<?php
// Start session securely (harden the cookie first)
if (session_status() === PHP_SESSION_NONE) {
    ini_set('session.use_strict_mode', '1');
    ini_set('session.cookie_httponly', '1');
    ini_set('session.cookie_samesite', 'Lax');
    if (!empty($_SERVER['HTTPS'])) {
        ini_set('session.cookie_secure', '1');
    }
    session_start();
}

// Check if the editor is logged in and validate session values
if (!isset($_SESSION['editor_is_logged']) || !$_SESSION['editor_is_logged'] || intval($_SESSION['editor_id']) < 1) {
    header('Location: login.php?loginrequired');
    exit;
}

// Include database configuration and connection (use require_once to avoid multiple includes)
require_once dirname(__DIR__) . '/config.php';

// Check if the PDO connection is available
if (!$pdo) {
    die('Database connection failed.');
}

// Define getEditor function only if it has not been declared to avoid redeclaration errors
if (!function_exists('getEditor')) {
    // Fetch editor details securely using PDO
    function getEditor($editor_id, $pdo) {
        // Use prepared statements to prevent SQL injection
        $stmt = $pdo->prepare("SELECT * FROM sm_editors WHERE id = :id");
        $stmt->bindParam(':id', $editor_id, PDO::PARAM_INT);
        $stmt->execute();
        return $stmt->fetch(PDO::FETCH_ASSOC); // Fetch editor data
    }
}

// Get the editor details
$cEditor = getEditor($_SESSION['editor_id'], $pdo);

// Set the editor type in the session securely if it's not already set
if (empty($_SESSION['editor_type'])) {
    $_SESSION['editor_type'] = htmlspecialchars($cEditor['user_type'], ENT_QUOTES, 'UTF-8'); // Escape for XSS protection
}

// Use a prepared statement to get the new status types using PDO
$query = "SELECT * FROM sm_status WHERE id > :status_id ORDER BY id";
$stmt = $pdo->prepare($query);
$status_id_threshold = 2;
$stmt->bindParam(':status_id', $status_id_threshold, PDO::PARAM_INT);
$stmt->execute();

// Fetch status types securely and store them in the $submission_status array
$submission_status = array();
while ($row = $stmt->fetch(PDO::FETCH_ASSOC)) {
    $submission_status[$row['id']] = htmlspecialchars($row['status'], ENT_QUOTES, 'UTF-8'); // Escape output for XSS protection
}

$stmt->closeCursor(); // Close the cursor to free connection resources
