requireRole(['super_admin', 'admin']); $db = DB(); $action = $_GET['action'] ?? 'list'; $flash = getFlashMessage(); // Handle form submission for Add/Edit/Delete if ($_SERVER['REQUEST_METHOD'] === 'POST') { // CSRF Protection if (!Auth()->verifyCSRFToken($_POST['csrf_token'] ?? '')) { redirectWithMessage('manage-news.php', 'Security session expired. Please try again.', 'danger'); } $action_post = $_POST['action'] ?? ''; // Handle Delete (now via POST) if ($action_post === 'delete' && isset($_POST['id'])) { $db->delete('news_posts', ['id' => $_POST['id']]); redirectWithMessage('manage-news.php', 'Post deleted', 'success'); } $title = cleanInput($_POST['title']); $content = $_POST['content']; // Rich text, don't strictly clean HTML here $post_type = cleanInput($_POST['post_type']); $is_active = isset($_POST['is_active']) ? 1 : 0; // Generate slug $slug = strtolower(trim(preg_replace('/[^A-Za-z0-9-]+/', '-', $title))); $data = [ 'title' => $title, 'slug' => $slug, 'content' => $content, 'post_type' => $post_type, 'is_active' => $is_active ]; // Handle File Upload with Security if (isset($_FILES['attachment']) && $_FILES['attachment']['error'] === 0) { $allowed = ['jpg', 'jpeg', 'png', 'pdf', 'doc', 'docx']; $ext = strtolower(pathinfo($_FILES['attachment']['name'], PATHINFO_EXTENSION)); if (in_array($ext, $allowed)) { $uploadDir = __DIR__ . '/../assets/uploads/news/'; if (!is_dir($uploadDir)) @mkdir($uploadDir, 0755, true); $filename = time() . '_' . bin2hex(random_bytes(8)) . '.' . $ext; if (move_uploaded_file($_FILES['attachment']['tmp_name'], $uploadDir . $filename)) { $data['featured_image'] = $filename; } } } if (isset($_POST['id']) && !empty($_POST['id'])) { $db->update('news_posts', $data, ['id' => $_POST['id']]); redirectWithMessage('manage-news.php', 'Post updated successfully', 'success'); } else { $db->insert('news_posts', $data); redirectWithMessage('manage-news.php', 'Post created successfully', 'success'); } } // Fetch single record for edit $post = null; if ($action === 'edit' && isset($_GET['id'])) { $post = $db->fetchOne("SELECT * FROM news_posts WHERE id = ?", [$_GET['id']]); } // Fetch all records for list $posts = []; if ($action === 'list') { $posts = $db->fetchAll("SELECT * FROM news_posts ORDER BY created_at DESC"); } ?> Manage News & Updates - <?= APP_SHORT_NAME ?>

Manage News & Updates

Add New Post Back to List
Title Type Status Date Actions
No posts found.
Live Hidden
Current file:
>