
|
|
|
|
// Decode active user primary key ID
|
|
$userId = (int)str_replace('nostolga_sess_', '', $sessionCookie);
|
|
|
|
// 2. Capture the Media ID Passed implicitly from our .htaccess Routing Engine
|
|
$mediaId = (int)($_GET['media_id'] ?? 0);
|
|
|
|
if ($mediaId <= 0) {
|
|
http_response_code(400);
|
|
die(json_encode(["status" => "fail", "message" => "Invalid target media identifier signature."]));
|
|
}
|
|
|
|
$db = getDB();
|
|
|
|
try {
|
|
// 3. Ownership Verification Check
|
|
// Locate the post to ensure it exists and belongs explicitly to the logged-in user
|
|
$stmt = $db->prepare("SELECT user_id FROM posts WHERE id = ?");
|
|
$stmt->execute([$mediaId]);
|
|
$post = $stmt->fetch();
|
|
|
|
if (!$post) {
|
|
http_response_code(404);
|
|
die(json_encode(["status" => "fail", "message" => "Target media asset registry record not found."]));
|
|
}
|
|
|
|
// Security Gate: Block malicious deletions from mismatched user accounts
|
|
if ((int)$post['user_id'] !== $userId) {
|
|
http_response_code(403);
|
|
die(json_encode(["status" => "fail", "message" => "Access denied. Action signature authorization failure."]));
|
|
}
|
|
|
|
// 4. Execute the SQL Data Purge
|
|
// InnoDB cascades or handles deletion cleanly across our constraints
|
|
$deleteStmt = $db->prepare("DELETE FROM posts WHERE id = ?");
|
|
$deleteStmt->execute([$mediaId]);
|
|
|
|
// 5. Dispatch success payload confirmation back to the app UI matrix
|
|
http_response_code(200);
|
|
echo json_encode([
|
|
"did_delete" => true,
|
|
"status" => "ok"
|
|
]);
|
|
exit;
|
|
|
|
} catch (PDOException $e) {
|
|
http_response_code(500);
|
|
die(json_encode(["status" => "fail", "message" => "Database ledger serialization drop encountered during record purge."]));
|
|
} |