From 92d782e6c59f6b426f680d393628bb0c1f047475 Mon Sep 17 00:00:00 2001
From: Edwin Noorlander <edwin@noorlander.info>
Date: Wed, 29 Jul 2026 16:01:14 +0200
Subject: [PATCH] Voeg IP-uitsluitingen toe aan configuratie: IP's niet
 meetellen in statistieken en overslaan bij beveiliging

---
 admin/templates/pages/config.php | 13 +++++++++++++
 cms/core/config.php              |  4 +++-
 public/admin.php                 | 13 +++++++++++++
 public/index.php                 |  7 +++++--
 4 files changed, 34 insertions(+), 3 deletions(-)

diff --git a/admin/templates/pages/config.php b/admin/templates/pages/config.php
index 07639a3..9ffa94d 100644
--- a/admin/templates/pages/config.php
+++ b/admin/templates/pages/config.php
@@ -127,6 +127,19 @@
         </div>
     </div>
 
+    <div class="card shadow-sm mb-4">
+        <div class="card-header">
+            <i class="bi bi-eye-slash"></i> IP Uitsluitingen
+        </div>
+        <div class="card-body">
+            <div class="mb-3">
+                <label for="excluded_ips" class="form-label fw-bold">IP-adressen uitsluiten van statistieken en beveiliging</label>
+                <textarea class="form-control font-monospace" id="excluded_ips" name="excluded_ips" rows="4" placeholder="Één IP per regel (bijv. 127.0.0.1)"><?= htmlspecialchars(implode("\n", $configData['analytics']['excluded_ips'] ?? [])) ?></textarea>
+                <div class="form-text">Verzoeken van deze IP-adressen worden niet opgenomen in de statistieken en overgeslagen bij beveiligingscontroles (bot-detectie, rate limiting).</div>
+            </div>
+        </div>
+    </div>
+
     <button type="submit" class="btn btn-primary btn-lg">
         <i class="bi bi-check-lg"></i> Configuratie opslaan
     </button>
diff --git a/cms/core/config.php b/cms/core/config.php
index 2af8926..8440fc0 100644
--- a/cms/core/config.php
+++ b/cms/core/config.php
@@ -53,7 +53,8 @@ if (!file_exists($configJsonPath)) {
                 'geoip_mmdb_path' => '',
                 'geoip_api_url' => '',
                 'geoip_api_key' => '',
-                'retention_days' => 400
+                'retention_days' => 400,
+                'excluded_ips' => []
             ]
         ];
         @file_put_contents($configJsonPath, json_encode($defaultConfig, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE));
@@ -87,6 +88,7 @@ if (file_exists($configJsonPath)) {
                 'geoip_api_url' => '',
                 'geoip_api_key' => '',
                 'retention_days' => 400,
+                'excluded_ips' => [],
             ],
         ];
         foreach ($sectionDefaults as $section => $defaults) {
diff --git a/public/admin.php b/public/admin.php
index 67b9bcf..f583c71 100644
--- a/public/admin.php
+++ b/public/admin.php
@@ -754,6 +754,19 @@ function handleConfig(AdminAuth $auth, array $config): void
             $configData['features']['search_enabled'] = !empty($_POST['feature_search']);
             $configData['features']['breadcrumbs_enabled'] = !empty($_POST['feature_breadcrumbs']);
 
+            $parseLines = function($text) {
+                $lines = explode("\n", str_replace("\r", "", $text));
+                $clean = [];
+                foreach ($lines as $line) {
+                    $item = trim($line);
+                    if ($item !== '') {
+                        $clean[] = $item;
+                    }
+                }
+                return array_values(array_unique($clean));
+            };
+            $configData['analytics']['excluded_ips'] = $parseLines($_POST['excluded_ips'] ?? '');
+
             file_put_contents($configJson, json_encode($configData, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE));
             adminLog($config, 'info', $user['username'] . ' wijzigde site configuratie');
             $message = 'Configuratie opgeslagen.';
diff --git a/public/index.php b/public/index.php
index cb0763c..562e3f3 100644
--- a/public/index.php
+++ b/public/index.php
@@ -112,7 +112,10 @@ $secSettings = $config['security'] ?? [
 ];
 
 $userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
-$isAllowedIp = in_array($clientIp, $secSettings['allowed_ips'] ?? [], true);
+$analyticsSettings = $config['analytics'] ?? [];
+$excludedIps = $analyticsSettings['excluded_ips'] ?? [];
+$isAllowedIp = in_array($clientIp, $secSettings['allowed_ips'] ?? [], true)
+            || in_array($clientIp, $excludedIps, true);
 $requestStatus = 'ok';
 
 if (!$isAllowedIp) {
@@ -182,7 +185,7 @@ if (!str_starts_with($path, '/-media/') && !str_starts_with($path, '/-assets/'))
     );
 
     // Record aggregated statistics
-    if (!empty($analyticsSettings['enabled'])) {
+    if (!empty($analyticsSettings['enabled']) && !in_array($clientIp, $excludedIps, true)) {
         $analytics = new Analytics($analyticsSettings);
         $analytics->record($currentPage, $storedIp, $userAgent, $referrer, $geoCountry, $requestStatus);
     }