apiban.php — VikAppointments Services Booking Calendar 1.2.17

vikappointments / admin / controllers / apiban.php

vikappointments / admin / controllers Last commit date

apiban.php

77 lines

1	<?php
2	/**
3	* @package VikAppointments
4	* @subpackage core
5	* @author E4J s.r.l.
6	* @copyright Copyright (C) 2021 E4J s.r.l. All Rights Reserved.
7	* @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
8	* @link https://vikwp.com
9	*/
10
11	// No direct access
12	defined('ABSPATH') or die('No script kiddies please!');
13
14	VAPLoader::import('libraries.mvc.controllers.admin');
15
16	/**
17	* VikAppointments API ban controller.
18	*
19	* @since 1.7
20	*/
21	class VikAppointmentsControllerApiban extends VAPControllerAdmin
22	{
23	/**
24	* Deletes a list of records set in the request.
25	*
26	* @return boolean
27	*/
28	public function delete()
29	{
30	$app = JFactory::getApplication();
31	$cid = $app->input->get('cid', array(), 'string');
32
33	/**
34	* Added token validation.
35	* Both GET and POST are supported.
36	*
37	* @since 1.7
38	*/
39	if (!JSession::checkToken() && !JSession::checkToken('get'))
40	{
41	// back to main list, missing CSRF-proof token
42	$app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
43	$this->cancel();
44
45	return false;
46	}
47
48	// check user permissions
49	if (!JFactory::getUser()->authorise('core.delete', 'com_vikappointments') \|\| !VAPFactory::getApi()->isEnabled())
50	{
51	// back to main list, not authorised to delete records
52	$app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
53	$this->cancel();
54
55	return false;
56	}
57
58	// delete selected records
59	$res = $this->getModel()->delete($cid);
60
61	// back to main list
62	$this->cancel();
63
64	return true;
65	}
66
67	/**
68	* Redirects the users to the main records list.
69	*
70	* @return void
71	*/
72	public function cancel()
73	{
74	$this->setRedirect('index.php?option=com_vikappointments&view=apibans');
75	}
76	}
77