E.Noorlander/CodePress
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix plugin security, hooks system, and admin features

Browse Source 
- Add plugin allowlist (enabled_plugins in config.json)
- Add enable/disable toggle in admin (separate from visibility)
- Add plugin hooks system (actions + filters with auto-registration)
- Fix autoLinkPageTitles nested <a> tag vulnerability
- Move MQTT credentials to environment variables
- Preserve current page in language switcher
- Fix ctime/birthtime for file creation date
- Deduplicate getGuidePage() CommonMark setup
- Simplify formatDisplayName() logic
- Add admin activity log to dashboard
- Add own password change with current password verification
- Apply theme header_color to admin sidebar
- Add content preview button in editor
This commit is contained in:
E.Noorlander
2026-07-21 13:42:32 +02:00
parent e19433a389
commit c0dc707a51
12 changed files with 412 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/src/AdminAuth.php
+23
View File
@@ -211,6 +211,29 @@ class AdminAuth
return ['success' => false, 'message' => 'Gebruiker niet gevonden.'];
}
public function changeOwnPassword(string $username, string $currentPassword, string $newPassword): array
{
$user = $this->findUser($username);
if (!$user) {
return ['success' => false, 'message' => 'Gebruiker niet gevonden.'];
}
if (!password_verify($currentPassword, $user['password_hash'])) {
return ['success' => false, 'message' => 'Huidig wachtwoord is onjuist.'];
}
if (strlen($newPassword) < 8) {
return ['success' => false, 'message' => 'Nieuw wachtwoord moet minimaal 8 tekens zijn.'];
}
foreach ($this->adminConfig['users'] as &$u) {
if ($u['username'] === $username) {
$u['password_hash'] = password_hash($newPassword, PASSWORD_DEFAULT);
$this->saveAdminConfig();
$this->log('info', "Eigen wachtwoord gewijzigd: {$username}");
return ['success' => true, 'message' => 'Wachtwoord gewijzigd.'];
}
}
return ['success' => false, 'message' => 'Fout bij wijzigen wachtwoord.'];
}
// --- Private helpers ---
private function findUser(string $username): ?array
admin/templates/layout.php
+11 -2
View File
@@ -1,4 +1,13 @@
<!DOCTYPE html>
<?php
// Load theme sidebar color from site config
$layoutConfigFile = __DIR__ . '/../../config.json';
$layoutSiteConfig = file_exists($layoutConfigFile) ? json_decode(file_get_contents($layoutConfigFile), true) : [];
$layoutActiveTheme = $layoutSiteConfig['active_theme'] ?? 'default';
$layoutThemeDir = dirname(__DIR__, 1) . '/../themes/' . $layoutActiveTheme;
$layoutThemeFile = $layoutThemeDir . '/theme.json';
$layoutThemeConfig = file_exists($layoutThemeFile) ? json_decode(file_get_contents($layoutThemeFile), true) : [];
$layoutSidebarColor = $layoutThemeConfig['header_color'] ?? '#0a369d';
?><!DOCTYPE html>
<html lang="nl">
<head>
<meta charset="UTF-8">
@@ -8,7 +17,7 @@
<link rel="stylesheet" href="/assets/css/bootstrap-icons.css">
<style>
body { background-color: #f5f6fa; min-height: 100vh; }
.admin-sidebar { background-color: #0a369d; min-height: 100vh; width: 240px; position: fixed; top: 0; left: 0; z-index: 100; }
.admin-sidebar { background-color: <?= htmlspecialchars($layoutSidebarColor) ?>; min-height: 100vh; width: 240px; position: fixed; top: 0; left: 0; z-index: 100; }
.admin-sidebar .nav-link { color: rgba(255,255,255,0.8); padding: 0.75rem 1.25rem; border-radius: 0; }
.admin-sidebar .nav-link:hover { color: #fff; background-color: rgba(255,255,255,0.1); }
.admin-sidebar .nav-link.active { color: #fff; background-color: rgba(255,255,255,0.2); border-left: 3px solid #fff; }
admin/templates/pages/content-edit.php
+5
View File
@@ -48,6 +48,11 @@
<button type="submit" class="btn btn-primary">
<i class="bi bi-check-lg"></i> Opslaan
</button>
<?php if ($isEditable): ?>
<a href="/<?= $currentLang ?>/<?= htmlspecialchars(pathinfo($file, PATHINFO_DIRNAME) . '/' . pathinfo($file, PATHINFO_FILENAME)) ?>" target="_blank" class="btn btn-outline-info" title="Open in nieuw tabblad">
<i class="bi bi-eye"></i> Preview
</a>
<?php endif; ?>
<a href="/admin/content?dir=<?= urlencode(dirname($file)) ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
</div>
</form>
admin/templates/pages/dashboard.php
+20
View File
@@ -62,6 +62,26 @@
</div>
</div>
</div>
<div class="col-md-6">
<div class="card shadow-sm">
<div class="card-header"><i class="bi bi-activity"></i> Recente activiteit</div>
<div class="card-body" style="max-height: 300px; overflow-y: auto;">
<?php if (empty($recentLogs)): ?>
<p class="text-muted mb-0">Geen activiteit geregistreerd.</p>
<?php else: ?>
<ul class="list-unstyled mb-0">
<?php foreach ($recentLogs as $log): ?>
<li class="mb-2 pb-2 border-bottom small">
<span class="text-muted"><?= htmlspecialchars($log['time']) ?></span>
<span class="badge bg-<?= $log['level'] === 'warning' ? 'warning text-dark' : ($log['level'] === 'error' ? 'danger' : 'info') ?> me-1"><?= htmlspecialchars($log['level']) ?></span>
<?= htmlspecialchars($log['message']) ?>
</li>
<?php endforeach; ?>
</ul>
<?php endif; ?>
</div>
</div>
</div>
<div class="col-md-6">
<div class="card shadow-sm">
<div class="card-header"><i class="bi bi-lightning"></i> Snelle acties</div>
admin/templates/pages/plugins.php
+20 -7
View File
@@ -83,11 +83,18 @@
<div class="card shadow-sm">
<div class="card-header d-flex justify-content-between align-items-center">
<strong><i class="bi bi-plug"></i> <?= htmlspecialchars($plugin['name']) ?></strong>
<?php if ($plugin['viewable']): ?>
<span class="badge bg-success">Zichtbaar</span>
<?php else: ?>
<span class="badge bg-secondary">Systeem</span>
<?php endif; ?>
<div>
<?php if ($plugin['enabled']): ?>
<span class="badge bg-success me-1">Actief</span>
<?php else: ?>
<span class="badge bg-secondary me-1">Uitgeschakeld</span>
<?php endif; ?>
<?php if ($plugin['viewable']): ?>
<span class="badge bg-info">Zichtbaar</span>
<?php else: ?>
<span class="badge bg-secondary">Systeem</span>
<?php endif; ?>
</div>
</div>
<div class="card-body">
<table class="table table-sm mb-0">
@@ -119,8 +126,14 @@
<?php endif; ?>
<form method="POST" action="/admin/plugins-toggle?plugin=<?= urlencode($plugin['name']) ?>" class="d-inline">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<button type="submit" class="btn btn-sm <?= $plugin['viewable'] ? 'btn-outline-warning' : 'btn-outline-success' ?>" title="<?= $plugin['viewable'] ? 'Verbergen' : 'Tonen' ?>">
<i class="bi <?= $plugin['viewable'] ? 'bi-eye-slash' : 'bi-eye' ?>"></i> <?= $plugin['viewable'] ? 'Verberg' : 'Toon' ?>
<button type="submit" class="btn btn-sm <?= $plugin['enabled'] ? 'btn-outline-warning' : 'btn-outline-success' ?>" title="<?= $plugin['enabled'] ? 'Uitschakelen' : 'Activeren' ?>">
<i class="bi <?= $plugin['enabled'] ? 'bi-pause-circle' : 'bi-play-circle' ?>"></i> <?= $plugin['enabled'] ? 'Uitschakelen' : 'Activeren' ?>
</button>
</form>
<form method="POST" action="/admin/plugins-toggle-visibility?plugin=<?= urlencode($plugin['name']) ?>" class="d-inline">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<button type="submit" class="btn btn-sm <?= $plugin['viewable'] ? 'btn-outline-secondary' : 'btn-outline-info' ?>" title="<?= $plugin['viewable'] ? 'Verbergen' : 'Tonen' ?>">
<i class="bi <?= $plugin['viewable'] ? 'bi-eye-slash' : 'bi-eye' ?>"></i>
</button>
</form>
<?php if ($plugin['has_config']): ?>
admin/templates/pages/users.php
+54 -15
View File
@@ -3,7 +3,7 @@
<div class="row g-4">
<!-- Users list -->
<div class="col-md-7">
<div class="card shadow-sm">
<div class="card shadow-sm mb-4">
<div class="card-header"><i class="bi bi-list"></i> Huidige gebruikers</div>
<div class="table-responsive">
<table class="table table-hover mb-0">
@@ -12,7 +12,7 @@
<th>Gebruikersnaam</th>
<th>Rol</th>
<th>Aangemaakt</th>
<th style="width: 160px;">Acties</th>
<th style="width: 200px;">Acties</th>
</tr>
</thead>
<tbody>
@@ -28,19 +28,23 @@
<td><span class="badge bg-primary"><?= htmlspecialchars($u['role']) ?></span></td>
<td class="text-muted"><?= htmlspecialchars($u['created']) ?></td>
<td>
<!-- Change password -->
<form method="POST" action="/admin/users" class="d-inline">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="change_password">
<input type="hidden" name="pw_username" value="<?= htmlspecialchars($u['username']) ?>">
<div class="input-group input-group-sm d-inline-flex" style="width: auto;">
<input type="password" name="new_password" placeholder="Nieuw ww" class="form-control form-control-sm" style="width: 100px;" required minlength="8">
<button type="submit" class="btn btn-sm btn-outline-warning" title="Wachtwoord wijzigen">
<i class="bi bi-key"></i>
</button>
</div>
</form>
<?php if ($u['username'] !== $user['username']): ?>
<?php if ($u['username'] === $user['username']): ?>
<button type="button" class="btn btn-sm btn-outline-warning" data-bs-toggle="modal" data-bs-target="#changeOwnPasswordModal" title="Eigen wachtwoord wijzigen">
<i class="bi bi-key"></i> Wachtwoord
</button>
<?php else: ?>
<!-- Change password (admin for other users) -->
<form method="POST" action="/admin/users" class="d-inline">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="change_password">
<input type="hidden" name="pw_username" value="<?= htmlspecialchars($u['username']) ?>">
<div class="input-group input-group-sm d-inline-flex" style="width: auto;">
<input type="password" name="new_password" placeholder="Nieuw ww" class="form-control form-control-sm" style="width: 100px;" required minlength="8">
<button type="submit" class="btn btn-sm btn-outline-warning" title="Wachtwoord wijzigen">
<i class="bi bi-key"></i>
</button>
</div>
</form>
<form method="POST" action="/admin/users" class="d-inline ms-1" onsubmit="return confirm('Weet je zeker dat je deze gebruiker wilt verwijderen?')">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="delete">
@@ -57,6 +61,41 @@
</table>
</div>
</div>
<!-- Change own password modal -->
<div class="modal fade" id="changeOwnPasswordModal" tabindex="-1">
<div class="modal-dialog">
<div class="modal-content">
<form method="POST" action="/admin/users">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="change_own_password">
<div class="modal-header">
<h5 class="modal-title"><i class="bi bi-key"></i> Eigen wachtwoord wijzigen</h5>
<button type="button" class="btn-close" data-bs-dismiss="modal"></button>
</div>
<div class="modal-body">
<div class="mb-3">
<label for="current_password" class="form-label">Huidig wachtwoord</label>
<input type="password" class="form-control" id="current_password" name="current_password" required>
</div>
<div class="mb-3">
<label for="new_password" class="form-label">Nieuw wachtwoord</label>
<input type="password" class="form-control" id="new_password" name="new_password" required minlength="8">
<small class="form-text text-muted">Minimaal 8 tekens.</small>
</div>
<div class="mb-3">
<label for="confirm_password" class="form-label">Bevestig nieuw wachtwoord</label>
<input type="password" class="form-control" id="confirm_password" name="confirm_password" required minlength="8">
</div>
</div>
<div class="modal-footer">
<button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Annuleren</button>
<button type="submit" class="btn btn-warning"><i class="bi bi-check-lg"></i> Wachtwoord wijzigen</button>
</div>
</form>
</div>
</div>
</div>
</div>
<!-- Add user form -->