foto-portfolio/admin/gallery-edit.php

<?php
/**
 * Per-gallery editor: settings, share link, proxied bulk uploader
 * (browser → webhost → S3), and image removal.
 */
require dirname(__DIR__) . '/app/bootstrap.php';
auth_require();

$gallery = gallery_load((string)($_GET['g'] ?? ''));
if ($gallery === null) {
    flash_set('Gallery not found.', 'error');
    redirect('galleries.php');
}
$slug = $gallery['slug'];

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();
    $action = $_POST['action'] ?? '';

    if ($action === 'settings') {
        $gallery['title'] = trim((string)($_POST['title'] ?? '')) ?: $gallery['title'];
        $gallery['expires_at'] = trim((string)($_POST['expires_at'] ?? '')) ?: null;
        if (!empty($_POST['remove_password'])) {
            $gallery['password_hash'] = null;
        } elseif (($pw = (string)($_POST['password'] ?? '')) !== '') {
            $gallery['password_hash'] = password_hash($pw, PASSWORD_DEFAULT);
        }
        gallery_save($gallery);
        flash_set('Gallery settings saved.');
        redirect('gallery-edit.php?g=' . rawurlencode($slug));
    }

    if ($action === 'delete-image') {
        $key = (string)($_POST['key'] ?? '');
        foreach ($gallery['images'] ?? [] as $i => $img) {
            if (($img['key'] ?? '') === $key) {
                s3_delete($img['key']);
                if (!empty($img['thumb'])) {
                    s3_delete($img['thumb']);
                }
                array_splice($gallery['images'], $i, 1);
                gallery_save($gallery);
                flash_set('Image deleted.');
                break;
            }
        }
        redirect('gallery-edit.php?g=' . rawurlencode($slug));
    }
}

// Build the share link from the page the admin is currently on, not from config,
// so it matches whatever host/path this app is actually served under.
$scheme  = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
$host    = $_SERVER['HTTP_HOST'] ?? 'localhost';
// gallery.php lives one directory up from admin/ (cf. the "../gallery.php" link below).
$basePath = str_replace('\\', '/', dirname(dirname($_SERVER['SCRIPT_NAME'] ?? '/admin/gallery-edit.php')));
$basePath = rtrim($basePath, '/');
$shareUrl = $scheme . '://' . $host . $basePath . '/gallery.php?g=' . rawurlencode($slug);

admin_header($gallery['title'], 'galleries');
flash_render();
?>
<h1><?= e($gallery['title']) ?></h1>
<p class="help" style="margin-bottom:1.5rem">
    Share link: <a href="../gallery.php?g=<?= e(rawurlencode($slug)) ?>" target="_blank" rel="noopener"><?= e($shareUrl) ?></a>
</p>

<div class="card">
    <h2 style="margin-top:0">Upload images</h2>
    <div class="dropzone" id="dropzone"
         data-api="api.php"
         data-slug="<?= e($slug) ?>"
         data-csrf="<?= e(csrf_token()) ?>"
         data-thumb-size="<?= (int)config('uploads.thumb_size', 600) ?>"
         data-thumb-quality="<?= e((string)config('uploads.thumb_quality', 0.8)) ?>">
        Drop images here or click to select.<br>
        <small>Uploaded through the site to S3, in full resolution, unmodified. One file at a time.</small>
    </div>
    <input type="file" id="file-input" accept="image/*" multiple style="display:none">
    <div class="upload-list" id="upload-list"></div>
</div>

<form method="post" class="card">
    <?= csrf_field() ?>
    <input type="hidden" name="action" value="settings">
    <h2 style="margin-top:0">Settings</h2>
    <label for="t">Title</label>
    <input type="text" id="t" name="title" value="<?= e($gallery['title']) ?>">
    <label for="ex">Expiry date (blank = never)</label>
    <input type="date" id="ex" name="expires_at" value="<?= e($gallery['expires_at'] ?? '') ?>">
    <label for="p">Set new password (blank = keep current)</label>
    <input type="text" id="p" name="password" autocomplete="off">
    <?php if (!empty($gallery['password_hash'])): ?>
        <p class="help"><label style="display:inline;text-transform:none;letter-spacing:0">
            <input type="checkbox" name="remove_password" value="1"> Remove password protection
        </label></p>
    <?php endif; ?>
    <button type="submit">Save settings</button>
</form>

<h2>Images (<span id="img-count"><?= count($gallery['images'] ?? []) ?></span>)</h2>
<div class="thumb-row">
    <?php foreach ($gallery['images'] ?? [] as $img): ?>
    <figure>
        <img src="<?= e(s3_presign_get($img['thumb'] ?? $img['key'])) ?>" alt="" loading="lazy">
        <figcaption title="<?= e($img['name'] ?? '') ?>"><?= e($img['name'] ?? '') ?></figcaption>
        <form method="post" onsubmit="return confirm('Delete this image from S3?')">
            <?= csrf_field() ?>
            <input type="hidden" name="action" value="delete-image">
            <input type="hidden" name="key" value="<?= e($img['key']) ?>">
            <button>✕</button>
        </form>
    </figure>
    <?php endforeach; ?>
</div>

<script src="../assets/admin.js"></script>
<?php admin_footer(); ?>