All-purposes AJAX handler made with PHP and .htaccess that speaks JSON - Part 2
There are two things I would refactor.

The first if statement (now) checks if the session has been initialized. I think this can be done in a more readable way by using the native PHP function session_status(). You can also write the admin check into a variable. This small refactor will make the if-statement more readable.

$session_name = session_name();

/*
 * Checks if a session exists and that the session was initialized
 * properly.
 */
$session_active = (session_status() == PHP_SESSION_ACTIVE);

/*
 * Checks if an administrator is logged in and that his
 * access level is greater than 2.
 */
$admin_authorized = (isset($_SESSION['admin'] &amp;&amp; $_SESSION['admin']['level'] &gt; 2)

if(!isset($_COOKIE[$session_name]) || !$session_active || !$admin_authorized) {

    header('HTTP/1.1 403 Forbidden');
    echo '{"error":403}';

    /*
     * Remember to exit to ensure execution is stopped.
     */
    exit; 

}


It doesn't hurt to write an extra variable if it helps readability. A too long or complex if-statement-body can hurt readability, because it can be hard to keep track of what conditions has been checked or what the condition actually does. By extracting the logic into variables you can also better document the specific piece of logic. Consider writing all documentation before the whole statement or before each variable definition.

Then there are the part where you check if the requested file exists. I think this should be refactored as well. You should also remove the silence operator. According to documentation is_file also checks if the file actually exists.

I would refactor this to:

/*
 * This may seem redundant, but experience has taught me that you should only
 * perform one manipulation on a variable per line. Its easier to read what is
 * actually happening and to modify it later.
 */
$file = preg_replace('@^/([a-z_]+)\.php@', '$1', $_SERVER['ORIG_PATH_INFO']);
$file = ROOT . '/ajax/' . $file . '.php';

if(!is_file($file)) {

    /*
     * The requested file does not exist.
     */
    header('HTTP/1.1 404 Not Found');
    echo '{"error":404}';
    exit;

}

// Continue execution as the file exists.


In the last post you also mentioned security. As said in that post I'm not security expert, but one thing that I have made a habit is to extract values from superglobals using the filter_input() function. It helps you filter out the input to better match your exact requirements. Imagine an input that was expected to provide a string, but was in fact an integer, due to a malicious user. This would break your code. As an example when extracting the ORIG_PATH_INFO you would write.

/*
 * There might be more/better filters. To add more filters delimit them
 * using the pipe-character: |
 */
$original_path_info = filter_input(INPUT_SERVER, 'ORIG_PATH_INFO', FILTER_SANITIZE_STRING);


This helps make sure the variable is actually a string. Its not bulletproof (no where near actually), but it could remove malicious code from a potential attacker.

Hope this helps, happy coding!