E.Noorlander/CodePress
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security: verwijder hardcoded wachtwoord, voeg random-wachtwoord-generator toe bij eerste installatie

Browse Source
This commit is contained in:
E.Noorlander
2026-08-27 08:57:05 +00:00
parent 6485f693dc
commit 74612aefbb
55 changed files with 6019 additions and 876 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cms/router.php
+50
View File
@@ -1,4 +1,15 @@
<?php
/**
* Router voor de PHP development-server: clean-URL support en statische bestanden.
*
* Wordt gebruikt via `php -S localhost:8080 cms/router.php`. Houdt de request-
* URI tegen de public/-map voor statische bestanden, serveert theme-, admin-
* theme- en plugin-assets buiten public/, en routeert /admin en taal-geprefixte
* paden (/nl, /en) door naar admin.php respectievelijk index.php.
*
* @since 2.6.4
* @package CodePress
*/
// Router file for PHP development server - clean URL support + static file serving
$requestUri = $_SERVER['REQUEST_URI'];
@@ -19,6 +30,11 @@ $mimeTypes = [
'json' => 'application/json',
];
/**
* Statische bestanden uit public/ serveren met juiste MIME-type.
*
* @since 2.6.4
*/
// Serve static files from public/
$filePath = $publicDir . $path;
if (is_file($filePath)) {
@@ -30,6 +46,13 @@ if (is_file($filePath)) {
return true;
}
/**
* Theme-assets uit themes/<naam>/ serveren (bijv. /themes/default/js/theme.js).
*
* Path-traversal wordt afgedwongen via realpath() + prefix-controle.
*
* @since 2.6.4
*/
// Serve theme assets from the themes/ directory (e.g. /themes/default/js/theme.js)
if (preg_match('#^/themes/([^/]+)/(.+)$#', $path, $m)) {
$themeName = $m[1];
@@ -50,6 +73,13 @@ if (preg_match('#^/themes/([^/]+)/(.+)$#', $path, $m)) {
return true;
}
/**
* Admin-theme-assets serveren (bijv. /admin/assets/css/bootstrap.min.js).
*
* Bronmap: admin/theme/default/assets/.
*
* @since 2.6.4
*/
// Serve admin theme assets (e.g. /admin/assets/css/bootstrap.min.js)
// Served from admin/theme/default/assets/
if (preg_match('#^/admin/assets/(.+)$#', $path, $m)) {
@@ -70,6 +100,11 @@ if (preg_match('#^/admin/assets/(.+)$#', $path, $m)) {
return true;
}
/**
* Plugin-assets serveren (bijv. /plugins/Navigation/assets/css/navigation.css).
*
* @since 2.6.4
*/
// Serve plugin assets (e.g. /plugins/Navigation/assets/css/navigation.css)
if (preg_match('#^/plugins/([^/]+)/assets/(.+)$#', $path, $m)) {
$pluginName = $m[1];
@@ -90,6 +125,13 @@ if (preg_match('#^/plugins/([^/]+)/assets/(.+)$#', $path, $m)) {
return true;
}
/**
* Admin-routes doorsturen: /admin/<route> → admin.php?route=<route>.
*
* Default route is 'dashboard' indien geen subpad opgegeven.
*
* @since 2.6.4
*/
// Admin routes: /admin/login → admin.php?route=login
if (preg_match('#^/admin(?:/(.+))?$#', $path, $m)) {
$_GET['route'] = $m[1] ?? 'dashboard';
@@ -97,6 +139,14 @@ if (preg_match('#^/admin(?:/(.+))?$#', $path, $m)) {
return true;
}
/**
* Taal-geprefixte routes: /nl/<page> of /en/<page> → index.php?lang=...&page=...
*
* /nl/guide activeert de guide-flag met bestaande ?page=. Default valt
* door naar index.php.
*
* @since 2.6.4
*/
// Language-prefixed routes: /nl/page/path → index.php?lang=nl&page=page/path
if (preg_match('#^/(nl|en)(?:/(.+))?$#', $path, $m)) {
$_GET['lang'] = $m[1];