Security: verwijder hardcoded wachtwoord, voeg random-wachtwoord-generator toe bij eerste installatie

guide/en/admin-beheerder/content-beheer.md

@@ -5,11 +5,21 @@ CodePress uses a **tree view** (`/admin/content`) for content management: a file
 ## Content editor
 
 ### File browser sidebar
-- Shows the nested file tree of `content/`
+- Shows the nested file tree of `content/`, with a clickable **content** root at the top
 - Hidden directories (`.bak`, `.git`) and dotfiles are skipped
-- Click a file to open it in the CodeMirror editor
+- Click a **file** to open it in the CodeMirror editor
+- Click a **folder** (the folder name) to select it — the **folder detail pane** appears on the right
+- The chevron (▶/▼) next to a folder expands/collapses it without selecting the folder
 - Folders containing the active file are auto-expanded
-- Per folder there are action buttons: new file, new folder, rename, delete
+- Per folder there are action buttons: new file (plus icon), new folder (folder-plus icon) — they operate on the selected folder
+- Per file there are action buttons: rename/move (pencil), delete (trash) — appear on hover
+
+### Drag-and-drop
+- Drag a file or folder onto another folder to move it
+- Valid drop targets are highlighted during dragging
+- The move is performed via an AJAX call — the page reloads automatically on success
+- Security: a folder cannot be dropped into itself or a subfolder
+- Path-traversal protection: all paths stay within the content directory
 
 ### Editable file types
 `.md` (Markdown), `.php` (PHP), `.html` (HTML) — consistent with the existing content-edit page.
@@ -56,26 +66,32 @@ Existing `{:width=...}` values are shown in the prompts. The size attributes are
 Images in `content/` are served via the `/-media/` endpoint (content/ lives outside the webroot). Markdown syntax `![alt](url)` with local URLs (relative like `image.jpg`, or absolute like `/content/_images/image.jpg`) is automatically rewritten to `/-media/...`. External URLs (`https://...`) are left untouched.
 
 ### Create a new file
-- Click **New file** (at the top or per folder in the sidebar)
+- Select the target folder in the sidebar (click the folder name), or use the root
+- Click **New file** (in the folder-detail pane or at the top)
 - Enter a path within content (e.g. `en.page` or `blog/en.post`)
 - Choose the file type (Markdown/PHP/HTML)
 - Subfolders are created automatically
 - Frontmatter with `layout`, `created`, `edited` is auto-generated
+- The new file is created in the selected folder
 
 ### Upload a file
-- Click **Upload** to upload files to `content/`
+- Select the target folder in the sidebar (click the folder name), or use the root
+- Click **Upload** (in the folder-detail pane or at the top) to upload files to the selected folder
 - Allowed: images, video, audio, PDF, ZIP, office docs, CSS, SCSS, JS, JSON, HTML, MD
 - Path-traversal protection: target dir must stay within `content/`
+- After the upload you return to the selected folder
 
-### Move / delete a file
-- In the file tree each file has a move button (arrows icon) and a delete button (trash)
-- **Move**: choose a target folder from the dropdown listing all folders in content
-- **Delete**: with confirmation
+### Rename / delete a file
+- Open the file in the editor (click the file name in the sidebar)
+- **Rename**: edit the **Filename** field on the right above the editor and click Save — the file is renamed immediately
+- **Delete**: click the delete button (trash) next to the file in the sidebar, with confirmation
 
 ### Folder management
-- **New folder**: per folder in the sidebar or at the top
-- **Rename folder**: pencil icon per folder
-- **Delete folder**: trash icon per folder (only empty folders)
+- Click a folder in the sidebar to open the **folder-detail pane** on the right
+- **Rename folder**: edit the **Folder name** field in the folder-detail pane and click Save
+- **New file / new folder / upload into this folder**: use the buttons in the folder-detail pane — they operate on the selected folder
+- **Delete folder**: delete button in the folder-detail pane (only empty folders)
+- The content root is also selectable (click "content" at the top of the tree) — shows the folder-detail pane for the root (rename disabled)
 
 ### Layout selection
 On the editor page you can choose the layout from the layouts defined in `theme.json` (template mapping). The selected layout is stored in the frontmatter `layout:` key.

guide/en/admin-beheerder/plugins.md

@@ -27,4 +27,45 @@ Only active plugins are shown in the admin sidebar.
 3. Edit the PHP file
 4. Enable the plugin
 
-New plugins are content-plugins by default. To create a system plugin, add `"type": "system"` to `plugin.json`.
+New plugins are content-plugins by default. To create a system plugin, add `"type": "system"` to `plugin.json`.
+
+## Plugin editor
+
+Via **Edit** (pencil icon) in the plugin overview you open the plugin editor (`/admin/plugins-edit?plugin=<name>`). It works the same as the content and theme editors.
+
+### File browser sidebar
+- Shows the nested file tree of the plugin, with a clickable **plugin** root at the top
+- Click a file to open it in the CodeMirror editor
+- Click a folder to open the **folder detail pane** on the right (new file, new folder, upload, delete)
+- Folders containing the active file are auto-expanded
+- Per folder there are action buttons: new file, new folder — they operate on the selected folder
+- Per file there are action buttons: rename/move (pencil), delete (trash) — appear on hover
+
+### Drag-and-drop
+- Drag a file or folder onto another folder to move it
+- Valid drop targets are highlighted during dragging
+- The move is performed via an AJAX call — the page reloads automatically on success
+- Protected plugins (like Navigation) cannot be edited/moved
+
+### Editable file types
+`.php`, `.json`, `.md`, `.html`, `.css`, `.scss`, `.js`
+
+### Create a new file / folder
+- Select the target folder in the sidebar (click the folder name), or use the root
+- Click **New file** or **New folder** (in the folder-detail pane or at the top)
+- For a new file: enter a path within the plugin (e.g. `helper.php` or `assets/css/extra.css`)
+- Subfolders are created automatically
+
+### Move / delete a file
+- **Move**: drag the file onto another folder (drag-and-drop), or click the pencil icon
+- **Delete**: click the trash button next to the file in the sidebar, with confirmation
+
+### Folder management
+- Click a folder in the sidebar to open the **folder-detail pane** on the right
+- **New file / new folder / upload into this folder**: use the buttons in the folder-detail pane
+- **Delete folder**: delete button in the folder-detail pane (only empty folders)
+
+### Security
+- Protected plugins (Navigation) cannot be edited
+- All actions require a CSRF token
+- Path-traversal protection via `realpath()` + prefix check on the plugin dir

guide/en/admin-beheerder/thema-beheer.md

@@ -21,17 +21,27 @@ In the theme overview you see per theme:
 Via **Edit** (pencil icon) in the theme overview you open the theme editor (`/admin/theme-edit?theme=<name>`). It works the same as the plugin editor:
 
 ### File browser sidebar
-- Shows the nested file tree of the theme
+- Shows the nested file tree of the theme, with a clickable **theme** root at the top
 - `assets/css_compiled/` is hidden (runtime artefact, read-only)
 - Click a file to open it in the CodeMirror editor
+- Click a folder to open the **folder detail pane** on the right (new file, new folder, upload, delete)
 - Folders containing the active file are auto-expanded
+- Per folder there are action buttons: new file, new folder — they operate on the selected folder
+- Per file there are action buttons: rename/move (pencil), delete (trash) — appear on hover
+
+### Drag-and-drop
+- Drag a file or folder onto another folder to move it
+- Valid drop targets are highlighted during dragging
+- The move is performed via an AJAX call — the page reloads automatically on success
+- `theme.json` cannot be moved
 
 ### Editable file types
 `.twig`, `.json`, `.scss`, `.css`, `.js`, `.html`, `.md`, `.php`
 
-### Create a new file
-- Click **New file**
-- Enter a path within the theme (e.g. `partials/header.twig` or `assets/scss/_variables.scss`)
+### Create a new file / folder
+- Select the target folder in the sidebar (click the folder name), or use the root
+- Click **New file** or **New folder** (in the folder-detail pane or at the top)
+- For a new file: enter a path within the theme (e.g. `partials/header.twig` or `assets/scss/_variables.scss`)
 - Subfolders are created automatically
 - Allowed: twig, json, scss, css, js, html, md, php
 - A stub is auto-generated (e.g. `{% extends 'base.twig' %}` for `.twig`)
@@ -42,9 +52,14 @@ Via **Edit** (pencil icon) in the theme overview you open the theme editor (`/ad
 - Path-traversal protection: target dir must stay within `assets/`
 
 ### Move / delete a file
-- In the file tree each file has a move button (arrows icon) and a delete button (trash)
-- **Move**: choose a target folder from the dropdown listing all folders in the theme
-- **Delete**: with confirmation; `theme.json` cannot be deleted
+- **Move**: drag the file onto another folder (drag-and-drop), or click the pencil icon next to the file to go to the move form
+- **Delete**: click the trash button next to the file in the sidebar, with confirmation; `theme.json` cannot be deleted
+
+### Folder management
+- Click a folder in the sidebar to open the **folder-detail pane** on the right
+- **New file / new folder / upload into this folder**: use the buttons in the folder-detail pane
+- **Delete folder**: delete button in the folder-detail pane (only empty folders)
+- The theme root is also selectable (click the theme name at the top of the tree)
 
 ### Compile SCSS from the editor
 - At the top of the editor there is a **Compile SCSS** button (only if `assets/scss/theme.scss` exists)