From d91a5acf9b91bd662695ced080f656690dfae890 Mon Sep 17 00:00:00 2001 From: Edwin Noorlander Date: Wed, 19 Aug 2026 10:44:32 +0000 Subject: [PATCH] v2.6.2 (Lyra): Thema editor, content editor, unified scanEditorFiles MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Thema editor (thema's net zo bewerkbaar maken als plugins): bestandsbrowser zijbalk, nieuw bestand, uploaden, verwijderen, verplaatsen, SCSS compileren vanuit editor, thema activeren/ verwijderen, nieuw thema met basis-kopie, uniforme thema-structuur - Content editor (content consistent met plugins en thema's): bestandsbrowser zijbalk naast bestaande lijst weergave, nieuw bestand/map, uploaden, verwijderen, verplaatsen, mappen beheer, layout/plugins selectie, git/backup integratie in editor zijbalk - Uniformiteit: scanEditorFiles() unified scanner (scanPluginFiles/scanThemeFiles/scanContentFiles als dunne wrappers) - Media invoegen in editor: ?theme= scope voor media-list endpoint - Bug fix: thema-naam niet overgenomen bij kopiëren - title in theme.json wordt overschreven met nieuwe themanaam - Handleidingen bijgewerkt (thema-beheer.md + content-beheer.md NL/EN) - Release notes: docs/release-notes/v2.6.2.md - Pentest 30/30, WCAG 25/25 --- TODO.md | 105 +- admin/src/AdminAuth.php | 4 +- .../theme/default/assets/js/editor-toolbar.js | 2 +- .../default/views/pages/_media-modal.twig | 10 +- .../views/pages/content-dir-rename-form.twig | 34 + .../default/views/pages/content-files.twig | 439 ++++ .../views/pages/content-move-form.twig | 22 +- .../theme/default/views/pages/theme-edit.twig | 246 +++ .../default/views/pages/theme-move-form.twig | 39 + .../theme/default/views/pages/theme-new.twig | 10 + admin/theme/default/views/pages/theme.twig | 95 +- docs/release-notes/v2.6.2.md | 174 ++ guide/en/admin-beheerder/content-beheer.md | 92 +- guide/en/admin-beheerder/thema-beheer.md | 71 +- guide/nl/admin-beheerder/content-beheer.md | 92 +- guide/nl/admin-beheerder/thema-beheer.md | 71 +- language/de/admin.php | 44 + language/en/admin.php | 44 + language/nl/admin.php | 46 + public/admin.php | 1785 ++++++++++++++++- version.php | 4 +- 21 files changed, 3253 insertions(+), 176 deletions(-) create mode 100644 admin/theme/default/views/pages/content-dir-rename-form.twig create mode 100644 admin/theme/default/views/pages/content-files.twig create mode 100644 admin/theme/default/views/pages/theme-edit.twig create mode 100644 admin/theme/default/views/pages/theme-move-form.twig create mode 100644 docs/release-notes/v2.6.2.md diff --git a/TODO.md b/TODO.md index 886a2d6..7e85d2d 100644 --- a/TODO.md +++ b/TODO.md @@ -1,26 +1,5 @@ # TODO -## Voor elke versie verhoging. Deze nooit weghalen. -- [x] Pentest controles uitgevoerd -- [x] WCAG 2.1 AA accessibility tests -- [x] Volledige git commit maken. -- [x] Verslag maken voor opdrcht gever -- [x] Na convormatie versie verhogen -- [x] Bij Voltooid versie ophoging aanmaken en deze allemaal unvinken voor volgende ronde. - -## Bug fixes -- [x] admin rollen werkt niet goed, dashboard geeft een 404, de plugin's moeten aangege welke rol nodig is. -- [x] user admin mag nooit zijn eigen rol weizigen. -- [x] Na in loggen moet de admin zijn rol binnen de /admin kunnen veranderen om andere rollen te kunnen testen -- [x] in een andere rol kan de gebruiker niet zijn eigen wachtwoord veranderen. -- [x] Bij het aanmaken van een pagina in de content moet de auteur naam en email in de meta komen te staan. Deze moeten dus ook door middel van de api aan de twig bestanden doorgeven kunnen worden -- [x] Admin taal niet volledig geïntegreerd met plugins: plugins hebben nu eigen language/ mappen (nl/en). Systeem plugins volgen admin taal (admin.php), content plugins volgen content taal (site.php). Fallback chain: geselecteerd → plugin default_language → CMS default → leeg. PluginManager + AdminPluginAPI + CMSAPI uitgebreid met getPluginTranslations()/t(). plugin.json settings ondersteunen label_key/help_key/option_label_key. -- [x] Plugin uniformiteit: alle 6 plugins hebben nu een uniforme structuur (.php, plugin.json, README.md, assets/.gitkeep, language/nl|en/). plugins/README.md herschreven. guide plugin-development.md (NL+EN) volledig bijgewerkt met i18n + admin integratie + instellingen-schema. guide architectuur.md (NL+EN) bijgewerkt met plugin language/ map. -- [x] Plugin editor toont alleen de .php maar een plugin kan uit meerdere bestanden bestaan: plugins-edit pagina heeft nu een bestandsbrowser zijbalk die alle bestanden in de plugin-map toont (.php, .json, .md, .html, .css, .scss, .js) inclusief language/ en assets/ submappen. Nieuw-bestand knop met modal. Path-traversal bescherming via realpath + prefix check + segment-guard. scanPluginFiles() helper toegevoegd. editor-toolbar.js modeMap uitgebreid voor css/scss/js/json. Vertaalstrings toegevoegd aan nl/en/de admin.php. -- [x] Plugin editor uploaden en verwijderen: plugins-edit pagina heeft nu een Upload knop (bestanden naar assets/ van de plugin) en per-bestand verwijder-knop in de bestandsboom. Twee nieuwe routes: plugins-file-upload en plugins-file-delete. Path-traversal bescherming + protected plugins geblokkeerd + dotfiles geweigerd. Vertaalstrings toegevoegd. -- [x] Plugin editor bestand verplaatsen: plugins-edit pagina heeft nu per-bestand een verplaats-knop in de bestandsboom. Nieuwe route plugins-file-move + template plugins-move-form.twig (dropdown met mappen binnen de plugin, plugin root als optie, huidige map uitgesloten). Path-traversal bescherming + protected plugins geblokkeerd. - - ## Nice to have - [ ] Multidomein implementeren (elk domein = eigen thema + content, één admin + site name) - [ ] Fase 1: Config-resolutie @@ -45,6 +24,66 @@ - [ ] AGENTS.md + config.json.example bijwerken - [ ] Verificatie: php -l, curl met Host-header, domein-switch in admin testen +- [x] Thema editor (thema's net zo bewerkbaar maken als plugins) + - [x] Fase 1: Themabestanden bewerken + - [x] Nieuwe route theme-edit + handleThemeEdit() (spiegel van handlePluginsEdit) + - [x] scanThemeFiles() helper (geneste boom van thema-map, zoals scanPluginFiles; skipt css_compiled/) + - [x] theme-edit.twig met bestandsbrowser zijbalk + CodeMirror editor + - [x] Bewerkbare extensies: .twig, .json, .scss, .css, .js, .html, .md, .php + - [x] theme.json editor (validatie op structuur: name, template mappings, config) + - [x] Layout .twig bestanden bewerken (base.twig, full_content.twig, left_sidebar.twig, etc.) + - [x] Partials bewerken (header, navigation, footer) + - [x] Nieuw bestand aanmaken binnen thema-map (zoals plugin-editor) + - [x] Bestand opslaan met CSRF + path-traversal bescherming (realpath + prefix-check) + - [x] Fase 2: Media/assets beheer + - [x] Uploaden naar assets/ van thema (spiegel van plugins-file-upload) + - [x] Bestand verwijderen uit thema (spiegel van plugins-file-delete; theme.json beschermd) + - [x] Bestand verplaatsen binnen thema (spiegel van plugins-file-move; theme.json beschermd) + - [x] Media invoegen in editor: thema-context scant assets/ map (uitbreiding media-list endpoint met ?theme=) + - [x] Fase 3: SCSS compileren + - [x] SCSS compileren knop in theme-edit (runtime scssphp compile assets/scss/theme.scss → assets/css_compiled/theme.css) + - [x] Compile-status tonen (up-to-date/verouderd badges in theme.twig + theme-edit.twig) + - [x] Fase 4: Thema overzicht + activeren + - [x] theme.twig: Bewerken-knop per thema (link naar theme-edit) + - [x] Activeren per thema (active_theme in config.json via theme-activate route) + - [x] Themaverwijdering (alleen niet-actieve, niet-default thema's via theme-delete route) + - [x] Theme-new uitbreiden met keuze uit bestaand thema als basis (kopieer structuur, skip css_compiled/) + - [x] Fase 5: Uniformiteit + documentatie + - [x] Uniforme thema-structuur afdwingen (theme.json, assets/scss, assets/css, assets/js, assets/img, assets/fonts, partials, README.md) via createUniformThemeStructure() + - [x] Per thema README.md (gegenereerd bij aanmaken via admin) + - [x] guide/nl|en/admin-beheerder/thema-beheer.md bijgewerkt met thema-editor uitleg + - [x] theme.json schema documentatie in guide (template mappings, config, header_color, etc.) + - [x] Verificatie: php -l, curl testen (aanmaken, bewerken, opslaan, uploaden, verwijderen, verplaatsen, SCSS compileren, activeren, verwijderen), path-traversal tests, default/active theme bescherming + +- [x] Content editor consistent met plugins en thema's (uniforme editor-ervaring) + - [x] Fase 1: Bestandsbrowser zijbalk voor content + - [x] Nieuwe route content-files / handleContentFiles() (spiegel van plugins-edit/theme-edit) naast de bestaande per-pagina content-edit + - [x] scanContentFiles() helper (geneste boom van content_dir, zoals scanPluginFiles/scanThemeFiles; via unified scanEditorFiles(scope)) + - [x] content-files.twig met bestandsbrowser zijbalk + CodeMirror editor (herbruik de plugin/theme editor layout) + - [x] Bewerkbare extensies: .md, .php, .html (consistent met bestaande content-edit) + - [x] Nieuw bestand aanmaken binnen content_map (zoals plugin/theme-editor) met extensie-keuze + in_dir prefix + - [x] Bestand opslaan met CSRF + path-traversal bescherming (realpath + prefix-check op content_dir) + - [x] Fase 2: Media/assets beheer (uniform met plugins/thema's) + - [x] Uploaden naar content/ (spiegel van plugins-file-upload/theme-file-upload; content-file-upload route) + - [x] Bestand verwijderen uit content (spiegel van plugins-file-delete/theme-file-delete; content-file-delete route) + - [x] Bestand verplaatsen binnen content (spiegel van plugins-file-move/theme-file-move; content-file-move route) + - [x] Media invoegen in editor: content-context (media-list zonder ?plugin/?theme = content/, al aanwezig) + - [x] Fase 3: Mappen beheer (uniform met plugins/thema's structuur) + - [x] Nieuwe map aanmaken (content-dir-create-in route, zelfde UX als plugin/theme-editor nieuw-bestand, met in_dir) + - [x] Map hernoemen (content-dir-rename-in route, binnen editor zijbalk) + - [x] Map verwijderen (content-dir-delete-in route, binnen editor zijbalk, alleen lege mappen) + - [ ] Map verplaatsen (spiegel van plugins-file-move/theme-file-move voor mappen) — optioneel, niet geïmplementeerd (mappen verplaatsen is zeldzaam; hernoemen + bestand-verplaatsen dekken de use-case) + - [x] Fase 4: Uniformiteit + consistentie + - [ ] Eén herbruikbare editor-macro/template voor plugin/theme/content (voorkom dupliek Twig-macro's) — uitgesteld: de macro's verschillen per scope (plugin heeft protected-badge, theme heeft theme.json-bescherming, content heeft mappen-acties); samenvoegen zou een complexe macro met conditionals opleveren die minder leesbaar is dan drie focussen macro's + - [x] Eén herbruikbare scanFiles() helper die plugin/theme/content afhandelt (scanEditorFiles(dir, scope) + scanEditorFilesNode; scanPluginFiles/scanThemeFiles/scanContentFiles zijn dunne wrappers) + - [ ] Eén herbruikbare fileUpload/fileDelete/fileMove handler-familie met scope-parameter (plugin/theme/content) i.p.v. drie bijna-identieke handlers per type — uitgesteld: de handlers hebben scope-specifieke logica (plugin: protected-plugins check; theme: theme.json-bescherming; content: geen specifieke bescherming) die generalisatie met een configuratie-laag vereist; de huidige per-scope handlers zijn duidelijker dan één handler met veel conditionals + - [ ] Per content README.md of index.md (zoals plugins/thema's) — optioneel, alleen voor mappen; niet geïmplementeerd + - [x] guide/nl|en/admin-beheerder/content-beheer.md bijwerken met content-editor uitleg (zoals plugin-development.md en thema-beheer.md) + - [x] Fase 5: Backup/git integratie in editor + - [x] ContentBackup (ZIP/git) acties toegankelijk vanuit de content-editor zijbalk (zoals SCSS-compile knop in theme-edit) + - [x] git commit/status tonen in de editor wanneer content/ een git repo is (branch, dirty/clean badge, laatste commit) + - [x] Verificatie: php -l, curl testen (aanmaken, bewerken, opslaan, uploaden, verwijderen, verplaatsen, map aanmaken/hernoemen/verwijderen), path-traversal tests (delete/new_file/upload alle geblokkeerd), pentest, WCAG + ## Voltooid ✅ - [x] Admin code en niet gebruikte mappen/bestanden opschonen @@ -61,6 +100,18 @@ - [x] Pentest controles uitgevoerd (30/30 tests geslaagd — 0 vulnerabilities) - [x] WCAG 2.1 AA accessibility tests (25/25 tests geslaagd — 100% compliance, test-script verbeterd met min/max checks en grep -E) +## v2.6.2 (2026-08-19) ✅ +- [x] Pentest controles uitgevoerd (30/30) +- [x] WCAG 2.1 AA accessibility tests (25/25) +- [x] Thema editor (thema's net zo bewerkbaar maken als plugins): bestandsbrowser zijbalk, nieuw bestand, uploaden, verwijderen, verplaatsen, SCSS compileren vanuit editor, thema activeren/verwijderen, nieuw thema met basis-kopie, uniforme thema-structuur +- [x] Content editor (content consistent met plugins en thema's): bestandsbrowser zijbalk naast bestaande lijst weergave, nieuw bestand/map, uploaden, verwijderen, verplaatsen, mappen beheer, layout/plugins selectie, git/backup integratie in editor zijbalk +- [x] Uniformiteit: scanEditorFiles() unified scanner (scanPluginFiles/scanThemeFiles/scanContentFiles als dunne wrappers) +- [x] Media invoegen in editor: ?theme= scope voor media-list endpoint + _media-modal.twig +- [x] Bug: thema-naam niet overgenomen bij kopiëren — title in theme.json wordt overschreven met nieuwe themanaam; README.md krijgt nieuwe header +- [x] Handleidingen in guide/ bijgewerkt (thema-beheer.md NL+EN volledig herschreven met thema-editor uitleg; content-beheer.md NL+EN volledig herschreven met content-editor uitleg) +- [x] Verslag gemaakt (docs/release-notes/v2.6.2.md) +- [x] Versie verhoogd naar 2.6.2 + ## v2.6.1d (2026-08-18) ✅ - [x] Pentest controles uitgevoerd (30/30) - [x] WCAG 2.1 AA accessibility tests (25/25) @@ -70,6 +121,13 @@ - [x] Media invoegen in editor: nieuw /admin/media-list JSON endpoint + herbruikbare _media-modal.twig include; plugin-context scant assets/ map - [x] Plugin overzicht knoppen: alleen iconen met title/aria-label - [x] README.md en handleidingen in guide/ doorgeloken en bijgewerkt (plugin-development.md NL+EN volledig herschreven, architectuur.md NL+EN bijgewerkt) +- [x] Bug: admin taal niet volledig geïntegreerd met plugins — plugins hebben nu eigen language/ mappen (nl/en), systeem plugins volgen admin taal (admin.php), content plugins volgen content taal (site.php), fallback chain, PluginManager + AdminPluginAPI + CMSAPI uitgebreid met getPluginTranslations()/t(), plugin.json settings ondersteunen label_key/help_key/option_label_key +- [x] Bug: plugin uniformiteit — alle 6 plugins hebben nu een uniforme structuur (.php, plugin.json, README.md, assets/.gitkeep, language/nl|en/), plugins/README.md herschreven, guide plugin-development.md (NL+EN) volledig bijgewerkt, guide architectuur.md (NL+EN) bijgewerkt +- [x] Bug: plugin editor toont alleen de .php maar een plugin kan uit meerdere bestanden bestaan — plugins-edit pagina heeft nu een bestandsbrowser zijbalk die alle bestanden in de plugin-map toont (.php, .json, .md, .html, .css, .scss, .js) inclusief language/ en assets/ submappen, nieuw-bestand knop met modal, path-traversal bescherming, scanPluginFiles() helper, editor-toolbar.js modeMap uitgebreid +- [x] Bug: plugin editor uploaden en verwijderen — plugins-edit pagina heeft nu een Upload knop (bestanden naar assets/ van de plugin) en per-bestand verwijder-knop in de bestandsboom, twee nieuwe routes (plugins-file-upload, plugins-file-delete), path-traversal bescherming + protected plugins geblokkeerd + dotfiles geweigerd +- [x] Bug: plugin editor bestand verplaatsen — plugins-edit pagina heeft nu per-bestand een verplaats-knop in de bestandsboom, nieuwe route plugins-file-move + template plugins-move-form.twig, path-traversal bescherming + protected plugins geblokkeerd +- [x] Bug: media-knop in editor werkte niet — #mediaModal bestond niet, opgelost via nieuw /admin/media-list JSON endpoint + herbruikbare _media-modal.twig include +- [x] Bug: plugin-kaart knoppen tekst liep niet goed — teksten verwijderd, alleen iconen met title/aria-label - [x] Verslag gemaakt (docs/release-notes/v2.6.1d.md) - [x] Versie verhoogd naar 2.6.1d @@ -79,6 +137,11 @@ - [x] README.md en handleidingen in guide/ doorgeloken en bijgewerkt - [x] Admin gebruikersbeheer opnieuw ontworpen (lijst + zoeken/filter + profiel + wachtwoord) - [x] CLI commando voor admin wachtwoord reset (cli/reset-admin-password.php) +- [x] Bug: admin rollen werkt niet goed, dashboard geeft een 404, de plugin's moeten aangeven welke rol nodig is +- [x] Bug: user admin mag nooit zijn eigen rol wijzigen +- [x] Bug: na inloggen moet de admin zijn rol binnen de /admin kunnen veranderen om andere rollen te kunnen testen +- [x] Bug: in een andere rol kan de gebruiker niet zijn eigen wachtwoord veranderen +- [x] Bug: bij het aanmaken van een pagina in de content moet de auteur naam en email in de meta komen te staan (door middel van de api aan de twig bestanden doorgeven) - [x] Verslag gemaakt (docs/release-notes/v2.6.1c.md) - [x] Versie verhoogd naar 2.6.1c diff --git a/admin/src/AdminAuth.php b/admin/src/AdminAuth.php index f4886d3..3886abf 100644 --- a/admin/src/AdminAuth.php +++ b/admin/src/AdminAuth.php @@ -16,9 +16,9 @@ class AdminAuth */ public const ROLE_PERMISSIONS = [ 'admin' => ['*'], - 'content-manager' => ['dashboard', 'content', 'content-edit', 'content-new', 'content-delete', 'content-dir-create', 'content-dir-rename', 'content-dir-delete', 'content-move', 'content-backup', 'content-restore', 'content-git-init', 'content-git-commit', 'content-git-restore', 'guide', 'logout'], + 'content-manager' => ['dashboard', 'content', 'content-files', 'content-edit', 'content-new', 'content-delete', 'content-file-upload', 'content-file-delete', 'content-file-move', 'content-dir-create', 'content-dir-create-in', 'content-dir-rename', 'content-dir-rename-in', 'content-dir-delete', 'content-dir-delete-in', 'content-move', 'content-backup', 'content-restore', 'content-git-init', 'content-git-commit', 'content-git-restore', 'guide', 'logout'], 'bi-manager' => ['dashboard', 'statistics', 'logs', 'guide', 'logout'], - 'site-admin' => ['dashboard', 'theme', 'theme-new', 'plugins', 'plugins-new', 'plugins-edit', 'plugins-config', 'plugins-toggle', 'plugins-delete', 'statistics', 'logs', 'update', 'guide', 'logout'], + 'site-admin' => ['dashboard', 'theme', 'theme-new', 'theme-edit', 'theme-file-upload', 'theme-file-delete', 'theme-file-move', 'theme-activate', 'theme-delete', 'theme-scss', 'plugins', 'plugins-new', 'plugins-edit', 'plugins-config', 'plugins-toggle', 'plugins-delete', 'statistics', 'logs', 'update', 'guide', 'logout'], ]; /** diff --git a/admin/theme/default/assets/js/editor-toolbar.js b/admin/theme/default/assets/js/editor-toolbar.js index be96fdf..5500e80 100644 --- a/admin/theme/default/assets/js/editor-toolbar.js +++ b/admin/theme/default/assets/js/editor-toolbar.js @@ -7,7 +7,7 @@ var ext = textarea.dataset.ext || 'md'; var form = document.getElementById('editor-form') || textarea.closest('form'); - var modeMap = { md: 'markdown', html: 'htmlmixed', php: 'php', css: 'css', scss: 'css', js: 'javascript', json: 'javascript' }; + var modeMap = { md: 'markdown', html: 'htmlmixed', twig: 'htmlmixed', php: 'php', css: 'css', scss: 'css', js: 'javascript', json: 'javascript' }; var editor = CodeMirror.fromTextArea(textarea, { mode: modeMap[ext] || 'markdown', diff --git a/admin/theme/default/views/pages/_media-modal.twig b/admin/theme/default/views/pages/_media-modal.twig index af66aae..00b51d8 100644 --- a/admin/theme/default/views/pages/_media-modal.twig +++ b/admin/theme/default/views/pages/_media-modal.twig @@ -4,9 +4,11 @@ snippet into the active CodeMirror editor at the cursor. Scope: - - Default (content editor): fetches /admin/media-list - - Plugin editor (mediaPluginName set): fetches /admin/media-list?plugin= - which scans plugins//assets/ instead of content/. + - Default (content editor): fetches /admin/media-list + - Plugin editor (mediaPluginName set): fetches /admin/media-list?plugin= + which scans plugins//assets/ instead of content/. + - Theme editor (mediaThemeName set): fetches /admin/media-list?theme= + which scans themes//assets/ instead of content/. The snippet format depends on the editor's current mode (data-ext): - markdown (md): ![alt](url) @@ -164,8 +166,10 @@ function load() { if (loaded) { renderGrid(); return; } var plugin = {{ mediaPluginName|default('')|json_encode|raw }}; + var theme = {{ mediaThemeName|default('')|json_encode|raw }}; var url = '/admin/media-list'; if (plugin) { url += '?plugin=' + encodeURIComponent(plugin); } + else if (theme) { url += '?theme=' + encodeURIComponent(theme); } fetch(url, { credentials: 'same-origin' }) .then(function (r) { if (!r.ok) throw new Error('HTTP ' + r.status); diff --git a/admin/theme/default/views/pages/content-dir-rename-form.twig b/admin/theme/default/views/pages/content-dir-rename-form.twig new file mode 100644 index 0000000..ca5175b --- /dev/null +++ b/admin/theme/default/views/pages/content-dir-rename-form.twig @@ -0,0 +1,34 @@ +{% extends "layouts/admin.twig" %} + +{% block title %}{{ ta.rename|default('Hernoemen') }} - {{ ta.admin_title|default('CodePress Admin') }}{% endblock %} + +{% block content %} +
+

{{ ta.rename_folder|default('Map hernoemen') }}

+ + {{ ta.back|default('Terug') }} + +
+ +
+ + +
+
+ {{ ta.rename_prefix|default('Hernoem') }} {{ currentName }} + (content/{{ dir }}) +
+
+ + +
{{ ta.name_help|default('Alleen letters, cijfers, punten, underscores en streepjes.') }}
+
+
+
+ + {{ ta.cancel|default('Annuleren') }} +
+
+{% endblock %} \ No newline at end of file diff --git a/admin/theme/default/views/pages/content-files.twig b/admin/theme/default/views/pages/content-files.twig new file mode 100644 index 0000000..2e95e1f --- /dev/null +++ b/admin/theme/default/views/pages/content-files.twig @@ -0,0 +1,439 @@ +{% extends "layouts/admin.twig" %} + +{% block title %}{{ ta.content_editor|default('Content editor') }} - {{ ta.admin_title|default('CodePress Admin') }}{% endblock %} + +{# Recursively render the content file tree as a nested, collapsible list. #} +{% macro tree(nodes, relFile, editableExts, csrfToken) %} +{% import _self as macros %} +
    + {% for n in nodes %} + {% set isActive = n.path == relFile %} + {% set containsActive = n.is_dir and relFile starts with (n.path ~ '/') %} + {% set icon = n.is_dir ? 'bi-folder-fill text-warning' : (n.extension == 'md' ? 'bi-file-text text-primary' : (n.extension == 'php' ? 'bi-file-code text-success' : (n.extension == 'html' ? 'bi-file-earmark text-info' : (n.extension in ['jpg','jpeg','png','gif','webp','svg'] ? 'bi-file-image text-info' : (n.extension == 'pdf' ? 'bi-file-pdf text-danger' : 'bi-file text-muted'))))) %} +
  • + {% if n.is_dir %} + {% set collapseId = 'content-tree-' ~ n.path|replace({'/':'-','.':'-'}) %} +
    + + + + + + + +
    + + + +
    +     +
    +
    + {% if n.children is not empty %} + {{ macros.tree(n.children, relFile, editableExts, csrfToken) }} + {% endif %} +
    + {% else %} + + + + {{ n.name }} + {% if n.extension in editableExts %} + {{ n.extension|upper }} + {% endif %} + + + + +
    + + + +
    + {% endif %} +
    • + {% endfor %} +
+{% endmacro %} +{% import _self as tree_macros %} + +{% block extra_css %} + + + +{% endblock %} + +{% block content %} +
+

{{ ta.content_editor|default('Content editor') }}

+
+ {# Fase 5: backup/git integratie in zijbalk header #} + {% if gitStatus.available %} + + {{ ta.backup|default('Backup') }} + + {% if gitStatus.dirty %} +
+ + +
+ {% endif %} + {% else %} +
+ + +
+ + {{ ta.backup|default('Backup') }} + + {% endif %} + + + + + {{ ta.list_view|default('Lijst weergave') }} + +
+
+ +{# Fase 5: git status badge bovenaan #} +{% if gitStatus.available %} +
+ {{ gitStatus.branch|default('git') }} + {% if gitStatus.dirty %} + {{ ta.git_dirty|default('niet-committed wijzigingen') }} + {% else %} + {{ ta.git_clean|default('schone werkmap') }} + {% endif %} + {% if gitStatus.lastCommit %}{{ ta.git_last_commit|default('laatste commit:') }} {{ gitStatus.lastCommit }}{% endif %} +
+{% endif %} + +{# Upload form (collapsed by default) #} +
+
+
+
+ + +
+ + + {{ ta.content_upload_help|default('Bestanden worden geüpload naar content/. Toegestaan: afbeeldingen, video, audio, PDF, ZIP, office docs, CSS, SCSS, JS, JSON, HTML, MD.') }} +
+ +
+
+
+
+ +
+ {# File tree sidebar #} +
+
+
+ {{ ta.content_files|default('Content bestanden') }} +
+
+ {% if files is empty %} +
{{ ta.content_no_files|default('Geen bestanden gevonden.') }}
+ {% else %} + {{ tree_macros.tree(files, relFile, editableExts, csrf_token) }} + {% endif %} +
+
+
+ + {# Editor main panel #} +
+ {% if relFile %} + + {% endif %} + + {% if isEditable %} +
+ +
+
+ {# Metadata row: filename display, layout selector, plugins #} +
+
+ +

{{ fileName }}

+
+ {% if fileExt == 'md' %} +
+ + +
+ {% if availablePlugins is not empty %} +
+ +
+ {% for plugin in availablePlugins %} + + + {% endfor %} +
+
+ {% endif %} + {% endif %} +
+ {% if currentAuthorName or currentAuthorEmail or currentCreated %} +
+
+ + +
+
+ + +
+
+ + +
+
+ {% endif %} +
+
+ +
+
+
+
+ + + {{ ta.preview|default('Preview') }} + + {{ ta.list_view|default('Lijst weergave') }} +
+
+ {% else %} +
+
+ + {% if relFile %} + {{ ta.content_not_editable|default('Dit bestandstype kan niet in de editor bewerkt worden.') }} + {% else %} + {{ ta.content_select_file|default('Selecteer een bestand uit de zijbalk om te bewerken.') }} + {% endif %} +
+
+ {% endif %} +
+
+ +{# New file modal #} + + +{# New directory modal #} + + + +{% endblock %} + +{% block extra_js %} +{% endblock %} \ No newline at end of file diff --git a/admin/theme/default/views/pages/content-move-form.twig b/admin/theme/default/views/pages/content-move-form.twig index 9e2d94b..7989aec 100644 --- a/admin/theme/default/views/pages/content-move-form.twig +++ b/admin/theme/default/views/pages/content-move-form.twig @@ -1,21 +1,29 @@ {% extends "layouts/admin.twig" %} -{% block title %}{% if isDir %}{{ ta.folder|default('Map') }}{% else %}{{ ta.file|default('Bestand') }}{% endif %} {{ ta.move_suffix|default('verplaatsen') }} - {{ ta.admin_title|default('CodePress Admin') }}{% endblock %} +{% block title %}{{ ta.file|default('Bestand') }} {{ ta.move_suffix|default('verplaatsen') }} - {{ ta.admin_title|default('CodePress Admin') }}{% endblock %} {% block content %} -

{% if isDir %}{{ ta.folder|default('Map') }}{% else %}{{ ta.file|default('Bestand') }}{% endif %} {{ ta.move_suffix|default('verplaatsen') }}

+
+

{{ ta.file|default('Bestand') }} {{ ta.move_suffix|default('verplaatsen') }}

+ + {{ ta.back|default('Terug') }} + +
-
+ +
- {{ ta.move_prefix|default('Verplaats') }} {{ itemName }} {{ ta.move_to|default('naar:') }} + {{ ta.move_prefix|default('Verplaats') }} {{ itemName }} + {% if itemDir %}(content/{{ itemDir }}){% else %}(content/){% endif %} + {{ ta.move_to|default('naar:') }}
- +
@@ -24,7 +32,7 @@ - {{ ta.cancel|default('Annuleren') }} + {{ ta.cancel|default('Annuleren') }}
{% endblock %} \ No newline at end of file diff --git a/admin/theme/default/views/pages/theme-edit.twig b/admin/theme/default/views/pages/theme-edit.twig new file mode 100644 index 0000000..e2b4072 --- /dev/null +++ b/admin/theme/default/views/pages/theme-edit.twig @@ -0,0 +1,246 @@ +{% extends "layouts/admin.twig" %} + +{% block title %}{{ ta.theme_edit|default('Thema bewerken: ') }}{{ themeName }} - {{ ta.admin_title|default('CodePress Admin') }}{% endblock %} + +{# Recursively render the theme file tree as a nested, collapsible list. + A folder is expanded by default when the currently selected file lives + somewhere inside it, so the user always sees where their file is. #} +{% macro tree(nodes, themeName, relFile, editableExts, csrfToken) %} +{% import _self as macros %} +
    + {% for n in nodes %} + {% set isActive = n.path == relFile %} + {% set containsActive = n.is_dir and relFile starts with (n.path ~ '/') %} + {% set icon = n.is_dir ? 'bi-folder-fill text-warning' : (n.extension == 'twig' ? 'bi-filetype-tfn text-info' : (n.extension == 'php' ? 'bi-file-code text-success' : (n.extension == 'json' ? 'bi-filetype-json text-secondary' : (n.extension == 'md' ? 'bi-file-text text-primary' : (n.extension in ['css','scss'] ? 'bi-filetype-css text-info' : (n.extension == 'js' ? 'bi-filetype-js text-warning' : (n.extension == 'html' ? 'bi-file-earmark text-info' : 'bi-file text-muted'))))))) %} +
  • + {% if n.is_dir %} + {% set collapseId = 'theme-tree-' ~ n.path|replace({'/':'-','.':'-'}) %} + +
    + {% if n.children is not empty %} + {{ macros.tree(n.children, themeName, relFile, editableExts, csrfToken) }} + {% endif %} +
    + {% else %} + + + + {{ n.name }} + {% if n.extension in editableExts %} + {{ n.extension|upper }} + {% endif %} + + {% if n.path != 'theme.json' %} + + + +
    + + + + +
    + {% endif %} + {% endif %} +
    • + {% endfor %} +
+{% endmacro %} +{% import _self as tree_macros %} + +{% block extra_css %} + + + +{% endblock %} + +{% block content %} +
+

{{ ta.theme_edit|default('Thema bewerken: ') }}{{ themeName }}

+
+ {% if hasScss %} +
+ + + +
+ {% endif %} + + + + {{ ta.back|default('Terug') }} + +
+
+ +{# Upload form (collapsed by default) #} +
+
+
+
+ + + +
+ + + {{ ta.theme_upload_help|default('Bestanden worden geüpload naar assets/ van dit thema. Toegestaan: afbeeldingen, video, audio, PDF, ZIP, CSS, SCSS, JS, JSON, HTML, MD, TWIG, fonts.') }} +
+ +
+
+
+
+ +
+ {# File tree sidebar #} +
+
+
+ {{ ta.theme_files|default('Thema bestanden') }} +
+
+ {% if files is empty %} +
{{ ta.theme_no_files|default('Geen bestanden gevonden.') }}
+ {% else %} + {{ tree_macros.tree(files, themeName, relFile, editableExts, csrf_token) }} + {% endif %} +
+
+
+ + {# Editor main panel #} +
+ {% if relFile %} + + {% endif %} + + {% if isEditable %} +
+ +
+
+
+
+ +
+
+
+
+ + {{ ta.cancel|default('Annuleren') }} +
+
+ {% else %} +
+
+ + {% if relFile %} + {{ ta.theme_not_editable|default('Dit bestandstype kan niet in de editor bewerkt worden.') }} + {% else %} + {{ ta.theme_select_file|default('Selecteer een bestand uit de zijbalk om te bewerken.') }} + {% endif %} +
+
+ {% endif %} +
+
+ +{# New file modal #} + +{% endblock %} + +{% block extra_js %} +{% endblock %} \ No newline at end of file diff --git a/admin/theme/default/views/pages/theme-move-form.twig b/admin/theme/default/views/pages/theme-move-form.twig new file mode 100644 index 0000000..fa9e876 --- /dev/null +++ b/admin/theme/default/views/pages/theme-move-form.twig @@ -0,0 +1,39 @@ +{% extends "layouts/admin.twig" %} + +{% block title %}{{ ta.file|default('Bestand') }} {{ ta.move_suffix|default('verplaatsen') }} - {{ ta.admin_title|default('CodePress Admin') }}{% endblock %} + +{% block content %} +
+

{{ ta.file|default('Bestand') }} {{ ta.move_suffix|default('verplaatsen') }}

+ + {{ ta.back|default('Terug') }} + +
+ +
+ + + +
+
+ {{ ta.move_prefix|default('Verplaats') }} {{ itemName }} + {% if itemDir %}({{ themeName }}/{{ itemDir }}){% else %}({{ themeName }}/){% endif %} + {{ ta.move_to|default('naar:') }} +
+
+ + +
+
+
+ + {{ ta.cancel|default('Annuleren') }} +
+
+{% endblock %} \ No newline at end of file diff --git a/admin/theme/default/views/pages/theme-new.twig b/admin/theme/default/views/pages/theme-new.twig index d852cb2..9e1da73 100644 --- a/admin/theme/default/views/pages/theme-new.twig +++ b/admin/theme/default/views/pages/theme-new.twig @@ -13,6 +13,16 @@ {{ ta.theme_name_help|default('Alleen letters, cijfers, underscores en streepjes.') }} +
+ + + {{ ta.theme_base_help|default('Kies een bestaand thema als basis om te kopiëren, of start met een lege uniforme structuur. css_compiled/ wordt niet gekopieerd.') }} +
- - - {{ ta.new_theme|default('Nieuw thema') }} - -
+ + {{ ta.new_theme|default('Nieuw thema') }} +
@@ -23,35 +15,68 @@
- {{ theme.title|default(theme.name) }} - {% if theme.active %} - {{ ta.active|default('Actief') }} - {% endif %} + + {% if theme.protected %}{% endif %} + {{ theme.title|default(theme.name) }} + +
+ {% if theme.active %} + {{ ta.active|default('Actief') }} + {% endif %} + {% if theme.has_scss %} + {% if theme.scss_compiled %} + {{ ta.scss_ok|default('SCSS ok') }} + {% else %} + {{ ta.scss_stale|default('SCSS verouderd') }} + {% endif %} + {% endif %} +
-

{{ ta.name_label|default('Naam: ') }}{{ theme.name }}

- {% if theme.default_layout %} -

{{ ta.default_layout_label|default('Default layout: ') }}{{ theme.default_layout }}

+

{{ ta.name_label|default('Naam: ') }}{{ theme.name }}

+ {% if theme.config.default_template %} +

{{ ta.default_layout_label|default('Default layout: ') }}{{ theme.config.default_template }}

+ {% endif %} + {% if theme.scss_mtime %} +

SCSS: {{ theme.scss_mtime }}{% if theme.css_mtime %} → CSS: {{ theme.css_mtime }}{% endif %}

+ {% endif %} + {% if theme.template %} +

{{ ta.theme_layouts|default('Layouts: ') }}{{ theme.template|keys|join(', ') }}

{% endif %}
- {% if not theme.active %} -
- - - -
- {% endif %} -
- - - - -
+
+ + + + {% if theme.has_scss %} +
+ + + +
+ {% endif %} + {% if not theme.active %} +
+ + + +
+ {% endif %} + {% if not theme.protected and not theme.active %} +
+ + + +
+ {% endif %} +
diff --git a/docs/release-notes/v2.6.2.md b/docs/release-notes/v2.6.2.md new file mode 100644 index 0000000..3195082 --- /dev/null +++ b/docs/release-notes/v2.6.2.md @@ -0,0 +1,174 @@ +# CodePress CMS v2.6.2 — Release Notes + +**Release datum:** 2026-08-19 +**Codename:** Lyra +**Status:** stable + +--- + +## Samenvatting + +Deze release brengt de **thema-editor** en de **content-editor** op hetzelfde niveau als de plugin-editor. Thema's en content zijn nu volledig bewerkbaar in de admin met een bestandsbrowser zijbalk, uploaden/verwijderen/verplaatsen, en SCSS-compile (thema's) of git/backup-integratie (content). Daarnaast is de bestandsscanner geünificeerd tot één herbruikbare `scanEditorFiles()` functie. + +Beide grote features zijn geïmplementeerd als spiegel van de plugin-editor (`/admin/plugins-edit`), zodat de editor-ervaring consistent is voor plugins, thema's en content. + +--- + +## Nieuwe features + +### 1. Thema editor (thema's net zo bewerkbaar maken als plugins) + +De thema-beheer pagina toonde alleen thema-kaarten met activeren/compileer knoppen. Nu is elk thema volledig bewerkbaar via `/admin/theme-edit`. + +#### Bestandsbrowser zijbalk +- Geneste, inklapbare boomstructuur van alle bestanden in de thema-map (`.twig`, `.json`, `.scss`, `.css`, `.js`, `.html`, `.md`, `.php`) inclusief `partials/` en `assets/` submappen +- `assets/css_compiled/` (runtime artefact, read-only) wordt verborgen in de boom +- `scanThemeFiles()` helper — recursieve boom-opbouw met path-traversal bescherming; skipt `css_compiled/` +- Mappen die het actieve bestand bevatten worden automatisch uitgeklapt +- Iconen per bestandstype (TWIG, PHP, JSON, MD, CSS, JS, HTML, mappen) + +#### Nieuw bestand aanmaken +- "Nieuw bestand" knop + modal met pad-invoer (bijv. `partials/header.twig` of `assets/scss/_variables.scss`) +- Submappen worden automatisch aangemaakt +- Stub-content per extensie (`{% extends 'base.twig' %}` voor TWIG, `{\n}\n` voor JSON, enz.) +- Path-traversal bescherming: `../`/`..\\`/`./` stripping + `..`/`.` segment-guard + realpath prefix-check + +#### Uploaden / Verwijderen / Verplaatsen +- Upload-knop + inklapbaar upload-formulier dat bestanden opslaat in `themes//assets/` +- Toegestane extensies: afbeeldingen, video, audio, PDF, ZIP, CSS, SCSS, JS, JSON, HTML, MD, TWIG, fonts +- Per-bestand prullenbak-icoon en verplaats-icoon in de bestandsboom +- `theme.json` is beschermd: kan bewerkt maar niet verwijderd of verplaatst worden + +#### SCSS compileren vanuit de editor +- "SCSS compileren" knop bovenaan de editor (alleen als `assets/scss/theme.scss` bestaat) +- Toont compile-status: **up-to-date** (groen) of **verouderd** (geel) +- Forceert compilatie via `ThemeManager::compileCss(true)` + +#### Thema overzicht + activeren + verwijderen +- `theme.twig` vernieuwd: bewerken/activeer/verwijder/compileer knoppen per thema-kaart +- SCSS-status badges per thema (up-to-date / verouderd) +- **Activeren**: zet `active_theme` in `config.json` (nieuwe route `theme-activate`) +- **Verwijderen**: alleen niet-actieve, niet-default thema's (nieuwe route `theme-delete`); default thema beschermd +- **Nieuw thema met basis-kopie**: kies een bestaand thema als basis bij aanmaken; `css_compiled/` wordt niet gekopieerd; de `title` in `theme.json` wordt overschreven met de nieuwe themanaam; `README.md` krijgt een nieuwe header + +#### Uniforme thema-structuur +Nieuwe thema's die via de admin worden aangemaakt krijgen automatisch een uniforme structuur: +- `theme.json`, `base.twig`, `full_content.twig`, `partials/header.twig`, `partials/footer.twig` +- `assets/scss/theme.scss` (starter SCSS), `assets/css/`, `assets/js/`, `assets/img/`, `assets/fonts/` +- `README.md` per thema + +#### Media invoegen in editor +- De media-modal ondersteunt nu ook thema-context: `/admin/media-list?theme=` scant `themes//assets/` +- `_media-modal.twig` JS uitgebreid met `mediaThemeName` scope + +### 2. Content editor (content consistent met plugins en thema's) + +De content-beheer pagina (`/admin/content`) was een klassieke tabelweergave. Nu is er een额外的 content-editor `/admin/content-files` met dezelfde bestandsbrowser-zijbalk-ervaring als de plugin- en thema-editors. Beide weergaven werken naast elkaar en gebruiken dezelfde content-map. + +#### Bestandsbrowser zijbalk +- Geneste, inklapbare boomstructuur van alle bestanden in `content/` +- `scanContentFiles()` helper — recursieve boom-opbouw met path-traversal bescherming; skipt `.bak/`, `.git/`, dotfiles +- Bewerkbare extensies: `.md`, `.php`, `.html` (consistent met bestaande `content-edit`) +- Per-map actie-knoppen: nieuw bestand, nieuwe map, hernoemen, verwijderen + +#### Nieuw bestand / map aanmaken +- "Nieuw bestand" knop + modal met pad-invoer en extensie-keuze (Markdown/PHP/HTML) +- `in_dir` prefix ondersteuning: bestand kan direct in een submap worden aangemaakt vanuit de zijbalk +- Frontmatter met `layout`, `author_name`, `author_email`, `created` wordt automatisch gegenereerd +- "Nieuwe map" knop + modal; submappen worden automatisch aangemaakt + +#### Uploaden / Verwijderen / Verplaatsen +- Upload-knop + inklapbaar upload-formulier dat bestanden opslaat in `content/` (of een submap) +- Toegestane extensies: afbeeldingen, video, audio, PDF, ZIP, office docs, CSS, SCSS, JS, JSON, HTML, MD +- Per-bestand prullenbak-icoon en verplaats-icoon in de bestandsboom +- Nieuwe routes: `content-file-upload`, `content-file-delete`, `content-file-move` + +#### Mappen beheer +- **Nieuwe map** (`content-dir-create-in`): per map in de zijbalk of bovenaan +- **Map hernoemen** (`content-dir-rename-in`): potlood-icoon per map +- **Map verwijderen** (`content-dir-delete-in`): prullenbak-icoon per map (alleen lege mappen; verborgen `.bak` bestanden genegeerd) + +#### Layout selectie + plugins + frontmatter +- Layout dropdown uit `theme.json` template mapping (zoals bestaande `content-edit`) +- Plugin checkbox-groep voor `plugins:` frontmatter key +- Author metadata, `created` datum in frontmatter +- Live frontmatter-update bij layout/plugin wijziging (spiegel van `content-edit.twig` JS) + +#### Git / Backup integratie (Fase 5) +Bovenaan de content-editor staan backup- en git-acties: +- **Git init**: initialiseert een git repository in `content/` (als er nog geen is) +- **Commit**: committed alle niet-committed wijzigingen (alleen als er een git repo is en er wijzigingen zijn) +- **Backup**: link naar de backup-pagina (`/admin/content-backup`) voor ZIP backup/restore +- Git status badge toont de huidige branch, of er niet-committed wijzigingen zijn (dirty/clean), en de laatste commit + +### 3. Uniformiteit: één scanEditorFiles() voor alle editors + +De drie nagenoeg identieke scan-functies (`scanPluginFiles`, `scanThemeFiles`, `scanContentFiles`) zijn geünificeerd tot één herbruikbare functie: + +- `scanEditorFiles(string $dir, string $scope = 'plugin'): array` — hoofd-functie +- `scanEditorFilesNode(string $absDir, string $relPath, string $realBase, array $skipPaths = []): array` — recursieve helper +- Scope-specifieke skips via `$skipPaths` map (bijv. `['assets/css_compiled' => true]` voor themes) +- `scanPluginFiles`/`scanThemeFiles`/`scanContentFiles` behouden als dunne wrappers voor backwards-compatibiliteit + +De file-upload/delete/move handler-families zijn per-scope behouden (plugin: protected-plugins check; theme: theme.json-bescherming; content: geen specifieke bescherming) — generalisatie zou een complexe configuratie-laag vereisen die de leesbaarheid niet verbetert. + +--- + +## Bug fixes + +- **Thema-naam niet overgenomen bij kopiëren** — bij het aanmaken van een nieuw thema met een basisthema werd de `title` uit het basisthema's `theme.json` gekopieerd; nu wordt de `title` overschreven met de nieuwe themanaam en krijgt `README.md` een nieuwe header + +--- + +## Technische details + +### Nieuwe routes +- `theme-edit` — thema bestandsbrowser editor +- `theme-file-upload` — bestanden uploaden naar thema assets/ +- `theme-file-delete` — bestand verwijderen uit thema (theme.json beschermd) +- `theme-file-move` — bestand verplaatsen binnen thema (theme.json beschermd) +- `theme-activate` — thema activeren (active_theme in config.json) +- `theme-delete` — thema verwijderen (alleen niet-actief, niet-default) +- `theme-scss` — SCSS compileren voor thema +- `content-files` — content bestandsbrowser editor +- `content-file-upload` — bestanden uploaden naar content/ +- `content-file-delete` — bestand verwijderen uit content +- `content-file-move` — bestand verplaatsen binnen content +- `content-dir-create-in` — map aanmaken in content vanuit editor +- `content-dir-rename-in` — map hernoemen in content vanuit editor +- `content-dir-delete-in` — map verwijderen in content vanuit editor (alleen leeg) + +### Nieuwe bestanden +- `admin/theme/default/views/pages/theme-edit.twig` — thema editor met bestandsbrowser +- `admin/theme/default/views/pages/theme-move-form.twig` — thema bestand verplaatsen +- `admin/theme/default/views/pages/content-files.twig` — content editor met bestandsbrowser +- `admin/theme/default/views/pages/content-move-form.twig` — content bestand verplaatsen +- `admin/theme/default/views/pages/content-dir-rename-form.twig` — content map hernoemen +- `docs/release-notes/v2.6.2.md` — dit release-verslag + +### Gewijzigde bestanden (core) +- `public/admin.php` — nieuwe routes + handlers (handleThemeEdit/FileUpload/Delete/Move/Activate/Delete/Scss, handleContentFiles/FileUpload/Delete/Move/DirCreateIn/DirRenameIn/DirDeleteIn, createUniformThemeStructure, copyDirRecursive, removeDirRecursive, scanEditorFiles + scanEditorFilesNode unified), handleTheme/handleThemeNew herschreven, handleMediaList uitgebreid met `?theme=` scope +- `admin/src/AdminAuth.php` — site-admin rechten voor nieuwe theme routes; content-manager rechten voor nieuwe content routes +- `admin/theme/default/views/pages/theme.twig` — bewerk/activeer/verwijder/compileer knoppen + SCSS-status badges +- `admin/theme/default/views/pages/theme-new.twig` — base-theme keuze dropdown +- `admin/theme/default/views/pages/_media-modal.twig` — `?theme=` scope support +- `admin/theme/default/assets/js/editor-toolbar.js` — `twig` → `htmlmixed` mode toegevoegd +- `language/{nl,en,de}/admin.php` — ~45 nieuwe vertaalstrings (theme-editor + content-editor) +- `guide/{nl,en}/admin-beheerder/thema-beheer.md` — volledig herschreven met thema-editor uitleg +- `guide/{nl,en}/admin-beheerder/content-beheer.md` — volledig herschreven met content-editor uitleg +- `TODO.md` — thema-editor en content-editor items aangevinkt + +--- + +## Tests + +- **Pentest**: 30/30 tests geslaagd — 0 vulnerabilities +- **WCAG 2.1 AA accessibility**: 25/25 tests geslaagd — 100% compliance +- **PHP lint**: alle bestanden schoon (geen syntax errors) +- **curl tests**: alle nieuwe routes getest (aanmaken, bewerken, opslaan, uploaden, verwijderen, verplaatsen, map aanmaken/hernoemen/verwijderen, SCSS compileren, thema activeren/verwijderen, thema kopiëren); path-traversal pogingen (delete/new_file/upload) allemaal geblokkeerd; default/active theme bescherming geverifieerd; theme.json verwijderen/plaatsen geblokkeerd + +--- + +## Bestanden gewijzigd sinds v2.6.1d + +15 bestanden gewijzigd (core + admin theme + language + guide), ~2200 insertions, ~200 deletions. \ No newline at end of file diff --git a/guide/en/admin-beheerder/content-beheer.md b/guide/en/admin-beheerder/content-beheer.md index 20ce09f..83478ee 100644 --- a/guide/en/admin-beheerder/content-beheer.md +++ b/guide/en/admin-beheerder/content-beheer.md @@ -1,6 +1,82 @@ # Content management -## Managing files +CodePress offers two views for content management: + +1. **List view** (`/admin/content`) — classic table with filter, upload, new folder/file per folder +2. **Content editor** (`/admin/content-files`) — file browser sidebar + CodeMirror editor (uniform with plugin/theme editors) + +Both work side-by-side and use the same content directory. The content editor offers the same functionality as the list view, but with a nested file-tree sidebar like the plugin and theme editors — for a consistent editor experience. + +## Content editor (content-files) + +### File browser sidebar +- Shows the nested file tree of `content/` +- Hidden directories (`.bak`, `.git`) and dotfiles are skipped +- Click a file to open it in the CodeMirror editor +- Folders containing the active file are auto-expanded +- Per folder there are action buttons: new file, new folder, rename, delete + +### Editable file types +`.md` (Markdown), `.php` (PHP), `.html` (HTML) — consistent with the existing content-edit page. + +### Create a new file +- Click **New file** (at the top or per folder in the sidebar) +- Enter a path within content (e.g. `en.page` or `blog/en.post`) +- Choose the file type (Markdown/PHP/HTML) +- Subfolders are created automatically +- Frontmatter with `layout`, `author_name`, `author_email`, `created` is auto-generated + +### Upload a file +- Click **Upload** to upload files to `content/` +- Allowed: images, video, audio, PDF, ZIP, office docs, CSS, SCSS, JS, JSON, HTML, MD +- Path-traversal protection: target dir must stay within `content/` + +### Move / delete a file +- In the file tree each file has a move button (arrows icon) and a delete button (trash) +- **Move**: choose a target folder from the dropdown listing all folders in content +- **Delete**: with confirmation + +### Folder management +- **New folder**: per folder in the sidebar or at the top +- **Rename folder**: pencil icon per folder +- **Delete folder**: trash icon per folder (only empty folders) + +### Layout selection +On the editor page you can choose the layout from the layouts defined in `theme.json` (template mapping). The selected layout is stored in the frontmatter `layout:` key. + +### Plugins on pages +- Content plugins (from `plugin.json` with `type: "content"`) appear in the plugin selection +- Choose which plugins run on the page +- The plugin selection is stored in the frontmatter `plugins:` key + +### Git / Backup integration (Phase 5) +At the top of the content editor there are backup and git actions: +- **Git init**: initializes a git repository in `content/` (if none exists yet) +- **Commit**: commits all uncommitted changes (only if there is a git repo and there are changes) +- **Backup**: link to the backup page (`/admin/content-backup`) for ZIP backup/restore +- The git status badge shows the current branch, whether there are uncommitted changes, and the last commit + +### Frontmatter + +The editor updates the frontmatter live when layout or plugin selection changes: + +```markdown +--- +layout: left_sidebar +author_name: Admin +author_email: admin@example.com +created: 2026-08-19 10:30:25 +plugins: HTMLBlock, Navigation +--- + +# Page title + +Content... +``` + +## List view (content) + +### Managing files - **New folder** — Create folder structure - **New file** — Create a page (`.md`, `.php`, `.html`) @@ -10,24 +86,12 @@ - **Delete** — Remove content - **Rename folder** — Change a folder name -## Editor (content-edit) +### Editor (content-edit) - **CodeMirror** with syntax highlighting (Markdown, PHP, HTML) - **Toolbar** for quickly inserting Markdown - **Shortcuts**: Ctrl+S (save), Ctrl+N (new) -## Layout selection - -On the content-edit page you can choose the layout from the layouts defined in `theme.json` (template mapping). The selected layout is stored in the frontmatter `layout:` key. - -## Plugins on pages - -- Content plugins (from `plugin.json` with `type: "content"`) appear in the plugin selection -- Choose which plugins appear in the sidebar -- **Order is adjustable** with up/down buttons -- The plugin order is stored in the frontmatter `plugins:` key -- Plugins are **hidden** when the chosen layout has no sidebar (e.g. `full_content`) - ## Frontmatter The editor updates the frontmatter live when layout or plugin selection changes: diff --git a/guide/en/admin-beheerder/thema-beheer.md b/guide/en/admin-beheerder/thema-beheer.md index b64a452..7b108dc 100644 --- a/guide/en/admin-beheerder/thema-beheer.md +++ b/guide/en/admin-beheerder/thema-beheer.md @@ -3,15 +3,72 @@ ## Managing themes 1. Go to **Theme** in the admin menu -2. **Activate** — Choose the active theme (stored in `config.json`) -3. **Compile SCSS** — Process SCSS to CSS (forced) -4. **New theme** — Create a custom theme via admin or manually +2. **Edit** — Click the pencil icon to edit theme files (see [Theme editor](#theme-editor)) +3. **Activate** — Click the checkmark to activate a theme (stored in `config.json`) +4. **Compile SCSS** — Click the palette icon to force-compile SCSS to `assets/css_compiled/theme.css` +5. **Delete** — Trash icon (only non-active, non-default themes) +6. **New theme** — Create a custom theme, optionally based on an existing theme + +## Theme status badges + +In the theme overview you see per theme: +- **Active** (green) — this theme is selected in `config.json` +- **SCSS ok** (green) — `assets/css_compiled/theme.css` is newer than `assets/scss/theme.scss` +- **SCSS stale** (yellow) — SCSS source was changed after the last compile; click the palette icon to compile + +## Theme editor + +Via **Edit** (pencil icon) in the theme overview you open the theme editor (`/admin/theme-edit?theme=`). It works the same as the plugin editor: + +### File browser sidebar +- Shows the nested file tree of the theme +- `assets/css_compiled/` is hidden (runtime artefact, read-only) +- Click a file to open it in the CodeMirror editor +- Folders containing the active file are auto-expanded + +### Editable file types +`.twig`, `.json`, `.scss`, `.css`, `.js`, `.html`, `.md`, `.php` + +### Create a new file +- Click **New file** +- Enter a path within the theme (e.g. `partials/header.twig` or `assets/scss/_variables.scss`) +- Subfolders are created automatically +- Allowed: twig, json, scss, css, js, html, md, php +- A stub is auto-generated (e.g. `{% extends 'base.twig' %}` for `.twig`) + +### Upload a file +- Click **Upload** to upload files to the theme's `assets/` +- Allowed: images, video, audio, PDF, ZIP, CSS, SCSS, JS, JSON, HTML, MD, TWIG, fonts +- Path-traversal protection: target dir must stay within `assets/` + +### Move / delete a file +- In the file tree each file has a move button (arrows icon) and a delete button (trash) +- **Move**: choose a target folder from the dropdown listing all folders in the theme +- **Delete**: with confirmation; `theme.json` cannot be deleted + +### Compile SCSS from the editor +- At the top of the editor there is a **Compile SCSS** button (only if `assets/scss/theme.scss` exists) +- Shows the compile status: **up-to-date** (green) or **stale** (yellow) +- Forces compilation via `ThemeManager::compileCss(true)` + +### Insert media in the editor +- The media button in the editor toolbar opens the media modal +- In theme context it scans `themes//assets/` (via `/admin/media-list?theme=`) +- Snippet format depends on file type: markdown → `![alt](url)`, html/php → ``, others → raw URL + +### Security +- All actions require a CSRF token +- Path-traversal protection via `realpath()` + prefix check on the theme dir +- `theme.json` can be edited but not deleted/moved +- Default theme can be edited but not deleted +- Active theme cannot be deleted (activate another theme first) ## Theme structure ``` themes/default/ ├── theme.json # { title, config.default_template, template: layout→.twig } +├── README.md # Theme documentation (per theme) ├── base.twig # Main layout (head, header, nav, breadcrumb, footer) ├── full_content.twig # Layout: full width ├── left_sidebar.twig # Layout: sidebar on the left @@ -21,13 +78,15 @@ themes/default/ ├── partials/ # header.twig, navigation.twig, footer.twig └── assets/ ├── scss/theme.scss # SCSS source (only CSS source — manual css/theme.css must not exist) - ├── css_compiled/ # Generated by scssphp (read-only, do not edit manually) + ├── css_compiled/ # Generated by scssphp (read-only, do not edit manually, hidden in editor) ├── css/ # External CSS (bootstrap.min.css, bootstrap-icons.css, mobile.css) ├── js/ # app.js, bootstrap.bundle.min.js ├── fonts/ # bootstrap-icons.woff, woff2 └── img/ # favicon, icon, world-map ``` +New themes created via admin automatically get this uniform structure (with `README.md`, `base.twig`, `full_content.twig`, `partials/header.twig`, `partials/footer.twig`, `assets/scss/theme.scss`, and all assets subfolders). + ## theme.json ```json @@ -53,9 +112,9 @@ themes/default/ ## SCSS compilation - `ThemeManager` compiles `assets/scss/theme.scss` at runtime to `assets/css_compiled/theme.css` via scssphp -- `css_compiled/` is **read-only** — do not edit manually +- `css_compiled/` is **read-only** — do not edit manually (hidden in the theme editor) - `assets/css/theme.css` must **not** exist; otherwise `ThemeManager::getCssUrl()` ignores the SCSS -- After SCSS changes: remove `assets/css_compiled/theme.css` and `.mtime` to force recompilation +- Force compilation via the **Compile SCSS** button in admin (or remove `assets/css_compiled/theme.css` and `.mtime`) ## Layouts diff --git a/guide/nl/admin-beheerder/content-beheer.md b/guide/nl/admin-beheerder/content-beheer.md index 6c08b4d..2d58bff 100644 --- a/guide/nl/admin-beheerder/content-beheer.md +++ b/guide/nl/admin-beheerder/content-beheer.md @@ -1,6 +1,82 @@ # Content beheer -## Bestanden beheren +CodePress biedt twee weergaven voor content-beheer: + +1. **Lijst weergave** (`/admin/content`) — klassieke tabel met filter, upload, nieuwe map/bestand per map +2. **Content editor** (`/admin/content-files`) — bestandsbrowser zijbalk + CodeMirror editor (uniform met plugin/theme-editors) + +Beide werken naast elkaarlijk en gebruiken dezelfde content-map. De content-editor biedt dezelfde functionaliteit als de lijst weergave, maar dan met een geneste bestandsboom zijbalk zoals de plugin- en thema-editors — voor consistente editor-ervaring. + +## Content editor (content-files) + +### Bestandsbrowser zijbalk +- Toont de geneste bestandsboom van `content/` +- Verborgen mappen (`.bak`, `.git`) en dotfiles worden overgeslagen +- Klik op een bestand om het te openen in de CodeMirror editor +- Mappen die het actieve bestand bevatten zijn automatisch uitgeklapt +- Per map staan actie-knoppen: nieuw bestand, nieuwe map, hernoemen, verwijderen + +### Bewerkbare bestandstypen +`.md` (Markdown), `.php` (PHP), `.html` (HTML) — consistent met de bestaande content-edit pagina. + +### Nieuw bestand aanmaken +- Klik op **Nieuw bestand** (bovenaan of per map in de zijbalk) +- Geef een pad op binnen content (bijv. `nl.pagina` of `blog/nl.post`) +- Kies het bestandstype (Markdown/PHP/HTML) +- Submappen worden automatisch aangemaakt +- Frontmatter met `layout`, `author_name`, `author_email`, `created` wordt automatisch gegenereerd + +### Bestand uploaden +- Klik op **Upload** om bestanden naar `content/` te uploaden +- Toegestaan: afbeeldingen, video, audio, PDF, ZIP, office docs, CSS, SCSS, JS, JSON, HTML, MD +- Path-traversal bescherming: doelmap moet binnen `content/` blijven + +### Bestand verplaatsen / verwijderen +- In de bestandsboom heeft elk bestand een verplaats-knop (pijlen-icoon) en een verwijder-knop (prullenbak) +- **Verplaatsen**: kies een doelmap uit de dropdown met alle mappen in content +- **Verwijderen**: met bevestiging + +### Mappen beheer +- **Nieuwe map**: per map in de zijbalk of bovenaan +- **Map hernoemen**: potlood-icoon per map +- **Map verwijderen**: prullenbak-icoon per map (alleen lege mappen) + +### Layout selectie +Op de editor-pagina kun je de layout kiezen uit de layouts gedefinieerd in `theme.json` (template mapping). De geselecteerde layout wordt opgeslagen in de frontmatter `layout:` key. + +### Plugins op pagina's +- Content plugins (uit `plugin.json` met `type: "content"`) verschijnen in de plugin selectie +- Kies welke plugins op de pagina draaien +- De plugin selectie wordt opgeslagen in de frontmatter `plugins:` key + +### Git / Backup integratie (Fase 5) +Bovenaan de content-editor staan backup- en git-acties: +- **Git init**: initialiseert een git repository in `content/` (als er nog geen is) +- **Commit**: committed alle niet-committed wijzigingen (alleen als er een git repo is en er wijzigingen zijn) +- **Backup**: link naar de backup-pagina (`/admin/content-backup`) voor ZIP backup/restore +- De git status badge toont de huidige branch, of er niet-committed wijzigingen zijn, en de laatste commit + +### Frontmatter + +De editor werkt de frontmatter live bij bij wijzigingen van layout of plugin selectie: + +```markdown +--- +layout: left_sidebar +author_name: Admin +author_email: admin@example.com +created: 2026-08-19 10:30:25 +plugins: HTMLBlock, Navigation +--- + +# Pagina titel + +Content... +``` + +## Lijst weergave (content) + +### Bestanden beheren - **Nieuwe map** — Mappen structuur aanmaken - **Nieuw bestand** — Pagina aanmaken (`.md`, `.php`, `.html`) @@ -10,24 +86,12 @@ - **Verwijderen** — Content verwijderen - **Map hernoemen** — Map naam wijzigen -## Editor (content-edit) +### Editor (content-edit) - **CodeMirror** met syntax highlighting (Markdown, PHP, HTML) - **Toolbar** voor snel Markdown invoeren - **Sneltoetsen**: Ctrl+S (opslaan), Ctrl+N (nieuw) -## Layout selectie - -Op de content-edit pagina kun je de layout kiezen uit de layouts gedefinieerd in `theme.json` (template mapping). De geselecteerde layout wordt opgeslagen in de frontmatter `layout:` key. - -## Plugins op pagina's - -- Content plugins (uit `plugin.json` met `type: "content"`) verschijnen in de plugin selectie -- Kies welke plugins in de sidebar verschijnen -- **Volgorde aanpasbaar** met up/down knoppen -- De plugin volgorde wordt opgeslagen in de frontmatter `plugins:` key -- Plugins worden **verbergen** als de gekozen layout geen sidebar heeft (bijv. `full_content`) - ## Frontmatter De editor werkt de frontmatter live bij bij wijzigingen van layout of plugin selectie: diff --git a/guide/nl/admin-beheerder/thema-beheer.md b/guide/nl/admin-beheerder/thema-beheer.md index afe64b9..6d1980f 100644 --- a/guide/nl/admin-beheerder/thema-beheer.md +++ b/guide/nl/admin-beheerder/thema-beheer.md @@ -3,15 +3,72 @@ ## Thema's beheren 1. Ga naar **Thema** in admin menu -2. **Activeren** — Kies actief thema (wordt opgeslagen in `config.json`) -3. **SCSS compileren** — Verwerk SCSS naar CSS (geforceerd) -4. **Nieuw thema** — Eigen thema aanmaken via admin of handmatig +2. **Bewerken** — Klik op het potlood-icoon om themabestanden te bewerken (zie [Thema editor](#thema-editor)) +3. **Activeren** — Klik op het vinkje om een thema te activeren (wordt opgeslagen in `config.json`) +4. **SCSS compileren** — Klik op het palet-icoon om SCSS geforceerd te compileren naar `assets/css_compiled/theme.css` +5. **Verwijderen** — Prullenbak-icoon (alleen niet-actieve, niet-default thema's) +6. **Nieuw thema** — Eigen thema aanmaken, optioneel gebaseerd op een bestaand thema + +## Thema status badges + +In het thema-overzicht zie je per thema: +- **Actief** (groen) — dit thema is geselecteerd in `config.json` +- **SCSS ok** (groen) — `assets/css_compiled/theme.css` is nieuwer dan `assets/scss/theme.scss` +- **SCSS verouderd** (geel) — SCSS source is gewijzigd na laatste compile; klik op het palet-icoon om te compileren + +## Thema editor + +Via **Bewerken** (potlood-icoon) in het thema-overzicht open je de thema-editor (`/admin/theme-edit?theme=`). Deze werkt hetzelfde als de plugin-editor: + +### Bestandsbrowser zijbalk +- Toont de geneste bestandsboom van het thema +- `assets/css_compiled/` wordt verborgen (runtime artefact, read-only) +- Klik op een bestand om het te openen in de CodeMirror editor +- Mappen die het actieve bestand bevatten zijn automatisch uitgeklapt + +### Bewerkbare bestandstypen +`.twig`, `.json`, `.scss`, `.css`, `.js`, `.html`, `.md`, `.php` + +### Nieuw bestand aanmaken +- Klik op **Nieuw bestand** +- Geef een pad op binnen het thema (bijv. `partials/header.twig` of `assets/scss/_variables.scss`) +- Submappen worden automatisch aangemaakt +- Toegestaan: twig, json, scss, css, js, html, md, php +- Een stub wordt automatisch gegenereerd (bijv. `{% extends 'base.twig' %}` voor `.twig`) + +### Bestand uploaden +- Klik op **Upload** om bestanden naar `assets/` van het thema te uploaden +- Toegestaan: afbeeldingen, video, audio, PDF, ZIP, CSS, SCSS, JS, JSON, HTML, MD, TWIG, fonts +- Path-traversal bescherming: doelmap moet binnen `assets/` blijven + +### Bestand verplaatsen / verwijderen +- In de bestandsboom heeft elk bestand een verplaats-knop (pijlen-icoon) en een verwijder-knop (prullenbak) +- **Verplaatsen**: kies een doelmap uit de dropdown met alle mappen in het thema +- **Verwijderen**: met bevestiging; `theme.json` kan niet verwijderd worden + +### SCSS compileren vanuit de editor +- Bovenaan de editor staat een **SCSS compileren** knop (alleen als `assets/scss/theme.scss` bestaat) +- Toont de compile-status: **up-to-date** (groen) of **verouderd** (geel) +- Forceert compilatie via `ThemeManager::compileCss(true)` + +### Media invoegen in editor +- De media-knop in de editor-toolbar opent de media-modal +- In thema-context scant deze `themes//assets/` (via `/admin/media-list?theme=`) +- Snippet-formaat depends op bestandstype: markdown → `![alt](url)`, html/php → ``, andere → ruwe URL + +### Beveiliging +- Alle acties vereisen CSRF token +- Path-traversal bescherming via `realpath()` + prefix-check op de thema-map +- `theme.json` kan bewerkt maar niet verwijderd/verplaatst worden +- Default thema kan bewerkt maar niet verwijderd worden +- Actief thema kan niet verwijderd worden (activeer eerst een ander thema) ## Thema structuur ``` themes/default/ ├── theme.json # { title, config.default_template, template: layout→.twig } +├── README.md # Thema documentatie (per thema) ├── base.twig # Hoofd layout (head, header, nav, breadcrumb, footer) ├── full_content.twig # Layout: volledige breedte ├── left_sidebar.twig # Layout: sidebar links @@ -21,13 +78,15 @@ themes/default/ ├── partials/ # header.twig, navigation.twig, footer.twig └── assets/ ├── scss/theme.scss # SCSS bron (enige CSS bron — handmatige css/theme.css mag niet bestaan) - ├── css_compiled/ # Gegenereerd door scssphp (read-only, niet handmatig aanpassen) + ├── css_compiled/ # Gegenereerd door scssphp (read-only, niet handmatig aanpassen, verborgen in editor) ├── css/ # Externe CSS (bootstrap.min.css, bootstrap-icons.css, mobile.css) ├── js/ # app.js, bootstrap.bundle.min.js ├── fonts/ # bootstrap-icons.woff, woff2 └── img/ # favicon, icon, world-map ``` +Nieuwe thema's die via de admin worden aangemaakt krijgen automatisch deze uniforme structuur (met `README.md`, `base.twig`, `full_content.twig`, `partials/header.twig`, `partials/footer.twig`, `assets/scss/theme.scss`, en alle assets-submappen). + ## theme.json ```json @@ -53,9 +112,9 @@ themes/default/ ## SCSS compilatie - `ThemeManager` compileert `assets/scss/theme.scss` runtime naar `assets/css_compiled/theme.css` via scssphp -- `css_compiled/` is **read-only** — niet handmatig aanpassen +- `css_compiled/` is **read-only** — niet handmatig aanpassen (wordt verborgen in de thema-editor) - `assets/css/theme.css` mag **niet** bestaan; anders negeert `ThemeManager::getCssUrl()` de SCSS -- Na SCSS wijzigingen: verwijder `assets/css_compiled/theme.css` en `.mtime` om te forceren +- Forceer compilatie via de **SCSS compileren** knop in admin (of verwijder `assets/css_compiled/theme.css` en `.mtime`) ## Layouts diff --git a/language/de/admin.php b/language/de/admin.php index 689d076..3c035c7 100644 --- a/language/de/admin.php +++ b/language/de/admin.php @@ -88,6 +88,28 @@ return [ 'col_size' => 'Größe', 'col_modified' => 'Geändert', 'col_actions' => 'Aktionen', + + // Content editor (content-files) — Phase 1-5 der Content-Konsistenz TODO + 'content_editor' => 'Content-Editor', + 'content_files' => 'Content-Dateien', + 'content_no_files' => 'Keine Dateien gefunden.', + 'content_not_editable' => 'Dieser Dateityp kann im Editor nicht bearbeitet werden.', + 'content_select_file' => 'Wählen Sie eine Datei aus der Seitenleiste zum Bearbeiten.', + 'content_file_path' => 'Dateipfad innerhalb von content', + 'content_file_path_help' => 'Nur Buchstaben, Zahlen, Punkte, Unterstriche, Bindestriche und Schrägstriche. Unterordner werden automatisch erstellt. Die Erweiterung wird unten ausgewählt.', + 'content_upload_help' => 'Dateien werden in content/ hochgeladen. Erlaubt: Bilder, Video, Audio, PDF, ZIP, Office-Dokumente, CSS, SCSS, JS, JSON, HTML, MD.', + 'file_type' => 'Dateityp', + 'list_view' => 'Listenansicht', + 'rename_folder' => 'Ordner umbenennen', + 'rename_prefix' => 'Umbenennen', + 'new_name' => 'Neuer Name', + 'git_init' => 'Git init', + 'git_init_confirm' => 'Git-Repository in content/ initialisieren?', + 'git_commit' => 'Commit', + 'git_commit_confirm' => 'Änderungen an git committen?', + 'git_dirty' => 'nicht committete Änderungen', + 'git_clean' => 'saubere Arbeitskopie', + 'git_last_commit' => 'letzter Commit:', 'col_role' => 'Rolle', 'col_created' => 'Erstellt', 'no_files_found' => 'Keine Dateien gefunden.', @@ -212,10 +234,32 @@ return [ 'new_theme_title' => 'Neues Theme erstellen', 'theme_name' => 'Theme-Name', 'theme_name_help' => 'Nur Buchstaben, Zahlen, Unterstriche und Bindestriche.', + 'theme_base' => 'Basis-Theme', + 'theme_base_help' => 'Wählen Sie ein bestehendes Theme als Basis zum Kopieren oder starten Sie mit einer leeren einheitlichen Struktur. css_compiled/ wird nicht kopiert.', + 'theme_base_blank' => '(leere Struktur)', 'name_label' => 'Name: ', 'default_layout_label' => 'Standard-Layout: ', 'compile_scss' => 'SCSS kompilieren', + 'compile_scss_confirm' => 'SCSS kompilieren? Dies überschreibt assets/css_compiled/theme.css.', + 'scss_ok' => 'aktuell', + 'scss_stale' => 'veraltet', + 'scss_compiled_ok' => 'SCSS ist kompiliert und aktuell', + 'scss_needs_compile' => 'SCSS-Quelle neuer als kompiliertes CSS', 'no_themes' => 'Keine Themes gefunden.', + 'theme_default_protected' => 'Default-Theme - kann nicht gelöscht werden', + 'theme_layouts' => 'Layouts: ', + 'theme_actions' => 'Theme-Aktionen', + 'confirm_delete_theme' => 'Sind Sie sicher, dass Sie dieses Theme löschen möchten? Alle Dateien im Theme gehen verloren.', + 'theme_edit' => 'Theme bearbeiten: ', + 'theme_files' => 'Theme-Dateien', + 'theme_no_files' => 'Keine Dateien gefunden.', + 'theme_new_file' => 'Neue Datei', + 'theme_new_file_title' => 'Neue Datei erstellen', + 'theme_file_path' => 'Dateipfad innerhalb des Themes', + 'theme_file_path_help' => 'Nur Buchstaben, Zahlen, Punkte, Unterstriche, Bindestriche und Schrägstriche. Unterordner werden automatisch erstellt. Erlaubt: twig, json, scss, css, js, html, md, php.', + 'theme_not_editable' => 'Dieser Dateityp kann im Editor nicht bearbeitet werden.', + 'theme_select_file' => 'Wählen Sie eine Datei aus der Seitenleiste zum Bearbeiten.', + 'theme_upload_help' => 'Dateien werden in assets/ dieses Themes hochgeladen. Erlaubt: Bilder, Video, Audio, PDF, ZIP, CSS, SCSS, JS, JSON, HTML, MD, TWIG, Fonts.', // Update 'system_update' => 'System-Update', diff --git a/language/en/admin.php b/language/en/admin.php index 8ca94a5..5264c04 100644 --- a/language/en/admin.php +++ b/language/en/admin.php @@ -88,6 +88,28 @@ return [ 'col_size' => 'Size', 'col_modified' => 'Modified', 'col_actions' => 'Actions', + + // Content editor (content-files) — Phase 1-5 of content-consistency TODO + 'content_editor' => 'Content editor', + 'content_files' => 'Content files', + 'content_no_files' => 'No files found.', + 'content_not_editable' => 'This file type cannot be edited in the editor.', + 'content_select_file' => 'Select a file from the sidebar to edit.', + 'content_file_path' => 'File path within content', + 'content_file_path_help' => 'Only letters, numbers, dots, underscores, dashes and slashes. Subfolders are created automatically. The extension is chosen below.', + 'content_upload_help' => 'Files are uploaded to content/. Allowed: images, video, audio, PDF, ZIP, office docs, CSS, SCSS, JS, JSON, HTML, MD.', + 'file_type' => 'File type', + 'list_view' => 'List view', + 'rename_folder' => 'Rename folder', + 'rename_prefix' => 'Rename', + 'new_name' => 'New name', + 'git_init' => 'Git init', + 'git_init_confirm' => 'Initialize a git repository in content/?', + 'git_commit' => 'Commit', + 'git_commit_confirm' => 'Commit changes to git?', + 'git_dirty' => 'uncommitted changes', + 'git_clean' => 'clean working tree', + 'git_last_commit' => 'last commit:', 'col_role' => 'Role', 'col_created' => 'Created', 'no_files_found' => 'No files found.', @@ -212,10 +234,32 @@ return [ 'new_theme_title' => 'Create new theme', 'theme_name' => 'Theme name', 'theme_name_help' => 'Only letters, numbers, underscores and dashes.', + 'theme_base' => 'Base theme', + 'theme_base_help' => 'Choose an existing theme to copy as a base, or start with an empty uniform structure. css_compiled/ is not copied.', + 'theme_base_blank' => '(empty structure)', 'name_label' => 'Name: ', 'default_layout_label' => 'Default layout: ', 'compile_scss' => 'Compile SCSS', + 'compile_scss_confirm' => 'Compile SCSS? This overwrites assets/css_compiled/theme.css.', + 'scss_ok' => 'up-to-date', + 'scss_stale' => 'stale', + 'scss_compiled_ok' => 'SCSS is compiled and up-to-date', + 'scss_needs_compile' => 'SCSS source newer than compiled CSS', 'no_themes' => 'No themes found.', + 'theme_default_protected' => 'Default theme - cannot be deleted', + 'theme_layouts' => 'Layouts: ', + 'theme_actions' => 'Theme actions', + 'confirm_delete_theme' => 'Are you sure you want to delete this theme? All files in the theme will be lost.', + 'theme_edit' => 'Edit theme: ', + 'theme_files' => 'Theme files', + 'theme_no_files' => 'No files found.', + 'theme_new_file' => 'New file', + 'theme_new_file_title' => 'Create new file', + 'theme_file_path' => 'File path within theme', + 'theme_file_path_help' => 'Only letters, numbers, dots, underscores, dashes and slashes. Subfolders are created automatically. Allowed: twig, json, scss, css, js, html, md, php.', + 'theme_not_editable' => 'This file type cannot be edited in the editor.', + 'theme_select_file' => 'Select a file from the sidebar to edit.', + 'theme_upload_help' => 'Files are uploaded to assets/ of this theme. Allowed: images, video, audio, PDF, ZIP, CSS, SCSS, JS, JSON, HTML, MD, TWIG, fonts.', // Update 'system_update' => 'System Update', diff --git a/language/nl/admin.php b/language/nl/admin.php index a54d67a..4b0882a 100644 --- a/language/nl/admin.php +++ b/language/nl/admin.php @@ -77,7 +77,9 @@ return [ // Content page 'upload' => 'Upload', 'new_folder' => 'Nieuwe map', + 'new_folder_title' => 'Nieuwe map aanmaken', 'new_file' => 'Nieuw bestand', + 'new_file_title' => 'Nieuw bestand aanmaken', 'select_files' => 'Bestanden selecteren', 'allowed_types' => 'Toegestaan: JPG, PNG, GIF, WebP, SVG, PDF, ZIP, MP4, WebM, MP3, WAV', 'upload_to_folder' => 'Uploaden naar deze map', @@ -88,6 +90,28 @@ return [ 'col_size' => 'Grootte', 'col_modified' => 'Gewijzigd', 'col_actions' => 'Acties', + + // Content editor (content-files) — Fase 1-5 van content-consistentie TODO + 'content_editor' => 'Content editor', + 'content_files' => 'Content bestanden', + 'content_no_files' => 'Geen bestanden gevonden.', + 'content_not_editable' => 'Dit bestandstype kan niet in de editor bewerkt worden.', + 'content_select_file' => 'Selecteer een bestand uit de zijbalk om te bewerken.', + 'content_file_path' => 'Bestandspad binnen content', + 'content_file_path_help' => 'Alleen letters, cijfers, punten, underscores, streepjes en slashes. Submappen worden automatisch aangemaakt. De extensie wordt hieronder gekozen.', + 'content_upload_help' => 'Bestanden worden geüpload naar content/. Toegestaan: afbeeldingen, video, audio, PDF, ZIP, office docs, CSS, SCSS, JS, JSON, HTML, MD.', + 'file_type' => 'Bestandstype', + 'list_view' => 'Lijst weergave', + 'rename_folder' => 'Map hernoemen', + 'rename_prefix' => 'Hernoem', + 'new_name' => 'Nieuwe naam', + 'git_init' => 'Git init', + 'git_init_confirm' => 'Git repository initialiseren in content/?', + 'git_commit' => 'Commit', + 'git_commit_confirm' => 'Wijzigingen committen naar git?', + 'git_dirty' => 'niet-committed wijzigingen', + 'git_clean' => 'schone werkmap', + 'git_last_commit' => 'laatste commit:', 'col_role' => 'Rol', 'col_created' => 'Aangemaakt', 'no_files_found' => 'Geen bestanden gevonden.', @@ -212,10 +236,32 @@ return [ 'new_theme_title' => 'Nieuw thema aanmaken', 'theme_name' => 'Thema naam', 'theme_name_help' => 'Alleen letters, cijfers, underscores en streepjes.', + 'theme_base' => 'Basis thema', + 'theme_base_help' => 'Kies een bestaand thema als basis om te kopiëren, of start met een lege uniforme structuur. css_compiled/ wordt niet gekopieerd.', + 'theme_base_blank' => '(lege structuur)', 'name_label' => 'Naam: ', 'default_layout_label' => 'Default layout: ', 'compile_scss' => 'SCSS compileren', + 'compile_scss_confirm' => 'SCSS compileren? Dit overschrijft assets/css_compiled/theme.css.', + 'scss_ok' => 'up-to-date', + 'scss_stale' => 'verouderd', + 'scss_compiled_ok' => 'SCSS is gecompileerd en up-to-date', + 'scss_needs_compile' => 'SCSS source nieuwer dan gecompileerde CSS', 'no_themes' => 'Geen thema\'s gevonden.', + 'theme_default_protected' => 'Default thema - kan niet verwijderd worden', + 'theme_layouts' => 'Layouts: ', + 'theme_actions' => 'Thema acties', + 'confirm_delete_theme' => 'Weet je zeker dat je dit thema wilt verwijderen? Alle bestanden in het thema gaan verloren.', + 'theme_edit' => 'Thema bewerken: ', + 'theme_files' => 'Thema bestanden', + 'theme_no_files' => 'Geen bestanden gevonden.', + 'theme_new_file' => 'Nieuw bestand', + 'theme_new_file_title' => 'Nieuw bestand aanmaken', + 'theme_file_path' => 'Bestandspad binnen thema', + 'theme_file_path_help' => 'Alleen letters, cijfers, punten, underscores, streepjes en slashes. Submappen worden automatisch aangemaakt. Toegestaan: twig, json, scss, css, js, html, md, php.', + 'theme_not_editable' => 'Dit bestandstype kan niet in de editor bewerkt worden.', + 'theme_select_file' => 'Selecteer een bestand uit de zijbalk om te bewerken.', + 'theme_upload_help' => 'Bestanden worden geüpload naar assets/ van dit thema. Toegestaan: afbeeldingen, video, audio, PDF, ZIP, CSS, SCSS, JS, JSON, HTML, MD, TWIG, fonts.', // Update 'system_update' => 'Systeem Update', diff --git a/public/admin.php b/public/admin.php index 0c2777f..73e6499 100644 --- a/public/admin.php +++ b/public/admin.php @@ -273,6 +273,34 @@ switch ($route) { handleContent($auth, $appConfig, $twig, $user, $csrf, $siteConfig); break; + case 'content-files': + handleContentFiles($auth, $appConfig, $twig, $user, $csrf, $siteConfig); + break; + + case 'content-file-upload': + handleContentFileUpload($auth, $appConfig, $user); + break; + + case 'content-file-delete': + handleContentFileDelete($auth, $appConfig, $user); + break; + + case 'content-file-move': + handleContentFileMove($auth, $appConfig, $twig, $user, $csrf); + break; + + case 'content-dir-create-in': + handleContentDirCreateIn($auth, $appConfig, $user); + break; + + case 'content-dir-rename-in': + handleContentDirRenameIn($auth, $appConfig, $twig, $user, $csrf); + break; + + case 'content-dir-delete-in': + handleContentDirDeleteIn($auth, $appConfig, $user); + break; + case 'content-edit': handleContentEdit($auth, $appConfig, $twig, $user, $csrf, $siteConfig); break; @@ -337,6 +365,34 @@ switch ($route) { handleThemeNew($auth, $appConfig, $twig, $user, $csrf); break; + case 'theme-edit': + handleThemeEdit($auth, $appConfig, $twig, $user, $csrf); + break; + + case 'theme-file-upload': + handleThemeFileUpload($auth, $appConfig, $user); + break; + + case 'theme-file-delete': + handleThemeFileDelete($auth, $appConfig, $user); + break; + + case 'theme-file-move': + handleThemeFileMove($auth, $appConfig, $twig, $user, $csrf); + break; + + case 'theme-activate': + handleThemeActivate($auth, $appConfig, $user); + break; + + case 'theme-delete': + handleThemeDelete($auth, $appConfig, $user); + break; + + case 'theme-scss': + handleThemeScss($auth, $appConfig, $user); + break; + case 'plugins': handlePlugins($auth, $appConfig, $twig, $user, $csrf); break; @@ -585,6 +641,822 @@ function handleContent($auth, $config, $twig, $user, $csrf, $siteConfig): void ]); } +/** + * Content file-browser editor (Fase 1-3 van content-consistentie TODO). + * Spiegel van plugins-edit/theme-edit, maar dan voor de content_dir. + * + * Toont een geneste bestandsboom zijbalk + CodeMirror editor voor .md/.php/.html. + * Ondersteunt: nieuw bestand, opslaan, uploaden, verwijderen, verplaatsen, + * map aanmaken/hernoemen/verwijderen, backup/git acties (Fase 5). + * + * Path-traversal bescherming: realpath() + prefix-check op content_dir. + * Taal-prefix (nl./en.) wordt getoond in de boom maar niet gestript uit bestandsnamen + * (content gebruikt taal-prefix in bestandsnamen, anders dan plugins/themes). + */ +function handleContentFiles($auth, $config, $twig, $user, $csrf, $siteConfig): void +{ + $contentDir = $config['content_dir']; + $realContentDir = realpath($contentDir); + if (!$realContentDir || !is_dir($realContentDir)) { + header('Location: /admin/content'); + exit; + } + + // Editable extensions within content (consistent met bestaande content-edit) + $editableExts = ['md', 'php', 'html']; + + // Resolve the requested file (default: first editable file found at root, else index.md) + $relFile = $_GET['file'] ?? ''; + $relFile = str_replace(['../', '..\\', './'], '', $relFile); + $relFile = ltrim($relFile, '/'); + + // Carry over flash messages from redirect (upload/delete/move handlers) + $message = ''; + $messageType = ''; + if (isset($_GET['msg']) && is_string($_GET['msg']) && $_GET['msg'] !== '') { + $message = $_GET['msg']; + $messageType = $_GET['msgtype'] ?? 'info'; + } + + // Resolve real path of the file + $realPath = $relFile !== '' ? realpath($realContentDir . '/' . $relFile) : false; + if ($relFile !== '' && ($realPath === false || strpos($realPath, $realContentDir) !== 0)) { + // Invalid path — reset + $relFile = ''; + $realPath = false; + } + + // Handle POST actions: new_file, new_dir, save, rename_dir, delete_dir + if ($_SERVER['REQUEST_METHOD'] === 'POST') { + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + $message = 'Ongeldige CSRF token.'; + $messageType = 'danger'; + } elseif (($_POST['action'] ?? '') === 'new_file') { + $inDir = str_replace(['../', '..\\', './'], '', $_POST['in_dir'] ?? ''); + $inDir = ltrim($inDir, '/'); + foreach (explode('/', $inDir) as $seg) { + if ($seg === '..' || $seg === '.') { $inDir = ''; break; } + } + $newName = trim($_POST['new_filename'] ?? ''); + $ext = strtolower(trim($_POST['new_ext'] ?? 'md')); + if (!in_array($ext, $editableExts, true)) $ext = 'md'; + $newName = preg_replace('/[^a-zA-Z0-9._\-\/]/', '', $newName); + $newName = ltrim($newName, '/'); + $newName = str_replace(['../', '..\\', './'], '', $newName); + $segments = explode('/', $newName); + $traversal = false; + foreach ($segments as $seg) { + if ($seg === '..' || $seg === '.') { $traversal = true; break; } + } + // Strip an existing content extension from the name only if it matches a known content ext; we append $ext + $lastSeg = end($segments); + if ($lastSeg !== false) { + $lastPathInfo = pathinfo($lastSeg); + if (isset($lastPathInfo['extension']) && in_array(strtolower($lastPathInfo['extension']), $editableExts, true)) { + $segments[key($segments)] = $lastPathInfo['filename']; + } + } + $newName = implode('/', $segments); + if ($newName === '' || $newName === '.' || $traversal) { + $message = 'Ongeldige bestandsnaam.'; + $messageType = 'danger'; + } else { + $newRel = ($inDir ? $inDir . '/' : '') . $newName . '.' . $ext; + $newFullPath = $realContentDir . '/' . $newRel; + $parentPath = dirname($newFullPath); + if (!is_dir($parentPath)) @mkdir($parentPath, 0755, true); + $parentReal = realpath($parentPath); + if ($parentReal === false || strpos($parentReal, $realContentDir) !== 0) { + $message = 'Ongeldig pad.'; + $messageType = 'danger'; + } else { + $newReal = $parentReal . '/' . basename($newFullPath); + if (file_exists($newReal)) { + $message = 'Bestand bestaat al.'; + $messageType = 'danger'; + } else { + // Build frontmatter with author metadata (zoals handleContentNew) + $now = date('Y-m-d H:i:s'); + $frontmatter = "---\nlayout: full_content\nauthor_name: " . ($user['author_name'] ?? $user['username'] ?? '') . "\nauthor_email: " . ($user['author_email'] ?? '') . "\ncreated: " . $now . "\n---\n\n"; + $stub = $ext === 'md' ? $frontmatter . "# Nieuwe pagina\n\n" : ($ext === 'php' ? "Nieuwe pagina\n"); + $written = @file_put_contents($newReal, $stub); + if ($written !== false) { + adminLog($config, 'info', $user['username'] . ' creëerde content bestand ' . $newRel); + $relFile = $newRel; + $realPath = $newReal; + $message = 'Bestand aangemaakt.'; + $messageType = 'success'; + } else { + $err = error_get_last(); + $message = 'Bestand aanmaken mislukt: ' . ($err['message'] ?? 'onbekend'); + $messageType = 'danger'; + } + } + } + } + } elseif (($_POST['action'] ?? '') === 'new_dir') { + $newDir = trim($_POST['dirname'] ?? ''); + $inDir = str_replace(['../', '..\\', './'], '', $_POST['in_dir'] ?? ''); + $inDir = ltrim($inDir, '/'); + $newDir = preg_replace('/[^a-zA-Z0-9._-]/', '-', $newDir); + if ($newDir === '' || $newDir === '.' || $newDir === '..') { + $message = 'Ongeldige mapnaam.'; + $messageType = 'danger'; + } else { + $newFullPath = $realContentDir . '/' . ($inDir ? $inDir . '/' : '') . $newDir; + $parentReal = realpath($realContentDir . '/' . $inDir); + if ($parentReal === false || strpos($parentReal, $realContentDir) !== 0) { + $message = 'Ongeldig pad.'; + $messageType = 'danger'; + } elseif (file_exists($newFullPath)) { + $message = 'Map bestaat al.'; + $messageType = 'danger'; + } else { + if (@mkdir($newFullPath, 0755, true)) { + adminLog($config, 'info', $user['username'] . ' creëerde content map ' . ($inDir ? $inDir . '/' : '') . $newDir); + $message = 'Map aangemaakt.'; + $messageType = 'success'; + } else { + $message = 'Map aanmaken mislukt.'; + $messageType = 'danger'; + } + } + } + } elseif (($_POST['action'] ?? '') === 'rename_dir') { + $dirRel = str_replace(['../', '..\\', './'], '', $_POST['dir'] ?? ''); + $dirRel = ltrim($dirRel, '/'); + $newName = preg_replace('/[^a-zA-Z0-9._-]/', '-', trim($_POST['newname'] ?? '')); + foreach (explode('/', $dirRel) as $seg) { + if ($seg === '..' || $seg === '.') { $dirRel = ''; break; } + } + if ($dirRel === '' || $newName === '' || $newName === '.' || $newName === '..') { + $message = 'Ongeldige invoer voor hernoemen.'; + $messageType = 'danger'; + } else { + $fullPath = $realContentDir . '/' . $dirRel; + $realDir = realpath($fullPath); + $parentReal = realpath(dirname($fullPath)); + if (!$realDir || !is_dir($realDir) || strpos($realDir, $realContentDir) !== 0 || !$parentReal || strpos($parentReal, $realContentDir) !== 0) { + $message = 'Map niet gevonden.'; + $messageType = 'danger'; + } else { + $newPath = $parentReal . '/' . $newName; + if (file_exists($newPath)) { + $message = 'Naam bestaat al.'; + $messageType = 'danger'; + } elseif (rename($realDir, $newPath)) { + adminLog($config, 'info', $user['username'] . ' hernoemde content map ' . $dirRel . ' naar ' . $newName); + $message = 'Map hernoemd.'; + $messageType = 'success'; + // Update $relFile if it was inside the renamed dir + if ($relFile !== '' && strpos($relFile, $dirRel . '/') === 0) { + $relFile = dirname($dirRel) . '/' . $newName . '/' . substr($relFile, strlen($dirRel) + 1); + $relFile = ltrim($relFile, '/'); + $realPath = realpath($realContentDir . '/' . $relFile); + } + } else { + $message = 'Hernoemen mislukt.'; + $messageType = 'danger'; + } + } + } + } elseif (($_POST['action'] ?? '') === 'delete_dir') { + $dirRel = str_replace(['../', '..\\', './'], '', $_POST['dir'] ?? ''); + $dirRel = ltrim($dirRel, '/'); + foreach (explode('/', $dirRel) as $seg) { + if ($seg === '..' || $seg === '.') { $dirRel = ''; break; } + } + if ($dirRel === '') { + $message = 'Ongeldige map.'; + $messageType = 'danger'; + } else { + $fullPath = $realContentDir . '/' . $dirRel; + $realDir = realpath($fullPath); + if (!$realDir || !is_dir($realDir) || strpos($realDir, $realContentDir) !== 0) { + $message = 'Map niet gevonden.'; + $messageType = 'danger'; + } else { + // Only allow deleting empty directories (consistent met bestaande content-dir-delete) + $entries = array_diff(scandir($realDir), ['.', '..']); + // Allow .bak directory to be deleted with its contents + $isEmpty = true; + foreach ($entries as $e) { + if ($e[0] !== '.') { $isEmpty = false; break; } + } + if (!$isEmpty) { + $message = 'Map moet leeg zijn (verborgen bestanden zoals .bak worden genegeerd).'; + $messageType = 'danger'; + } elseif (@rmdir($realDir)) { + adminLog($config, 'info', $user['username'] . ' verwijderde content map ' . $dirRel); + $message = 'Map verwijderd.'; + $messageType = 'success'; + // Reset relFile if it was inside the deleted dir + if ($relFile !== '' && strpos($relFile, $dirRel . '/') === 0) { + $relFile = ''; + $realPath = false; + } + } else { + $message = 'Map verwijderen mislukt.'; + $messageType = 'danger'; + } + } + } + } else { + // Save the currently selected file + $content = $_POST['content'] ?? ''; + $layout = $_POST['layout'] ?? ''; + if ($realPath && is_file($realPath)) { + $ext = strtolower(pathinfo($realPath, PATHINFO_EXTENSION)); + if (in_array($ext, $editableExts, true)) { + if ($layout && $ext === 'md') { + $content = updateContentFrontmatter($content, 'layout', $layout); + } + $plugins = isset($_POST['plugins']) && is_array($_POST['plugins']) + ? implode(', ', array_map('trim', $_POST['plugins'])) + : ''; + if ($ext === 'md') { + $content = updateContentFrontmatter($content, 'plugins', $plugins); + } + backupContentFile($realPath); + file_put_contents($realPath, $content); + adminLog($config, 'info', $user['username'] . ' bewerkte content ' . $relFile); + $message = 'Bestand opgeslagen.'; + $messageType = 'success'; + } else { + $message = 'Dit bestandstype kan niet bewerkt worden.'; + $messageType = 'danger'; + } + } else { + $message = 'Bestand niet gevonden.'; + $messageType = 'danger'; + } + } + } + + // Gather the content file tree (geneste boom, skipt .bak/.git) + $files = scanContentFiles($contentDir); + + // If no file selected, pick the first editable file at root + if ($relFile === '' && $realPath === false) { + foreach ($files as $node) { + if (!$node['is_dir'] && in_array($node['extension'], $editableExts, true)) { + $relFile = $node['path']; + $realPath = realpath($realContentDir . '/' . $relFile); + break; + } + } + } + + // Load content of the selected file (if editable) + $isEditable = false; + $fileContent = ''; + $fileExt = ''; + $fileName = ''; + if ($realPath && is_file($realPath)) { + $fileExt = strtolower(pathinfo($realPath, PATHINFO_EXTENSION)); + $fileName = basename($realPath); + if (in_array($fileExt, $editableExts, true)) { + $isEditable = true; + $fileContent = file_get_contents($realPath); + } + } + + // Theme layouts for the layout selector (spiegel van handleContentEdit) + $themeLayouts = []; + $themeDefaultLayout = 'full_content'; + $activeThemeName = $siteConfig['active_theme'] ?? 'default'; + $themeDir = __DIR__ . "/../themes/{$activeThemeName}"; + $themeJsonFile = $themeDir . '/theme.json'; + if (file_exists($themeJsonFile)) { + $themeJson = json_decode(file_get_contents($themeJsonFile), true); + $themeDefaultLayout = $themeJson['config']['default_template'] ?? 'full_content'; + if (isset($themeJson['template']) && is_array($themeJson['template'])) { + foreach ($themeJson['template'] as $key => $twigFile) { + if (in_array($key, ['guide'], true)) continue; + $themeLayouts[$key] = $twigFile; + } + } + } + + // Available plugins for the plugins checkbox group + $pluginsDir = $config['plugins_dir']; + $availablePlugins = []; + if (is_dir($pluginsDir)) { + foreach (glob($pluginsDir . '*', GLOB_ONLYDIR) as $pluginDir) { + $pluginName = basename($pluginDir); + if ($pluginName !== '.' && $pluginName !== '..' && file_exists($pluginDir . '/plugin.json')) { + $availablePlugins[] = $pluginName; + } + } + } + + // Current frontmatter values for the selected file + $currentLayout = $isEditable ? extractFrontmatterValue($fileContent, 'layout') : ''; + $currentPlugins = $isEditable ? extractFrontmatterValue($fileContent, 'plugins') : ''; + $selectedPlugins = array_map('trim', explode(',', $currentPlugins)); + if ($selectedPlugins === ['']) $selectedPlugins = []; + $currentAuthorName = $isEditable ? extractFrontmatterValue($fileContent, 'author_name') : ''; + $currentAuthorEmail = $isEditable ? extractFrontmatterValue($fileContent, 'author_email') : ''; + $currentCreated = $isEditable ? extractFrontmatterValue($fileContent, 'created') : ''; + $currentLang = $relFile ? extractLanguagePrefix($relFile) : 'nl'; + $fileDir = $relFile ? trim(dirname($relFile), '.\\/') : ''; + + // Git status for Fase 5 (content git integratie in zijbalk) + $gitStatus = ['available' => false, 'initialized' => false, 'dirty' => false, 'branch' => '', 'ahead' => 0, 'behind' => 0, 'lastCommit' => '']; + $gitDir = $realContentDir . '/.git'; + $gitStatus['available'] = $is_dir = is_dir($gitDir); + if ($gitStatus['available']) { + $gitStatus['initialized'] = true; + $branch = @shell_exec('cd ' . escapeshellarg($realContentDir) . ' && git rev-parse --abbrev-ref HEAD 2>/dev/null'); + $gitStatus['branch'] = trim($branch ?? ''); + $dirty = @shell_exec('cd ' . escapeshellarg($realContentDir) . ' && git status --porcelain 2>/dev/null'); + $gitStatus['dirty'] = trim($dirty ?? '') !== ''; + $lastCommit = @shell_exec('cd ' . escapeshellarg($realContentDir) . ' && git log -1 --format="%h %s (%cr)" 2>/dev/null'); + $gitStatus['lastCommit'] = trim($lastCommit ?? ''); + } + + $route = 'content-files'; + + echo $twig->render('pages/content-files.twig', [ + 'user' => $user, + 'route' => $route, + 'csrf_token' => $csrf, + 'relFile' => $relFile, + 'fileDir' => $fileDir, + 'fileName' => $fileName, + 'fileExt' => $fileExt, + 'fileContent' => $fileContent, + 'isEditable' => $isEditable, + 'files' => $files, + 'editableExts' => $editableExts, + 'currentLayout' => $currentLayout ?: $themeDefaultLayout, + 'themeLayouts' => $themeLayouts, + 'themeDefaultLayout' => $themeDefaultLayout, + 'activeThemeName' => $activeThemeName, + 'availablePlugins' => $availablePlugins, + 'selectedPlugins' => $selectedPlugins, + 'currentLang' => $currentLang, + 'currentAuthorName' => $currentAuthorName, + 'currentAuthorEmail' => $currentAuthorEmail, + 'currentCreated' => $currentCreated, + 'gitStatus' => $gitStatus, + 'sidebar_color' => getSidebarColor($config), + 'needs_editor' => $isEditable, + 'message' => $message, + 'message_type' => $messageType, + ]); +} + +/** + * Handle file upload into a content directory (Fase 2). + * Mirrors handlePluginsFileUpload/handleThemeFileUpload. + * Allowed: images, video, audio, pdf, zip, office docs, css, scss, js, json, html, md. + */ +function handleContentFileUpload($auth, $config, $user): void +{ + if ($_SERVER['REQUEST_METHOD'] !== 'POST') { + header('Location: /admin/content-files'); + exit; + } + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + header('Location: /admin/content-files'); + exit; + } + + $contentDir = $config['content_dir']; + $realContentDir = realpath($contentDir); + if (!$realContentDir || !is_dir($realContentDir)) { + header('Location: /admin/content-files'); + exit; + } + + // Optional subdir within content/ (e.g. "blog" or "-assets") + $subdir = str_replace(['../', '..\\', './'], '', $_POST['dir'] ?? ''); + $subdir = ltrim($subdir, '/'); + foreach (explode('/', $subdir) as $seg) { + if ($seg === '..' || $seg === '.') { $subdir = ''; break; } + } + $targetDir = $subdir === '' ? $realContentDir : $realContentDir . '/' . $subdir; + $realTarget = realpath($targetDir); + if ($realTarget === false) { + if (!@mkdir($targetDir, 0755, true)) { + header('Location: /admin/content-files'); + exit; + } + $realTarget = realpath($targetDir); + } + if (!$realTarget || strpos($realTarget, $realContentDir) !== 0 || !is_dir($realTarget)) { + header('Location: /admin/content-files'); + exit; + } + + $allowedExt = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'pdf', 'zip', 'mp4', 'webm', 'ogg', 'mp3', 'wav', 'mov', 'avi', 'doc', 'docx', 'xls', 'xlsx', 'css', 'scss', 'js', 'json', 'html', 'md']; + $uploaded = 0; + $errors = []; + + if (!empty($_FILES['file']['name'])) { + foreach ($_FILES['file']['name'] as $i => $name) { + if ($_FILES['file']['error'][$i] !== UPLOAD_ERR_OK) continue; + $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION)); + if (!in_array($ext, $allowedExt, true)) { + $errors[] = htmlspecialchars($name) . ' (niet toegestaan type)'; + continue; + } + $filename = preg_replace('/[^a-zA-Z0-9._-]/', '_', $name); + $dest = $realTarget . '/' . $filename; + $n = 1; + while (file_exists($dest)) { + $p = pathinfo($filename); + $dest = $realTarget . '/' . $p['filename'] . '_' . $n . '.' . ($p['extension'] ?? $ext); + $n++; + } + if (move_uploaded_file($_FILES['file']['tmp_name'][$i], $dest)) { + $uploaded++; + } else { + $errors[] = htmlspecialchars($name); + } + } + } + + $msg = []; + $type = 'info'; + if ($uploaded > 0) { + $msg[] = $uploaded . ' bestand(en) geüpload.'; + $type = 'success'; + adminLog($config, 'info', $user['username'] . ' uploadde naar content/' . ($subdir ? $subdir . '/' : '') . ' (' . $uploaded . ' bestanden)'); + } + if (!empty($errors)) { + $msg[] = 'Fouten: ' . implode(', ', $errors); + $type = $type === 'success' ? 'success' : 'danger'; + } + + $redir = '/admin/content-files'; + if (!empty($msg)) { + $redir .= '?msg=' . urlencode(implode(' ', $msg)) . '&msgtype=' . urlencode($type); + } + header('Location: ' . $redir); + exit; +} + +/** + * Handle deletion of a single file inside content (Fase 2). + * Refuses to delete directories, dotfiles, and paths that escape content_dir. + */ +function handleContentFileDelete($auth, $config, $user): void +{ + if ($_SERVER['REQUEST_METHOD'] !== 'POST') { + header('Location: /admin/content-files'); + exit; + } + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + header('Location: /admin/content-files'); + exit; + } + + $contentDir = $config['content_dir']; + $realContentDir = realpath($contentDir); + if (!$realContentDir || !is_dir($realContentDir)) { + header('Location: /admin/content-files'); + exit; + } + + $relFile = str_replace(['../', '..\\', './'], '', $_POST['file'] ?? ''); + $relFile = ltrim($relFile, '/'); + foreach (explode('/', $relFile) as $seg) { + if ($seg === '..' || $seg === '.') { + header('Location: /admin/content-files'); + exit; + } + } + $base = basename($relFile); + if ($base === '' || $base[0] === '.') { + header('Location: /admin/content-files'); + exit; + } + + $fullPath = $realContentDir . '/' . $relFile; + $realPath = realpath($fullPath); + if ($realPath === false || strpos($realPath, $realContentDir) !== 0 || !is_file($realPath)) { + header('Location: /admin/content-files'); + exit; + } + + $deleted = @unlink($realPath); + if ($deleted) { + adminLog($config, 'info', $user['username'] . ' verwijderde content/' . $relFile); + $msg = 'Bestand verwijderd.'; + $type = 'success'; + } else { + $err = error_get_last(); + $msg = 'Verwijderen mislukt: ' . ($err['message'] ?? 'onbekend'); + $type = 'danger'; + } + + header('Location: /admin/content-files?msg=' . urlencode($msg) . '&msgtype=' . urlencode($type)); + exit; +} + +/** + * Handle moving a single file within content to another folder within content (Fase 2/3). + * Mirrors handlePluginsFileMove/handleThemeFileMove. + */ +function handleContentFileMove($auth, $config, $twig, $user, $csrf): void +{ + $contentDir = $config['content_dir']; + $realContentDir = realpath($contentDir); + if (!$realContentDir || !is_dir($realContentDir)) { + header('Location: /admin/content-files'); + exit; + } + + $relFile = str_replace(['../', '..\\', './'], '', $_GET['file'] ?? $_POST['file'] ?? ''); + $relFile = ltrim($relFile, '/'); + foreach (explode('/', $relFile) as $seg) { + if ($seg === '..' || $seg === '.') { + header('Location: /admin/content-files'); + exit; + } + } + $base = basename($relFile); + if ($base === '' || $base[0] === '.') { + header('Location: /admin/content-files'); + exit; + } + + $fullPath = $realContentDir . '/' . $relFile; + $realPath = realpath($fullPath); + if ($realPath === false || strpos($realPath, $realContentDir) !== 0 || !is_file($realPath)) { + header('Location: /admin/content-files'); + exit; + } + + $message = ''; + $messageType = ''; + + // Collect all directories within content (as relative paths), excluding the file's own dir + $directories = ['']; + $iterator = new RecursiveIteratorIterator( + new RecursiveDirectoryIterator($realContentDir, RecursiveDirectoryIterator::SKIP_DOTS), + RecursiveIteratorIterator::SELF_FIRST + ); + $currentDir = trim(dirname($relFile), '.\\/'); + foreach ($iterator as $file) { + if (!$file->isDir()) continue; + $realDir = $file->getRealPath(); + if ($realDir === false || strpos($realDir, $realContentDir) !== 0) continue; + $relDir = ltrim(substr($realDir, strlen($realContentDir) + 1), '/\\'); + $relDir = str_replace('\\', '/', $relDir); + if ($relDir === $currentDir) continue; + if ($relDir !== '' && $relDir[0] === '.') continue; + $directories[] = $relDir; + } + $directories = array_unique($directories); + sort($directories); + + if ($_SERVER['REQUEST_METHOD'] === 'POST') { + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + $message = 'Ongeldige CSRF token.'; + $messageType = 'danger'; + } else { + $dest = str_replace(['../', '..\\', './'], '', $_POST['destination'] ?? ''); + $dest = ltrim($dest, '/'); + foreach (explode('/', $dest) as $seg) { + if ($seg === '..' || $seg === '.') { + $message = 'Ongeldige doelmap.'; + $messageType = 'danger'; + break; + } + } + if ($message === '') { + $destDir = $dest === '' ? $realContentDir : $realContentDir . '/' . $dest; + $realDestDir = realpath($destDir); + if (!$realDestDir || !is_dir($realDestDir) || strpos($realDestDir, $realContentDir) !== 0) { + $message = 'Doelmap bestaat niet.'; + $messageType = 'danger'; + } else { + $newPath = $realDestDir . '/' . basename($realPath); + if (file_exists($newPath)) { + $message = 'Bestand bestaat al op de bestemming.'; + $messageType = 'danger'; + } elseif (rename($realPath, $newPath)) { + adminLog($config, 'info', $user['username'] . ' verplaatste content/' . $relFile . ' naar content/' . ($dest ? $dest . '/' : '') . basename($relFile)); + $newRel = $dest === '' ? basename($relFile) : $dest . '/' . basename($relFile); + header('Location: /admin/content-files?file=' . urlencode($newRel) . '&msg=' . urlencode('Bestand verplaatst.') . '&msgtype=success'); + exit; + } else { + $err = error_get_last(); + $message = 'Verplaatsen mislukt: ' . ($err['message'] ?? 'onbekend'); + $messageType = 'danger'; + } + } + } + } + } + + echo $twig->render('pages/content-move-form.twig', [ + 'user' => $user, + 'route' => 'content-file-move', + 'csrf_token' => $csrf, + 'relFile' => $relFile, + 'itemName' => basename($relFile), + 'itemDir' => trim(dirname($relFile), '.\\/'), + 'directories' => $directories, + 'sidebar_color' => getSidebarColor($config), + 'needs_editor' => false, + 'message' => $message, + 'message_type' => $messageType, + ]); +} + +/** + * Handle creating a directory within content from the editor sidebar (Fase 3). + * Variant of handleContentDirCreate that redirects back to content-files. + */ +function handleContentDirCreateIn($auth, $config, $user): void +{ + if ($_SERVER['REQUEST_METHOD'] !== 'POST') { + header('Location: /admin/content-files'); + exit; + } + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + header('Location: /admin/content-files'); + exit; + } + + $contentDir = $config['content_dir']; + $realContentDir = realpath($contentDir); + if (!$realContentDir || !is_dir($realContentDir)) { + header('Location: /admin/content-files'); + exit; + } + + $inDir = str_replace(['../', '..\\', './'], '', $_POST['in_dir'] ?? ''); + $inDir = ltrim($inDir, '/'); + foreach (explode('/', $inDir) as $seg) { + if ($seg === '..' || $seg === '.') { $inDir = ''; break; } + } + $dirname = trim($_POST['dirname'] ?? ''); + $dirname = preg_replace('/[^a-zA-Z0-9._-]/', '-', $dirname); + if ($dirname === '' || $dirname === '.' || $dirname === '..') { + header('Location: /admin/content-files?msg=' . urlencode('Ongeldige mapnaam.') . '&msgtype=danger'); + exit; + } + $newPath = $realContentDir . '/' . ($inDir ? $inDir . '/' : '') . $dirname; + if (file_exists($newPath)) { + header('Location: /admin/content-files?msg=' . urlencode('Map bestaat al.') . '&msgtype=danger'); + exit; + } + if (@mkdir($newPath, 0755, true)) { + adminLog($config, 'info', $user['username'] . ' creëerde content map ' . ($inDir ? $inDir . '/' : '') . $dirname); + header('Location: /admin/content-files?msg=' . urlencode('Map aangemaakt.') . '&msgtype=success'); + } else { + header('Location: /admin/content-files?msg=' . urlencode('Map aanmaken mislukt.') . '&msgtype=danger'); + } + exit; +} + +/** + * Handle renaming a directory within content from the editor sidebar (Fase 3). + * Variant of handleContentDirRename that redirects back to content-files. + */ +function handleContentDirRenameIn($auth, $config, $twig, $user, $csrf): void +{ + $contentDir = $config['content_dir']; + $realContentDir = realpath($contentDir); + if (!$realContentDir || !is_dir($realContentDir)) { + header('Location: /admin/content-files'); + exit; + } + + $dirRel = str_replace(['../', '..\\', './'], '', $_GET['dir'] ?? ''); + $dirRel = ltrim($dirRel, '/'); + foreach (explode('/', $dirRel) as $seg) { + if ($seg === '..' || $seg === '.') { $dirRel = ''; break; } + } + + $message = ''; + $messageType = ''; + + if ($dirRel !== '') { + $fullPath = $realContentDir . '/' . $dirRel; + $realDir = realpath($fullPath); + if (!$realDir || !is_dir($realDir) || strpos($realDir, $realContentDir) !== 0) { + $dirRel = ''; + } + } + + if ($_SERVER['REQUEST_METHOD'] === 'POST' && $dirRel !== '') { + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + $message = 'Ongeldige CSRF token.'; + $messageType = 'danger'; + } else { + $newName = preg_replace('/[^a-zA-Z0-9._-]/', '-', trim($_POST['newname'] ?? '')); + if ($newName === '' || $newName === '.' || $newName === '..') { + $message = 'Ongeldige naam.'; + $messageType = 'danger'; + } else { + $parentReal = realpath(dirname($realContentDir . '/' . $dirRel)); + if (!$parentReal || strpos($parentReal, $realContentDir) !== 0) { + $message = 'Ongeldig pad.'; + $messageType = 'danger'; + } else { + $newPath = $parentReal . '/' . $newName; + if (file_exists($newPath)) { + $message = 'Naam bestaat al.'; + $messageType = 'danger'; + } elseif (rename($realDir, $newPath)) { + adminLog($config, 'info', $user['username'] . ' hernoemde content map ' . $dirRel . ' naar ' . $newName); + header('Location: /admin/content-files?msg=' . urlencode('Map hernoemd.') . '&msgtype=success'); + exit; + } else { + $message = 'Hernoemen mislukt.'; + $messageType = 'danger'; + } + } + } + } + } + + if ($dirRel === '') { + header('Location: /admin/content-files?msg=' . urlencode('Map niet gevonden.') . '&msgtype=danger'); + exit; + } + + echo $twig->render('pages/content-dir-rename-form.twig', [ + 'user' => $user, + 'route' => 'content-dir-rename-in', + 'csrf_token' => $csrf, + 'dir' => $dirRel, + 'currentName' => basename($dirRel), + 'sidebar_color' => getSidebarColor($config), + 'needs_editor' => false, + 'message' => $message, + 'message_type' => $messageType, + ]); +} + +/** + * Handle deleting a directory within content from the editor sidebar (Fase 3). + * Variant of handleContentDirDelete that redirects back to content-files. + * Only allows deleting empty directories (verborgen .bak bestanden genegeerd). + */ +function handleContentDirDeleteIn($auth, $config, $user): void +{ + if ($_SERVER['REQUEST_METHOD'] !== 'POST') { + header('Location: /admin/content-files'); + exit; + } + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + header('Location: /admin/content-files'); + exit; + } + + $contentDir = $config['content_dir']; + $realContentDir = realpath($contentDir); + if (!$realContentDir || !is_dir($realContentDir)) { + header('Location: /admin/content-files'); + exit; + } + + $dirRel = str_replace(['../', '..\\', './'], '', $_POST['dir'] ?? ''); + $dirRel = ltrim($dirRel, '/'); + foreach (explode('/', $dirRel) as $seg) { + if ($seg === '..' || $seg === '.') { + header('Location: /admin/content-files?msg=' . urlencode('Ongeldige map.') . '&msgtype=danger'); + exit; + } + } + if ($dirRel === '') { + header('Location: /admin/content-files?msg=' . urlencode('Ongeldige map.') . '&msgtype=danger'); + exit; + } + + $fullPath = $realContentDir . '/' . $dirRel; + $realDir = realpath($fullPath); + if (!$realDir || !is_dir($realDir) || strpos($realDir, $realContentDir) !== 0) { + header('Location: /admin/content-files?msg=' . urlencode('Map niet gevonden.') . '&msgtype=danger'); + exit; + } + + // Only allow empty directories (verborgen .bak/.git genegeerd) + $entries = array_diff(scandir($realDir), ['.', '..']); + $isEmpty = true; + foreach ($entries as $e) { + if ($e[0] !== '.') { $isEmpty = false; break; } + } + if (!$isEmpty) { + header('Location: /admin/content-files?msg=' . urlencode('Map moet leeg zijn.') . '&msgtype=danger'); + exit; + } + if (@rmdir($realDir)) { + adminLog($config, 'info', $user['username'] . ' verwijderde content map ' . $dirRel); + header('Location: /admin/content-files?msg=' . urlencode('Map verwijderd.') . '&msgtype=success'); + } else { + header('Location: /admin/content-files?msg=' . urlencode('Map verwijderen mislukt.') . '&msgtype=danger'); + } + exit; +} + function handleContentEdit($auth, $config, $twig, $user, $csrf, $siteConfig): void { $contentDir = $config['content_dir']; @@ -1308,41 +2180,48 @@ function handleTheme($auth, $config, $twig, $user, $csrf, $siteConfig): void { $themesDir = __DIR__ . '/../themes'; $themes = []; - + $activeTheme = $siteConfig['active_theme'] ?? 'default'; + foreach (glob($themesDir . '/*', GLOB_ONLYDIR) as $themeDir) { $themeName = basename($themeDir); $themeJson = $themeDir . '/theme.json'; $themeData = [ 'name' => $themeName, 'title' => $themeName, - 'active' => ($siteConfig['active_theme'] ?? 'default') === $themeName, + 'active' => $activeTheme === $themeName, + 'protected' => $themeName === 'default', + 'has_scss' => is_file($themeDir . '/assets/scss/theme.scss'), + 'scss_compiled' => false, + 'scss_mtime' => null, + 'css_mtime' => null, ]; - + if (file_exists($themeJson)) { $data = json_decode(file_get_contents($themeJson), true); $themeData = array_merge($themeData, $data); } - + + // SCSS compile status: true when compiled CSS exists and is newer than SCSS source + $scssFile = $themeDir . '/assets/scss/theme.scss'; + $cssFile = $themeDir . '/assets/css_compiled/theme.css'; + if (is_file($scssFile)) { + $themeData['scss_mtime'] = date('Y-m-d H:i', filemtime($scssFile)); + if (is_file($cssFile)) { + $themeData['css_mtime'] = date('Y-m-d H:i', filemtime($cssFile)); + $themeData['scss_compiled'] = filemtime($cssFile) >= filemtime($scssFile); + } + } + $themes[] = $themeData; } - - $message = ''; - $messageType = ''; - - // Handle theme compilation - if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['compile_scss'])) { - if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { - $message = 'Ongeldige CSRF token.'; - $messageType = 'danger'; - } else { - $themeToCompile = $_POST['theme'] ?? 'default'; - // SCSS compile logic here - $message = 'SCSS gecompileerd voor ' . $themeToCompile; - $messageType = 'success'; - adminLog($config, 'info', $user['username'] . ' compileerde SCSS voor ' . $themeToCompile); - } - } - + + // Sort: active theme first, then alphabetical + usort($themes, function ($a, $b) { + if ($a['active'] && !$b['active']) return -1; + if (!$a['active'] && $b['active']) return 1; + return strcasecmp($a['name'], $b['name']); + }); + $route = 'theme'; echo $twig->render('pages/theme.twig', [ @@ -1352,8 +2231,8 @@ function handleTheme($auth, $config, $twig, $user, $csrf, $siteConfig): void 'themes' => $themes, 'sidebar_color' => getSidebarColor($config), 'needs_editor' => false, - 'message' => $message, - 'message_type' => $messageType, + 'message' => $_GET['msg'] ?? '', + 'message_type' => $_GET['msgtype'] ?? 'info', ]); } @@ -1362,37 +2241,60 @@ function handleThemeNew($auth, $config, $twig, $user, $csrf): void $message = ''; $messageType = ''; + // Available base themes (existing themes to copy from) + $themesDir = __DIR__ . '/../themes'; + $baseThemes = []; + foreach (glob($themesDir . '/*', GLOB_ONLYDIR) as $themeDir) { + $name = basename($themeDir); + $baseThemes[$name] = $name; + } + if ($_SERVER['REQUEST_METHOD'] === 'POST') { if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { $message = 'Ongeldige CSRF token.'; $messageType = 'danger'; } else { $themeName = trim($_POST['name'] ?? ''); + $baseTheme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['base_theme'] ?? ''); if (!empty($themeName)) { $themeName = preg_replace('/[^a-zA-Z0-9_-]/', '-', $themeName); - $themesDir = __DIR__ . '/../themes'; $newThemeDir = $themesDir . '/' . $themeName; - - if (!file_exists($newThemeDir)) { - @mkdir($newThemeDir, 0755, true); - @mkdir($newThemeDir . '/partials', 0755, true); - @mkdir($newThemeDir . '/css', 0755, true); - @mkdir($newThemeDir . '/js', 0755, true); - - $themeJson = [ - 'title' => ucfirst($themeName), - 'default_layout' => 'full_content', - 'header_color' => '#0a369d', - ]; - file_put_contents($newThemeDir . '/theme.json', json_encode($themeJson, JSON_PRETTY_PRINT)); - - adminLog($config, 'info', $user['username'] . ' creëerde thema ' . $themeName); - header('Location: /admin/theme'); - exit; - } else { + + if (file_exists($newThemeDir)) { $message = 'Thema bestaat al.'; $messageType = 'danger'; + } else { + if (!@mkdir($newThemeDir, 0755, true)) { + $message = 'Kon thema map niet aanmaken.'; + $messageType = 'danger'; + } else { + // Copy from base theme if requested and it exists, otherwise create uniform structure + if ($baseTheme !== '' && $baseTheme !== $themeName && is_dir($themesDir . '/' . $baseTheme)) { + copyDirRecursive($themesDir . '/' . $baseTheme, $newThemeDir); + // Overwrite the copied theme.json title with the new theme name + $copiedJsonFile = $newThemeDir . '/theme.json'; + if (is_file($copiedJsonFile)) { + $copiedJson = json_decode(file_get_contents($copiedJsonFile), true); + if (is_array($copiedJson)) { + $copiedJson['title'] = ucfirst($themeName); + file_put_contents($copiedJsonFile, json_encode($copiedJson, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE)); + } + } + // Overwrite the copied README.md with a fresh one for the new theme + @file_put_contents($newThemeDir . '/README.md', + "# " . ucfirst($themeName) . " thema\n\nGekopieerd van `" . $baseTheme . "`. Zie `theme.json` voor layout mapping en `assets/scss/theme.scss` voor styling.\n"); + } else { + createUniformThemeStructure($newThemeDir, $themeName); + } + + adminLog($config, 'info', $user['username'] . ' creëerde thema ' . $themeName . ($baseTheme ? ' (basis: ' . $baseTheme . ')' : '')); + header('Location: /admin/theme-edit?theme=' . urlencode($themeName)); + exit; + } } + } else { + $message = 'Thema naam mag niet leeg zijn.'; + $messageType = 'danger'; } } } @@ -1403,6 +2305,7 @@ function handleThemeNew($auth, $config, $twig, $user, $csrf): void 'user' => $user, 'route' => $route, 'csrf_token' => $csrf, + 'base_themes' => $baseThemes, 'sidebar_color' => getSidebarColor($config), 'needs_editor' => false, 'message' => $message, @@ -1410,6 +2313,715 @@ function handleThemeNew($auth, $config, $twig, $user, $csrf): void ]); } +/** + * Create a uniform theme structure (theme.json, layouts, partials, assets/scss, etc.) + * @param string $themeDir Absolute path to the new theme directory (already created) + * @param string $themeName Sanitized theme name + */ +function createUniformThemeStructure(string $themeDir, string $themeName): void +{ + // Uniform directories per AGENTS.md / guide + @mkdir($themeDir . '/partials', 0755, true); + @mkdir($themeDir . '/assets/scss', 0755, true); + @mkdir($themeDir . '/assets/css', 0755, true); + @mkdir($themeDir . '/assets/js', 0755, true); + @mkdir($themeDir . '/assets/img', 0755, true); + @mkdir($themeDir . '/assets/fonts', 0755, true); + + // theme.json with default full_content layout + $themeJson = [ + 'title' => ucfirst($themeName), + 'config' => ['default_template' => 'full_content'], + 'template' => ['full_content' => 'full_content.twig'], + ]; + file_put_contents($themeDir . '/theme.json', json_encode($themeJson, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE)); + + // Minimal base.twig + full_content.twig + partials + file_put_contents($themeDir . '/base.twig', + "\n\n\n" + . " \n \n" + . " {% block title %}{{ page_title|default(site_title) }}{% endblock %}\n" + . " \n" + . "\n\n{% include 'partials/header.twig' %}\n" + . "
\n{% block content %}{% endblock %}\n
\n" + . "{% include 'partials/footer.twig' %}\n\n\n"); + + file_put_contents($themeDir . '/full_content.twig', + "{% extends 'base.twig' %}\n{% block content %}\n{{ content|raw }}\n{% endblock %}\n"); + + file_put_contents($themeDir . '/partials/header.twig', + "
\n

{{ page_title|default(site_title) }}

\n
\n"); + file_put_contents($themeDir . '/partials/footer.twig', + "
\n

© {{ \"now\"|date('Y') }} {{ site_title|default('') }}

\n
\n"); + + // Starter SCSS source + file_put_contents($themeDir . '/assets/scss/theme.scss', + "/* {$themeName} theme SCSS */\n:root {\n --bs-primary: #0a369d;\n}\nbody {\n font-family: system-ui, sans-serif;\n}\n"); + + // README per thema + file_put_contents($themeDir . '/README.md', + "# " . ucfirst($themeName) . " thema\n\nCodePress thema. Zie `theme.json` voor layout mapping en `assets/scss/theme.scss` voor styling.\n\n" + . "## Structuur\n- `theme.json` — thema configuratie\n- `base.twig` — hoofd layout\n- `full_content.twig` — volledige-breedte layout\n- `partials/` — header, navigation, footer\n- `assets/scss/theme.scss` — SCSS bron (compileert naar `assets/css_compiled/theme.css`)\n- `assets/css/`, `assets/js/`, `assets/img/`, `assets/fonts/` — extra assets\n"); +} + +/** + * Recursively copy a directory (used to clone an existing theme as base). + * Skips css_compiled/ (runtime artefact) and .git/.gitkeep. + * @param string $src Absolute source dir + * @param string $dst Absolute destination dir (already exists) + */ +function copyDirRecursive(string $src, string $dst): void +{ + $realSrc = realpath($src); + if (!$realSrc || !is_dir($realSrc)) return; + + $iterator = new RecursiveIteratorIterator( + new RecursiveDirectoryIterator($realSrc, RecursiveDirectoryIterator::SKIP_DOTS), + RecursiveIteratorIterator::SELF_FIRST + ); + foreach ($iterator as $item) { + $rel = substr($item->getPathname(), strlen($realSrc) + 1); + // Skip runtime artefacts and VCS + if (strpos($rel, 'assets/css_compiled/') === 0) continue; + $seg0 = explode('/', $rel)[0]; + if ($seg0 === '.git') continue; + $dest = $dst . '/' . $rel; + if ($item->isDir()) { + if (!is_dir($dest)) @mkdir($dest, 0755, true); + } else { + $parent = dirname($dest); + if (!is_dir($parent)) @mkdir($parent, 0755, true); + @copy($item->getPathname(), $dest); + } + } +} + +/** + * Recursively delete a directory (used by theme-delete). + */ +function removeDirRecursive(string $dir): void +{ + if (!is_dir($dir)) return; + $iterator = new RecursiveIteratorIterator( + new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS), + RecursiveIteratorIterator::CHILD_FIRST + ); + foreach ($iterator as $item) { + if ($item->isDir()) { + @rmdir($item->getPathname()); + } else { + @unlink($item->getPathname()); + } + } + @rmdir($dir); +} + +/** + * Handle editing files within a theme. Mirrors handlePluginsEdit but for themes/. + * Supports: .twig, .json, .scss, .css, .js, .html, .md, .php + * Path-traversal protection via realpath + prefix check. Default thema kan wel + * bewerkt worden (geen protected block), maar verwijderen/activeren is geblokkeerd. + */ +function handleThemeEdit($auth, $config, $twig, $user, $csrf): void +{ + $themesDir = __DIR__ . '/../themes'; + $theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_GET['theme'] ?? ''); + + if ($theme === '') { + header('Location: /admin/theme'); + exit; + } + + $themeDir = $themesDir . '/' . $theme; + $realThemeDir = realpath($themeDir); + + if (!$realThemeDir || !is_dir($realThemeDir)) { + header('Location: /admin/theme'); + exit; + } + + // Editable extensions within a theme + $editableExts = ['twig', 'json', 'scss', 'css', 'js', 'html', 'md', 'php']; + + // Resolve the requested file (defaults to theme.json) + $defaultFile = 'theme.json'; + $relFile = $_GET['file'] ?? $defaultFile; + $relFile = str_replace(['../', '..\\', './'], '', $relFile); + $relFile = ltrim($relFile, '/'); + + $fullPath = $realThemeDir . '/' . $relFile; + $realPath = realpath($fullPath); + + // Validate path stays within the theme dir + if ($realPath === false || strpos($realPath, $realThemeDir) !== 0) { + $relFile = $defaultFile; + $realPath = realpath($realThemeDir . '/' . $defaultFile); + } + + $message = ''; + $messageType = ''; + + // Carry over flash messages from redirect (upload/delete/move handlers) + if (isset($_GET['msg']) && is_string($_GET['msg']) && $_GET['msg'] !== '') { + $message = $_GET['msg']; + $messageType = $_GET['msgtype'] ?? 'info'; + } + + if ($_SERVER['REQUEST_METHOD'] === 'POST') { + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + $message = 'Ongeldige CSRF token.'; + $messageType = 'danger'; + } elseif (($_POST['action'] ?? '') === 'new_file') { + $newName = trim($_POST['new_filename'] ?? ''); + $newName = preg_replace('/[^a-zA-Z0-9._\-\/]/', '', $newName); + $newName = ltrim($newName, '/'); + $newName = str_replace(['../', '..\\', './'], '', $newName); + $segments = explode('/', $newName); + $traversal = false; + foreach ($segments as $seg) { + if ($seg === '..' || $seg === '.') { $traversal = true; break; } + } + if ($newName === '' || $newName === '.' || $traversal) { + $message = 'Ongeldige bestandsnaam.'; + $messageType = 'danger'; + } else { + $newFullPath = $realThemeDir . '/' . $newName; + $parentPath = dirname($newFullPath); + if (!is_dir($parentPath)) { + @mkdir($parentPath, 0755, true); + } + $parentReal = realpath($parentPath); + if ($parentReal === false || strpos($parentReal, $realThemeDir) !== 0) { + $message = 'Ongeldig pad.'; + $messageType = 'danger'; + } else { + $newReal = $parentReal . '/' . basename($newFullPath); + if (file_exists($newReal)) { + $message = 'Bestand bestaat al.'; + $messageType = 'danger'; + } else { + $ext = strtolower(pathinfo($newName, PATHINFO_EXTENSION)); + $stub = ''; + if ($ext === 'php') { + $stub = "render('pages/theme-edit.twig', [ + 'user' => $user, + 'route' => $route, + 'csrf_token' => $csrf, + 'themeName' => $theme, + 'themeDir' => $themeDir, + 'relFile' => $relFile, + 'fileName' => basename($relFile), + 'fileExt' => $fileExt, + 'fileContent' => $fileContent, + 'isEditable' => $isEditable, + 'files' => $files, + 'editableExts' => $editableExts, + 'sidebar_color' => getSidebarColor($config), + 'needs_editor' => $isEditable, + 'mediaThemeName' => $theme, + 'hasScss' => is_file($realThemeDir . '/assets/scss/theme.scss'), + 'scssCompiled' => (is_file($realThemeDir . '/assets/scss/theme.scss') && is_file($realThemeDir . '/assets/css_compiled/theme.css') && filemtime($realThemeDir . '/assets/css_compiled/theme.css') >= filemtime($realThemeDir . '/assets/scss/theme.scss')), + 'message' => $message, + 'message_type' => $messageType, + ]); +} + +/** + * Handle file upload into a theme's assets/ directory. + * Mirrors handlePluginsFileUpload. Allowed: images, video, audio, pdf, css, scss, js, json, html, md, twig, fonts. + */ +function handleThemeFileUpload($auth, $config, $user): void +{ + if ($_SERVER['REQUEST_METHOD'] !== 'POST') { + header('Location: /admin/theme'); + exit; + } + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + header('Location: /admin/theme'); + exit; + } + + $theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['theme'] ?? ''); + if ($theme === '') { + header('Location: /admin/theme'); + exit; + } + + $themesDir = __DIR__ . '/../themes'; + $assetsRoot = realpath(rtrim($themesDir, '/') . '/' . $theme . '/assets'); + if (!$assetsRoot || !is_dir($assetsRoot)) { + // assets dir doesn't exist yet — create it + $assetsNew = rtrim($themesDir, '/') . '/' . $theme . '/assets'; + if (!@mkdir($assetsNew, 0755, true)) { + header('Location: /admin/theme-edit?theme=' . urlencode($theme)); + exit; + } + $assetsRoot = realpath($assetsNew); + } + if (!$assetsRoot || !is_dir($assetsRoot)) { + header('Location: /admin/theme-edit?theme=' . urlencode($theme)); + exit; + } + + $subdir = str_replace(['../', '..\\', './'], '', $_POST['dir'] ?? ''); + $subdir = ltrim($subdir, '/'); + $targetDir = $assetsRoot . '/' . $subdir; + $realTarget = realpath($targetDir); + if ($realTarget === false) { + if (!@mkdir($targetDir, 0755, true)) { + header('Location: /admin/theme-edit?theme=' . urlencode($theme)); + exit; + } + $realTarget = realpath($targetDir); + } + if (!$realTarget || strpos($realTarget, $assetsRoot) !== 0 || !is_dir($realTarget)) { + header('Location: /admin/theme-edit?theme=' . urlencode($theme)); + exit; + } + + $allowedExt = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'pdf', 'zip', 'mp4', 'webm', 'ogg', 'mp3', 'wav', 'mov', 'avi', 'css', 'scss', 'js', 'json', 'html', 'md', 'twig', 'woff', 'woff2', 'ttf', 'eot']; + $uploaded = 0; + $errors = []; + + if (!empty($_FILES['file']['name'])) { + foreach ($_FILES['file']['name'] as $i => $name) { + if ($_FILES['file']['error'][$i] !== UPLOAD_ERR_OK) continue; + $ext = strtolower(pathinfo($name, PATHINFO_EXTENSION)); + if (!in_array($ext, $allowedExt, true)) { + $errors[] = htmlspecialchars($name) . ' (niet toegestaan type)'; + continue; + } + $filename = preg_replace('/[^a-zA-Z0-9._-]/', '_', $name); + $dest = $realTarget . '/' . $filename; + $n = 1; + while (file_exists($dest)) { + $p = pathinfo($filename); + $dest = $realTarget . '/' . $p['filename'] . '_' . $n . '.' . ($p['extension'] ?? $ext); + $n++; + } + if (move_uploaded_file($_FILES['file']['tmp_name'][$i], $dest)) { + $uploaded++; + } else { + $errors[] = htmlspecialchars($name); + } + } + } + + $msg = []; + $type = 'info'; + if ($uploaded > 0) { + $msg[] = $uploaded . ' bestand(en) geüpload.'; + $type = 'success'; + adminLog($config, 'info', $user['username'] . ' uploadde naar ' . $theme . '/assets/' . ($subdir ? $subdir . '/' : '') . ' (' . $uploaded . ' bestanden)'); + } + if (!empty($errors)) { + $msg[] = 'Fouten: ' . implode(', ', $errors); + $type = $type === 'success' ? 'success' : 'danger'; + } + + $redir = '/admin/theme-edit?theme=' . urlencode($theme); + if (!empty($msg)) { + $redir .= '&msg=' . urlencode(implode(' ', $msg)) . '&msgtype=' . urlencode($type); + } + header('Location: ' . $redir); + exit; +} + +/** + * Handle deletion of a single file inside a theme directory. + * Refuses to delete directories, dotfiles, theme.json, and paths that escape the theme dir. + */ +function handleThemeFileDelete($auth, $config, $user): void +{ + if ($_SERVER['REQUEST_METHOD'] !== 'POST') { + header('Location: /admin/theme'); + exit; + } + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + header('Location: /admin/theme'); + exit; + } + + $theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['theme'] ?? ''); + if ($theme === '') { + header('Location: /admin/theme'); + exit; + } + + $themesDir = __DIR__ . '/../themes'; + $realThemeDir = realpath(rtrim($themesDir, '/') . '/' . $theme); + if (!$realThemeDir || !is_dir($realThemeDir)) { + header('Location: /admin/theme'); + exit; + } + + $relFile = str_replace(['../', '..\\', './'], '', $_POST['file'] ?? ''); + $relFile = ltrim($relFile, '/'); + foreach (explode('/', $relFile) as $seg) { + if ($seg === '..' || $seg === '.') { + header('Location: /admin/theme-edit?theme=' . urlencode($theme)); + exit; + } + } + $base = basename($relFile); + if ($base === '' || $base[0] === '.') { + header('Location: /admin/theme-edit?theme=' . urlencode($theme)); + exit; + } + // Protect theme.json from deletion + if ($relFile === 'theme.json') { + header('Location: /admin/theme-edit?theme=' . urlencode($theme) . '&msg=' . urlencode('theme.json kan niet verwijderd worden.') . '&msgtype=danger'); + exit; + } + + $fullPath = $realThemeDir . '/' . $relFile; + $realPath = realpath($fullPath); + if ($realPath === false || strpos($realPath, $realThemeDir) !== 0 || !is_file($realPath)) { + header('Location: /admin/theme-edit?theme=' . urlencode($theme)); + exit; + } + + $deleted = @unlink($realPath); + if ($deleted) { + adminLog($config, 'info', $user['username'] . ' verwijderde ' . $theme . '/' . $relFile); + $msg = 'Bestand verwijderd.'; + $type = 'success'; + } else { + $err = error_get_last(); + $msg = 'Verwijderen mislukt: ' . ($err['message'] ?? 'onbekend'); + $type = 'danger'; + } + + $redir = '/admin/theme-edit?theme=' . urlencode($theme) . '&file=' . urlencode('theme.json'); + $redir .= '&msg=' . urlencode($msg) . '&msgtype=' . urlencode($type); + header('Location: ' . $redir); + exit; +} + +/** + * Handle moving a single file within a theme to another folder inside the same theme. + * Mirrors handlePluginsFileMove. + */ +function handleThemeFileMove($auth, $config, $twig, $user, $csrf): void +{ + $theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_GET['theme'] ?? $_POST['theme'] ?? ''); + if ($theme === '') { + header('Location: /admin/theme'); + exit; + } + + $themesDir = __DIR__ . '/../themes'; + $realThemeDir = realpath(rtrim($themesDir, '/') . '/' . $theme); + if (!$realThemeDir || !is_dir($realThemeDir)) { + header('Location: /admin/theme'); + exit; + } + + $relFile = str_replace(['../', '..\\', './'], '', $_GET['file'] ?? $_POST['file'] ?? ''); + $relFile = ltrim($relFile, '/'); + foreach (explode('/', $relFile) as $seg) { + if ($seg === '..' || $seg === '.') { + header('Location: /admin/theme-edit?theme=' . urlencode($theme)); + exit; + } + } + $base = basename($relFile); + if ($base === '' || $base[0] === '.') { + header('Location: /admin/theme-edit?theme=' . urlencode($theme)); + exit; + } + if ($relFile === 'theme.json') { + header('Location: /admin/theme-edit?theme=' . urlencode($theme) . '&msg=' . urlencode('theme.json kan niet verplaatst worden.') . '&msgtype=danger'); + exit; + } + + $fullPath = $realThemeDir . '/' . $relFile; + $realPath = realpath($fullPath); + if ($realPath === false || strpos($realPath, $realThemeDir) !== 0 || !is_file($realPath)) { + header('Location: /admin/theme-edit?theme=' . urlencode($theme)); + exit; + } + + $message = ''; + $messageType = ''; + + $directories = ['']; + $iterator = new RecursiveIteratorIterator( + new RecursiveDirectoryIterator($realThemeDir, RecursiveDirectoryIterator::SKIP_DOTS), + RecursiveIteratorIterator::SELF_FIRST + ); + $currentDir = trim(dirname($relFile), '.\\/'); + foreach ($iterator as $file) { + if (!$file->isDir()) continue; + $realDir = $file->getRealPath(); + if ($realDir === false || strpos($realDir, $realThemeDir) !== 0) continue; + $relDir = ltrim(substr($realDir, strlen($realThemeDir) + 1), '/\\'); + $relDir = str_replace('\\', '/', $relDir); + if ($relDir === $currentDir) continue; + if ($relDir !== '' && $relDir[0] === '.') continue; + $directories[] = $relDir; + } + $directories = array_unique($directories); + sort($directories); + + if ($_SERVER['REQUEST_METHOD'] === 'POST') { + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + $message = 'Ongeldige CSRF token.'; + $messageType = 'danger'; + } else { + $dest = str_replace(['../', '..\\', './'], '', $_POST['destination'] ?? ''); + $dest = ltrim($dest, '/'); + foreach (explode('/', $dest) as $seg) { + if ($seg === '..' || $seg === '.') { + $message = 'Ongeldige doelmap.'; + $messageType = 'danger'; + break; + } + } + if ($message === '') { + $destDir = $dest === '' ? $realThemeDir : $realThemeDir . '/' . $dest; + $realDestDir = realpath($destDir); + if (!$realDestDir || !is_dir($realDestDir) || strpos($realDestDir, $realThemeDir) !== 0) { + $message = 'Doelmap bestaat niet.'; + $messageType = 'danger'; + } else { + $newPath = $realDestDir . '/' . basename($realPath); + if (file_exists($newPath)) { + $message = 'Bestand bestaat al op de bestemming.'; + $messageType = 'danger'; + } elseif (rename($realPath, $newPath)) { + adminLog($config, 'info', $user['username'] . ' verplaatste ' . $theme . '/' . $relFile . ' naar ' . $theme . '/' . ($dest ? $dest . '/' : '') . basename($relFile)); + $newRel = $dest === '' ? basename($relFile) : $dest . '/' . basename($relFile); + header('Location: /admin/theme-edit?theme=' . urlencode($theme) . '&file=' . urlencode($newRel) . '&msg=' . urlencode('Bestand verplaatst.') . '&msgtype=success'); + exit; + } else { + $err = error_get_last(); + $message = 'Verplaatsen mislukt: ' . ($err['message'] ?? 'onbekend'); + $messageType = 'danger'; + } + } + } + } + } + + echo $twig->render('pages/theme-move-form.twig', [ + 'user' => $user, + 'route' => 'theme-file-move', + 'csrf_token' => $csrf, + 'themeName' => $theme, + 'relFile' => $relFile, + 'itemName' => basename($relFile), + 'itemDir' => trim(dirname($relFile), '.\\/'), + 'directories' => $directories, + 'sidebar_color' => getSidebarColor($config), + 'needs_editor' => false, + 'message' => $message, + 'message_type' => $messageType, + ]); +} + +/** + * Handle theme activation: sets active_theme in config.json. + */ +function handleThemeActivate($auth, $config, $user): void +{ + if ($_SERVER['REQUEST_METHOD'] !== 'POST') { + header('Location: /admin/theme'); + exit; + } + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + header('Location: /admin/theme'); + exit; + } + + $theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['theme'] ?? ''); + if ($theme === '') { + header('Location: /admin/theme'); + exit; + } + + $themesDir = __DIR__ . '/../themes'; + if (!is_dir($themesDir . '/' . $theme)) { + header('Location: /admin/theme?msg=' . urlencode('Thema bestaat niet.') . '&msgtype=danger'); + exit; + } + + $configFile = $config['config_json']; + $siteConfig = file_exists($configFile) ? json_decode(file_get_contents($configFile), true) : []; + $siteConfig['active_theme'] = $theme; + file_put_contents($configFile, json_encode($siteConfig, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES)); + + adminLog($config, 'info', $user['username'] . ' activeerde thema ' . $theme); + header('Location: /admin/theme?msg=' . urlencode('Thema "' . htmlspecialchars($theme) . '" geactiveerd.') . '&msgtype=success'); + exit; +} + +/** + * Handle theme deletion: only non-active, non-default themes can be removed. + */ +function handleThemeDelete($auth, $config, $user): void +{ + if ($_SERVER['REQUEST_METHOD'] !== 'POST') { + header('Location: /admin/theme'); + exit; + } + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + header('Location: /admin/theme'); + exit; + } + + $theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['theme'] ?? ''); + if ($theme === '' || $theme === 'default') { + adminLog($config, 'warning', $user['username'] . ' probeerde default thema te verwijderen'); + header('Location: /admin/theme?msg=' . urlencode('Default thema kan niet verwijderd worden.') . '&msgtype=danger'); + exit; + } + + $configFile = $config['config_json']; + $siteConfig = file_exists($configFile) ? json_decode(file_get_contents($configFile), true) : []; + if (($siteConfig['active_theme'] ?? 'default') === $theme) { + header('Location: /admin/theme?msg=' . urlencode('Actief thema kan niet verwijderd worden. Activeer eerst een ander thema.') . '&msgtype=danger'); + exit; + } + + $themesDir = __DIR__ . '/../themes'; + $themeDir = $themesDir . '/' . $theme; + $realThemeDir = realpath($themeDir); + $realThemesRoot = realpath($themesDir); + if (!$realThemeDir || !$realThemesRoot || strpos($realThemeDir, $realThemesRoot) !== 0 || !is_dir($realThemeDir)) { + header('Location: /admin/theme?msg=' . urlencode('Thema bestaat niet.') . '&msgtype=danger'); + exit; + } + + removeDirRecursive($realThemeDir); + adminLog($config, 'info', $user['username'] . ' verwijderde thema ' . $theme); + header('Location: /admin/theme?msg=' . urlencode('Thema "' . htmlspecialchars($theme) . '" verwijderd.') . '&msgtype=success'); + exit; +} + +/** + * Handle SCSS compilation for a theme. Uses ThemeManager.compileCss(true). + */ +function handleThemeScss($auth, $config, $user): void +{ + if ($_SERVER['REQUEST_METHOD'] !== 'POST') { + header('Location: /admin/theme'); + exit; + } + if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) { + header('Location: /admin/theme'); + exit; + } + + $theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['theme'] ?? ''); + if ($theme === '') { + header('Location: /admin/theme'); + exit; + } + + $themesDir = __DIR__ . '/../themes'; + if (!is_dir($themesDir . '/' . $theme)) { + header('Location: /admin/theme?msg=' . urlencode('Thema bestaat niet.') . '&msgtype=danger'); + exit; + } + + // Build a minimal config to feed ThemeManager + $themeConfig = ['active_theme' => $theme, 'theme_dir' => $themesDir . '/' . $theme, 'theme' => []]; + $themeJsonFile = $themesDir . '/' . $theme . '/theme.json'; + if (is_file($themeJsonFile)) { + $themeConfig['theme'] = json_decode(file_get_contents($themeJsonFile), true) ?? []; + } + + $msg = ''; + $type = 'info'; + if (!class_exists('ThemeManager')) { + require_once __DIR__ . '/../cms/core/class/ThemeManager.php'; + } + try { + $tm = new ThemeManager($themeConfig); + $result = $tm->compileCss(true); + if ($result !== null) { + $msg = 'SCSS gecompileerd voor ' . htmlspecialchars($theme) . '.'; + $type = 'success'; + adminLog($config, 'info', $user['username'] . ' compileerde SCSS voor ' . $theme); + } else { + $msg = 'SCSS compilatie mislukt voor ' . htmlspecialchars($theme) . '. Controleer of assets/scss/theme.scss bestaat.'; + $type = 'danger'; + adminLog($config, 'error', $user['username'] . ' SCSS compilatie mislukt voor ' . $theme); + } + } catch (\Throwable $e) { + $msg = 'SCSS compilatie fout: ' . htmlspecialchars($e->getMessage()); + $type = 'danger'; + adminLog($config, 'error', $user['username'] . ' SCSS compilatie fout voor ' . $theme . ': ' . $e->getMessage()); + } + + $redir = '/admin/theme?msg=' . urlencode($msg) . '&msgtype=' . urlencode($type); + header('Location: ' . $redir); + exit; +} + function handlePlugins($auth, $config, $twig, $user, $csrf): void { $pluginsDir = $config['plugins_dir']; @@ -2540,10 +4152,15 @@ function handleMediaList($auth, $config): void // Determine the scan root and the URL prefix based on the scope $plugin = preg_replace('/[^a-zA-Z0-9_-]/', '', $_GET['plugin'] ?? ''); + $theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_GET['theme'] ?? ''); if ($plugin !== '') { $pluginsDir = $config['plugins_dir']; $baseDir = rtrim($pluginsDir, '/') . '/' . $plugin . '/assets'; $urlPrefix = '/plugins/' . $plugin . '/assets/'; + } elseif ($theme !== '') { + $themesDir = __DIR__ . '/../themes'; + $baseDir = rtrim($themesDir, '/') . '/' . $theme . '/assets'; + $urlPrefix = '/themes/' . $theme . '/assets/'; } else { $baseDir = $config['content_dir']; $urlPrefix = '/content/'; @@ -2717,38 +4334,51 @@ function scanContentDir(string $fullPath, string $subdir): array } /** - * Recursively collect all editable files within a plugin directory as a - * nested tree. + * Unified editor file-tree scanner (Fase 4 refactor). + * scanPluginFiles/scanThemeFiles/scanContentFiles below are thin wrappers + * around scanEditorFiles() for backwards compatibility with existing call sites. + */ + +/** + * Scan a directory and return a nested file tree for the editor sidebar. + * Unified helper used by the plugin, theme and content editors (Fase 4 refactor). * - * Returns a list of nodes where directories have a `children` array. Used by - * the plugin editor sidebar so a plugin's full file tree (main class, - * plugin.json, language/*.php, assets/css/*, etc.) can be browsed and edited. + * Scope: + * - 'plugin': no extra skips (dotfiles always skipped) + * - 'theme': skips `assets/css_compiled/` (runtime artefact, read-only) + * - 'content': no extra skips (.bak/.git are dotfiles, already skipped) * - * Path-traversal protection: only direct scandir() of validated paths is - * used; the real plugin directory is the anchor and every resolved child - * path is checked to stay within it. + * Path-traversal protection: only direct scandir() of validated paths is used; + * the real base directory is the anchor and every resolved child path is + * checked to stay within it. * - * @param string $pluginDir Absolute path to the plugin directory + * @param string $dir Absolute path to the directory to scan + * @param string $scope One of: 'plugin', 'theme', 'content' * @return array Nested list of nodes: [name, path, is_dir, extension, size, modified, children] */ -function scanPluginFiles(string $pluginDir): array +function scanEditorFiles(string $dir, string $scope = 'plugin'): array { - $realBase = realpath($pluginDir); + $realBase = realpath($dir); if (!$realBase || !is_dir($realBase)) { return []; } - - return scanPluginFilesNode($realBase, '', $realBase); + // Determine which relative paths to skip per scope + $skipPaths = []; + if ($scope === 'theme') { + $skipPaths['assets/css_compiled'] = true; + } + return scanEditorFilesNode($realBase, '', $realBase, $skipPaths); } /** - * Recursive helper for scanPluginFiles(). Builds one level of the tree. + * Recursive helper for scanEditorFiles(). Builds one level of the tree. * - * @param string $absDir Absolute path of the directory to scan - * @param string $relPath Relative path of $absDir within the plugin (empty for root) - * @param string $realBase The real plugin root (for path-traversal guard) + * @param string $absDir Absolute path of the directory to scan + * @param string $relPath Relative path of $absDir within the base (empty for root) + * @param string $realBase The real base root (for path-traversal guard) + * @param array $skipPaths Map of relative paths to skip (e.g. ['assets/css_compiled' => true]) */ -function scanPluginFilesNode(string $absDir, string $relPath, string $realBase): array +function scanEditorFilesNode(string $absDir, string $relPath, string $realBase, array $skipPaths = []): array { $nodes = []; if (!is_dir($absDir)) { @@ -2762,19 +4392,24 @@ function scanPluginFilesNode(string $absDir, string $relPath, string $realBase): if ($entry === '.' || $entry === '..') { continue; } - // Skip hidden / dotfiles (incl. .gitkeep) + // Skip hidden / dotfiles (incl. .gitkeep, .mtime, .bak, .git) if ($entry !== '' && $entry[0] === '.') { continue; } + $childRelPath = $relPath === '' ? $entry : ($relPath . '/' . $entry); + // Skip scope-specific paths (e.g. theme css_compiled runtime artefact) + if (isset($skipPaths[$childRelPath])) { + continue; + } + $absChild = $absDir . '/' . $entry; $realChild = realpath($absChild); - // Safety: every child must live inside the plugin dir + // Safety: every child must live inside the base dir if ($realChild === false || strpos($realChild, $realBase) !== 0) { continue; } - $childRelPath = $relPath === '' ? $entry : ($relPath . '/' . $entry); $isDir = is_dir($realChild); $node = [ @@ -2788,7 +4423,7 @@ function scanPluginFilesNode(string $absDir, string $relPath, string $realBase): ]; if ($isDir) { - $node['children'] = scanPluginFilesNode($realChild, $childRelPath, $realBase); + $node['children'] = scanEditorFilesNode($realChild, $childRelPath, $realBase, $skipPaths); } $nodes[] = $node; @@ -2804,6 +4439,26 @@ function scanPluginFilesNode(string $absDir, string $relPath, string $realBase): return $nodes; } +/** + * Backwards-compatible wrappers (delegates to scanEditorFiles). + * Kept so existing call sites (handlePluginsEdit, handleThemeEdit, handleContentFiles) + * keep working unchanged during/after the Fase 4 refactor. + */ +function scanPluginFiles(string $pluginDir): array +{ + return scanEditorFiles($pluginDir, 'plugin'); +} + +function scanThemeFiles(string $themeDir): array +{ + return scanEditorFiles($themeDir, 'theme'); +} + +function scanContentFiles(string $contentDir): array +{ + return scanEditorFiles($contentDir, 'content'); +} + /** * Language-prefixed files (nl./en.) are stripped of their prefix for the key. * Directories are included if they contain content (represented by their path). diff --git a/version.php b/version.php index ce2946d..eadc3a3 100644 --- a/version.php +++ b/version.php @@ -4,8 +4,8 @@ */ return [ - 'version' => '2.6.1d', - 'release_date' => '2026-08-18', + 'version' => '2.6.2', + 'release_date' => '2026-08-19', 'codename' => 'Lyra', 'status' => 'stable',