WhyKorp's server
98 lines
2.9 KiB
PHP
98 lines
2.9 KiB
PHP
<?php
|
|
require_once __DIR__ . '/config.php';
|
|
if (session_status() === PHP_SESSION_NONE) { session_start(); }
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
|
|
http_response_code(405);
|
|
exit('Méthode non autorisée');
|
|
}
|
|
|
|
// CSRF
|
|
if (empty($_POST['csrf_token']) || $_POST['csrf_token'] !== ($_SESSION['csrf_token'] ?? '')) {
|
|
http_response_code(400);
|
|
exit('Token CSRF invalide.');
|
|
}
|
|
|
|
// Vérif login
|
|
if (empty($_SESSION['user_id'])) {
|
|
http_response_code(403);
|
|
exit('Tu dois être connecté pour acheter.');
|
|
}
|
|
|
|
$user_id = (int)$_SESSION['user_id'];
|
|
$item_id = isset($_POST['item_id']) ? (int)$_POST['item_id'] : 0;
|
|
|
|
$pdo = pdo_connect();
|
|
|
|
try {
|
|
$pdo->beginTransaction();
|
|
|
|
// Vérifie si le user possède déjà un item
|
|
$stmt = $pdo->prepare("SELECT ui.id, i.name
|
|
FROM user_items ui
|
|
JOIN items i ON ui.item_id = i.id
|
|
WHERE ui.user_id = :uid
|
|
LIMIT 1 FOR UPDATE");
|
|
$stmt->execute([':uid' => $user_id]);
|
|
$existing = $stmt->fetch();
|
|
|
|
if ($existing) {
|
|
$pdo->rollBack();
|
|
exit("Tu possèdes déjà un item actif : " . htmlspecialchars($existing['name']));
|
|
}
|
|
|
|
// Récupère item
|
|
$stmt = $pdo->prepare("SELECT id, name, price FROM items WHERE id = :id FOR UPDATE");
|
|
$stmt->execute([':id' => $item_id]);
|
|
$item = $stmt->fetch();
|
|
if (!$item) {
|
|
$pdo->rollBack();
|
|
exit('Item introuvable.');
|
|
}
|
|
|
|
$total = (int)$item['price'];
|
|
|
|
// Vérifie aura
|
|
$stmt = $pdo->prepare("SELECT aura FROM users WHERE id = :uid FOR UPDATE");
|
|
$stmt->execute([':uid' => $user_id]);
|
|
$u = $stmt->fetch();
|
|
if (!$u) {
|
|
$pdo->rollBack();
|
|
exit('Utilisateur introuvable.');
|
|
}
|
|
$aura = (int)$u['aura'];
|
|
|
|
if ($aura < $total) {
|
|
$pdo->rollBack();
|
|
exit('Tu n\'as pas assez d\'aura pour cet achat.');
|
|
}
|
|
|
|
// Débite l'aura
|
|
$stmt = $pdo->prepare("UPDATE users SET aura = aura - :amt WHERE id = :uid");
|
|
$stmt->execute([':amt' => $total, ':uid' => $user_id]);
|
|
|
|
// Ajoute item à user_items
|
|
$stmt = $pdo->prepare("INSERT INTO user_items (user_id, item_id) VALUES (:uid, :iid)");
|
|
$stmt->execute([':uid' => $user_id, ':iid' => $item_id]);
|
|
|
|
// Log (version simplifiée, sans actor_discord_id ni type)
|
|
$stmt = $pdo->prepare("INSERT INTO logs (user_id, amount, reason)
|
|
VALUES (:uid, :amount, :reason)");
|
|
$stmt->execute([
|
|
':uid' => $user_id,
|
|
':amount' => -$total,
|
|
':reason' => 'Achat: ' . $item['name']
|
|
]);
|
|
|
|
$pdo->commit();
|
|
|
|
header('Location: shop.php?buy=ok');
|
|
exit;
|
|
|
|
} catch (Exception $e) {
|
|
if ($pdo->inTransaction()) $pdo->rollBack();
|
|
echo "Erreur détaillée : " . $e->getMessage();
|
|
var_dump($item_id, $user_id, $total, $aura);
|
|
exit;
|
|
}
|