Files
Thanakorn 8705be0d1b Enforce roles on admin endpoints and return real status codes
- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client
2026-09-24 14:53:40 +07:00

22 lines
691 B
PHP

<?php
require_once __DIR__ . '/../../../session.php';
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/classes/SmtpManager.php';
// Admin data: owners and admins only; staff and viewers never see it.
require_role($user_role, ['owner', 'admin']);
try {
$smtp = new SmtpManager($pdo1, $company_id, $method, $pinkey, $iv);
$answer['success'] = 1;
$answer['output'] = $smtp->get();
} catch (Exception $e) {
error_log('[retrieve_smtp] ' . $e->getMessage());
$answer['message'] = 'Could not load SMTP settings.';
http_response_code(500);
}
exit(json_encode($answer));
?>