Create PHP news site with admin dashboard and Shopee ad flow - #37
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| $id = (int)($_GET['id'] ?? 0); | ||
| $stmt = $pdo->prepare('DELETE FROM articles WHERE id = :id'); | ||
| $stmt->execute([':id' => $id]); |
There was a problem hiding this comment.
The admin delete action deletes a post purely from a GET id without verifying a CSRF token. An attacker could trick a logged-in admin into loading /admin/post_delete.php?id=... (e.g., via an image tag), silently deleting content without consent. Add CSRF validation (as used elsewhere) before executing the delete to prevent cross-site request forgery.
Useful? React with 👍 / 👎.
| document.addEventListener('DOMContentLoaded',function(){ | ||
| var o=document.createElement('div'); | ||
| o.id='adOverlay'; | ||
| o.style.cssText='position:fixed;inset:0;z-index:99999;background:rgba(0,0,0,.75);display:flex;align-items:center;justify-content:center;padding:14px;'; | ||
| var b=document.createElement('div'); |
There was a problem hiding this comment.
The overlay is only created inside a DOMContentLoaded listener. On the homepage the ad script is added dynamically from a click handler after the page has already fired DOMContentLoaded, so this handler never runs and the overlay/redirect flow does not trigger—clicking a post just prevents navigation. The overlay should be initialized immediately when the script loads (or the load timing changed) so clicks actually show the ad flow.
Useful? React with 👍 / 👎.
| if(!truthy(S.adsEnabled)||!S.adLink||S.bypass===true) return; | ||
| function openFlow(slug){ | ||
| try{window.open('/'+slug+'?ad=0','_blank','noopener');}catch(e){} | ||
| window.location.href=S.adLink; | ||
| } |
There was a problem hiding this comment.
The ad flow navigates to the article and Shopee link but never calls the tracking endpoint or trackEvent for an ad_click. As a result events rows, dashboard counts, and Telegram notifications for ad clicks will stay at zero even when users interact with the overlay. Trigger the tracking call before redirecting so clicks are recorded.
Useful? React with 👍 / 👎.
1 participant
Summary
Testing
Codex Task