admin/pages.php

这里只显示每个文件的开头 60 行。登录后可以解锁完整代码。

微信扫码关注公众号，代码整理好后第一时间通知你。

<?php
require_once __DIR__ . '/../core/Session.php';
require_once __DIR__ . '/../core/Security.php';
require_once __DIR__ . '/../core/Logger.php';
require_once __DIR__ . '/../core/Pagination.php';
require_once __DIR__ . '/../app/models/Page.php';

Session::start();
Session::requireLogin();

$user = Session::getUser();
$pageModel = new Page();

$error = '';
$success = Session::getFlash('success');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $action = $_POST['action'] ?? '';
    $csrfToken = $_POST['csrf_token'] ?? '';
    
    if (!Security::verifyCSRFToken($csrfToken)) {
        $error = '安全验证失败';
    } else {
        switch ($action) {
            case 'create':
                $title = trim($_POST['title'] ?? '');
                $slug = trim($_POST['slug'] ?? '');
                $content = $_POST['content'] ?? '';
                $sortOrder = (int)($_POST['sort_order'] ?? 0);
                $status = $_POST['status'] ?? 'draft';
                
                if (empty($title)) {
                    $error = '请输入页面标题';
                } else {
                    if (empty($slug)) {
                        $slug = Security::slugify($title);
                    }
                    
                    $existing = $pageModel->findOneBy('slug', $slug);
                    if ($existing) {
                        $error = 'URL别名已存在';
                    } else {
                        $pageModel->create([
                            'title' => $title,
                            'slug' => $slug,
                            'content' => $content,
                            'user_id' => $user['id'],
                            'sort_order' => $sortOrder,
                            'status' => $status
                        ]);
                        Logger::userAction('page_create', "创建页面: {$title}");
                        Session::setFlash('success', '页面创建成功');
                        header('Location: pages.php');
                        exit;
                    }
                }
                break;
                
            case 'update':
                $id = (int)($_POST['id'] ?? 0);