From 52e1ce0b2034583f03157be593dcdc9a86d8d2ee Mon Sep 17 00:00:00 2001
From: Edwin Noorlander <edwin@noorlander.info>
Date: Tue, 21 Jul 2026 12:45:58 +0200
Subject: [PATCH] Fix admin form actions and redirects: replace & with ? for
 query parameters

---
 admin/templates/pages/content-dir-form.php  |  2 +-
 admin/templates/pages/content-edit.php      |  4 ++--
 admin/templates/pages/content-move-form.php |  2 +-
 admin/templates/pages/content-new.php       |  4 ++--
 admin/templates/pages/content.php           | 24 ++++++++++-----------
 admin/templates/pages/plugins-edit.php      |  2 +-
 admin/templates/pages/plugins.php           |  8 +++----
 admin/templates/pages/theme.php             |  2 +-
 public/admin.php                            | 14 ++++++------
 9 files changed, 31 insertions(+), 31 deletions(-)

diff --git a/admin/templates/pages/content-dir-form.php b/admin/templates/pages/content-dir-form.php
index 5c098d1..35b0c82 100644
--- a/admin/templates/pages/content-dir-form.php
+++ b/admin/templates/pages/content-dir-form.php
@@ -20,7 +20,7 @@
     </div>
 
     <div class="card-footer text-end">
-        <a href="/admin/content&dir=<?= urlencode(dirname($dir) === '.' ? '' : dirname($dir)) ?>" class="btn btn-secondary">Annuleren</a>
+        <a href="/admin/content?dir=<?= urlencode(dirname($dir) === '.' ? '' : dirname($dir)) ?>" class="btn btn-secondary">Annuleren</a>
         <button type="submit" class="btn btn-primary"><i class="bi bi-check-lg"></i> Opslaan</button>
     </div>
 </form>
diff --git a/admin/templates/pages/content-edit.php b/admin/templates/pages/content-edit.php
index ca71cab..ccea1c8 100644
--- a/admin/templates/pages/content-edit.php
+++ b/admin/templates/pages/content-edit.php
@@ -2,7 +2,7 @@
 
 <div class="card shadow-sm">
     <div class="card-body">
-        <form method="POST" action="/admin/content-edit&file=<?= urlencode($file) ?>" id="editor-form">
+        <form method="POST" action="/admin/content-edit?file=<?= urlencode($file) ?>" id="editor-form">
             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
             <div class="row mb-3">
                 <div class="col-md-4">
@@ -48,7 +48,7 @@
                 <button type="submit" class="btn btn-primary">
                     <i class="bi bi-check-lg"></i> Opslaan
                 </button>
-                <a href="/admin/content&dir=<?= urlencode(dirname($file)) ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
+                <a href="/admin/content?dir=<?= urlencode(dirname($file)) ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
             </div>
         </form>
     </div>
diff --git a/admin/templates/pages/content-move-form.php b/admin/templates/pages/content-move-form.php
index 2ff4cd1..fdc0b78 100644
--- a/admin/templates/pages/content-move-form.php
+++ b/admin/templates/pages/content-move-form.php
@@ -28,7 +28,7 @@
     </div>
 
     <div class="card-footer text-end">
-        <a href="/admin/content&dir=<?= urlencode(dirname($item) === '.' ? '' : dirname($item)) ?>" class="btn btn-secondary">Annuleren</a>
+        <a href="/admin/content?dir=<?= urlencode(dirname($item) === '.' ? '' : dirname($item)) ?>" class="btn btn-secondary">Annuleren</a>
         <button type="submit" class="btn btn-primary"><i class="bi bi-check-lg"></i> Verplaatsen</button>
     </div>
 </form>
diff --git a/admin/templates/pages/content-new.php b/admin/templates/pages/content-new.php
index fd4cd1b..ed20c6c 100644
--- a/admin/templates/pages/content-new.php
+++ b/admin/templates/pages/content-new.php
@@ -2,7 +2,7 @@
 
 <div class="card shadow-sm">
     <div class="card-body">
-        <form method="POST" action="/admin/content-new&dir=<?= urlencode($dir ?? '') ?>" id="editor-form" data-new-page>
+        <form method="POST" action="/admin/content-new?dir=<?= urlencode($dir ?? '') ?>" id="editor-form" data-new-page>
             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
             <div class="row mb-3">
                 <div class="col-md-8">
@@ -55,7 +55,7 @@
                 <button type="submit" class="btn btn-primary" id="content-create-btn" disabled>
                     <i class="bi bi-check-lg"></i> Aanmaken
                 </button>
-                <a href="/admin/content&dir=<?= urlencode($dir ?? '') ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
+                <a href="/admin/content?dir=<?= urlencode($dir ?? '') ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
             </div>
         </form>
     </div>
diff --git a/admin/templates/pages/content.php b/admin/templates/pages/content.php
index 09667a9..3fe769c 100644
--- a/admin/templates/pages/content.php
+++ b/admin/templates/pages/content.php
@@ -7,7 +7,7 @@
         <button type="button" class="btn btn-outline-secondary btn-sm me-1" data-bs-toggle="modal" data-bs-target="#createDirModal">
             <i class="bi bi-folder-plus"></i> Nieuwe map
         </button>
-        <a href="/admin/content-new&dir=<?= urlencode($subdir) ?>" class="btn btn-primary btn-sm">
+        <a href="/admin/content-new?dir=<?= urlencode($subdir) ?>" class="btn btn-primary btn-sm">
             <i class="bi bi-plus-lg"></i> Nieuw bestand
         </a>
     </div>
@@ -16,7 +16,7 @@
 <div class="collapse mb-4" id="uploadForm">
     <div class="card shadow-sm">
         <div class="card-body">
-            <form method="POST" action="/admin/content&dir=<?= urlencode($subdir) ?>" enctype="multipart/form-data">
+            <form method="POST" action="/admin/content?dir=<?= urlencode($subdir) ?>" enctype="multipart/form-data">
                 <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                 <div class="mb-3">
                     <label for="file" class="form-label">Bestanden selecteren</label>
@@ -48,7 +48,7 @@
                     <?php if ($crumbPath === $subdir): ?>
                         <?= htmlspecialchars($crumb) ?>
                     <?php else: ?>
-                        <a href="/admin/content&dir=<?= urlencode($crumbPath) ?>"><?= htmlspecialchars($crumb) ?></a>
+                        <a href="/admin/content?dir=<?= urlencode($crumbPath) ?>"><?= htmlspecialchars($crumb) ?></a>
                     <?php endif; ?>
                 </li>
             <?php endforeach; ?>
@@ -76,11 +76,11 @@
                         <tr>
                             <td>
                                 <?php if ($item['is_dir']): ?>
-                                    <a href="/admin/content&dir=<?= urlencode($item['path']) ?>">
+                                    <a href="/admin/content?dir=<?= urlencode($item['path']) ?>">
                                         <i class="bi bi-folder-fill text-warning"></i> <?= htmlspecialchars($item['name']) ?>
                                     </a>
                                 <?php else: ?>
-                                    <a href="/admin/content-edit&file=<?= urlencode($item['path']) ?>">
+                                    <a href="/admin/content-edit?file=<?= urlencode($item['path']) ?>">
                                         <?php
                                         $icon = match($item['extension']) {
                                             'md' => 'bi-file-text text-primary',
@@ -104,26 +104,26 @@
                             <td class="text-muted"><?= $item['modified'] ?></td>
                             <td>
                                 <?php if ($item['is_dir']): ?>
-                                    <a href="/admin/content-dir-rename&dir=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-secondary" title="Hernoemen">
+                                    <a href="/admin/content-dir-rename?dir=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-secondary" title="Hernoemen">
                                         <i class="bi bi-pencil"></i>
                                     </a>
-                                    <a href="/admin/content-move&item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
+                                    <a href="/admin/content-move?item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
                                         <i class="bi bi-arrows-move"></i>
                                     </a>
-                                    <form method="POST" action="/admin/content-dir-delete&dir=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je deze map wilt verwijderen? De map moet leeg zijn.')">
+                                    <form method="POST" action="/admin/content-dir-delete?dir=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je deze map wilt verwijderen? De map moet leeg zijn.')">
                                         <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                         <button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">
                                             <i class="bi bi-trash"></i>
                                         </button>
                                     </form>
                                 <?php else: ?>
-                                    <a href="/admin/content-edit&file=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-primary" title="Bewerken">
+                                    <a href="/admin/content-edit?file=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-primary" title="Bewerken">
                                         <i class="bi bi-pencil"></i>
                                     </a>
-                                    <a href="/admin/content-move&item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
+                                    <a href="/admin/content-move?item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
                                         <i class="bi bi-arrows-move"></i>
                                     </a>
-                                    <form method="POST" action="/admin/content-delete&file=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je dit bestand wilt verwijderen?')">
+                                    <form method="POST" action="/admin/content-delete?file=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je dit bestand wilt verwijderen?')">
                                         <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                         <button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">
                                             <i class="bi bi-trash"></i>
@@ -143,7 +143,7 @@
 <div class="modal fade" id="createDirModal" tabindex="-1">
     <div class="modal-dialog">
         <div class="modal-content">
-            <form method="POST" action="/admin/content-dir-create&dir=<?= urlencode($subdir) ?>">
+            <form method="POST" action="/admin/content-dir-create?dir=<?= urlencode($subdir) ?>">
                 <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                 <div class="modal-header">
                     <h5 class="modal-title"><i class="bi bi-folder-plus"></i> Nieuwe map aanmaken</h5>
diff --git a/admin/templates/pages/plugins-edit.php b/admin/templates/pages/plugins-edit.php
index cafdc7f..169a542 100644
--- a/admin/templates/pages/plugins-edit.php
+++ b/admin/templates/pages/plugins-edit.php
@@ -7,7 +7,7 @@
 
 <div class="card shadow-sm">
     <div class="card-body">
-        <form method="POST" action="/admin/plugins-edit&plugin=<?= urlencode($pluginName) ?>" id="editor-form">
+        <form method="POST" action="/admin/plugins-edit?plugin=<?= urlencode($pluginName) ?>" id="editor-form">
             <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
             <div class="d-flex justify-content-between align-items-center mb-2">
                 <span class="badge bg-secondary">PHP</span>
diff --git a/admin/templates/pages/plugins.php b/admin/templates/pages/plugins.php
index 7621995..149f424 100644
--- a/admin/templates/pages/plugins.php
+++ b/admin/templates/pages/plugins.php
@@ -113,23 +113,23 @@
                         <div class="mt-3 d-flex justify-content-between align-items-center">
                             <div class="btn-group btn-group-sm">
                                 <?php if ($plugin['has_main']): ?>
-                                    <a href="/admin/plugins-edit&plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-secondary" title="Bewerken">
+                                    <a href="/admin/plugins-edit?plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-secondary" title="Bewerken">
                                         <i class="bi bi-pencil"></i>
                                     </a>
                                 <?php endif; ?>
-                                <form method="POST" action="/admin/plugins-toggle&plugin=<?= urlencode($plugin['name']) ?>" class="d-inline">
+                                <form method="POST" action="/admin/plugins-toggle?plugin=<?= urlencode($plugin['name']) ?>" class="d-inline">
                                     <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                     <button type="submit" class="btn btn-sm <?= $plugin['viewable'] ? 'btn-outline-warning' : 'btn-outline-success' ?>" title="<?= $plugin['viewable'] ? 'Verbergen' : 'Tonen' ?>">
                                         <i class="bi <?= $plugin['viewable'] ? 'bi-eye-slash' : 'bi-eye' ?>"></i> <?= $plugin['viewable'] ? 'Verberg' : 'Toon' ?>
                                     </button>
                                 </form>
                                 <?php if ($plugin['has_config']): ?>
-                                    <a href="/admin/plugins-config&plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-primary" title="Configureren">
+                                    <a href="/admin/plugins-config?plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-primary" title="Configureren">
                                         <i class="bi bi-gear"></i>
                                     </a>
                                 <?php endif; ?>
                             </div>
-                            <form method="POST" action="/admin/plugins-delete&plugin=<?= urlencode($plugin['name']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je de plugin &#39;<?= htmlspecialchars($plugin['name']) ?>&#39; wilt verwijderen? Alle bestanden worden permanent verwijderd.')">
+                            <form method="POST" action="/admin/plugins-delete?plugin=<?= urlencode($plugin['name']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je de plugin &#39;<?= htmlspecialchars($plugin['name']) ?>&#39; wilt verwijderen? Alle bestanden worden permanent verwijderd.')">
                                 <input type="hidden" name="csrf_token" value="<?= $csrf ?>">
                                 <button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">
                                     <i class="bi bi-trash"></i>
diff --git a/admin/templates/pages/theme.php b/admin/templates/pages/theme.php
index ff8d8ea..dd434fc 100644
--- a/admin/templates/pages/theme.php
+++ b/admin/templates/pages/theme.php
@@ -233,7 +233,7 @@
                         </div>
 
                         <div class="d-flex gap-2">
-                            <a href="/admin/theme&edit=<?= urlencode($themeName) ?>" class="btn btn-outline-primary btn-sm">
+                            <a href="/admin/theme?edit=<?= urlencode($themeName) ?>" class="btn btn-outline-primary btn-sm">
                                 <i class="bi bi-pencil"></i> Bewerken
                             </a>
                             <?php if ($themeName !== $activeTheme): ?>
diff --git a/public/admin.php b/public/admin.php
index 02013b3..6560c7b 100644
--- a/public/admin.php
+++ b/public/admin.php
@@ -405,7 +405,7 @@ function handleContentNew(AdminAuth $auth, array $config): void
                     }
 
                     file_put_contents($filePath, $content);
-                    header('Location: /admin/content&dir=' . urlencode($dir));
+                    header('Location: /admin/content?dir=' . urlencode($dir));
                     exit;
                 }
             }
@@ -454,7 +454,7 @@ function handleContentDelete(AdminAuth $auth, array $config): void
     }
 
     $dir = dirname($file);
-    header('Location: /admin/content&dir=' . urlencode($dir === '.' ? '' : $dir));
+    header('Location: /admin/content?dir=' . urlencode($dir === '.' ? '' : $dir));
     exit;
 }
 
@@ -470,7 +470,7 @@ function handleContentDirCreate(AdminAuth $auth, array $config): void
     $subdir = str_replace(['../', '..\\'], '', $subdir);
 
     if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
-        header('Location: /admin/content&dir=' . urlencode($subdir));
+        header('Location: /admin/content?dir=' . urlencode($subdir));
         exit;
     }
 
@@ -483,7 +483,7 @@ function handleContentDirCreate(AdminAuth $auth, array $config): void
         }
     }
 
-    header('Location: /admin/content&dir=' . urlencode($subdir));
+    header('Location: /admin/content?dir=' . urlencode($subdir));
     exit;
 }
 
@@ -518,7 +518,7 @@ function handleContentDirRename(AdminAuth $auth, array $config): void
         }
 
         $parentRelative = dirname($dir);
-        header('Location: /admin/content&dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
+        header('Location: /admin/content?dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
         exit;
     }
 
@@ -560,7 +560,7 @@ function handleContentMove(AdminAuth $auth, array $config): void
         }
 
         $parentRelative = is_file($fullPath) ? dirname($item) : dirname($item);
-        header('Location: /admin/content&dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
+        header('Location: /admin/content?dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
         exit;
     }
 
@@ -598,7 +598,7 @@ function handleContentDirDelete(AdminAuth $auth, array $config): void
     }
 
     $parentDir = dirname($dir);
-    header('Location: /admin/content&dir=' . urlencode($parentDir === '.' ? '' : $parentDir));
+    header('Location: /admin/content?dir=' . urlencode($parentDir === '.' ? '' : $parentDir));
     exit;
 }