E.Noorlander/CodePress
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Clean URLs and security improvements

Browse Source 
- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off
This commit is contained in:
E.Noorlander
2026-07-14 15:28:53 +02:00
parent 98f74b2861
commit c244514a48
24 changed files with 233 additions and 205 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+1 -1
View File
@@ -5,7 +5,7 @@
- Sessie gestart: 16 feb 2026
## Build & Run
- **Run Server**: `php -S localhost:8080 -t public`
- **Run Server**: `php -S localhost:8080 cms/router.php` (router nodig voor clean URLs)
- **Lint PHP**: `find . -name "*.php" -not -path "./vendor/*" -exec php -l {} \;`
- **Dependencies**: Composer vereist voor CommonMark. Geen NPM.
- **Admin Console**: Toegankelijk op `/admin.php` (standaard login: `admin` / `admin`)
admin/templates/layout.php
+24 -24
View File
@@ -4,8 +4,8 @@
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>CodePress Admin</title>
<link rel="stylesheet" href="assets/css/bootstrap.min.css">
<link rel="stylesheet" href="assets/css/bootstrap-icons.css">
<link rel="stylesheet" href="/assets/css/bootstrap.min.css">
<link rel="stylesheet" href="/assets/css/bootstrap-icons.css">
<style>
body { background-color: #f5f6fa; min-height: 100vh; }
.admin-sidebar { background-color: #0a369d; min-height: 100vh; width: 240px; position: fixed; top: 0; left: 0; z-index: 100; }
@@ -25,8 +25,8 @@
}
</style>
<?php if (in_array($route ?? '', ['content-edit', 'content-new', 'plugins-edit'])): ?>
<link rel="stylesheet" href="assets/codemirror/codemirror.min.css">
<link rel="stylesheet" href="assets/css/editor.css">
<link rel="stylesheet" href="/assets/codemirror/codemirror.min.css">
<link rel="stylesheet" href="/assets/css/editor.css">
<?php endif; ?>
</head>
<body>
@@ -37,43 +37,43 @@
</div>
<ul class="nav flex-column mt-2">
<li class="nav-item">
<a class="nav-link <?= ($route ?? '') === 'dashboard' || ($route ?? '') === '' ? 'active' : '' ?>" href="admin.php?route=dashboard">
<a class="nav-link <?= ($route ?? '') === 'dashboard' || ($route ?? '') === '' ? 'active' : '' ?>" href="/admin/dashboard">
<i class="bi bi-speedometer2"></i> Dashboard
</a>
</li>
<li class="nav-item">
<a class="nav-link <?= ($route ?? '') === 'content' || str_starts_with($route ?? '', 'content') ? 'active' : '' ?>" href="admin.php?route=content">
<a class="nav-link <?= ($route ?? '') === 'content' || str_starts_with($route ?? '', 'content') ? 'active' : '' ?>" href="/admin/content">
<i class="bi bi-file-earmark-text"></i> Content
</a>
</li>
<li class="nav-item">
<a class="nav-link <?= ($route ?? '') === 'theme' ? 'active' : '' ?>" href="admin.php?route=theme">
<a class="nav-link <?= ($route ?? '') === 'theme' ? 'active' : '' ?>" href="/admin/theme">
<i class="bi bi-palette"></i> Thema
</a>
</li>
<li class="nav-item">
<a class="nav-link <?= ($route ?? '') === 'config' ? 'active' : '' ?>" href="admin.php?route=config">
<a class="nav-link <?= ($route ?? '') === 'config' ? 'active' : '' ?>" href="/admin/config">
<i class="bi bi-sliders"></i> Configuratie
</a>
</li>
<li class="nav-item">
<a class="nav-link <?= ($route ?? '') === 'plugins' ? 'active' : '' ?>" href="admin.php?route=plugins">
<a class="nav-link <?= ($route ?? '') === 'plugins' ? 'active' : '' ?>" href="/admin/plugins">
<i class="bi bi-plug"></i> Plugins
</a>
</li>
<li class="nav-item">
<a class="nav-link <?= ($route ?? '') === 'users' ? 'active' : '' ?>" href="admin.php?route=users">
<a class="nav-link <?= ($route ?? '') === 'users' ? 'active' : '' ?>" href="/admin/users">
<i class="bi bi-people"></i> Gebruikers
</a>
</li>
<li class="nav-item mt-3">
<a class="nav-link" href="index.php" target="_blank">
<a class="nav-link" href="/" target="_blank">
<i class="bi bi-box-arrow-up-right"></i> Website bekijken
</a>
</li>
<li class="nav-item">
<a class="nav-link text-warning" href="admin.php?route=logout">
<a class="nav-link text-warning" href="/admin/logout">
<i class="bi bi-box-arrow-left"></i> Uitloggen
</a>
</li>
@@ -147,19 +147,19 @@
?>
</main>
<script src="assets/js/bootstrap.bundle.min.js"></script>
<script src="/assets/js/bootstrap.bundle.min.js"></script>
<?php if (in_array($route ?? '', ['content-edit', 'content-new', 'plugins-edit'])): ?>
<script src="assets/codemirror/codemirror.min.js"></script>
<script src="assets/codemirror/mode/markdown.min.js"></script>
<script src="assets/codemirror/mode/xml.min.js"></script>
<script src="assets/codemirror/mode/htmlmixed.min.js"></script>
<script src="assets/codemirror/mode/php.min.js"></script>
<script src="assets/codemirror/mode/clike.min.js"></script>
<script src="assets/codemirror/mode/css.min.js"></script>
<script src="assets/codemirror/mode/javascript.min.js"></script>
<script src="assets/codemirror/addon/edit/closebrackets.min.js"></script>
<script src="assets/codemirror/addon/selection/active-line.min.js"></script>
<script src="assets/js/editor-toolbar.js"></script>
<script src="/assets/codemirror/codemirror.min.js"></script>
<script src="/assets/codemirror/mode/markdown.min.js"></script>
<script src="/assets/codemirror/mode/xml.min.js"></script>
<script src="/assets/codemirror/mode/htmlmixed.min.js"></script>
<script src="/assets/codemirror/mode/php.min.js"></script>
<script src="/assets/codemirror/mode/clike.min.js"></script>
<script src="/assets/codemirror/mode/css.min.js"></script>
<script src="/assets/codemirror/mode/javascript.min.js"></script>
<script src="/assets/codemirror/addon/edit/closebrackets.min.js"></script>
<script src="/assets/codemirror/addon/selection/active-line.min.js"></script>
<script src="/assets/js/editor-toolbar.js"></script>
<?php endif; ?>
</body>
</html>
admin/templates/login.php
+5 -5
View File
@@ -4,8 +4,8 @@
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>CodePress Admin - Login</title>
<link rel="stylesheet" href="assets/css/bootstrap.min.css">
<link rel="stylesheet" href="assets/css/bootstrap-icons.css">
<link rel="stylesheet" href="/assets/css/bootstrap.min.css">
<link rel="stylesheet" href="/assets/css/bootstrap-icons.css">
<style>
body { background-color: #f5f6fa; }
.login-card { max-width: 400px; margin: 10vh auto; }
@@ -26,7 +26,7 @@
<button type="button" class="btn-close" data-bs-dismiss="alert"></button>
</div>
<?php endif; ?>
<form method="POST" action="admin.php?route=login">
<form method="POST" action="/admin/login">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken) ?>">
<div class="mb-3">
<label for="username" class="form-label">Gebruikersnaam</label>
@@ -51,10 +51,10 @@
</div>
</div>
<p class="text-center text-muted mt-3 small">
<a href="index.php" class="text-decoration-none"><i class="bi bi-arrow-left"></i> Terug naar website</a>
<a href="/" class="text-decoration-none"><i class="bi bi-arrow-left"></i> Terug naar website</a>
</p>
</div>
</div>
<script src="assets/js/bootstrap.bundle.min.js"></script>
<script src="/assets/js/bootstrap.bundle.min.js"></script>
</body>
</html>
admin/templates/pages/config.php
+1 -1
View File
@@ -5,7 +5,7 @@
<i class="bi bi-filetype-json"></i> config.json
</div>
<div class="card-body">
<form method="POST" action="admin.php?route=config">
<form method="POST" action="/admin/config">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<div class="mb-3">
<textarea name="config_content" class="form-control font-monospace" rows="25" style="font-size: 0.9rem; tab-size: 4;"><?= htmlspecialchars($siteConfig) ?></textarea>
admin/templates/pages/content-dir-form.php
+1 -1
View File
@@ -20,7 +20,7 @@
</div>
<div class="card-footer text-end">
<a href="admin.php?route=content&dir=<?= urlencode(dirname($dir) === '.' ? '' : dirname($dir)) ?>" class="btn btn-secondary">Annuleren</a>
<a href="/admin/content&dir=<?= urlencode(dirname($dir) === '.' ? '' : dirname($dir)) ?>" class="btn btn-secondary">Annuleren</a>
<button type="submit" class="btn btn-primary"><i class="bi bi-check-lg"></i> Opslaan</button>
</div>
</form>
admin/templates/pages/content-edit.php
+4 -4
View File
@@ -2,7 +2,7 @@
<div class="card shadow-sm">
<div class="card-body">
<form method="POST" action="admin.php?route=content-edit&file=<?= urlencode($file) ?>" id="editor-form">
<form method="POST" action="/admin/content-edit&file=<?= urlencode($file) ?>" id="editor-form">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<div class="row mb-3">
<div class="col-md-4">
@@ -48,7 +48,7 @@
<button type="submit" class="btn btn-primary">
<i class="bi bi-check-lg"></i> Opslaan
</button>
<a href="admin.php?route=content&dir=<?= urlencode(dirname($file)) ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
<a href="/admin/content&dir=<?= urlencode(dirname($file)) ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
</div>
</form>
</div>
@@ -172,7 +172,7 @@ document.addEventListener('DOMContentLoaded', function () {
document.getElementById('media-size-form').classList.add('d-none');
document.getElementById('media-grid').classList.remove('d-none');
pendingFile = null;
fetch('admin.php?route=media-list')
fetch('/admin/media-list')
.then(function (r) { return r.json(); })
.then(function (files) {
var grid = document.getElementById('media-grid');
@@ -288,7 +288,7 @@ document.addEventListener('DOMContentLoaded', function () {
var formData = new FormData(form);
formData.append('csrf_token', '<?= $csrf ?>');
fetch('admin.php?route=media', { method: 'POST', body: formData })
fetch('/admin/media', { method: 'POST', body: formData })
.then(function () {
form.reset();
document.getElementById('media-upload-btn').disabled = true;
admin/templates/pages/content-move-form.php
+1 -1
View File
@@ -28,7 +28,7 @@
</div>
<div class="card-footer text-end">
<a href="admin.php?route=content&dir=<?= urlencode(dirname($item) === '.' ? '' : dirname($item)) ?>" class="btn btn-secondary">Annuleren</a>
<a href="/admin/content&dir=<?= urlencode(dirname($item) === '.' ? '' : dirname($item)) ?>" class="btn btn-secondary">Annuleren</a>
<button type="submit" class="btn btn-primary"><i class="bi bi-check-lg"></i> Verplaatsen</button>
</div>
</form>
admin/templates/pages/content-new.php
+4 -4
View File
@@ -2,7 +2,7 @@
<div class="card shadow-sm">
<div class="card-body">
<form method="POST" action="admin.php?route=content-new&dir=<?= urlencode($dir ?? '') ?>" id="editor-form" data-new-page>
<form method="POST" action="/admin/content-new&dir=<?= urlencode($dir ?? '') ?>" id="editor-form" data-new-page>
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<div class="row mb-3">
<div class="col-md-8">
@@ -55,7 +55,7 @@
<button type="submit" class="btn btn-primary" id="content-create-btn" disabled>
<i class="bi bi-check-lg"></i> Aanmaken
</button>
<a href="admin.php?route=content&dir=<?= urlencode($dir ?? '') ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
<a href="/admin/content&dir=<?= urlencode($dir ?? '') ?>" class="btn btn-outline-secondary" id="back-btn">Terug</a>
</div>
</form>
</div>
@@ -174,7 +174,7 @@ document.addEventListener('DOMContentLoaded', function () {
document.getElementById('media-size-form').classList.add('d-none');
document.getElementById('media-grid').classList.remove('d-none');
pendingFile = null;
fetch('admin.php?route=media-list')
fetch('/admin/media-list')
.then(function (r) { return r.json(); })
.then(function (files) {
var grid = document.getElementById('media-grid');
@@ -289,7 +289,7 @@ document.addEventListener('DOMContentLoaded', function () {
var formData = new FormData(form);
formData.append('csrf_token', '<?= $csrf ?>');
fetch('admin.php?route=media', { method: 'POST', body: formData })
fetch('/admin/media', { method: 'POST', body: formData })
.then(function () {
form.reset();
document.getElementById('media-upload-btn').disabled = true;
admin/templates/pages/content.php
+13 -13
View File
@@ -7,7 +7,7 @@
<button type="button" class="btn btn-outline-secondary btn-sm me-1" data-bs-toggle="modal" data-bs-target="#createDirModal">
<i class="bi bi-folder-plus"></i> Nieuwe map
</button>
<a href="admin.php?route=content-new&dir=<?= urlencode($subdir) ?>" class="btn btn-primary btn-sm">
<a href="/admin/content-new&dir=<?= urlencode($subdir) ?>" class="btn btn-primary btn-sm">
<i class="bi bi-plus-lg"></i> Nieuw bestand
</a>
</div>
@@ -16,7 +16,7 @@
<div class="collapse mb-4" id="uploadForm">
<div class="card shadow-sm">
<div class="card-body">
<form method="POST" action="admin.php?route=content&dir=<?= urlencode($subdir) ?>" enctype="multipart/form-data">
<form method="POST" action="/admin/content&dir=<?= urlencode($subdir) ?>" enctype="multipart/form-data">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<div class="mb-3">
<label for="file" class="form-label">Bestanden selecteren</label>
@@ -38,7 +38,7 @@
?>
<nav aria-label="breadcrumb" class="mb-3">
<ol class="breadcrumb">
<li class="breadcrumb-item"><a href="admin.php?route=content"><i class="bi bi-house"></i></a></li>
<li class="breadcrumb-item"><a href="/admin/content"><i class="bi bi-house"></i></a></li>
<?php
$crumbPath = '';
foreach (explode('/', $subdir) as $i => $crumb):
@@ -48,7 +48,7 @@
<?php if ($crumbPath === $subdir): ?>
<?= htmlspecialchars($crumb) ?>
<?php else: ?>
<a href="admin.php?route=content&dir=<?= urlencode($crumbPath) ?>"><?= htmlspecialchars($crumb) ?></a>
<a href="/admin/content&dir=<?= urlencode($crumbPath) ?>"><?= htmlspecialchars($crumb) ?></a>
<?php endif; ?>
</li>
<?php endforeach; ?>
@@ -76,11 +76,11 @@
<tr>
<td>
<?php if ($item['is_dir']): ?>
<a href="admin.php?route=content&dir=<?= urlencode($item['path']) ?>">
<a href="/admin/content&dir=<?= urlencode($item['path']) ?>">
<i class="bi bi-folder-fill text-warning"></i> <?= htmlspecialchars($item['name']) ?>
</a>
<?php else: ?>
<a href="admin.php?route=content-edit&file=<?= urlencode($item['path']) ?>">
<a href="/admin/content-edit&file=<?= urlencode($item['path']) ?>">
<?php
$icon = match($item['extension']) {
'md' => 'bi-file-text text-primary',
@@ -104,26 +104,26 @@
<td class="text-muted"><?= $item['modified'] ?></td>
<td>
<?php if ($item['is_dir']): ?>
<a href="admin.php?route=content-dir-rename&dir=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-secondary" title="Hernoemen">
<a href="/admin/content-dir-rename&dir=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-secondary" title="Hernoemen">
<i class="bi bi-pencil"></i>
</a>
<a href="admin.php?route=content-move&item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
<a href="/admin/content-move&item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
<i class="bi bi-arrows-move"></i>
</a>
<form method="POST" action="admin.php?route=content-dir-delete&dir=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je deze map wilt verwijderen? De map moet leeg zijn.')">
<form method="POST" action="/admin/content-dir-delete&dir=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je deze map wilt verwijderen? De map moet leeg zijn.')">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">
<i class="bi bi-trash"></i>
</button>
</form>
<?php else: ?>
<a href="admin.php?route=content-edit&file=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-primary" title="Bewerken">
<a href="/admin/content-edit&file=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-primary" title="Bewerken">
<i class="bi bi-pencil"></i>
</a>
<a href="admin.php?route=content-move&item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
<a href="/admin/content-move&item=<?= urlencode($item['path']) ?>" class="btn btn-sm btn-outline-info" title="Verplaatsen">
<i class="bi bi-arrows-move"></i>
</a>
<form method="POST" action="admin.php?route=content-delete&file=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je dit bestand wilt verwijderen?')">
<form method="POST" action="/admin/content-delete&file=<?= urlencode($item['path']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je dit bestand wilt verwijderen?')">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">
<i class="bi bi-trash"></i>
@@ -143,7 +143,7 @@
<div class="modal fade" id="createDirModal" tabindex="-1">
<div class="modal-dialog">
<div class="modal-content">
<form method="POST" action="admin.php?route=content-dir-create&dir=<?= urlencode($subdir) ?>">
<form method="POST" action="/admin/content-dir-create&dir=<?= urlencode($subdir) ?>">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<div class="modal-header">
<h5 class="modal-title"><i class="bi bi-folder-plus"></i> Nieuwe map aanmaken</h5>
admin/templates/pages/dashboard.php
+3 -3
View File
@@ -67,9 +67,9 @@
<div class="card-header"><i class="bi bi-lightning"></i> Snelle acties</div>
<div class="card-body">
<div class="d-grid gap-2">
<a href="admin.php?route=content-new" class="btn btn-outline-primary"><i class="bi bi-plus-lg"></i> Nieuwe pagina</a>
<a href="admin.php?route=config" class="btn btn-outline-secondary"><i class="bi bi-sliders"></i> Configuratie bewerken</a>
<a href="admin.php?route=content" class="btn btn-outline-info"><i class="bi bi-folder2-open"></i> Content beheren</a>
<a href="/admin/content-new" class="btn btn-outline-primary"><i class="bi bi-plus-lg"></i> Nieuwe pagina</a>
<a href="/admin/config" class="btn btn-outline-secondary"><i class="bi bi-sliders"></i> Configuratie bewerken</a>
<a href="/admin/content" class="btn btn-outline-info"><i class="bi bi-folder2-open"></i> Content beheren</a>
<a href="index.php" target="_blank" class="btn btn-outline-success"><i class="bi bi-box-arrow-up-right"></i> Website bekijken</a>
</div>
</div>
admin/templates/pages/media.php
+2 -2
View File
@@ -8,7 +8,7 @@
<div class="collapse mb-4" id="uploadForm">
<div class="card shadow-sm">
<div class="card-body">
<form method="POST" action="admin.php?route=media" enctype="multipart/form-data">
<form method="POST" action="/admin/media" enctype="multipart/form-data">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<div class="mb-3">
<label for="file" class="form-label">Bestanden selecteren</label>
@@ -53,7 +53,7 @@
<td class="text-muted small"><?= htmlspecialchars($file['modified']) ?></td>
<td><code class="small"><?= htmlspecialchars($file['url']) ?></code></td>
<td>
<form method="POST" action="admin.php?route=media" class="d-inline" onsubmit="return confirm('Weet je zeker dat je &#39;<?= htmlspecialchars($file['name']) ?>&#39; wilt verwijderen?')">
<form method="POST" action="/admin/media" class="d-inline" onsubmit="return confirm('Weet je zeker dat je &#39;<?= htmlspecialchars($file['name']) ?>&#39; wilt verwijderen?')">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="delete" value="<?= htmlspecialchars($file['name']) ?>">
<button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">
admin/templates/pages/plugin-config.php
+2 -2
View File
@@ -15,14 +15,14 @@
<?php if (!empty($pluginConfig)): ?>
<div class="card-footer text-end">
<a href="admin.php?route=plugins" class="btn btn-secondary">Annuleren</a>
<a href="/admin/plugins" class="btn btn-secondary">Annuleren</a>
<button type="submit" class="btn btn-primary"><i class="bi bi-check-lg"></i> Opslaan</button>
</div>
<?php endif; ?>
</form>
<div class="mt-3">
<a href="admin.php?route=plugins" class="btn btn-outline-secondary btn-sm">
<a href="/admin/plugins" class="btn btn-outline-secondary btn-sm">
<i class="bi bi-arrow-left"></i> Terug naar plugins
</a>
</div>
admin/templates/pages/plugins-edit.php
+3 -3
View File
@@ -1,13 +1,13 @@
<div class="d-flex justify-content-between align-items-center mb-4">
<h2><i class="bi bi-pencil"></i> Plugin bewerken: <?= htmlspecialchars($pluginName) ?></h2>
<a href="admin.php?route=plugins" class="btn btn-outline-secondary btn-sm">
<a href="/admin/plugins" class="btn btn-outline-secondary btn-sm">
<i class="bi bi-arrow-left"></i> Terug
</a>
</div>
<div class="card shadow-sm">
<div class="card-body">
<form method="POST" action="admin.php?route=plugins-edit&plugin=<?= urlencode($pluginName) ?>" id="editor-form">
<form method="POST" action="/admin/plugins-edit&plugin=<?= urlencode($pluginName) ?>" id="editor-form">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<div class="d-flex justify-content-between align-items-center mb-2">
<span class="badge bg-secondary">PHP</span>
@@ -21,7 +21,7 @@
<button type="submit" class="btn btn-primary">
<i class="bi bi-check-lg"></i> Opslaan
</button>
<a href="admin.php?route=plugins" class="btn btn-outline-secondary">Annuleren</a>
<a href="/admin/plugins" class="btn btn-outline-secondary">Annuleren</a>
</div>
</form>
</div>
admin/templates/pages/plugins-new.php
+1 -1
View File
@@ -34,7 +34,7 @@
</div>
<div class="card-footer text-end">
<a href="admin.php?route=plugins" class="btn btn-secondary">Annuleren</a>
<a href="/admin/plugins" class="btn btn-secondary">Annuleren</a>
<button type="submit" class="btn btn-primary"><i class="bi bi-check-lg"></i> Aanmaken</button>
</div>
</form>
admin/templates/pages/plugins.php
+5 -5
View File
@@ -1,6 +1,6 @@
<div class="d-flex justify-content-between align-items-center mb-4">
<h2><i class="bi bi-plug"></i> Plugins</h2>
<a href="admin.php?route=plugins-new" class="btn btn-primary btn-sm">
<a href="/admin/plugins-new" class="btn btn-primary btn-sm">
<i class="bi bi-plus-lg"></i> Nieuwe plugin
</a>
</div>
@@ -113,23 +113,23 @@
<div class="mt-3 d-flex justify-content-between align-items-center">
<div class="btn-group btn-group-sm">
<?php if ($plugin['has_main']): ?>
<a href="admin.php?route=plugins-edit&plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-secondary" title="Bewerken">
<a href="/admin/plugins-edit&plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-secondary" title="Bewerken">
<i class="bi bi-pencil"></i>
</a>
<?php endif; ?>
<form method="POST" action="admin.php?route=plugins-toggle&plugin=<?= urlencode($plugin['name']) ?>" class="d-inline">
<form method="POST" action="/admin/plugins-toggle&plugin=<?= urlencode($plugin['name']) ?>" class="d-inline">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<button type="submit" class="btn btn-sm <?= $plugin['viewable'] ? 'btn-outline-warning' : 'btn-outline-success' ?>" title="<?= $plugin['viewable'] ? 'Verbergen' : 'Tonen' ?>">
<i class="bi <?= $plugin['viewable'] ? 'bi-eye-slash' : 'bi-eye' ?>"></i> <?= $plugin['viewable'] ? 'Verberg' : 'Toon' ?>
</button>
</form>
<?php if ($plugin['has_config']): ?>
<a href="admin.php?route=plugins-config&plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-primary" title="Configureren">
<a href="/admin/plugins-config&plugin=<?= urlencode($plugin['name']) ?>" class="btn btn-outline-primary" title="Configureren">
<i class="bi bi-gear"></i>
</a>
<?php endif; ?>
</div>
<form method="POST" action="admin.php?route=plugins-delete&plugin=<?= urlencode($plugin['name']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je de plugin &#39;<?= htmlspecialchars($plugin['name']) ?>&#39; wilt verwijderen? Alle bestanden worden permanent verwijderd.')">
<form method="POST" action="/admin/plugins-delete&plugin=<?= urlencode($plugin['name']) ?>" class="d-inline" onsubmit="return confirm('Weet je zeker dat je de plugin &#39;<?= htmlspecialchars($plugin['name']) ?>&#39; wilt verwijderen? Alle bestanden worden permanent verwijderd.')">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<button type="submit" class="btn btn-sm btn-outline-danger" title="Verwijderen">
<i class="bi bi-trash"></i>
admin/templates/pages/theme.php
+7 -7
View File
@@ -3,14 +3,14 @@
<!-- Edit theme -->
<div class="d-flex justify-content-between align-items-center mb-4">
<h2><i class="bi bi-palette"></i> Bewerk thema: <?= htmlspecialchars($editTheme['name'] ?? $editThemeName) ?></h2>
<a href="admin.php?route=theme" class="btn btn-outline-secondary btn-sm">
<a href="/admin/theme" class="btn btn-outline-secondary btn-sm">
<i class="bi bi-arrow-left"></i> Terug
</a>
</div>
<div class="card shadow-sm">
<div class="card-body">
<form method="POST" action="admin.php?route=theme" enctype="multipart/form-data">
<form method="POST" action="/admin/theme" enctype="multipart/form-data">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="save">
<input type="hidden" name="theme" value="<?= htmlspecialchars($editThemeName) ?>">
@@ -150,7 +150,7 @@
<button type="submit" class="btn btn-primary">
<i class="bi bi-check-lg"></i> Opslaan
</button>
<a href="admin.php?route=theme" class="btn btn-outline-secondary">Annuleren</a>
<a href="/admin/theme" class="btn btn-outline-secondary">Annuleren</a>
</div>
</form>
</div>
@@ -169,7 +169,7 @@
<div class="collapse mb-4" id="newThemeForm">
<div class="card shadow-sm">
<div class="card-body">
<form method="POST" action="admin.php?route=theme" class="row g-3 align-items-end">
<form method="POST" action="/admin/theme" class="row g-3 align-items-end">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="create">
<div class="col-md-6">
@@ -233,11 +233,11 @@
</div>
<div class="d-flex gap-2">
<a href="admin.php?route=theme&edit=<?= urlencode($themeName) ?>" class="btn btn-outline-primary btn-sm">
<a href="/admin/theme&edit=<?= urlencode($themeName) ?>" class="btn btn-outline-primary btn-sm">
<i class="bi bi-pencil"></i> Bewerken
</a>
<?php if ($themeName !== $activeTheme): ?>
<form method="POST" action="admin.php?route=theme">
<form method="POST" action="/admin/theme">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="activate">
<input type="hidden" name="theme" value="<?= htmlspecialchars($themeName) ?>">
@@ -247,7 +247,7 @@
</form>
<?php endif; ?>
<?php if ($themeName !== 'default'): ?>
<form method="POST" action="admin.php?route=theme">
<form method="POST" action="/admin/theme">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="delete">
<input type="hidden" name="theme" value="<?= htmlspecialchars($themeName) ?>">
admin/templates/pages/users.php
+3 -3
View File
@@ -29,7 +29,7 @@
<td class="text-muted"><?= htmlspecialchars($u['created']) ?></td>
<td>
<!-- Change password -->
<form method="POST" action="admin.php?route=users" class="d-inline">
<form method="POST" action="/admin/users" class="d-inline">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="change_password">
<input type="hidden" name="pw_username" value="<?= htmlspecialchars($u['username']) ?>">
@@ -41,7 +41,7 @@
</div>
</form>
<?php if ($u['username'] !== $user['username']): ?>
<form method="POST" action="admin.php?route=users" class="d-inline ms-1" onsubmit="return confirm('Weet je zeker dat je deze gebruiker wilt verwijderen?')">
<form method="POST" action="/admin/users" class="d-inline ms-1" onsubmit="return confirm('Weet je zeker dat je deze gebruiker wilt verwijderen?')">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="delete">
<input type="hidden" name="delete_username" value="<?= htmlspecialchars($u['username']) ?>">
@@ -64,7 +64,7 @@
<div class="card shadow-sm">
<div class="card-header"><i class="bi bi-person-plus"></i> Gebruiker toevoegen</div>
<div class="card-body">
<form method="POST" action="admin.php?route=users">
<form method="POST" action="/admin/users">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="add">
<div class="mb-3">
cms/core/class/CodePressCMS.php
+58 -14
View File
@@ -57,6 +57,48 @@ class CodePressCMS {
}
}
/**
* Build a clean URL for a page
*
* @param string $page Page path (e.g., 'blog/leren/artikel')
* @param string|null $lang Language code
* @param array $params Additional query parameters
* @return string Clean URL
*/
public function buildUrl($page = 'index', $lang = null, $params = []) {
$lang = $lang ?: $this->currentLanguage;
$url = '/' . $lang;
if ($page && $page !== 'index') {
$url .= '/' . $page;
}
if (!empty($params)) {
$url .= '?' . http_build_query($params);
}
return $url;
}
/**
* Build a clean admin URL
*
* @param string $route Admin route
* @param array $params Additional query parameters
* @return string Clean admin URL
*/
public static function buildAdminUrl($route = '', $params = []) {
$url = $route ? '/admin/' . $route : '/admin';
if (!empty($params)) {
$url .= '?' . http_build_query($params);
}
return $url;
}
/**
* Build URL string for template use (non-static, with current lang context)
*/
public function url($page = 'index', $extraParams = []) {
return $this->buildUrl($page, $this->currentLanguage, $extraParams);
}
/**
* Get current language from request or config
*
@@ -215,7 +257,7 @@ class CodePressCMS {
'type' => 'file',
'title' => $title,
'path' => $pathWithoutExt,
'url' => '?page=' . $pathWithoutExt . '&lang=' . $this->currentLanguage
'url' => $this->buildUrl($pathWithoutExt)
];
}
}
@@ -262,7 +304,7 @@ class CodePressCMS {
$this->searchResults[] = [
'title' => $title,
'path' => $relativePath,
'url' => '?page=' . $relativePath . '&lang=' . $this->currentLanguage,
'url' => $this->buildUrl($relativePath),
'snippet' => $this->createSnippet($content, $query)
];
}
@@ -297,8 +339,9 @@ class CodePressCMS {
return $this->getSearchResults();
}
// Check if guide is requested
if (isset($_GET['guide'])) {
// Check if guide is requested (either via ?guide or /guide clean URL)
$pageCheck = $_GET['page'] ?? '';
if (isset($_GET['guide']) || $pageCheck === 'guide') {
return $this->getGuidePage();
}
@@ -536,9 +579,9 @@ class CodePressCMS {
// Auto-link page titles to existing content pages (but not in H1 tags)
$body = $this->autoLinkPageTitles($body, $cleanName);
// Convert relative internal links to CMS format
$body = preg_replace('/href="\/blog\/([^"]+)"/', 'href="?page=blog/$1"', $body);
$body = preg_replace('/href="\/([^"]+)"/', 'href="?page=$1"', $body);
// Convert relative internal links to clean URLs
$body = preg_replace('/href="\/blog\/([^"]+)"/', 'href="/' . $this->currentLanguage . '/blog/$1"', $body);
$body = preg_replace('/href="\/([^"]+)"/', 'href="/' . $this->currentLanguage . '/$1"', $body);
return [
'title' => $title ?: $cleanName ?: 'Untitled',
@@ -578,7 +621,7 @@ class CodePressCMS {
return $text; // Don't link existing links, current page title, or H1 headings
}
return '<a href="?page=' . $pagePath . '&lang=' . $this->currentLanguage . '" class="auto-link" title="' . $this->t('go_to') . ' ' . htmlspecialchars($pageTitle) . '">' . $text . '</a>';
return '<a href="' . $this->buildUrl($pagePath) . '" class="auto-link" title="' . $this->t('go_to') . ' ' . htmlspecialchars($pageTitle) . '">' . $text . '</a>';
};
$content = preg_replace_callback($pattern, $replacement, $content);
@@ -916,7 +959,7 @@ private function getGuidePage() {
$allItems[] = [
'name' => ucfirst($item),
'path' => $relativePath,
'url' => '?page=' . $relativePath,
'url' => $this->buildUrl($relativePath),
'icon' => 'bi-folder',
'type' => 'directory'
];
@@ -929,7 +972,7 @@ private function getGuidePage() {
$allItems[] = [
'name' => $fileTitle,
'path' => $pathWithoutExt,
'url' => '?page=' . $pathWithoutExt,
'url' => $this->buildUrl($pathWithoutExt),
'icon' => $icon,
'type' => 'file'
];
@@ -1021,7 +1064,7 @@ private function getGuidePage() {
'is_homepage' => (!isset($_GET['page']) || $_GET['page'] === $this->config['default_page']),
'home_active_class' => (!isset($_GET['page']) || $_GET['page'] === $this->config['default_page']) ? 'active' : '',
'is_guide_page' => isset($_GET['guide']),
'lang_switch_url' => isset($_GET['guide']) ? '&guide' : '&page=' . $this->config['default_page'],
'lang_switch_url' => '',
'author_name' => $this->config['author']['name'] ?? 'CodePress Developer',
'author_website' => $this->config['author']['website'] ?? '#',
'author_git' => 'https://git.noorlander.info/E.Noorlander',
@@ -1133,13 +1176,14 @@ private function getGuidePage() {
$sidebarToggle = '<li class="breadcrumb-item sidebar-toggle-item"><button type="button" class="sidebar-toggle-btn" onclick="toggleSidebar()" title="Toggle Sidebar" aria-label="Toggle Sidebar" aria-expanded="true"><i class="bi bi-layout-sidebar-inset"></i></button></li>';
if (isset($_GET['search'])) {
return '<nav aria-label="breadcrumb"><ol class="breadcrumb">' . $sidebarToggle . '<li class="breadcrumb-item"><a href="?page=' . $this->config['default_page'] . '&lang=' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li><li class="breadcrumb-item"> > </li><li class="breadcrumb-item active">' . $this->t('search') . '</li></ol></nav>';
return '<nav aria-label="breadcrumb"><ol class="breadcrumb">' . $sidebarToggle . '<li class="breadcrumb-item"><a href="/' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li><li class="breadcrumb-item"> > </li><li class="breadcrumb-item active">' . $this->t('search') . '</li></ol></nav>';
}
$page = $_GET['page'] ?? $this->config['default_page'];
$page = htmlspecialchars($page, ENT_QUOTES, 'UTF-8');
$page = preg_replace('/\.[^.]+$/', '', $page);
// Convert page to clean URL format for breadcrumb
if ($page === $this->config['default_page']) {
return '<nav aria-label="breadcrumb"><ol class="breadcrumb">' . $sidebarToggle . '<li class="breadcrumb-item active"><i class="bi bi-house"></i></li></ol></nav>';
}
@@ -1148,7 +1192,7 @@ private function getGuidePage() {
// Start with sidebar toggle, then home icon linking to default page (root)
$breadcrumb .= $sidebarToggle;
$breadcrumb .= '<li class="breadcrumb-item"><a href="?page=' . $this->config['default_page'] . '&lang=' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li>';
$breadcrumb .= '<li class="breadcrumb-item"><a href="/' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li>';
// Split page path and build breadcrumb items
$parts = explode('/', $page);
@@ -1164,7 +1208,7 @@ private function getGuidePage() {
$breadcrumb .= '<li class="breadcrumb-item"> > </li><li class="breadcrumb-item active">' . $title . '</li>';
} else {
// Parent directory - clickable link with separator
$breadcrumb .= '<li class="breadcrumb-item"> > </li><li class="breadcrumb-item"><a href="?page=' . $safePath . '&lang=' . $this->currentLanguage . '">' . $title . '</a></li>';
$breadcrumb .= '<li class="breadcrumb-item"> > </li><li class="breadcrumb-item"><a href="/' . $this->currentLanguage . '/' . $safePath . '">' . $title . '</a></li>';
}
}
cms/router.php
+38 -44
View File
@@ -1,59 +1,53 @@
<?php
// Router file for PHP development server to handle security and static files
// Router file for PHP development server - clean URL support + static file serving
$requestUri = $_SERVER['REQUEST_URI'];
$parsedUrl = parse_url($requestUri);
$path = $parsedUrl['path'];
$path = $parsedUrl['path'] ?? '/';
$path = rtrim($path, '/') ?: '/';
$publicDir = __DIR__ . '/../public';
// Block direct access to content directory
if (strpos($path, '/content/') === 0) {
http_response_code(403);
echo '<h1>403 - Forbidden</h1><p>Access denied.</p>';
$mimeTypes = [
'css' => 'text/css',
'js' => 'application/javascript',
'svg' => 'image/svg+xml',
'png' => 'image/png',
'jpg' => 'image/jpeg',
'ico' => 'image/x-icon',
'woff' => 'font/woff',
'woff2' => 'font/woff2',
'json' => 'application/json',
];
// Serve static files from public/
$filePath = $publicDir . $path;
if (is_file($filePath)) {
$ext = strtolower(pathinfo($filePath, PATHINFO_EXTENSION));
if (isset($mimeTypes[$ext])) {
header('Content-Type: ' . $mimeTypes[$ext]);
}
readfile($filePath);
return true;
}
// Block PHP execution in content directory
if (preg_match('/\.php$/i', $path) && strpos($path, '/content/') !== false) {
http_response_code(403);
echo '<h1>403 - Forbidden</h1><p>PHP execution not allowed in content directory.</p>';
// Admin routes: /admin/login → admin.php?route=login
if (preg_match('#^/admin(?:/(.+))?$#', $path, $m)) {
$_GET['route'] = $m[1] ?? 'dashboard';
require $publicDir . '/admin.php';
return true;
}
// Block access to sensitive files
$sensitiveFiles = ['.htaccess', 'config.php'];
foreach ($sensitiveFiles as $file) {
if (basename($path) === $file && dirname($path) === '/') {
http_response_code(403);
echo '<h1>403 - Forbidden</h1><p>Access denied.</p>';
return true;
// Language-prefixed routes: /nl/page/path → index.php?lang=nl&page=page/path
if (preg_match('#^/(nl|en)(?:/(.+))?$#', $path, $m)) {
$_GET['lang'] = $m[1];
$_GET['page'] = $m[2] ?? 'index';
if ($_GET['page'] === 'guide') {
$_GET['guide'] = '1';
}
require $publicDir . '/index.php';
return true;
}
// Serve static files from engine/assets
if (strpos($path, '/engine/') === 0) {
$filePath = __DIR__ . $path;
if (file_exists($filePath)) {
// Set appropriate content type
$extension = strtolower(pathinfo($filePath, PATHINFO_EXTENSION));
$mimeTypes = [
'css' => 'text/css',
'js' => 'application/javascript',
'svg' => 'image/svg+xml',
'woff' => 'font/woff',
'woff2' => 'font/woff2',
'ttf' => 'font/ttf'
];
if (isset($mimeTypes[$extension])) {
header('Content-Type: ' . $mimeTypes[$extension]);
}
// Serve the file
readfile($filePath);
return true;
}
}
// Route all other requests to index.php
include __DIR__ . '/index.php';
// Root or unknown → index.php
require $publicDir . '/index.php';
return true;
cms/templates/assets/footer.mustache
+1 -1
View File
@@ -19,7 +19,7 @@
</div>
<div class="site-info">
<small class="text-muted">
<a href="?guide&lang={{current_lang}}" class="footer-icon guide" title="{{t_guide}}">
<a href="/{{current_lang}}/guide" class="footer-icon guide" title="{{t_guide}}">
<i class="bi bi-book"></i>
</a>
<span class="ms-1">|</span>
cms/templates/assets/header.mustache
+3 -3
View File
@@ -1,6 +1,6 @@
<header id="site-header" class="navbar navbar-expand-lg navbar-dark" style="background-color: transparent;">
<div class="container-fluid">
<a class="navbar-brand" href="?page={{default_page}}&lang={{current_lang}}">
<a class="navbar-brand" href="/{{current_lang}}">
<img src="/assets/icon.svg" alt="CodePress Logo" width="32" height="32" class="me-2">
{{site_title}}
</a>
@@ -27,7 +27,7 @@
<ul class="dropdown-menu dropdown-menu-end" role="menu">
{{#available_langs}}
<li role="none">
<a class="dropdown-item {{#is_current}}active{{/is_current}}" href="?lang={{code}}{{lang_switch_url}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
<a class="dropdown-item {{#is_current}}active{{/is_current}}" href="/{{code}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
{{native_name}}
</a>
</li>
@@ -47,7 +47,7 @@
<ul class="dropdown-menu dropdown-menu-end" role="menu">
{{#available_langs}}
<li role="none">
<a class="dropdown-item {{#is_current}}active{{/is_current}}" href="?lang={{code}}{{lang_switch_url}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
<a class="dropdown-item {{#is_current}}active{{/is_current}}" href="/{{code}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
{{native_name}}
</a>
</li>
cms/templates/assets/navigation.mustache
+1 -1
View File
@@ -5,7 +5,7 @@
<div class="col">
<ul class="nav nav-tabs flex-wrap" role="menubar">
<li class="nav-item" role="none">
<a class="nav-link {{home_active_class}}" href="?page={{homepage}}&lang={{current_lang}}" role="menuitem" aria-current="{{#is_homepage}}page{{/is_homepage}}">
<a class="nav-link {{home_active_class}}" href="/{{current_lang}}" role="menuitem" aria-current="{{#is_homepage}}page{{/is_homepage}}">
<i class="bi bi-house" aria-hidden="true"></i> {{homepage_title}}
</a>
</li>
public/.htaccess
+27 -37
View File
@@ -1,50 +1,44 @@
# Disable directory listing
Options -Indexes
# Security - Block access to sensitive files and directories
# Security - Block sensitive files
<Files ~ "^\.">
Order allow,deny
Deny from all
Require all denied
</Files>
<FilesMatch "\.(ini|log|conf|config|map)$">
Order allow,deny
Deny from all
Require all denied
</FilesMatch>
# Block access to backup files
<FilesMatch "\.(backup|bak|old|orig|swp|save)$">
Order allow,deny
Deny from all
Require all denied
</FilesMatch>
# URL Routing - Route all requests to index.php
<IfModule mod_rewrite.c>
RewriteEngine On
# Set base directory
RewriteBase /
# Block direct access to PHP files in content directory
RewriteRule ^content/.*\.php$ - [F,L]
# Route all non-file/non-directory requests to index.php
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php [QSA,L]
# Allow access to assets
# Admin routes: /admin/login → admin.php?route=login
RewriteRule ^admin$ admin.php?route=dashboard [L,QSA]
RewriteRule ^admin/(.+)$ admin.php?route=$1 [L,QSA]
# Language-prefixed page routes: /nl, /en, /nl/page/path
RewriteRule ^(nl|en)/?$ index.php?lang=$1 [L,QSA]
RewriteRule ^(nl|en)/(.+)$ index.php?lang=$1&page=$2 [L,QSA]
# Root
RewriteRule ^$ index.php [L]
# Serve existing static files directly
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^assets/.*$ - [L]
# Allow access to content assets
RewriteRule ^content/assets/.*$ - [L]
# Serve files from content/-assets/ via index.php
RewriteRule ^-assets/.*$ index.php [L]
# Block direct access to all other content files
RewriteRule ^content/.*$ - [F,L]
RewriteRule ^ - [L]
# Block directory listing for remaining physical dirs
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^ - [F]
# Fallback to index.php
RewriteRule ^(.*)$ index.php [L,QSA]
</IfModule>
# Security headers
@@ -53,21 +47,17 @@ Options -Indexes
Header always set X-Frame-Options DENY
Header always set X-XSS-Protection "1; mode=block"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self';"
</IfModule>
# PHP settings
<IfModule mod_php.c>
php_flag display_errors Off
php_flag log_errors On
php_value error_log /var/log/php_errors.log
php_value max_execution_time 30
php_value memory_limit 128M
php_value upload_max_filesize 10M
php_value post_max_size 10M
</IfModule>
# Default index file
DirectoryIndex index.php
# Error handling
ErrorDocument 404 /index.php
ErrorDocument 404 /index.php
public/admin.php
+25 -25
View File
@@ -2,7 +2,7 @@
/**
* CodePress Admin Console - Entry Point
* Access via: /admin.php?route=login|dashboard|content|config|plugins|users|logout
* Access via: //admin/login|dashboard|content|config|plugins|users|logout
*/
// Security headers
@@ -29,7 +29,7 @@ if ($route === 'login') {
// All other routes require authentication
if (!$auth->isAuthenticated()) {
header('Location: admin.php?route=login');
header('Location: /admin/login');
exit;
}
@@ -37,7 +37,7 @@ if (!$auth->isAuthenticated()) {
switch ($route) {
case 'logout':
$auth->logout();
header('Location: admin.php?route=login');
header('Location: /admin/login');
exit;
case 'dashboard':
@@ -122,7 +122,7 @@ switch ($route) {
break;
default:
header('Location: admin.php?route=dashboard');
header('Location: /admin/dashboard');
exit;
}
@@ -143,7 +143,7 @@ function handleLogin(AdminAuth $auth): void
$result = $auth->login($username, $password);
if ($result['success']) {
$auth->regenerateCsrfToken();
header('Location: admin.php?route=dashboard');
header('Location: /admin/dashboard');
exit;
}
$error = $result['message'];
@@ -264,7 +264,7 @@ function handleContentEdit(AdminAuth $auth, array $config): void
$realPath = realpath($filePath);
$realContentDir = realpath($contentDir);
if (!$realPath || !$realContentDir || strpos($realPath, $realContentDir) !== 0) {
header('Location: admin.php?route=content');
header('Location: /admin/content');
exit;
}
@@ -405,7 +405,7 @@ function handleContentNew(AdminAuth $auth, array $config): void
}
file_put_contents($filePath, $content);
header('Location: admin.php?route=content&dir=' . urlencode($dir));
header('Location: /admin/content&dir=' . urlencode($dir));
exit;
}
}
@@ -454,14 +454,14 @@ function handleContentDelete(AdminAuth $auth, array $config): void
}
$dir = dirname($file);
header('Location: admin.php?route=content&dir=' . urlencode($dir === '.' ? '' : $dir));
header('Location: /admin/content&dir=' . urlencode($dir === '.' ? '' : $dir));
exit;
}
function handleContentDirCreate(AdminAuth $auth, array $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: admin.php?route=content');
header('Location: /admin/content');
exit;
}
@@ -470,7 +470,7 @@ function handleContentDirCreate(AdminAuth $auth, array $config): void
$subdir = str_replace(['../', '..\\'], '', $subdir);
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: admin.php?route=content&dir=' . urlencode($subdir));
header('Location: /admin/content&dir=' . urlencode($subdir));
exit;
}
@@ -483,7 +483,7 @@ function handleContentDirCreate(AdminAuth $auth, array $config): void
}
}
header('Location: admin.php?route=content&dir=' . urlencode($subdir));
header('Location: /admin/content&dir=' . urlencode($subdir));
exit;
}
@@ -498,7 +498,7 @@ function handleContentDirRename(AdminAuth $auth, array $config): void
$realContentDir = realpath($contentDir);
if (!$realPath || !$realContentDir || strpos($realPath, $realContentDir) !== 0 || !is_dir($fullPath)) {
header('Location: admin.php?route=content');
header('Location: /admin/content');
exit;
}
@@ -518,7 +518,7 @@ function handleContentDirRename(AdminAuth $auth, array $config): void
}
$parentRelative = dirname($dir);
header('Location: admin.php?route=content&dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
header('Location: /admin/content&dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
exit;
}
@@ -540,7 +540,7 @@ function handleContentMove(AdminAuth $auth, array $config): void
$realContentDir = realpath($contentDir);
if (!$realPath || !$realContentDir || strpos($realPath, $realContentDir) !== 0) {
header('Location: admin.php?route=content');
header('Location: /admin/content');
exit;
}
@@ -560,7 +560,7 @@ function handleContentMove(AdminAuth $auth, array $config): void
}
$parentRelative = is_file($fullPath) ? dirname($item) : dirname($item);
header('Location: admin.php?route=content&dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
header('Location: /admin/content&dir=' . urlencode($parentRelative === '.' ? '' : $parentRelative));
exit;
}
@@ -598,7 +598,7 @@ function handleContentDirDelete(AdminAuth $auth, array $config): void
}
$parentDir = dirname($dir);
header('Location: admin.php?route=content&dir=' . urlencode($parentDir === '.' ? '' : $parentDir));
header('Location: /admin/content&dir=' . urlencode($parentDir === '.' ? '' : $parentDir));
exit;
}
@@ -833,7 +833,7 @@ function handlePluginConfig(AdminAuth $auth, array $config): void
$messageType = '';
if (empty($pluginName) || !is_dir($pluginPath)) {
header('Location: admin.php?route=plugins');
header('Location: /admin/plugins');
exit;
}
@@ -878,7 +878,7 @@ function handlePluginEdit(AdminAuth $auth, array $config): void
$messageType = '';
if (empty($pluginName) || !is_dir($pluginPath) || !file_exists($pluginFile)) {
header('Location: admin.php?route=plugins');
header('Location: /admin/plugins');
exit;
}
@@ -954,7 +954,7 @@ function handlePluginNew(AdminAuth $auth, array $config): void
file_put_contents($pluginPath . '/README.md', $readme);
}
header('Location: admin.php?route=plugins');
header('Location: /admin/plugins');
exit;
}
}
@@ -968,7 +968,7 @@ function handlePluginNew(AdminAuth $auth, array $config): void
function handlePluginToggle(AdminAuth $auth, array $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: admin.php?route=plugins');
header('Location: /admin/plugins');
exit;
}
@@ -977,7 +977,7 @@ function handlePluginToggle(AdminAuth $auth, array $config): void
$pluginPath = $pluginsDir . '/' . $pluginName;
if (empty($pluginName) || !is_dir($pluginPath)) {
header('Location: admin.php?route=plugins');
header('Location: /admin/plugins');
exit;
}
@@ -992,14 +992,14 @@ function handlePluginToggle(AdminAuth $auth, array $config): void
}
}
header('Location: admin.php?route=plugins');
header('Location: /admin/plugins');
exit;
}
function handlePluginDelete(AdminAuth $auth, array $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: admin.php?route=plugins');
header('Location: /admin/plugins');
exit;
}
@@ -1008,7 +1008,7 @@ function handlePluginDelete(AdminAuth $auth, array $config): void
$pluginPath = $pluginsDir . '/' . $pluginName;
if (empty($pluginName) || !is_dir($pluginPath)) {
header('Location: admin.php?route=plugins');
header('Location: /admin/plugins');
exit;
}
@@ -1021,7 +1021,7 @@ function handlePluginDelete(AdminAuth $auth, array $config): void
rmdir($pluginPath);
}
header('Location: admin.php?route=plugins');
header('Location: /admin/plugins');
exit;
}