$_POST['folder_name'] ?? '', 'parent_id' => $_POST['parent_id'] ?? '', 'description' => $_POST['description'] ?? '' // rowID is empty = insert (standard pattern) ]; $response = ioServer('/v2/marketing_folders', json_encode($payload)); } else { // Get folders $get_values = urlGETdetails($_GET) ?? ''; $response = ioServer('/v2/marketing_folders/' . $get_values, ''); } header('Content-Type: application/json'); echo $response; exit; } // Marketing files if ($action === 'marketing_files') { // Filter out 'page', 'action', and cache busting timestamp from GET parameters $filtered_params = $_GET; unset($filtered_params['page']); unset($filtered_params['action']); unset($filtered_params['_t']); $get_values = urlGETdetails($filtered_params) ?? ''; // API expects path segments, not query string: /v2/marketing_files/params $api_url = '/v2/marketing_files/' . $get_values; $response = ioServer($api_url, ''); header('Content-Type: application/json'); echo $response; exit; } // Marketing tags if ($action === 'marketing_tags') { // Filter out 'page' and 'action' from GET parameters $get_values = urlGETdetails($_GET) ?? ''; $response = ioServer('/v2/marketing_tags?' . $get_values, ''); header('Content-Type: application/json'); echo $response; exit; } // Marketing upload if ($action === 'marketing_upload' && $_SERVER['REQUEST_METHOD'] === 'POST') { if (isset($_FILES['file']) && $_FILES['file']['error'] === UPLOAD_ERR_OK && $_FILES['file']['size'] > 0) { // Use the uploaded file's temp path directly $temp_path = $_FILES['file']['tmp_name']; // Get actual MIME type from file content (more secure than trusting browser) $actual_mime_type = mime_content_type($temp_path); // Sanitize filename - remove path info and dangerous characters $safe_filename = basename($_FILES['file']['name']); $safe_filename = preg_replace('/[^a-zA-Z0-9._-]/', '_', $safe_filename); $fileData = [ 'file' => new CURLFile($temp_path, $actual_mime_type, $safe_filename) ]; $additionalData = $_POST; // Include any additional POST data $token = createCommunicationToken($_SESSION['userkey']); $response = ioAPIv2_FileUpload('/v2/marketing_upload/', $fileData, $additionalData, $token); // No need to unlink since we didn't move the file } else { $response = json_encode(['error' => 'No file uploaded or upload error']); } header('Content-Type: application/json'); echo $response; exit; } // Marketing delete if ($action === 'marketing_delete' && $_SERVER['REQUEST_METHOD'] === 'POST') { $payload = ['file_id' => $_POST['file_id'] ?? '']; $response = ioServer('/v2/marketing_delete', json_encode($payload)); header('Content-Type: application/json'); echo $response; exit; } // Marketing update if ($action === 'marketing_update' && $_SERVER['REQUEST_METHOD'] === 'POST') { $payload = $_POST; $response = ioServer('/v2/marketing_update', json_encode($payload)); header('Content-Type: application/json'); echo $response; exit; } } catch (Exception $e) { header('Content-Type: application/json'); http_response_code(500); echo json_encode(['error' => $e->getMessage()]); exit; } } template_header('Marketing', 'marketing'); ?>