E.Noorlander/CodePress
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Clean URLs and security improvements

Browse Source 
- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route)
- Add PHP dev server router with clean URL support
- Update admin template asset paths to absolute for clean URL compat
- All pentest fixes verified: CSRF on login, directory listing disabled,
  secure cookies, backup/sourcemap files removed, version disclosure off
This commit is contained in:
E.Noorlander
2026-07-14 15:28:53 +02:00
parent 3d397b38b4
commit caa335a319
24 changed files with 233 additions and 205 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/templates/pages/users.php
+3 -3
View File
@@ -29,7 +29,7 @@
<td class="text-muted"><?= htmlspecialchars($u['created']) ?></td>
<td>
<!-- Change password -->
<form method="POST" action="admin.php?route=users" class="d-inline">
<form method="POST" action="/admin/users" class="d-inline">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="change_password">
<input type="hidden" name="pw_username" value="<?= htmlspecialchars($u['username']) ?>">
@@ -41,7 +41,7 @@
</div>
</form>
<?php if ($u['username'] !== $user['username']): ?>
<form method="POST" action="admin.php?route=users" class="d-inline ms-1" onsubmit="return confirm('Weet je zeker dat je deze gebruiker wilt verwijderen?')">
<form method="POST" action="/admin/users" class="d-inline ms-1" onsubmit="return confirm('Weet je zeker dat je deze gebruiker wilt verwijderen?')">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="delete">
<input type="hidden" name="delete_username" value="<?= htmlspecialchars($u['username']) ?>">
@@ -64,7 +64,7 @@
<div class="card shadow-sm">
<div class="card-header"><i class="bi bi-person-plus"></i> Gebruiker toevoegen</div>
<div class="card-body">
<form method="POST" action="admin.php?route=users">
<form method="POST" action="/admin/users">
<input type="hidden" name="csrf_token" value="<?= $csrf ?>">
<input type="hidden" name="action" value="add">
<div class="mb-3">