From e80967f0fe57432cdc734d3c70b6b92aecefdc59 Mon Sep 17 00:00:00 2001 From: Edwin Noorlander Date: Tue, 21 Jul 2026 13:42:32 +0200 Subject: [PATCH] Fix plugin security, hooks system, and admin features - Add plugin allowlist (enabled_plugins in config.json) - Add enable/disable toggle in admin (separate from visibility) - Add plugin hooks system (actions + filters with auto-registration) - Fix autoLinkPageTitles nested tag vulnerability - Move MQTT credentials to environment variables - Preserve current page in language switcher - Fix ctime/birthtime for file creation date - Deduplicate getGuidePage() CommonMark setup - Simplify formatDisplayName() logic - Add admin activity log to dashboard - Add own password change with current password verification - Apply theme header_color to admin sidebar - Add content preview button in editor --- admin/src/AdminAuth.php | 23 ++++ admin/templates/layout.php | 13 ++- admin/templates/pages/content-edit.php | 5 + admin/templates/pages/dashboard.php | 20 ++++ admin/templates/pages/plugins.php | 27 +++-- admin/templates/pages/users.php | 69 +++++++++--- cms/core/class/CodePressCMS.php | 132 +++++++++-------------- cms/core/plugin/PluginManager.php | 73 ++++++++++++- cms/templates/assets/header.mustache | 4 +- config.json | 5 + plugins/MQTTTracker/MQTTTracker.php | 16 ++- public/admin.php | 141 ++++++++++++++++++++++++- 12 files changed, 412 insertions(+), 116 deletions(-) diff --git a/admin/src/AdminAuth.php b/admin/src/AdminAuth.php index b2b5f64..5699db2 100644 --- a/admin/src/AdminAuth.php +++ b/admin/src/AdminAuth.php @@ -211,6 +211,29 @@ class AdminAuth return ['success' => false, 'message' => 'Gebruiker niet gevonden.']; } + public function changeOwnPassword(string $username, string $currentPassword, string $newPassword): array + { + $user = $this->findUser($username); + if (!$user) { + return ['success' => false, 'message' => 'Gebruiker niet gevonden.']; + } + if (!password_verify($currentPassword, $user['password_hash'])) { + return ['success' => false, 'message' => 'Huidig wachtwoord is onjuist.']; + } + if (strlen($newPassword) < 8) { + return ['success' => false, 'message' => 'Nieuw wachtwoord moet minimaal 8 tekens zijn.']; + } + foreach ($this->adminConfig['users'] as &$u) { + if ($u['username'] === $username) { + $u['password_hash'] = password_hash($newPassword, PASSWORD_DEFAULT); + $this->saveAdminConfig(); + $this->log('info', "Eigen wachtwoord gewijzigd: {$username}"); + return ['success' => true, 'message' => 'Wachtwoord gewijzigd.']; + } + } + return ['success' => false, 'message' => 'Fout bij wijzigen wachtwoord.']; + } + // --- Private helpers --- private function findUser(string $username): ?array diff --git a/admin/templates/layout.php b/admin/templates/layout.php index b8b6fb5..b5bf098 100644 --- a/admin/templates/layout.php +++ b/admin/templates/layout.php @@ -1,4 +1,13 @@ - + @@ -8,7 +17,7 @@