Simple-Wishlist/reservations.php

<?php
declare(strict_types=1);

/* ========= Session & Bootstrap ========= */
$secure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off');
session_set_cookie_params([
  'lifetime'=>0,'path'=>'/','secure'=>$secure,'httponly'=>true,'samesite'=>'Lax',
]);
session_name('WLISTSESSID');
session_start();
umask(0022); // neue Dateien: 0644, Ordner: 0755

require_once __DIR__ . '/config/config.php';

/* ===== Debug Toggle (wie item.php) ===== */
if (!empty($app_debug)) {
  ini_set('display_errors','1'); ini_set('display_startup_errors','1'); ini_set('log_errors','1');
  if (!is_dir(__DIR__.'/logs')) { @mkdir(__DIR__.'/logs',0750,true); }
  ini_set('error_log', __DIR__.'/logs/php-error.log'); error_reporting(E_ALL);
} else {
  ini_set('display_errors','0'); ini_set('display_startup_errors','0'); ini_set('log_errors','1');
  if (!is_dir(__DIR__.'/logs')) { @mkdir(__DIR__.'/logs',0750,true); }
  ini_set('error_log', __DIR__.'/logs/php-error.log'); error_reporting(E_ALL);
}

/* ============= Helpers ============= */
function fail(string $msg, int $code=400): void {
  http_response_code($code);
  // kleine Flash-Message für index.php
  $_SESSION['flash'] = ['msg'=>$msg,'type'=> ($code>=400?'danger':'success')];
  safe_redirect_back();
}
function db(): mysqli {
  global $servername, $username, $password, $db;
  $conn = new mysqli($servername, $username, $password, $db);
  if ($conn->connect_error) fail('Interner Fehler (DB)', 500);
  $conn->set_charset('utf8mb4');
  return $conn;
}
function require_csrf(): void {
  $t = (string)($_POST['csrf'] ?? '');
  if (empty($_SESSION['csrf']) || !hash_equals($_SESSION['csrf'], $t)) {
    fail('Ungültiges CSRF-Token', 403);
  }
}
function e(string $s): string { return htmlspecialchars($s, ENT_QUOTES|ENT_SUBSTITUTE, 'UTF-8'); }
function safe_redirect_back(): void {
  $ref = (string)($_SERVER['HTTP_REFERER'] ?? '');
  if ($ref === '' || stripos($ref, 'http') !== 0) {
    $host = $_SERVER['HTTP_HOST'] ?? '';
    $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
    header('Location: '.$scheme.'://'.$host.'/', true, 303);
  } else {
    header('Location: '.$ref, true, 303);
  }
  exit;
}

/* ============= Controller ============= */

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
  fail('Methode nicht erlaubt', 405);
}
require_csrf();

$wishId       = (int)($_POST['wishid'] ?? -1);
$pw           = (string)($_POST['WishPassword'] ?? '');
$reservedstat = (int)($_POST['reservedstat'] ?? 0); // 0 = setzen, 1 = aufheben

if ($wishId <= 0) fail('Ungültige Wunsch-ID', 400);
if ($pw === '')   fail('Passwort erforderlich', 400);

$conn = db();

/* --- qty des Wunsch + bestehende Reservierungen zählen --- */
$qty = 1;
$stmt = $conn->prepare('SELECT qty FROM wishes WHERE ID = ?');
$stmt->bind_param('i', $wishId);
$stmt->execute();
$res = $stmt->get_result();
if (!$res || !($row = $res->fetch_assoc())) {
  $stmt->close(); $conn->close(); fail('Wunsch nicht gefunden', 404);
}
$qty = max(1, (int)$row['qty']);
$stmt->close();

/* Existierende Reservierungen zählen */
$cnt = 0;
$stmt = $conn->prepare('SELECT COUNT(*) AS c FROM wishes_reservations WHERE wish_id = ?');
$stmt->bind_param('i',$wishId);
$stmt->execute();
$res = $stmt->get_result();
if ($res && ($row = $res->fetch_assoc())) $cnt = (int)$row['c'];
$stmt->close();

/* --- Operationen --- */
if ($reservedstat === 0) {
  // setzen
  if ($cnt >= $qty) {
    $conn->close();
    fail('Für diesen Wunsch sind bereits alle Exemplare reserviert.', 409);
  }
  $hash = password_hash($pw, PASSWORD_BCRYPT);
  $ins = $conn->prepare('INSERT INTO wishes_reservations (wish_id, pass_hash, created_at) VALUES (?, ?, NOW())');
  $ins->bind_param('is', $wishId, $hash);
  if (!$ins->execute()) {
    $ins->close(); $conn->close();
    fail('Reservierung fehlgeschlagen', 500);
  }
  $ins->close();
  $conn->close();
  $_SESSION['flash'] = ['msg'=>'Reservierung eingetragen','type'=>'success'];
  safe_redirect_back();

} else {
  // aufheben: passenden Hash suchen und genau einen Eintrag löschen
  $sel = $conn->prepare('SELECT id, pass_hash FROM wishes_reservations WHERE wish_id = ?');
  $sel->bind_param('i',$wishId);
  $sel->execute();
  $res = $sel->get_result();

  $deleted = false;
  while ($row = $res->fetch_assoc()) {
    $rid  = (int)$row['id'];
    $rhash= (string)$row['pass_hash'];
    if (password_verify($pw, $rhash)) {
      $del = $conn->prepare('DELETE FROM wishes_reservations WHERE id = ? LIMIT 1');
      $del->bind_param('i', $rid);
      $deleted = $del->execute();
      $del->close();
      break;
    }
  }
  $sel->close();
  $conn->close();

  if ($deleted) {
    $_SESSION['flash'] = ['msg'=>'Reservierung aufgehoben','type'=>'success'];
  } else {
    $_SESSION['flash'] = ['msg'=>'Kein passender Reservierungseintrag gefunden (Passwort korrekt?)','type'=>'warning'];
  }
  safe_redirect_back();
}