diff --git a/website/public/API/deletePost.php b/website/public/API/deletePost.php new file mode 100644 index 0000000..fffadf5 --- /dev/null +++ b/website/public/API/deletePost.php @@ -0,0 +1,20 @@ +execute(); return $stmt->rowCount(); } + +function deletePost(int $postID, int $userID) { + if (checkPermissionOnPost($postID, $userID)) { + $stmt = prepareQuery(" + DELETE FROM + `post` + WHERE + `postID` = :postID + "); + $stmt->bindParam(":postID", $postID); + $stmt->execute(); + } +} + +function checkPermissionOnPost(int $postID, int $userID) : bool { + $getGroupID = prepareQuery(" + SELECT + `author`, + `groupID` + FROM + `post` + WHERE + `postID` = :postID + "); + $getGroupID->bindParam(":postID", $postID); + $getGroupID->execute(); + $postinfo = $getGroupID->fetch(); + + if ($postinfo["groupID"] == null) { + // User post + return ($userID == $postinfo["author"]); + } else { + // Group post + $roleInGroup = getRoleInGroup($userID, $postinfo["groupID"]); + return ($roleInGroup == "mod" or $roleInGroup == "admin"); + } +} + +function getRoleInGroup(int $userID, int $groupID) { + $stmt = prepareQuery(" + SELECT + `role` + FROM + `group_member` + WHERE + `userID` = :userID AND + `groupID` = :groupID + "); + $stmt->bindParam(":userID", $userID); + $stmt->bindParam(":groupID", $groupID); + $stmt->execute(); + return $stmt->fetch()["role"]; +} diff --git a/website/views/post-view.php b/website/views/post-view.php index 11a985a..0844224 100644 --- a/website/views/post-view.php +++ b/website/views/post-view.php @@ -6,7 +6,9 @@ session_start(); ?>

-
verwijder post
+
+ +
gepost door , '>