erp-sync/web/syncs.php

<?php

require_once "bootstrap.inc.php";

gettopost();

if (! auth()) {
	sync_error(__FILE__.':'.__LINE__, "Auth failed");
	die();
}

if (empty($_POST['sens']) || !is_string($sens=$_POST['sens']) || !in_array($_POST['sens'], ['pd', 'dp'])){
	sync_error(__FILE__.':'.__LINE__, "Bad param : sens : ".(empty($_POST['sens']) ?'empty' :json_encode($_POST['sens'])));
	die();
}
if (empty($_POST['list']) || !is_array($list=$_POST['list'])){
	sync_error(__FILE__.':'.__LINE__, "Bad param : list : ".(empty($_POST['list']) ?'empty' :json_encode($_POST['list'])));
	die();
}

foreach($list as $r) {
	if (empty($r['type']) || !is_string($type=$r['type'])){
		sync_error(__FILE__.':'.__LINE__, "Bad param : type : ".json_encode($r));
		break;
	}
	if (empty($r['action']) || !is_string($action=$r['action']) || !in_array($r['action'], ['create', 'osync', 'delete'])){
		sync_error(__FILE__.':'.__LINE__, "Bad param : action : ".json_encode($r));
		break;
	}
	if (empty($r['otype']) || !is_string($otype=$r['otype'])){
		sync_error(__FILE__.':'.__LINE__, "Bad param : otype : ".json_encode($r));
		break;
	}
	if (empty($r['oid']) || !is_numeric($oid=$r['oid'])){
		sync_error(__FILE__.':'.__LINE__, "Bad param : oid : ".json_encode($r));
		break;
	}
	sync::_action($type, $sens, $action, $otype, $oid);
}