Upload via GUI (258 Dateien)

2026-10-16 19:12:13 +00:00
parent 893bef356c
commit 491b87f468
50 changed files with 4601 additions and 0 deletions
@@ -0,0 +1,100 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/common.php';
+
+api_require_method('GET', 'POST');
+$staff = api_require_staff();
+api_require_admin($staff);
+$pdo = get_db();
+
+if ($_SERVER['REQUEST_METHOD'] === 'GET') {
+    $entries = $pdo->query(
+        'SELECT b.*, s.name AS added_by_name FROM banlist b LEFT JOIN staff s ON s.id = b.created_by ORDER BY b.created_at DESC'
+    )->fetchAll();
+
+    api_json([
+        'items' => array_map(fn(array $b) => [
+            'id' => (int) $b['id'],
+            'matchType' => $b['match_type'],
+            'value' => $b['value'],
+            'reason' => $b['reason'],
+            'addedByName' => $b['added_by_name'],
+            'createdAt' => $b['created_at'],
+        ], $entries),
+    ]);
+}
+
+$body = api_request_body();
+$action = $body['action'] ?? '';
+
+/** Schließt alle offenen Tickets, die zur gerade gesperrten E-Mail/Domain passen. */
+function api_close_banned_tickets(PDO $pdo, string $matchType, string $value): void
+{
+    $col = $matchType === 'email' ? 'requester_email' : sql_email_domain('requester_email');
+    $pdo->prepare("UPDATE tickets SET status='closed',closed_at=?,updated_at=? WHERE $col=? AND status NOT IN ('closed')")
+        ->execute([db_now(), db_now(), $value]);
+}
+
+if ($action === 'create') {
+    $matchType = ($body['matchType'] ?? 'email') === 'domain' ? 'domain' : 'email';
+    $value = trim(strtolower((string) ($body['value'] ?? '')));
+    $reason = trim((string) ($body['reason'] ?? ''));
+
+    if ($value === '') {
+        api_error(422, 'VALUE_REQUIRED', 'Bitte einen Wert angeben.');
+    }
+    if ($matchType === 'email' && !filter_var($value, FILTER_VALIDATE_EMAIL)) {
+        api_error(422, 'INVALID_EMAIL', 'Ungültige E-Mail-Adresse.');
+    }
+    if ($matchType === 'domain' && (!str_contains($value, '.') || str_contains($value, '@'))) {
+        api_error(422, 'INVALID_DOMAIN', 'Nur Domain angeben, z.B. spam.de (ohne @).');
+    }
+
+    $chk = $pdo->prepare('SELECT id FROM banlist WHERE value=?');
+    $chk->execute([$value]);
+    if (!$chk->fetchColumn()) {
+        $pdo->prepare('INSERT INTO banlist (match_type,value,reason,created_by,created_at) VALUES (?,?,?,?,?)')
+            ->execute([$matchType, $value, $reason ?: null, $staff['id'], db_now()]);
+        api_close_banned_tickets($pdo, $matchType, $value);
+        audit_log($staff['id'], "Sperrliste: {$value} hinzugefügt ({$matchType}, Mobile App)");
+    }
+    api_json(['ok' => true]);
+}
+
+if ($action === 'bulk_add') {
+    $raw = trim((string) ($body['values'] ?? ''));
+    $reason = trim((string) ($body['reason'] ?? ''));
+    $lines = array_filter(array_map('trim', preg_split('/[\r\n,;]+/', $raw)));
+    $added = 0;
+    $skipped = 0;
+    foreach ($lines as $val) {
+        $val = strtolower($val);
+        $type = str_contains($val, '@') ? 'email' : 'domain';
+        if ($type === 'email' && !filter_var($val, FILTER_VALIDATE_EMAIL)) { $skipped++; continue; }
+        if ($type === 'domain' && !str_contains($val, '.')) { $skipped++; continue; }
+        $chk = $pdo->prepare('SELECT id FROM banlist WHERE value=?');
+        $chk->execute([$val]);
+        if ($chk->fetchColumn()) { $skipped++; continue; }
+        $pdo->prepare('INSERT INTO banlist (match_type,value,reason,created_by,created_at) VALUES (?,?,?,?,?)')
+            ->execute([$type, $val, $reason ?: null, $staff['id'], db_now()]);
+        api_close_banned_tickets($pdo, $type, $val);
+        $added++;
+    }
+    audit_log($staff['id'], "Sperrliste Massen-Import: {$added} hinzugefügt, {$skipped} übersprungen (Mobile App)");
+    api_json(['added' => $added, 'skipped' => $skipped]);
+}
+
+if ($action === 'delete') {
+    $id = (int) ($body['id'] ?? 0);
+    $val = $pdo->prepare('SELECT value FROM banlist WHERE id=?');
+    $val->execute([$id]);
+    $v = $val->fetchColumn();
+    if ($v === false) {
+        api_error(404, 'ENTRY_NOT_FOUND', 'Der Eintrag wurde nicht gefunden.');
+    }
+    $pdo->prepare('DELETE FROM banlist WHERE id=?')->execute([$id]);
+    audit_log($staff['id'], "Sperrliste: {$v} entfernt (Mobile App)");
+    api_json(['ok' => true]);
+}
+
+api_error(422, 'INVALID_ACTION', 'Unbekannte Aktion.');