Security fixes n.a.v. pentest op noorlander.info

- CSRF token toegevoegd aan admin login formulier
- Directory listing uitgeschakeld (Options -Indexes)
- Secure/SameSite=Strict cookie verbeterd in AdminAuth
- app.js.backup en source maps verwijderd
- Version disclosure configureerbaar via config.json
- .map en backup extensies geblokkeerd in .htaccess

admin/src/AdminAuth.php

@@ -39,12 +39,15 @@ class AdminAuth
     {
         if (session_status() === PHP_SESSION_NONE) {
             $timeout = $this->adminConfig['security']['session_timeout'] ?? 1800;
+            $isHttps = !empty($_SERVER['HTTPS'])
+                || (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https')
+                || (isset($_SERVER['HTTP_X_FORWARDED_SSL']) && $_SERVER['HTTP_X_FORWARDED_SSL'] === 'on');
             session_set_cookie_params([
                 'lifetime' => $timeout,
                 'path' => '/',
-                'secure' => isset($_SERVER['HTTPS']),
+                'secure' => $isHttps,
                 'httponly' => true,
-                'samesite' => 'Lax'
+                'samesite' => 'Strict'
             ]);
             session_start();
         }
@@ -139,6 +142,11 @@ class AdminAuth
         return isset($_SESSION['admin_csrf_token']) && hash_equals($_SESSION['admin_csrf_token'], $token);
     }
 
+    public function regenerateCsrfToken(): void
+    {
+        $_SESSION['admin_csrf_token'] = bin2hex(random_bytes(32));
+    }
+
     // --- User Management ---
 
     public function getUsers(): array

admin/templates/login.php

@@ -27,6 +27,7 @@
                         </div>
                     <?php endif; ?>
                     <form method="POST" action="admin.php?route=login">
+                        <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken) ?>">
                         <div class="mb-3">
                             <label for="username" class="form-label">Gebruikersnaam</label>
                             <div class="input-group">