__DIR__ . '/../var/cache/twig',
'auto_reload' => true,
'debug' => true,
]);
// Add Twig functions
$twig->addFunction(new \Twig\TwigFunction('get_country_flag', function($country) {
return GeoIP::getCountryFlagEmoji($country);
}));
$twig->addFunction(new \Twig\TwigFunction('get_country_name', function($country) {
return GeoIP::getCountryName($country);
}));
// Add Twig global for user role and permission checks
$twig->addGlobal('user_role', $auth->getCurrentRole());
$twig->addGlobal('user_real_role', $auth->getRealRole());
$twig->addGlobal('has_role_override', $auth->hasRoleOverride());
$twig->addGlobal('roles', AdminAuth::getRoles());
$twig->addFunction(new \Twig\TwigFunction('has_permission', function($route) use ($auth) {
return $auth->hasPermission($route);
}));
$twig->addFunction(new \Twig\TwigFunction('role_label', function($role) {
return AdminAuth::getRoleLabel($role);
}));
// Load admin interface translations
// admin_language is resolved from: config admin_language -> language.default -> 'nl'
function loadAdminTranslations(?array $siteConfig = null): array {
$adminLang = $siteConfig['admin_language'] ?? ($siteConfig['language']['default'] ?? 'nl');
$langDir = __DIR__ . '/../language/';
$file = $langDir . $adminLang . '/admin.php';
if (file_exists($file)) {
$t = include $file;
if (is_array($t)) {
return $t;
}
}
// Fallback to Dutch admin translations
$fallback = $langDir . 'nl/admin.php';
if (file_exists($fallback)) {
$t = include $fallback;
if (is_array($t)) {
return $t;
}
}
return [];
}
$siteConfigForI18n = file_exists($appConfig['config_json'])
? (json_decode(file_get_contents($appConfig['config_json']), true) ?? [])
: [];
$adminTranslations = loadAdminTranslations($siteConfigForI18n);
$adminLangCode = $siteConfigForI18n['admin_language'] ?? ($siteConfigForI18n['language']['default'] ?? 'nl');
$twig->addGlobal('ta', $adminTranslations);
$twig->addGlobal('admin_lang', $adminLangCode);
$twig->addFunction(new \Twig\TwigFunction('ta', function($key) use ($adminTranslations) {
return $adminTranslations[$key] ?? $key;
}));
// Initialize admin PluginManager for plugin-provided admin pages and menu items
$enabledPluginsList = $siteConfigForI18n['enabled_plugins'] ?? [];
$siteDefaultLangForPlugins = $siteConfigForI18n['language']['default'] ?? 'nl';
$adminPluginManager = new PluginManager(__DIR__ . '/../plugins', $enabledPluginsList, $siteDefaultLangForPlugins);
$adminPluginAPI = new AdminPluginAPI($siteConfigForI18n);
$adminPluginAPI->setPluginManager($adminPluginManager);
$adminPluginManager->setAPI($adminPluginAPI);
$adminPluginMenuItems = $adminPluginManager->getAdminMenuItems();
$twig->addGlobal('plugin_admin_menu', $adminPluginMenuItems);
// Plugin translations for the admin context.
// System plugins resolve against the admin language; content plugins against
// the current content language (handled per-plugin in the API). For the Twig
// sidebar we load the admin-language pack of every plugin.
$adminPluginTranslations = $adminPluginManager->getAllPluginTranslations($adminLangCode, 'admin');
$twig->addGlobal('ta_plugins', $adminPluginTranslations);
$twig->addFunction(new \Twig\TwigFunction('tap', function($plugin, $key) use ($adminPluginTranslations) {
return $adminPluginTranslations[$plugin][$key] ?? $key;
}));
$twig->addFunction(new \Twig\TwigFunction('plugin_menu_label', function($item) use ($adminPluginTranslations) {
$plugin = $item['plugin'] ?? '';
$labelKey = $item['label_key'] ?? '';
if ($plugin !== '' && $labelKey !== '' && isset($adminPluginTranslations[$plugin][$labelKey])) {
return $adminPluginTranslations[$plugin][$labelKey];
}
return $item['label'] ?? ($item['route'] ?? '');
}));
// Routing
$route = $_GET['route'] ?? '';
// Helper to get sidebar color
function getSidebarColor($config) {
$siteConfig = file_exists($config['config_json'])
? json_decode(file_get_contents($config['config_json']), true)
: [];
$activeTheme = $siteConfig['active_theme'] ?? 'default';
$themeFile = __DIR__ . "/../themes/{$activeTheme}/theme.json";
if (file_exists($themeFile)) {
$theme = json_decode(file_get_contents($themeFile), true);
return $theme['header_color'] ?? '#0a369d';
}
return '#0a369d';
}
// Essential plugins that cannot be disabled or deleted
function getProtectedPlugins(): array {
return ['Navigation'];
}
function isProtectedPlugin(string $pluginName): bool {
return in_array($pluginName, getProtectedPlugins(), true);
}
// Public routes (no auth required)
if ($route === 'login') {
$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$result = $auth->login($_POST['username'] ?? '', $_POST['password'] ?? '', $_POST['csrf_token'] ?? '');
if ($result['success']) {
header('Location: /admin/dashboard');
exit;
}
$error = $result['message'];
}
echo $twig->render('login.twig', [
'error' => $error,
'csrf_token' => $auth->getCsrfToken(),
]);
exit;
}
// All other routes require authentication
if (!$auth->isAuthenticated()) {
header('Location: /admin/login');
exit;
}
$user = $auth->getCurrentUser();
$csrf = $auth->getCsrfToken();
$userRole = $auth->getCurrentRole();
$siteConfig = file_exists($appConfig['config_json'])
? json_decode(file_get_contents($appConfig['config_json']), true)
: [];
// Check route permission (except dashboard and role-switch/reset which real admins always need)
if ($route !== '' && $route !== 'dashboard' && $route !== 'role-switch' && $route !== 'role-reset' && !$auth->hasPermission($route)) {
http_response_code(403);
echo $twig->render('pages/error.twig', [
'user' => $user,
'route' => '',
'csrf_token' => $csrf,
'error_code' => 403,
'error_title' => 'Geen toegang',
'error_message' => 'Je hebt geen rechten om deze pagina te bekijken.',
'sidebar_color' => getSidebarColor($appConfig),
'needs_editor' => false,
'message' => '',
'message_type' => 'info',
]);
exit;
}
// Authenticated routes
// Check if a plugin handles this route (e.g. 'statistics', 'logs')
$pluginRouteMatch = $adminPluginManager->resolveAdminRoute($route);
if ($pluginRouteMatch !== null) {
// Permission check: use the permission declared by the plugin (default 'plugins')
$requiredPermission = $pluginRouteMatch['permission'] ?? 'plugins';
// Role check: if the plugin declares required_roles, the current role must be in the list (admin always passes)
$requiredRoles = $pluginRouteMatch['required_roles'] ?? null;
$currentRole = $auth->getCurrentRole();
$roleOk = $requiredRoles === null || $currentRole === 'admin' || in_array($currentRole, $requiredRoles, true);
if (($requiredPermission !== 'dashboard' && !$auth->hasPermission($requiredPermission)) || !$roleOk) {
http_response_code(403);
echo $twig->render('pages/error.twig', [
'user' => $user,
'route' => '',
'csrf_token' => $csrf,
'error_code' => 403,
'error_title' => $adminTranslations['no_permission_title'] ?? 'Geen toegang',
'error_message' => $adminTranslations['no_permission'] ?? 'Geen toegang.',
'sidebar_color' => getSidebarColor($appConfig),
'needs_editor' => false,
'message' => '',
'message_type' => 'info',
]);
exit;
}
$pluginHtml = $adminPluginManager->dispatchAdminRoute($pluginRouteMatch['plugin'], $pluginRouteMatch['action']);
if ($pluginHtml !== null) {
// Wrap plugin output in admin layout
echo $twig->render('pages/plugin-page.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'sidebar_color' => getSidebarColor($appConfig),
'needs_editor' => false,
'message' => '',
'message_type' => 'info',
'plugin_content' => $pluginHtml,
]);
exit;
}
// If plugin returned null, fall through to 404
}
switch ($route) {
case 'logout':
$auth->logout();
header('Location: /admin/login');
exit;
case 'role-switch':
handleRoleSwitch($auth, $appConfig);
break;
case 'role-reset':
handleRoleReset($auth, $appConfig);
break;
case 'content':
handleContent($auth, $appConfig, $twig, $user, $csrf, $siteConfig);
break;
case 'content-files':
handleContentFiles($auth, $appConfig, $twig, $user, $csrf, $siteConfig);
break;
case 'content-file-upload':
handleContentFileUpload($auth, $appConfig, $user);
break;
case 'content-file-delete':
handleContentFileDelete($auth, $appConfig, $user);
break;
case 'content-file-move':
handleContentFileMove($auth, $appConfig, $twig, $user, $csrf);
break;
case 'content-dir-create-in':
handleContentDirCreateIn($auth, $appConfig, $user);
break;
case 'content-dir-rename-in':
handleContentDirRenameIn($auth, $appConfig, $twig, $user, $csrf);
break;
case 'content-dir-delete-in':
handleContentDirDeleteIn($auth, $appConfig, $user);
break;
case 'content-edit':
handleContentEdit($auth, $appConfig, $twig, $user, $csrf, $siteConfig);
break;
case 'content-new':
handleContentNew($auth, $appConfig, $twig, $user, $csrf, $siteConfig);
break;
case 'content-delete':
handleContentDelete($auth, $appConfig);
break;
case 'content-dir-create':
handleContentDirCreate($auth, $appConfig);
break;
case 'content-dir-rename':
handleContentDirRename($auth, $appConfig, $twig, $user, $csrf);
break;
case 'content-move':
handleContentMove($auth, $appConfig, $twig, $user, $csrf);
break;
case 'content-backup':
handleContentBackup($auth, $appConfig, $twig, $user, $csrf);
break;
case 'content-restore':
handleContentRestore($auth, $appConfig);
break;
case 'content-git-init':
handleContentGitInit($auth, $appConfig);
break;
case 'content-git-commit':
handleContentGitCommit($auth, $appConfig);
break;
case 'content-git-restore':
handleContentGitRestore($auth, $appConfig);
break;
case 'content-dir-delete':
handleContentDirDelete($auth, $appConfig);
break;
case 'config':
handleConfig($auth, $appConfig, $twig, $user, $csrf);
break;
case 'security':
handleSecurity($auth, $appConfig, $twig, $user, $csrf);
break;
case 'theme':
handleTheme($auth, $appConfig, $twig, $user, $csrf, $siteConfig);
break;
case 'theme-new':
handleThemeNew($auth, $appConfig, $twig, $user, $csrf);
break;
case 'theme-edit':
handleThemeEdit($auth, $appConfig, $twig, $user, $csrf);
break;
case 'theme-file-upload':
handleThemeFileUpload($auth, $appConfig, $user);
break;
case 'theme-file-delete':
handleThemeFileDelete($auth, $appConfig, $user);
break;
case 'theme-file-move':
handleThemeFileMove($auth, $appConfig, $twig, $user, $csrf);
break;
case 'theme-activate':
handleThemeActivate($auth, $appConfig, $user);
break;
case 'theme-delete':
handleThemeDelete($auth, $appConfig, $user);
break;
case 'theme-scss':
handleThemeScss($auth, $appConfig, $user);
break;
case 'plugins':
handlePlugins($auth, $appConfig, $twig, $user, $csrf);
break;
case 'plugins-new':
handlePluginsNew($auth, $appConfig, $twig, $user, $csrf);
break;
case 'plugins-edit':
handlePluginsEdit($auth, $appConfig, $twig, $user, $csrf);
break;
case 'plugins-file-upload':
handlePluginsFileUpload($auth, $appConfig, $user);
break;
case 'plugins-file-delete':
handlePluginsFileDelete($auth, $appConfig, $user);
break;
case 'plugins-file-move':
handlePluginsFileMove($auth, $appConfig, $twig, $user, $csrf);
break;
case 'plugins-config':
handlePluginsConfig($auth, $appConfig, $twig, $user, $csrf);
break;
case 'plugins-toggle':
handlePluginsToggle($auth, $appConfig);
break;
case 'plugins-delete':
handlePluginsDelete($auth, $appConfig);
break;
case 'users':
handleUsers($auth, $appConfig, $twig, $user, $csrf);
break;
case 'users-edit':
handleUsersEdit($auth, $appConfig, $twig, $user, $csrf);
break;
case 'users-new':
handleUsersNew($auth, $appConfig, $twig, $user, $csrf);
break;
case 'guide':
handleGuide($auth, $appConfig, $twig, $user, $csrf);
break;
case 'update':
handleUpdate($auth, $appConfig, $twig, $user, $csrf);
break;
case 'media':
handleMedia($auth, $appConfig, $twig, $user, $csrf);
break;
case 'media-list':
handleMediaList($auth, $appConfig);
break;
default:
handleDashboard($auth, $appConfig, $twig, $user, $csrf, $siteConfig);
}
// ============================================================================
// HANDLER FUNCTIONS
// ============================================================================
function handleDashboard($auth, $config, $twig, $user, $csrf, $siteConfig): void
{
$contentDir = $config['content_dir'];
$pluginsDir = $config['plugins_dir'];
$configJson = $config['config_json'];
$versionFile = __DIR__ . '/../version.php';
$versionInfo = [];
if (file_exists($versionFile)) {
$verData = include $versionFile;
$versionInfo = is_array($verData) ? $verData : [];
}
if (empty($versionInfo['version'])) {
$versionInfo['version'] = '0.0.0';
}
$stats = [
'pages' => countFiles($contentDir, ['md', 'php', 'html']),
'directories' => countDirs($contentDir),
'config_exists' => file_exists($configJson),
'content_size' => formatSize(dirSize($contentDir)),
'php_version' => PHP_VERSION,
'cms_version' => $versionInfo['version'],
'os' => PHP_OS_FAMILY . ' (' . php_uname('r') . ')',
];
// Build plugin overview (name => enabled status)
$pluginOverview = [];
$enabledPlugins = $siteConfig['enabled_plugins'] ?? [];
if (is_dir($pluginsDir)) {
foreach (glob($pluginsDir . '/*', GLOB_ONLYDIR) as $pluginDir) {
$pluginName = basename($pluginDir);
$pluginOverview[$pluginName] = [
'enabled' => in_array($pluginName, $enabledPlugins, true),
];
}
}
ksort($pluginOverview);
echo $twig->render('pages/dashboard.twig', [
'user' => $user,
'route' => 'dashboard',
'csrf_token' => $csrf,
'stats' => $stats,
'site_config' => $siteConfig,
'plugin_overview' => $pluginOverview,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => '',
'message_type' => 'info',
]);
}
/**
* Handle role switch (POST): admin temporarily switches to another role for testing.
*/
function handleRoleSwitch($auth, $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/dashboard');
exit;
}
$user = $auth->getCurrentUser();
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/dashboard?error=' . urlencode('Ongeldige CSRF token.'));
exit;
}
$newRole = $_POST['new_role'] ?? '';
$result = $auth->switchRole($newRole);
adminLog($config, $result['success'] ? 'info' : 'warning', $user['username'] . ' rol-switch: ' . $result['message']);
header('Location: /admin/dashboard?msg=' . urlencode($result['message']));
exit;
}
/**
* Handle role reset (POST): admin resets back to their real role.
*/
function handleRoleReset($auth, $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/dashboard');
exit;
}
$user = $auth->getCurrentUser();
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/dashboard?error=' . urlencode('Ongeldige CSRF token.'));
exit;
}
$result = $auth->resetRole();
adminLog($config, $result['success'] ? 'info' : 'warning', $user['username'] . ' rol-reset: ' . $result['message']);
header('Location: /admin/dashboard?msg=' . urlencode($result['message']));
exit;
}
function handleContent($auth, $config, $twig, $user, $csrf, $siteConfig): void
{
$contentDir = $config['content_dir'];
$subdir = $_GET['dir'] ?? '';
// Prevent path traversal
$subdir = str_replace(['../', '..\\'], '', $subdir);
$subdir = trim($subdir, '/');
if ($subdir === '.' || $subdir === '') {
$subdir = '';
}
$fullPath = rtrim($contentDir, '/') . '/' . $subdir;
if (!is_dir($fullPath)) {
$fullPath = $contentDir;
$subdir = '';
}
$message = '';
$messageType = '';
// Handle file upload
if ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_FILES['file']['name'][0])) {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$allowedExt = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'pdf', 'zip', 'mp4', 'webm', 'ogg', 'mp3', 'wav', 'doc', 'docx', 'xls', 'xlsx'];
$uploaded = 0;
$errors = [];
foreach ($_FILES['file']['name'] as $i => $name) {
if ($_FILES['file']['error'][$i] !== UPLOAD_ERR_OK) continue;
$ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
if (!in_array($ext, $allowedExt)) {
$errors[] = htmlspecialchars($name) . ' (niet toegestaan type)';
continue;
}
$filename = preg_replace('/[^a-zA-Z0-9._-]/', '_', $name);
$dest = rtrim($fullPath, '/') . '/' . $filename;
$n = 1;
while (file_exists($dest)) {
$p = pathinfo($filename);
$dest = rtrim($fullPath, '/') . '/' . $p['filename'] . '_' . $n . '.' . ($p['extension'] ?? $ext);
$n++;
}
if (move_uploaded_file($_FILES['file']['tmp_name'][$i], $dest)) {
$uploaded++;
} else {
$errors[] = htmlspecialchars($name);
}
}
if ($uploaded > 0) {
$message = $uploaded . ' bestand(en) geüpload.';
$messageType = 'success';
}
if (!empty($errors)) {
$message .= ' Fouten: ' . implode(', ', $errors);
$messageType = $messageType ?: 'danger';
}
}
}
$items = scanContentDir($fullPath, $subdir);
echo $twig->render('pages/content.twig', [
'user' => $user,
'route' => 'content',
'csrf_token' => $csrf,
'subdir' => $subdir,
'items' => $items,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
/**
* Content file-browser editor (Fase 1-3 van content-consistentie TODO).
* Spiegel van plugins-edit/theme-edit, maar dan voor de content_dir.
*
* Toont een geneste bestandsboom zijbalk + CodeMirror editor voor .md/.php/.html.
* Ondersteunt: nieuw bestand, opslaan, uploaden, verwijderen, verplaatsen,
* map aanmaken/hernoemen/verwijderen, backup/git acties (Fase 5).
*
* Path-traversal bescherming: realpath() + prefix-check op content_dir.
* Taal-prefix (nl./en.) wordt getoond in de boom maar niet gestript uit bestandsnamen
* (content gebruikt taal-prefix in bestandsnamen, anders dan plugins/themes).
*/
function handleContentFiles($auth, $config, $twig, $user, $csrf, $siteConfig): void
{
$contentDir = $config['content_dir'];
$realContentDir = realpath($contentDir);
if (!$realContentDir || !is_dir($realContentDir)) {
header('Location: /admin/content');
exit;
}
// Editable extensions within content (consistent met bestaande content-edit)
$editableExts = ['md', 'php', 'html'];
// Resolve the requested file (default: first editable file found at root, else index.md)
$relFile = $_GET['file'] ?? '';
$relFile = str_replace(['../', '..\\', './'], '', $relFile);
$relFile = ltrim($relFile, '/');
// Carry over flash messages from redirect (upload/delete/move handlers)
$message = '';
$messageType = '';
if (isset($_GET['msg']) && is_string($_GET['msg']) && $_GET['msg'] !== '') {
$message = $_GET['msg'];
$messageType = $_GET['msgtype'] ?? 'info';
}
// Resolve real path of the file
$realPath = $relFile !== '' ? realpath($realContentDir . '/' . $relFile) : false;
if ($relFile !== '' && ($realPath === false || strpos($realPath, $realContentDir) !== 0)) {
// Invalid path — reset
$relFile = '';
$realPath = false;
}
// Handle POST actions: new_file, new_dir, save, rename_dir, delete_dir
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} elseif (($_POST['action'] ?? '') === 'new_file') {
$inDir = str_replace(['../', '..\\', './'], '', $_POST['in_dir'] ?? '');
$inDir = ltrim($inDir, '/');
foreach (explode('/', $inDir) as $seg) {
if ($seg === '..' || $seg === '.') { $inDir = ''; break; }
}
$newName = trim($_POST['new_filename'] ?? '');
$ext = strtolower(trim($_POST['new_ext'] ?? 'md'));
if (!in_array($ext, $editableExts, true)) $ext = 'md';
$newName = preg_replace('/[^a-zA-Z0-9._\-\/]/', '', $newName);
$newName = ltrim($newName, '/');
$newName = str_replace(['../', '..\\', './'], '', $newName);
$segments = explode('/', $newName);
$traversal = false;
foreach ($segments as $seg) {
if ($seg === '..' || $seg === '.') { $traversal = true; break; }
}
// Strip an existing content extension from the name only if it matches a known content ext; we append $ext
$lastSeg = end($segments);
if ($lastSeg !== false) {
$lastPathInfo = pathinfo($lastSeg);
if (isset($lastPathInfo['extension']) && in_array(strtolower($lastPathInfo['extension']), $editableExts, true)) {
$segments[key($segments)] = $lastPathInfo['filename'];
}
}
$newName = implode('/', $segments);
if ($newName === '' || $newName === '.' || $traversal) {
$message = 'Ongeldige bestandsnaam.';
$messageType = 'danger';
} else {
$newRel = ($inDir ? $inDir . '/' : '') . $newName . '.' . $ext;
$newFullPath = $realContentDir . '/' . $newRel;
$parentPath = dirname($newFullPath);
if (!is_dir($parentPath)) @mkdir($parentPath, 0755, true);
$parentReal = realpath($parentPath);
if ($parentReal === false || strpos($parentReal, $realContentDir) !== 0) {
$message = 'Ongeldig pad.';
$messageType = 'danger';
} else {
$newReal = $parentReal . '/' . basename($newFullPath);
if (file_exists($newReal)) {
$message = 'Bestand bestaat al.';
$messageType = 'danger';
} else {
// Build frontmatter with author metadata (zoals handleContentNew)
$now = date('Y-m-d H:i:s');
$frontmatter = "---\nlayout: full_content\nauthor_name: " . ($user['author_name'] ?? $user['username'] ?? '') . "\nauthor_email: " . ($user['author_email'] ?? '') . "\ncreated: " . $now . "\n---\n\n";
$stub = $ext === 'md' ? $frontmatter . "# Nieuwe pagina\n\n" : ($ext === 'php' ? "Nieuwe pagina\n");
$written = @file_put_contents($newReal, $stub);
if ($written !== false) {
adminLog($config, 'info', $user['username'] . ' creëerde content bestand ' . $newRel);
$relFile = $newRel;
$realPath = $newReal;
$message = 'Bestand aangemaakt.';
$messageType = 'success';
} else {
$err = error_get_last();
$message = 'Bestand aanmaken mislukt: ' . ($err['message'] ?? 'onbekend');
$messageType = 'danger';
}
}
}
}
} elseif (($_POST['action'] ?? '') === 'new_dir') {
$newDir = trim($_POST['dirname'] ?? '');
$inDir = str_replace(['../', '..\\', './'], '', $_POST['in_dir'] ?? '');
$inDir = ltrim($inDir, '/');
$newDir = preg_replace('/[^a-zA-Z0-9._-]/', '-', $newDir);
if ($newDir === '' || $newDir === '.' || $newDir === '..') {
$message = 'Ongeldige mapnaam.';
$messageType = 'danger';
} else {
$newFullPath = $realContentDir . '/' . ($inDir ? $inDir . '/' : '') . $newDir;
$parentReal = realpath($realContentDir . '/' . $inDir);
if ($parentReal === false || strpos($parentReal, $realContentDir) !== 0) {
$message = 'Ongeldig pad.';
$messageType = 'danger';
} elseif (file_exists($newFullPath)) {
$message = 'Map bestaat al.';
$messageType = 'danger';
} else {
if (@mkdir($newFullPath, 0755, true)) {
adminLog($config, 'info', $user['username'] . ' creëerde content map ' . ($inDir ? $inDir . '/' : '') . $newDir);
$message = 'Map aangemaakt.';
$messageType = 'success';
} else {
$message = 'Map aanmaken mislukt.';
$messageType = 'danger';
}
}
}
} elseif (($_POST['action'] ?? '') === 'rename_dir') {
$dirRel = str_replace(['../', '..\\', './'], '', $_POST['dir'] ?? '');
$dirRel = ltrim($dirRel, '/');
$newName = preg_replace('/[^a-zA-Z0-9._-]/', '-', trim($_POST['newname'] ?? ''));
foreach (explode('/', $dirRel) as $seg) {
if ($seg === '..' || $seg === '.') { $dirRel = ''; break; }
}
if ($dirRel === '' || $newName === '' || $newName === '.' || $newName === '..') {
$message = 'Ongeldige invoer voor hernoemen.';
$messageType = 'danger';
} else {
$fullPath = $realContentDir . '/' . $dirRel;
$realDir = realpath($fullPath);
$parentReal = realpath(dirname($fullPath));
if (!$realDir || !is_dir($realDir) || strpos($realDir, $realContentDir) !== 0 || !$parentReal || strpos($parentReal, $realContentDir) !== 0) {
$message = 'Map niet gevonden.';
$messageType = 'danger';
} else {
$newPath = $parentReal . '/' . $newName;
if (file_exists($newPath)) {
$message = 'Naam bestaat al.';
$messageType = 'danger';
} elseif (rename($realDir, $newPath)) {
adminLog($config, 'info', $user['username'] . ' hernoemde content map ' . $dirRel . ' naar ' . $newName);
$message = 'Map hernoemd.';
$messageType = 'success';
// Update $relFile if it was inside the renamed dir
if ($relFile !== '' && strpos($relFile, $dirRel . '/') === 0) {
$relFile = dirname($dirRel) . '/' . $newName . '/' . substr($relFile, strlen($dirRel) + 1);
$relFile = ltrim($relFile, '/');
$realPath = realpath($realContentDir . '/' . $relFile);
}
} else {
$message = 'Hernoemen mislukt.';
$messageType = 'danger';
}
}
}
} elseif (($_POST['action'] ?? '') === 'delete_dir') {
$dirRel = str_replace(['../', '..\\', './'], '', $_POST['dir'] ?? '');
$dirRel = ltrim($dirRel, '/');
foreach (explode('/', $dirRel) as $seg) {
if ($seg === '..' || $seg === '.') { $dirRel = ''; break; }
}
if ($dirRel === '') {
$message = 'Ongeldige map.';
$messageType = 'danger';
} else {
$fullPath = $realContentDir . '/' . $dirRel;
$realDir = realpath($fullPath);
if (!$realDir || !is_dir($realDir) || strpos($realDir, $realContentDir) !== 0) {
$message = 'Map niet gevonden.';
$messageType = 'danger';
} else {
// Only allow deleting empty directories (consistent met bestaande content-dir-delete)
$entries = array_diff(scandir($realDir), ['.', '..']);
// Allow .bak directory to be deleted with its contents
$isEmpty = true;
foreach ($entries as $e) {
if ($e[0] !== '.') { $isEmpty = false; break; }
}
if (!$isEmpty) {
$message = 'Map moet leeg zijn (verborgen bestanden zoals .bak worden genegeerd).';
$messageType = 'danger';
} elseif (@rmdir($realDir)) {
adminLog($config, 'info', $user['username'] . ' verwijderde content map ' . $dirRel);
$message = 'Map verwijderd.';
$messageType = 'success';
// Reset relFile if it was inside the deleted dir
if ($relFile !== '' && strpos($relFile, $dirRel . '/') === 0) {
$relFile = '';
$realPath = false;
}
} else {
$message = 'Map verwijderen mislukt.';
$messageType = 'danger';
}
}
}
} else {
// Save the currently selected file
$content = $_POST['content'] ?? '';
$layout = $_POST['layout'] ?? '';
if ($realPath && is_file($realPath)) {
$ext = strtolower(pathinfo($realPath, PATHINFO_EXTENSION));
if (in_array($ext, $editableExts, true)) {
if ($layout && $ext === 'md') {
$content = updateContentFrontmatter($content, 'layout', $layout);
}
$plugins = isset($_POST['plugins']) && is_array($_POST['plugins'])
? implode(', ', array_map('trim', $_POST['plugins']))
: '';
if ($ext === 'md') {
$content = updateContentFrontmatter($content, 'plugins', $plugins);
}
backupContentFile($realPath);
file_put_contents($realPath, $content);
adminLog($config, 'info', $user['username'] . ' bewerkte content ' . $relFile);
$message = 'Bestand opgeslagen.';
$messageType = 'success';
} else {
$message = 'Dit bestandstype kan niet bewerkt worden.';
$messageType = 'danger';
}
} else {
$message = 'Bestand niet gevonden.';
$messageType = 'danger';
}
}
}
// Gather the content file tree (geneste boom, skipt .bak/.git)
$files = scanContentFiles($contentDir);
// If no file selected, pick the first editable file at root
if ($relFile === '' && $realPath === false) {
foreach ($files as $node) {
if (!$node['is_dir'] && in_array($node['extension'], $editableExts, true)) {
$relFile = $node['path'];
$realPath = realpath($realContentDir . '/' . $relFile);
break;
}
}
}
// Load content of the selected file (if editable)
$isEditable = false;
$fileContent = '';
$fileExt = '';
$fileName = '';
if ($realPath && is_file($realPath)) {
$fileExt = strtolower(pathinfo($realPath, PATHINFO_EXTENSION));
$fileName = basename($realPath);
if (in_array($fileExt, $editableExts, true)) {
$isEditable = true;
$fileContent = file_get_contents($realPath);
}
}
// Theme layouts for the layout selector (spiegel van handleContentEdit)
$themeLayouts = [];
$themeDefaultLayout = 'full_content';
$activeThemeName = $siteConfig['active_theme'] ?? 'default';
$themeDir = __DIR__ . "/../themes/{$activeThemeName}";
$themeJsonFile = $themeDir . '/theme.json';
if (file_exists($themeJsonFile)) {
$themeJson = json_decode(file_get_contents($themeJsonFile), true);
$themeDefaultLayout = $themeJson['config']['default_template'] ?? 'full_content';
if (isset($themeJson['template']) && is_array($themeJson['template'])) {
foreach ($themeJson['template'] as $key => $twigFile) {
if (in_array($key, ['guide'], true)) continue;
$themeLayouts[$key] = $twigFile;
}
}
}
// Available plugins for the plugins checkbox group
$pluginsDir = $config['plugins_dir'];
$availablePlugins = [];
if (is_dir($pluginsDir)) {
foreach (glob($pluginsDir . '*', GLOB_ONLYDIR) as $pluginDir) {
$pluginName = basename($pluginDir);
if ($pluginName !== '.' && $pluginName !== '..' && file_exists($pluginDir . '/plugin.json')) {
$availablePlugins[] = $pluginName;
}
}
}
// Current frontmatter values for the selected file
$currentLayout = $isEditable ? extractFrontmatterValue($fileContent, 'layout') : '';
$currentPlugins = $isEditable ? extractFrontmatterValue($fileContent, 'plugins') : '';
$selectedPlugins = array_map('trim', explode(',', $currentPlugins));
if ($selectedPlugins === ['']) $selectedPlugins = [];
$currentAuthorName = $isEditable ? extractFrontmatterValue($fileContent, 'author_name') : '';
$currentAuthorEmail = $isEditable ? extractFrontmatterValue($fileContent, 'author_email') : '';
$currentCreated = $isEditable ? extractFrontmatterValue($fileContent, 'created') : '';
$currentLang = $relFile ? extractLanguagePrefix($relFile) : 'nl';
$fileDir = $relFile ? trim(dirname($relFile), '.\\/') : '';
// Git status for Fase 5 (content git integratie in zijbalk)
$gitStatus = ['available' => false, 'initialized' => false, 'dirty' => false, 'branch' => '', 'ahead' => 0, 'behind' => 0, 'lastCommit' => ''];
$gitDir = $realContentDir . '/.git';
$gitStatus['available'] = $is_dir = is_dir($gitDir);
if ($gitStatus['available']) {
$gitStatus['initialized'] = true;
$branch = @shell_exec('cd ' . escapeshellarg($realContentDir) . ' && git rev-parse --abbrev-ref HEAD 2>/dev/null');
$gitStatus['branch'] = trim($branch ?? '');
$dirty = @shell_exec('cd ' . escapeshellarg($realContentDir) . ' && git status --porcelain 2>/dev/null');
$gitStatus['dirty'] = trim($dirty ?? '') !== '';
$lastCommit = @shell_exec('cd ' . escapeshellarg($realContentDir) . ' && git log -1 --format="%h %s (%cr)" 2>/dev/null');
$gitStatus['lastCommit'] = trim($lastCommit ?? '');
}
$route = 'content-files';
echo $twig->render('pages/content-files.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'relFile' => $relFile,
'fileDir' => $fileDir,
'fileName' => $fileName,
'fileExt' => $fileExt,
'fileContent' => $fileContent,
'isEditable' => $isEditable,
'files' => $files,
'editableExts' => $editableExts,
'currentLayout' => $currentLayout ?: $themeDefaultLayout,
'themeLayouts' => $themeLayouts,
'themeDefaultLayout' => $themeDefaultLayout,
'activeThemeName' => $activeThemeName,
'availablePlugins' => $availablePlugins,
'selectedPlugins' => $selectedPlugins,
'currentLang' => $currentLang,
'currentAuthorName' => $currentAuthorName,
'currentAuthorEmail' => $currentAuthorEmail,
'currentCreated' => $currentCreated,
'gitStatus' => $gitStatus,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => $isEditable,
'message' => $message,
'message_type' => $messageType,
]);
}
/**
* Handle file upload into a content directory (Fase 2).
* Mirrors handlePluginsFileUpload/handleThemeFileUpload.
* Allowed: images, video, audio, pdf, zip, office docs, css, scss, js, json, html, md.
*/
function handleContentFileUpload($auth, $config, $user): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/content-files');
exit;
}
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/content-files');
exit;
}
$contentDir = $config['content_dir'];
$realContentDir = realpath($contentDir);
if (!$realContentDir || !is_dir($realContentDir)) {
header('Location: /admin/content-files');
exit;
}
// Optional subdir within content/ (e.g. "blog" or "-assets")
$subdir = str_replace(['../', '..\\', './'], '', $_POST['dir'] ?? '');
$subdir = ltrim($subdir, '/');
foreach (explode('/', $subdir) as $seg) {
if ($seg === '..' || $seg === '.') { $subdir = ''; break; }
}
$targetDir = $subdir === '' ? $realContentDir : $realContentDir . '/' . $subdir;
$realTarget = realpath($targetDir);
if ($realTarget === false) {
if (!@mkdir($targetDir, 0755, true)) {
header('Location: /admin/content-files');
exit;
}
$realTarget = realpath($targetDir);
}
if (!$realTarget || strpos($realTarget, $realContentDir) !== 0 || !is_dir($realTarget)) {
header('Location: /admin/content-files');
exit;
}
$allowedExt = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'pdf', 'zip', 'mp4', 'webm', 'ogg', 'mp3', 'wav', 'mov', 'avi', 'doc', 'docx', 'xls', 'xlsx', 'css', 'scss', 'js', 'json', 'html', 'md'];
$uploaded = 0;
$errors = [];
if (!empty($_FILES['file']['name'])) {
foreach ($_FILES['file']['name'] as $i => $name) {
if ($_FILES['file']['error'][$i] !== UPLOAD_ERR_OK) continue;
$ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
if (!in_array($ext, $allowedExt, true)) {
$errors[] = htmlspecialchars($name) . ' (niet toegestaan type)';
continue;
}
$filename = preg_replace('/[^a-zA-Z0-9._-]/', '_', $name);
$dest = $realTarget . '/' . $filename;
$n = 1;
while (file_exists($dest)) {
$p = pathinfo($filename);
$dest = $realTarget . '/' . $p['filename'] . '_' . $n . '.' . ($p['extension'] ?? $ext);
$n++;
}
if (move_uploaded_file($_FILES['file']['tmp_name'][$i], $dest)) {
$uploaded++;
} else {
$errors[] = htmlspecialchars($name);
}
}
}
$msg = [];
$type = 'info';
if ($uploaded > 0) {
$msg[] = $uploaded . ' bestand(en) geüpload.';
$type = 'success';
adminLog($config, 'info', $user['username'] . ' uploadde naar content/' . ($subdir ? $subdir . '/' : '') . ' (' . $uploaded . ' bestanden)');
}
if (!empty($errors)) {
$msg[] = 'Fouten: ' . implode(', ', $errors);
$type = $type === 'success' ? 'success' : 'danger';
}
$redir = '/admin/content-files';
if (!empty($msg)) {
$redir .= '?msg=' . urlencode(implode(' ', $msg)) . '&msgtype=' . urlencode($type);
}
header('Location: ' . $redir);
exit;
}
/**
* Handle deletion of a single file inside content (Fase 2).
* Refuses to delete directories, dotfiles, and paths that escape content_dir.
*/
function handleContentFileDelete($auth, $config, $user): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/content-files');
exit;
}
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/content-files');
exit;
}
$contentDir = $config['content_dir'];
$realContentDir = realpath($contentDir);
if (!$realContentDir || !is_dir($realContentDir)) {
header('Location: /admin/content-files');
exit;
}
$relFile = str_replace(['../', '..\\', './'], '', $_POST['file'] ?? '');
$relFile = ltrim($relFile, '/');
foreach (explode('/', $relFile) as $seg) {
if ($seg === '..' || $seg === '.') {
header('Location: /admin/content-files');
exit;
}
}
$base = basename($relFile);
if ($base === '' || $base[0] === '.') {
header('Location: /admin/content-files');
exit;
}
$fullPath = $realContentDir . '/' . $relFile;
$realPath = realpath($fullPath);
if ($realPath === false || strpos($realPath, $realContentDir) !== 0 || !is_file($realPath)) {
header('Location: /admin/content-files');
exit;
}
$deleted = @unlink($realPath);
if ($deleted) {
adminLog($config, 'info', $user['username'] . ' verwijderde content/' . $relFile);
$msg = 'Bestand verwijderd.';
$type = 'success';
} else {
$err = error_get_last();
$msg = 'Verwijderen mislukt: ' . ($err['message'] ?? 'onbekend');
$type = 'danger';
}
header('Location: /admin/content-files?msg=' . urlencode($msg) . '&msgtype=' . urlencode($type));
exit;
}
/**
* Handle moving a single file within content to another folder within content (Fase 2/3).
* Mirrors handlePluginsFileMove/handleThemeFileMove.
*/
function handleContentFileMove($auth, $config, $twig, $user, $csrf): void
{
$contentDir = $config['content_dir'];
$realContentDir = realpath($contentDir);
if (!$realContentDir || !is_dir($realContentDir)) {
header('Location: /admin/content-files');
exit;
}
$relFile = str_replace(['../', '..\\', './'], '', $_GET['file'] ?? $_POST['file'] ?? '');
$relFile = ltrim($relFile, '/');
foreach (explode('/', $relFile) as $seg) {
if ($seg === '..' || $seg === '.') {
header('Location: /admin/content-files');
exit;
}
}
$base = basename($relFile);
if ($base === '' || $base[0] === '.') {
header('Location: /admin/content-files');
exit;
}
$fullPath = $realContentDir . '/' . $relFile;
$realPath = realpath($fullPath);
if ($realPath === false || strpos($realPath, $realContentDir) !== 0 || !is_file($realPath)) {
header('Location: /admin/content-files');
exit;
}
$message = '';
$messageType = '';
// Collect all directories within content (as relative paths), excluding the file's own dir
$directories = [''];
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($realContentDir, RecursiveDirectoryIterator::SKIP_DOTS),
RecursiveIteratorIterator::SELF_FIRST
);
$currentDir = trim(dirname($relFile), '.\\/');
foreach ($iterator as $file) {
if (!$file->isDir()) continue;
$realDir = $file->getRealPath();
if ($realDir === false || strpos($realDir, $realContentDir) !== 0) continue;
$relDir = ltrim(substr($realDir, strlen($realContentDir) + 1), '/\\');
$relDir = str_replace('\\', '/', $relDir);
if ($relDir === $currentDir) continue;
if ($relDir !== '' && $relDir[0] === '.') continue;
$directories[] = $relDir;
}
$directories = array_unique($directories);
sort($directories);
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$dest = str_replace(['../', '..\\', './'], '', $_POST['destination'] ?? '');
$dest = ltrim($dest, '/');
foreach (explode('/', $dest) as $seg) {
if ($seg === '..' || $seg === '.') {
$message = 'Ongeldige doelmap.';
$messageType = 'danger';
break;
}
}
if ($message === '') {
$destDir = $dest === '' ? $realContentDir : $realContentDir . '/' . $dest;
$realDestDir = realpath($destDir);
if (!$realDestDir || !is_dir($realDestDir) || strpos($realDestDir, $realContentDir) !== 0) {
$message = 'Doelmap bestaat niet.';
$messageType = 'danger';
} else {
$newPath = $realDestDir . '/' . basename($realPath);
if (file_exists($newPath)) {
$message = 'Bestand bestaat al op de bestemming.';
$messageType = 'danger';
} elseif (rename($realPath, $newPath)) {
adminLog($config, 'info', $user['username'] . ' verplaatste content/' . $relFile . ' naar content/' . ($dest ? $dest . '/' : '') . basename($relFile));
$newRel = $dest === '' ? basename($relFile) : $dest . '/' . basename($relFile);
header('Location: /admin/content-files?file=' . urlencode($newRel) . '&msg=' . urlencode('Bestand verplaatst.') . '&msgtype=success');
exit;
} else {
$err = error_get_last();
$message = 'Verplaatsen mislukt: ' . ($err['message'] ?? 'onbekend');
$messageType = 'danger';
}
}
}
}
}
echo $twig->render('pages/content-move-form.twig', [
'user' => $user,
'route' => 'content-file-move',
'csrf_token' => $csrf,
'relFile' => $relFile,
'itemName' => basename($relFile),
'itemDir' => trim(dirname($relFile), '.\\/'),
'directories' => $directories,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
/**
* Handle creating a directory within content from the editor sidebar (Fase 3).
* Variant of handleContentDirCreate that redirects back to content-files.
*/
function handleContentDirCreateIn($auth, $config, $user): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/content-files');
exit;
}
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/content-files');
exit;
}
$contentDir = $config['content_dir'];
$realContentDir = realpath($contentDir);
if (!$realContentDir || !is_dir($realContentDir)) {
header('Location: /admin/content-files');
exit;
}
$inDir = str_replace(['../', '..\\', './'], '', $_POST['in_dir'] ?? '');
$inDir = ltrim($inDir, '/');
foreach (explode('/', $inDir) as $seg) {
if ($seg === '..' || $seg === '.') { $inDir = ''; break; }
}
$dirname = trim($_POST['dirname'] ?? '');
$dirname = preg_replace('/[^a-zA-Z0-9._-]/', '-', $dirname);
if ($dirname === '' || $dirname === '.' || $dirname === '..') {
header('Location: /admin/content-files?msg=' . urlencode('Ongeldige mapnaam.') . '&msgtype=danger');
exit;
}
$newPath = $realContentDir . '/' . ($inDir ? $inDir . '/' : '') . $dirname;
if (file_exists($newPath)) {
header('Location: /admin/content-files?msg=' . urlencode('Map bestaat al.') . '&msgtype=danger');
exit;
}
if (@mkdir($newPath, 0755, true)) {
adminLog($config, 'info', $user['username'] . ' creëerde content map ' . ($inDir ? $inDir . '/' : '') . $dirname);
header('Location: /admin/content-files?msg=' . urlencode('Map aangemaakt.') . '&msgtype=success');
} else {
header('Location: /admin/content-files?msg=' . urlencode('Map aanmaken mislukt.') . '&msgtype=danger');
}
exit;
}
/**
* Handle renaming a directory within content from the editor sidebar (Fase 3).
* Variant of handleContentDirRename that redirects back to content-files.
*/
function handleContentDirRenameIn($auth, $config, $twig, $user, $csrf): void
{
$contentDir = $config['content_dir'];
$realContentDir = realpath($contentDir);
if (!$realContentDir || !is_dir($realContentDir)) {
header('Location: /admin/content-files');
exit;
}
$dirRel = str_replace(['../', '..\\', './'], '', $_GET['dir'] ?? '');
$dirRel = ltrim($dirRel, '/');
foreach (explode('/', $dirRel) as $seg) {
if ($seg === '..' || $seg === '.') { $dirRel = ''; break; }
}
$message = '';
$messageType = '';
if ($dirRel !== '') {
$fullPath = $realContentDir . '/' . $dirRel;
$realDir = realpath($fullPath);
if (!$realDir || !is_dir($realDir) || strpos($realDir, $realContentDir) !== 0) {
$dirRel = '';
}
}
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $dirRel !== '') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$newName = preg_replace('/[^a-zA-Z0-9._-]/', '-', trim($_POST['newname'] ?? ''));
if ($newName === '' || $newName === '.' || $newName === '..') {
$message = 'Ongeldige naam.';
$messageType = 'danger';
} else {
$parentReal = realpath(dirname($realContentDir . '/' . $dirRel));
if (!$parentReal || strpos($parentReal, $realContentDir) !== 0) {
$message = 'Ongeldig pad.';
$messageType = 'danger';
} else {
$newPath = $parentReal . '/' . $newName;
if (file_exists($newPath)) {
$message = 'Naam bestaat al.';
$messageType = 'danger';
} elseif (rename($realDir, $newPath)) {
adminLog($config, 'info', $user['username'] . ' hernoemde content map ' . $dirRel . ' naar ' . $newName);
header('Location: /admin/content-files?msg=' . urlencode('Map hernoemd.') . '&msgtype=success');
exit;
} else {
$message = 'Hernoemen mislukt.';
$messageType = 'danger';
}
}
}
}
}
if ($dirRel === '') {
header('Location: /admin/content-files?msg=' . urlencode('Map niet gevonden.') . '&msgtype=danger');
exit;
}
echo $twig->render('pages/content-dir-rename-form.twig', [
'user' => $user,
'route' => 'content-dir-rename-in',
'csrf_token' => $csrf,
'dir' => $dirRel,
'currentName' => basename($dirRel),
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
/**
* Handle deleting a directory within content from the editor sidebar (Fase 3).
* Variant of handleContentDirDelete that redirects back to content-files.
* Only allows deleting empty directories (verborgen .bak bestanden genegeerd).
*/
function handleContentDirDeleteIn($auth, $config, $user): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/content-files');
exit;
}
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/content-files');
exit;
}
$contentDir = $config['content_dir'];
$realContentDir = realpath($contentDir);
if (!$realContentDir || !is_dir($realContentDir)) {
header('Location: /admin/content-files');
exit;
}
$dirRel = str_replace(['../', '..\\', './'], '', $_POST['dir'] ?? '');
$dirRel = ltrim($dirRel, '/');
foreach (explode('/', $dirRel) as $seg) {
if ($seg === '..' || $seg === '.') {
header('Location: /admin/content-files?msg=' . urlencode('Ongeldige map.') . '&msgtype=danger');
exit;
}
}
if ($dirRel === '') {
header('Location: /admin/content-files?msg=' . urlencode('Ongeldige map.') . '&msgtype=danger');
exit;
}
$fullPath = $realContentDir . '/' . $dirRel;
$realDir = realpath($fullPath);
if (!$realDir || !is_dir($realDir) || strpos($realDir, $realContentDir) !== 0) {
header('Location: /admin/content-files?msg=' . urlencode('Map niet gevonden.') . '&msgtype=danger');
exit;
}
// Only allow empty directories (verborgen .bak/.git genegeerd)
$entries = array_diff(scandir($realDir), ['.', '..']);
$isEmpty = true;
foreach ($entries as $e) {
if ($e[0] !== '.') { $isEmpty = false; break; }
}
if (!$isEmpty) {
header('Location: /admin/content-files?msg=' . urlencode('Map moet leeg zijn.') . '&msgtype=danger');
exit;
}
if (@rmdir($realDir)) {
adminLog($config, 'info', $user['username'] . ' verwijderde content map ' . $dirRel);
header('Location: /admin/content-files?msg=' . urlencode('Map verwijderd.') . '&msgtype=success');
} else {
header('Location: /admin/content-files?msg=' . urlencode('Map verwijderen mislukt.') . '&msgtype=danger');
}
exit;
}
function handleContentEdit($auth, $config, $twig, $user, $csrf, $siteConfig): void
{
$contentDir = $config['content_dir'];
$file = $_GET['file'] ?? '';
$file = str_replace(['../', '..\\'], '', $file);
$filePath = rtrim($contentDir, '/') . '/' . $file;
$message = '';
$messageType = '';
// Validate path
$realPath = realpath($filePath);
$realContentDir = realpath($contentDir);
if (!$realPath || !$realContentDir || strpos($realPath, $realContentDir) !== 0) {
header('Location: /admin/content');
exit;
}
$fileExt = pathinfo($filePath, PATHINFO_EXTENSION);
$isEditable = in_array($fileExt, ['md', 'php', 'html']);
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
// Handle rename
$newFilename = trim($_POST['filename'] ?? '');
$wasRenamed = false;
if (!empty($newFilename)) {
$newFilename = preg_replace('/[^a-zA-Z0-9._-]/', '-', $newFilename);
$newFilename .= '.' . $fileExt;
$parentDir = dirname($filePath);
$newFilePath = $parentDir . '/' . $newFilename;
$realParentDir = realpath($parentDir);
if ($realParentDir && strpos($realParentDir, $realContentDir) === 0) {
if ($newFilePath !== $filePath && !file_exists($newFilePath)) {
rename($filePath, $newFilePath);
$wasRenamed = true;
adminLog($config, 'info', $user['username'] . ' hernoemde ' . basename($filePath) . ' naar ' . $newFilename);
$filePath = $newFilePath;
$newFile = dirname($file) . '/' . $newFilename;
$file = ltrim($newFile, './');
}
}
}
// Save content only for editable files
if ($isEditable) {
$content = $_POST['content'] ?? '';
$layout = $_POST['layout'] ?? '';
if ($layout) {
$content = updateContentFrontmatter($content, 'layout', $layout);
}
$plugins = isset($_POST['plugins']) && is_array($_POST['plugins'])
? implode(', ', array_map('trim', $_POST['plugins']))
: '';
$content = updateContentFrontmatter($content, 'plugins', $plugins);
backupContentFile($filePath);
file_put_contents($filePath, $content);
if (!$wasRenamed) {
adminLog($config, 'info', $user['username'] . ' bewerkte ' . basename($filePath));
}
$message = 'Bestand opgeslagen.';
$messageType = 'success';
}
}
}
$fileName = basename($filePath);
$fileContent = $isEditable ? file_get_contents($filePath) : '';
$currentLayout = extractFrontmatterValue($fileContent, 'layout');
$currentPlugins = extractFrontmatterValue($fileContent, 'plugins');
$currentAuthorName = extractFrontmatterValue($fileContent, 'author_name');
$currentAuthorEmail = extractFrontmatterValue($fileContent, 'author_email');
$currentCreated = extractFrontmatterValue($fileContent, 'created');
$selectedPlugins = array_map('trim', explode(',', $currentPlugins));
if ($selectedPlugins === ['']) $selectedPlugins = [];
// Get available layouts from active theme's theme.json
$themeLayouts = [];
$themeDefaultLayout = 'full_content';
$activeThemeName = $siteConfig['active_theme'] ?? 'default';
$themeDir = __DIR__ . "/../themes/{$activeThemeName}";
$themeJsonFile = $themeDir . '/theme.json';
if (file_exists($themeJsonFile)) {
$themeJson = json_decode(file_get_contents($themeJsonFile), true);
$themeDefaultLayout = $themeJson['config']['default_template'] ?? 'full_content';
if (isset($themeJson['template']) && is_array($themeJson['template'])) {
foreach ($themeJson['template'] as $key => $twigFile) {
// Skip internal layouts that users shouldn't select
if (in_array($key, ['guide'], true)) continue;
$themeLayouts[$key] = $twigFile;
}
}
} else {
// Fallback: scan theme directory for .twig files
if (is_dir($themeDir)) {
foreach (glob($themeDir . '/*.twig') as $layoutFile) {
$layoutName = basename($layoutFile, '.twig');
if (!in_array($layoutName, ['base', 'guide'], true)) {
$themeLayouts[$layoutName] = $layoutName . '.twig';
}
}
}
}
// Get available plugins
$pluginsDir = $config['plugins_dir'];
$availablePlugins = [];
if (is_dir($pluginsDir)) {
foreach (glob($pluginsDir . '*', GLOB_ONLYDIR) as $pluginDir) {
$pluginName = basename($pluginDir);
if ($pluginName !== '.' && $pluginName !== '..' && file_exists($pluginDir . '/plugin.json')) {
$availablePlugins[] = $pluginName;
}
}
}
$currentLang = extractLanguagePrefix($file);
$route = 'content-edit';
$fileDir = trim(dirname($file), '.\\/');
echo $twig->render('pages/content-edit.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'file' => $file,
'fileDir' => $fileDir,
'fileName' => $fileName,
'fileExt' => $fileExt,
'fileContent' => $fileContent,
'isEditable' => $isEditable,
'currentLayout' => $currentLayout ?: $themeDefaultLayout,
'themeLayouts' => $themeLayouts,
'themeDefaultLayout' => $themeDefaultLayout,
'activeThemeName' => $activeThemeName,
'availablePlugins' => $availablePlugins,
'selectedPlugins' => $selectedPlugins,
'currentLang' => $currentLang,
'currentAuthorName' => $currentAuthorName,
'currentAuthorEmail' => $currentAuthorEmail,
'currentCreated' => $currentCreated,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => $isEditable,
'message' => $message,
'message_type' => $messageType,
]);
}
function handleContentNew($auth, $config, $twig, $user, $csrf, $siteConfig): void
{
$contentDir = $config['content_dir'];
$dir = $_GET['dir'] ?? '';
$dir = str_replace(['../', '..\\'], '', $dir);
$fullPath = rtrim($contentDir, '/') . '/' . $dir;
$message = '';
$messageType = '';
// Get available layouts from active theme's theme.json
$themeLayouts = [];
$themeDefaultLayout = 'full_content';
$activeThemeName = $siteConfig['active_theme'] ?? 'default';
$themeDir = __DIR__ . "/../themes/{$activeThemeName}";
$themeJsonFile = $themeDir . '/theme.json';
if (file_exists($themeJsonFile)) {
$themeJson = json_decode(file_get_contents($themeJsonFile), true);
$themeDefaultLayout = $themeJson['config']['default_template'] ?? 'full_content';
if (isset($themeJson['template']) && is_array($themeJson['template'])) {
foreach ($themeJson['template'] as $key => $twigFile) {
if (in_array($key, ['guide'], true)) continue;
$themeLayouts[$key] = $twigFile;
}
}
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$filename = trim($_POST['filename'] ?? '');
$ext = $_POST['extension'] ?? 'md';
$layout = $_POST['layout'] ?? $themeDefaultLayout;
if (!empty($filename)) {
$filename = preg_replace('/[^a-zA-Z0-9._-]/', '-', $filename);
$filename .= '.' . $ext;
$dest = rtrim($fullPath, '/') . '/' . $filename;
if (!file_exists($dest)) {
// Build frontmatter with layout and author metadata
$now = date('Y-m-d H:i:s');
$frontmatter = "---\n";
$frontmatter .= "layout: " . $layout . "\n";
$frontmatter .= "author_name: " . ($user['author_name'] ?? $user['username'] ?? '') . "\n";
$frontmatter .= "author_email: " . ($user['author_email'] ?? '') . "\n";
$frontmatter .= "created: " . $now . "\n";
$frontmatter .= "---\n\n";
$content = $frontmatter . "# Nieuwe pagina\n\n";
file_put_contents($dest, $content);
adminLog($config, 'info', $user['username'] . ' creëerde ' . $filename);
header('Location: /admin/content-edit?file=' . urlencode($dir . '/' . $filename));
exit;
} else {
$message = 'Bestand bestaat al.';
$messageType = 'danger';
}
}
}
}
$route = 'content-new';
$availableExtensions = ['md' => 'Markdown', 'php' => 'PHP', 'html' => 'HTML'];
echo $twig->render('pages/content-new.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'dir' => $dir,
'availableExtensions' => $availableExtensions,
'themeLayouts' => $themeLayouts,
'themeDefaultLayout' => $themeDefaultLayout,
'activeThemeName' => $activeThemeName,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handleContentDelete($auth, $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/content');
exit;
}
$user = $auth->getCurrentUser();
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/content');
exit;
}
$contentDir = $config['content_dir'];
$file = $_POST['file'] ?? $_GET['file'] ?? '';
$file = str_replace(['../', '..\\'], '', $file);
$filePath = rtrim($contentDir, '/') . '/' . $file;
if (file_exists($filePath) && is_file($filePath)) {
unlink($filePath);
adminLog($config, 'info', $user['username'] . ' verwijderde ' . $file);
}
header('Location: /admin/content?dir=' . urlencode(dirname($file)));
exit;
}
function handleContentDirCreate($auth, $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/content');
exit;
}
$user = $auth->getCurrentUser();
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/content');
exit;
}
$contentDir = $config['content_dir'];
$subdir = $_GET['dir'] ?? '';
$subdir = str_replace(['../', '..\\'], '', $subdir);
$dirname = trim($_POST['dirname'] ?? '');
if (!empty($dirname)) {
$dirname = preg_replace('/[^a-zA-Z0-9._-]/', '-', $dirname);
$newPath = rtrim($contentDir, '/') . '/' . ($subdir ? $subdir . '/' : '') . $dirname;
if (!file_exists($newPath)) {
@mkdir($newPath, 0755, true);
adminLog($config, 'info', $user['username'] . ' creëerde map ' . $dirname);
}
}
header('Location: /admin/content?dir=' . urlencode($subdir));
exit;
}
function handleContentDirRename($auth, $config, $twig, $user, $csrf): void
{
$contentDir = $config['content_dir'];
$dir = $_GET['dir'] ?? '';
$dir = str_replace(['../', '..\\'], '', $dir);
$fullPath = rtrim($contentDir, '/') . '/' . $dir;
$message = '';
$messageType = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$newName = trim($_POST['newname'] ?? '');
if (!empty($newName)) {
$newName = preg_replace('/[^a-zA-Z0-9._-]/', '-', $newName);
$parentDir = dirname($fullPath);
$newPath = $parentDir . '/' . $newName;
if (!file_exists($newPath) && $newPath !== $fullPath) {
rename($fullPath, $newPath);
adminLog($config, 'info', $user['username'] . ' hernoemde map ' . basename($dir) . ' naar ' . $newName);
header('Location: /admin/content?dir=' . urlencode(dirname($dir) . '/' . $newName));
exit;
} else {
$message = 'Map bestaat al of ongeldige naam.';
$messageType = 'danger';
}
}
}
}
$route = 'content-dir-rename';
echo $twig->render('pages/content-dir-form.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'dir' => $dir,
'fullPath' => $fullPath,
'currentName' => basename($dir),
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handleContentDirDelete($auth, $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/content');
exit;
}
$user = $auth->getCurrentUser();
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/content');
exit;
}
$contentDir = $config['content_dir'];
$dir = $_GET['dir'] ?? $_POST['dir'] ?? '';
$dir = str_replace(['../', '..\\'], '', $dir);
$fullPath = rtrim($contentDir, '/') . '/' . $dir;
if (is_dir($fullPath)) {
$files = scandir($fullPath);
$files = array_diff($files, ['.', '..']);
if (empty($files)) {
rmdir($fullPath);
adminLog($config, 'info', $user['username'] . ' verwijderde map ' . $dir);
}
}
header('Location: /admin/content?dir=' . urlencode(dirname($dir)));
exit;
}
function handleContentMove($auth, $config, $twig, $user, $csrf): void
{
$contentDir = $config['content_dir'];
$item = $_GET['item'] ?? '';
$item = str_replace(['../', '..\\'], '', $item);
$fullPath = rtrim($contentDir, '/') . '/' . $item;
$message = '';
$messageType = '';
// Get all directories for destination selection
$directories = [];
$realContentDir = realpath($contentDir);
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($contentDir, RecursiveDirectoryIterator::SKIP_DOTS),
RecursiveIteratorIterator::SELF_FIRST
);
foreach ($iterator as $file) {
if ($file->isDir()) {
$path = str_replace($realContentDir, '', realpath($file->getPathname()));
$path = trim($path, '/\\');
if ($path && $path !== $item && !str_starts_with($path, '-') && !str_starts_with($path, '.')) {
$directories[] = $path;
}
}
}
sort($directories);
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$dest = trim($_POST['destination'] ?? '');
if (!empty($dest)) {
$dest = str_replace(['../', '..\\'], '', $dest);
$destPath = rtrim($contentDir, '/') . '/' . $dest;
if (is_dir($destPath)) {
$newPath = $destPath . '/' . basename($item);
if (!file_exists($newPath)) {
rename($fullPath, $newPath);
adminLog($config, 'info', $user['username'] . ' verplaatste ' . $item . ' naar ' . $dest);
header('Location: /admin/content?dir=' . urlencode($dest));
exit;
} else {
$message = 'Bestand of map bestaat al op de bestemming.';
$messageType = 'danger';
}
}
}
}
}
$route = 'content-move';
$isDir = is_dir($fullPath);
$itemDir = trim(dirname($item), '.\\/');
echo $twig->render('pages/content-move-form.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'item' => $item,
'itemDir' => $itemDir,
'fullPath' => $fullPath,
'itemName' => basename($item),
'isDir' => $isDir,
'directories' => $directories,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handleContentBackup($auth, $config, $twig, $user, $csrf): void
{
$contentDir = $config['content_dir'];
$projectRoot = $config['codepress_root'];
$backup = new ContentBackup($contentDir, $projectRoot);
$message = '';
$messageType = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} elseif (isset($_POST['action'])) {
$action = $_POST['action'];
if ($action === 'download_zip') {
$backupDir = $projectRoot . '/var/tmp';
if (!is_dir($backupDir)) {
@mkdir($backupDir, 0755, true);
}
$backupFile = $backupDir . '/content-backup-' . date('YmdHis') . '.zip';
if ($backup->createZipBackup($backupFile)) {
adminLog($config, 'info', $user['username'] . ' maakte een content ZIP backup aan');
header('Content-Type: application/zip');
header('Content-Disposition: attachment; filename="' . basename($backupFile) . '"');
header('Content-Length: ' . filesize($backupFile));
readfile($backupFile);
unlink($backupFile);
exit;
} else {
$message = 'Kon geen ZIP backup maken.';
$messageType = 'danger';
}
}
}
}
// Get git info
$gitAvailable = $backup->isGitAvailable();
$hasGitRepo = $backup->hasGitRepo();
$gitCommits = [];
if ($hasGitRepo) {
$logResult = $backup->gitLog(20);
$gitCommits = $logResult['commits'] ?? [];
}
$route = 'content-backup';
echo $twig->render('pages/content-backup.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'git_available' => $gitAvailable,
'has_git_repo' => $hasGitRepo,
'git_commits' => $gitCommits,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handleContentRestore($auth, $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/content-backup');
exit;
}
$user = $auth->getCurrentUser();
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/content-backup?error=csrf');
exit;
}
if (empty($_FILES['zipfile']['tmp_name'])) {
header('Location: /admin/content-backup?error=nofile');
exit;
}
$contentDir = $config['content_dir'];
$projectRoot = $config['codepress_root'];
$backup = new ContentBackup($contentDir, $projectRoot);
$result = $backup->restoreFromZip($_FILES['zipfile']['tmp_name']);
if ($result['success']) {
adminLog($config, 'info', $user['username'] . ' herstelde content uit ZIP backup');
header('Location: /admin/content-backup?restored=1');
} else {
adminLog($config, 'warning', $user['username'] . ' - content restore mislukt: ' . $result['message']);
header('Location: /admin/content-backup?error=' . urlencode($result['message']));
}
exit;
}
function handleContentGitInit($auth, $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/content-backup');
exit;
}
$user = $auth->getCurrentUser();
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/content-backup?error=csrf');
exit;
}
$backup = new ContentBackup($config['content_dir'], $config['codepress_root']);
$result = $backup->gitInit();
if ($result['success']) {
adminLog($config, 'info', $user['username'] . ' initialiseerde git in content/');
}
header('Location: /admin/content-backup?git=' . urlencode($result['message']));
exit;
}
function handleContentGitCommit($auth, $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/content-backup');
exit;
}
$user = $auth->getCurrentUser();
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/content-backup?error=csrf');
exit;
}
$message = trim($_POST['commit_message'] ?? '');
$backup = new ContentBackup($config['content_dir'], $config['codepress_root']);
$result = $backup->gitCommit($message);
if ($result['success']) {
adminLog($config, 'info', $user['username'] . ' committe content: ' . $message);
}
header('Location: /admin/content-backup?git=' . urlencode($result['message']));
exit;
}
function handleContentGitRestore($auth, $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/content-backup');
exit;
}
$user = $auth->getCurrentUser();
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/content-backup?error=csrf');
exit;
}
$commitHash = $_POST['commit'] ?? '';
$backup = new ContentBackup($config['content_dir'], $config['codepress_root']);
$result = $backup->gitRestore($commitHash);
if ($result['success']) {
adminLog($config, 'info', $user['username'] . ' herstelde content naar git commit ' . $commitHash);
}
header('Location: /admin/content-backup?git=' . urlencode($result['message']));
exit;
}
function handleConfig($auth, $config, $twig, $user, $csrf): void
{
$configFile = $config['config_json'];
$message = '';
$messageType = '';
$ta = loadAdminTranslations(file_exists($configFile)
? (json_decode(file_get_contents($configFile), true) ?? [])
: []);
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = $ta['invalid_csrf'] ?? 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$newConfig = json_decode(file_get_contents($configFile), true) ?? [];
$newConfig['site_title'] = $_POST['site_title'] ?? '';
$defaultPage = $_POST['default_page'] ?? 'auto';
if ($defaultPage === 'specific') {
$defaultPage = $_POST['default_page_specific'] ?? 'auto';
}
$newConfig['default_page'] = $defaultPage;
$newConfig['language']['default'] = $_POST['content_language'] ?? 'nl';
$newConfig['admin_language'] = $_POST['admin_language'] ?? 'nl';
backupContentFile($configFile);
file_put_contents($configFile, json_encode($newConfig, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE));
adminLog($config, 'info', $user['username'] . ' bewerkte configuratie');
// Redirect after successful save (PRG pattern) so the new admin
// language is applied immediately without a manual reload.
header('Location: /admin/config?saved=1');
exit;
}
}
// Show success message after redirect
if (isset($_GET['saved'])) {
$message = $ta['saved'] ?? 'Configuratie opgeslagen.';
$messageType = 'success';
}
$currentConfig = file_exists($configFile) ? json_decode(file_get_contents($configFile), true) : [];
$route = 'config';
$contentPages = collectContentPages($config['content_dir']);
$currentDefaultPage = $currentConfig['default_page'] ?? 'auto';
echo $twig->render('pages/config.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'config' => $currentConfig,
'content_pages' => $contentPages,
'current_default_page' => $currentDefaultPage,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handleSecurity($auth, $config, $twig, $user, $csrf): void
{
$adminConfigFile = $config['admin_config'];
$message = '';
$messageType = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$adminConfig = json_decode(file_get_contents($adminConfigFile), true) ?? [];
$adminConfig['security']['force_ssl'] = isset($_POST['force_ssl']);
$adminConfig['security']['session_timeout'] = (int)($_POST['session_timeout'] ?? 3600);
$adminConfig['security']['max_login_attempts'] = (int)($_POST['max_login_attempts'] ?? 5);
file_put_contents($adminConfigFile, json_encode($adminConfig, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE));
adminLog($config, 'info', $user['username'] . ' bewerkte beveiligingsinstellingen');
$message = 'Beveiligingsinstellingen opgeslagen.';
$messageType = 'success';
}
}
$adminConfig = file_exists($adminConfigFile) ? json_decode(file_get_contents($adminConfigFile), true) : [];
$route = 'security';
echo $twig->render('pages/security.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'config' => $adminConfig,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handleTheme($auth, $config, $twig, $user, $csrf, $siteConfig): void
{
$themesDir = __DIR__ . '/../themes';
$themes = [];
$activeTheme = $siteConfig['active_theme'] ?? 'default';
foreach (glob($themesDir . '/*', GLOB_ONLYDIR) as $themeDir) {
$themeName = basename($themeDir);
$themeJson = $themeDir . '/theme.json';
$themeData = [
'name' => $themeName,
'title' => $themeName,
'active' => $activeTheme === $themeName,
'protected' => $themeName === 'default',
'has_scss' => is_file($themeDir . '/assets/scss/theme.scss'),
'scss_compiled' => false,
'scss_mtime' => null,
'css_mtime' => null,
];
if (file_exists($themeJson)) {
$data = json_decode(file_get_contents($themeJson), true);
$themeData = array_merge($themeData, $data);
}
// SCSS compile status: true when compiled CSS exists and is newer than SCSS source
$scssFile = $themeDir . '/assets/scss/theme.scss';
$cssFile = $themeDir . '/assets/css_compiled/theme.css';
if (is_file($scssFile)) {
$themeData['scss_mtime'] = date('Y-m-d H:i', filemtime($scssFile));
if (is_file($cssFile)) {
$themeData['css_mtime'] = date('Y-m-d H:i', filemtime($cssFile));
$themeData['scss_compiled'] = filemtime($cssFile) >= filemtime($scssFile);
}
}
$themes[] = $themeData;
}
// Sort: active theme first, then alphabetical
usort($themes, function ($a, $b) {
if ($a['active'] && !$b['active']) return -1;
if (!$a['active'] && $b['active']) return 1;
return strcasecmp($a['name'], $b['name']);
});
$route = 'theme';
echo $twig->render('pages/theme.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'themes' => $themes,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $_GET['msg'] ?? '',
'message_type' => $_GET['msgtype'] ?? 'info',
]);
}
function handleThemeNew($auth, $config, $twig, $user, $csrf): void
{
$message = '';
$messageType = '';
// Available base themes (existing themes to copy from)
$themesDir = __DIR__ . '/../themes';
$baseThemes = [];
foreach (glob($themesDir . '/*', GLOB_ONLYDIR) as $themeDir) {
$name = basename($themeDir);
$baseThemes[$name] = $name;
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$themeName = trim($_POST['name'] ?? '');
$baseTheme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['base_theme'] ?? '');
if (!empty($themeName)) {
$themeName = preg_replace('/[^a-zA-Z0-9_-]/', '-', $themeName);
$newThemeDir = $themesDir . '/' . $themeName;
if (file_exists($newThemeDir)) {
$message = 'Thema bestaat al.';
$messageType = 'danger';
} else {
if (!@mkdir($newThemeDir, 0755, true)) {
$message = 'Kon thema map niet aanmaken.';
$messageType = 'danger';
} else {
// Copy from base theme if requested and it exists, otherwise create uniform structure
if ($baseTheme !== '' && $baseTheme !== $themeName && is_dir($themesDir . '/' . $baseTheme)) {
copyDirRecursive($themesDir . '/' . $baseTheme, $newThemeDir);
// Overwrite the copied theme.json title with the new theme name
$copiedJsonFile = $newThemeDir . '/theme.json';
if (is_file($copiedJsonFile)) {
$copiedJson = json_decode(file_get_contents($copiedJsonFile), true);
if (is_array($copiedJson)) {
$copiedJson['title'] = ucfirst($themeName);
file_put_contents($copiedJsonFile, json_encode($copiedJson, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE));
}
}
// Overwrite the copied README.md with a fresh one for the new theme
@file_put_contents($newThemeDir . '/README.md',
"# " . ucfirst($themeName) . " thema\n\nGekopieerd van `" . $baseTheme . "`. Zie `theme.json` voor layout mapping en `assets/scss/theme.scss` voor styling.\n");
} else {
createUniformThemeStructure($newThemeDir, $themeName);
}
adminLog($config, 'info', $user['username'] . ' creëerde thema ' . $themeName . ($baseTheme ? ' (basis: ' . $baseTheme . ')' : ''));
header('Location: /admin/theme-edit?theme=' . urlencode($themeName));
exit;
}
}
} else {
$message = 'Thema naam mag niet leeg zijn.';
$messageType = 'danger';
}
}
}
$route = 'theme-new';
echo $twig->render('pages/theme-new.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'base_themes' => $baseThemes,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
/**
* Create a uniform theme structure (theme.json, layouts, partials, assets/scss, etc.)
* @param string $themeDir Absolute path to the new theme directory (already created)
* @param string $themeName Sanitized theme name
*/
function createUniformThemeStructure(string $themeDir, string $themeName): void
{
// Uniform directories per AGENTS.md / guide
@mkdir($themeDir . '/partials', 0755, true);
@mkdir($themeDir . '/assets/scss', 0755, true);
@mkdir($themeDir . '/assets/css', 0755, true);
@mkdir($themeDir . '/assets/js', 0755, true);
@mkdir($themeDir . '/assets/img', 0755, true);
@mkdir($themeDir . '/assets/fonts', 0755, true);
// theme.json with default full_content layout
$themeJson = [
'title' => ucfirst($themeName),
'config' => ['default_template' => 'full_content'],
'template' => ['full_content' => 'full_content.twig'],
];
file_put_contents($themeDir . '/theme.json', json_encode($themeJson, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE));
// Minimal base.twig + full_content.twig + partials
file_put_contents($themeDir . '/base.twig',
"\n\n\n"
. " \n \n"
. " {% block title %}{{ page_title|default(site_title) }}{% endblock %}\n"
. " \n"
. "\n\n{% include 'partials/header.twig' %}\n"
. "\n{% block content %}{% endblock %}\n\n"
. "{% include 'partials/footer.twig' %}\n\n\n");
file_put_contents($themeDir . '/full_content.twig',
"{% extends 'base.twig' %}\n{% block content %}\n{{ content|raw }}\n{% endblock %}\n");
file_put_contents($themeDir . '/partials/header.twig',
"\n {{ page_title|default(site_title) }}
\n\n");
file_put_contents($themeDir . '/partials/footer.twig',
"\n");
// Starter SCSS source
file_put_contents($themeDir . '/assets/scss/theme.scss',
"/* {$themeName} theme SCSS */\n:root {\n --bs-primary: #0a369d;\n}\nbody {\n font-family: system-ui, sans-serif;\n}\n");
// README per thema
file_put_contents($themeDir . '/README.md',
"# " . ucfirst($themeName) . " thema\n\nCodePress thema. Zie `theme.json` voor layout mapping en `assets/scss/theme.scss` voor styling.\n\n"
. "## Structuur\n- `theme.json` — thema configuratie\n- `base.twig` — hoofd layout\n- `full_content.twig` — volledige-breedte layout\n- `partials/` — header, navigation, footer\n- `assets/scss/theme.scss` — SCSS bron (compileert naar `assets/css_compiled/theme.css`)\n- `assets/css/`, `assets/js/`, `assets/img/`, `assets/fonts/` — extra assets\n");
}
/**
* Recursively copy a directory (used to clone an existing theme as base).
* Skips css_compiled/ (runtime artefact) and .git/.gitkeep.
* @param string $src Absolute source dir
* @param string $dst Absolute destination dir (already exists)
*/
function copyDirRecursive(string $src, string $dst): void
{
$realSrc = realpath($src);
if (!$realSrc || !is_dir($realSrc)) return;
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($realSrc, RecursiveDirectoryIterator::SKIP_DOTS),
RecursiveIteratorIterator::SELF_FIRST
);
foreach ($iterator as $item) {
$rel = substr($item->getPathname(), strlen($realSrc) + 1);
// Skip runtime artefacts and VCS
if (strpos($rel, 'assets/css_compiled/') === 0) continue;
$seg0 = explode('/', $rel)[0];
if ($seg0 === '.git') continue;
$dest = $dst . '/' . $rel;
if ($item->isDir()) {
if (!is_dir($dest)) @mkdir($dest, 0755, true);
} else {
$parent = dirname($dest);
if (!is_dir($parent)) @mkdir($parent, 0755, true);
@copy($item->getPathname(), $dest);
}
}
}
/**
* Recursively delete a directory (used by theme-delete).
*/
function removeDirRecursive(string $dir): void
{
if (!is_dir($dir)) return;
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS),
RecursiveIteratorIterator::CHILD_FIRST
);
foreach ($iterator as $item) {
if ($item->isDir()) {
@rmdir($item->getPathname());
} else {
@unlink($item->getPathname());
}
}
@rmdir($dir);
}
/**
* Handle editing files within a theme. Mirrors handlePluginsEdit but for themes/.
* Supports: .twig, .json, .scss, .css, .js, .html, .md, .php
* Path-traversal protection via realpath + prefix check. Default thema kan wel
* bewerkt worden (geen protected block), maar verwijderen/activeren is geblokkeerd.
*/
function handleThemeEdit($auth, $config, $twig, $user, $csrf): void
{
$themesDir = __DIR__ . '/../themes';
$theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_GET['theme'] ?? '');
if ($theme === '') {
header('Location: /admin/theme');
exit;
}
$themeDir = $themesDir . '/' . $theme;
$realThemeDir = realpath($themeDir);
if (!$realThemeDir || !is_dir($realThemeDir)) {
header('Location: /admin/theme');
exit;
}
// Editable extensions within a theme
$editableExts = ['twig', 'json', 'scss', 'css', 'js', 'html', 'md', 'php'];
// Resolve the requested file (defaults to theme.json)
$defaultFile = 'theme.json';
$relFile = $_GET['file'] ?? $defaultFile;
$relFile = str_replace(['../', '..\\', './'], '', $relFile);
$relFile = ltrim($relFile, '/');
$fullPath = $realThemeDir . '/' . $relFile;
$realPath = realpath($fullPath);
// Validate path stays within the theme dir
if ($realPath === false || strpos($realPath, $realThemeDir) !== 0) {
$relFile = $defaultFile;
$realPath = realpath($realThemeDir . '/' . $defaultFile);
}
$message = '';
$messageType = '';
// Carry over flash messages from redirect (upload/delete/move handlers)
if (isset($_GET['msg']) && is_string($_GET['msg']) && $_GET['msg'] !== '') {
$message = $_GET['msg'];
$messageType = $_GET['msgtype'] ?? 'info';
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} elseif (($_POST['action'] ?? '') === 'new_file') {
$newName = trim($_POST['new_filename'] ?? '');
$newName = preg_replace('/[^a-zA-Z0-9._\-\/]/', '', $newName);
$newName = ltrim($newName, '/');
$newName = str_replace(['../', '..\\', './'], '', $newName);
$segments = explode('/', $newName);
$traversal = false;
foreach ($segments as $seg) {
if ($seg === '..' || $seg === '.') { $traversal = true; break; }
}
if ($newName === '' || $newName === '.' || $traversal) {
$message = 'Ongeldige bestandsnaam.';
$messageType = 'danger';
} else {
$newFullPath = $realThemeDir . '/' . $newName;
$parentPath = dirname($newFullPath);
if (!is_dir($parentPath)) {
@mkdir($parentPath, 0755, true);
}
$parentReal = realpath($parentPath);
if ($parentReal === false || strpos($parentReal, $realThemeDir) !== 0) {
$message = 'Ongeldig pad.';
$messageType = 'danger';
} else {
$newReal = $parentReal . '/' . basename($newFullPath);
if (file_exists($newReal)) {
$message = 'Bestand bestaat al.';
$messageType = 'danger';
} else {
$ext = strtolower(pathinfo($newName, PATHINFO_EXTENSION));
$stub = '';
if ($ext === 'php') {
$stub = "render('pages/theme-edit.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'themeName' => $theme,
'themeDir' => $themeDir,
'relFile' => $relFile,
'fileName' => basename($relFile),
'fileExt' => $fileExt,
'fileContent' => $fileContent,
'isEditable' => $isEditable,
'files' => $files,
'editableExts' => $editableExts,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => $isEditable,
'mediaThemeName' => $theme,
'hasScss' => is_file($realThemeDir . '/assets/scss/theme.scss'),
'scssCompiled' => (is_file($realThemeDir . '/assets/scss/theme.scss') && is_file($realThemeDir . '/assets/css_compiled/theme.css') && filemtime($realThemeDir . '/assets/css_compiled/theme.css') >= filemtime($realThemeDir . '/assets/scss/theme.scss')),
'message' => $message,
'message_type' => $messageType,
]);
}
/**
* Handle file upload into a theme's assets/ directory.
* Mirrors handlePluginsFileUpload. Allowed: images, video, audio, pdf, css, scss, js, json, html, md, twig, fonts.
*/
function handleThemeFileUpload($auth, $config, $user): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/theme');
exit;
}
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/theme');
exit;
}
$theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['theme'] ?? '');
if ($theme === '') {
header('Location: /admin/theme');
exit;
}
$themesDir = __DIR__ . '/../themes';
$assetsRoot = realpath(rtrim($themesDir, '/') . '/' . $theme . '/assets');
if (!$assetsRoot || !is_dir($assetsRoot)) {
// assets dir doesn't exist yet — create it
$assetsNew = rtrim($themesDir, '/') . '/' . $theme . '/assets';
if (!@mkdir($assetsNew, 0755, true)) {
header('Location: /admin/theme-edit?theme=' . urlencode($theme));
exit;
}
$assetsRoot = realpath($assetsNew);
}
if (!$assetsRoot || !is_dir($assetsRoot)) {
header('Location: /admin/theme-edit?theme=' . urlencode($theme));
exit;
}
$subdir = str_replace(['../', '..\\', './'], '', $_POST['dir'] ?? '');
$subdir = ltrim($subdir, '/');
$targetDir = $assetsRoot . '/' . $subdir;
$realTarget = realpath($targetDir);
if ($realTarget === false) {
if (!@mkdir($targetDir, 0755, true)) {
header('Location: /admin/theme-edit?theme=' . urlencode($theme));
exit;
}
$realTarget = realpath($targetDir);
}
if (!$realTarget || strpos($realTarget, $assetsRoot) !== 0 || !is_dir($realTarget)) {
header('Location: /admin/theme-edit?theme=' . urlencode($theme));
exit;
}
$allowedExt = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'pdf', 'zip', 'mp4', 'webm', 'ogg', 'mp3', 'wav', 'mov', 'avi', 'css', 'scss', 'js', 'json', 'html', 'md', 'twig', 'woff', 'woff2', 'ttf', 'eot'];
$uploaded = 0;
$errors = [];
if (!empty($_FILES['file']['name'])) {
foreach ($_FILES['file']['name'] as $i => $name) {
if ($_FILES['file']['error'][$i] !== UPLOAD_ERR_OK) continue;
$ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
if (!in_array($ext, $allowedExt, true)) {
$errors[] = htmlspecialchars($name) . ' (niet toegestaan type)';
continue;
}
$filename = preg_replace('/[^a-zA-Z0-9._-]/', '_', $name);
$dest = $realTarget . '/' . $filename;
$n = 1;
while (file_exists($dest)) {
$p = pathinfo($filename);
$dest = $realTarget . '/' . $p['filename'] . '_' . $n . '.' . ($p['extension'] ?? $ext);
$n++;
}
if (move_uploaded_file($_FILES['file']['tmp_name'][$i], $dest)) {
$uploaded++;
} else {
$errors[] = htmlspecialchars($name);
}
}
}
$msg = [];
$type = 'info';
if ($uploaded > 0) {
$msg[] = $uploaded . ' bestand(en) geüpload.';
$type = 'success';
adminLog($config, 'info', $user['username'] . ' uploadde naar ' . $theme . '/assets/' . ($subdir ? $subdir . '/' : '') . ' (' . $uploaded . ' bestanden)');
}
if (!empty($errors)) {
$msg[] = 'Fouten: ' . implode(', ', $errors);
$type = $type === 'success' ? 'success' : 'danger';
}
$redir = '/admin/theme-edit?theme=' . urlencode($theme);
if (!empty($msg)) {
$redir .= '&msg=' . urlencode(implode(' ', $msg)) . '&msgtype=' . urlencode($type);
}
header('Location: ' . $redir);
exit;
}
/**
* Handle deletion of a single file inside a theme directory.
* Refuses to delete directories, dotfiles, theme.json, and paths that escape the theme dir.
*/
function handleThemeFileDelete($auth, $config, $user): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/theme');
exit;
}
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/theme');
exit;
}
$theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['theme'] ?? '');
if ($theme === '') {
header('Location: /admin/theme');
exit;
}
$themesDir = __DIR__ . '/../themes';
$realThemeDir = realpath(rtrim($themesDir, '/') . '/' . $theme);
if (!$realThemeDir || !is_dir($realThemeDir)) {
header('Location: /admin/theme');
exit;
}
$relFile = str_replace(['../', '..\\', './'], '', $_POST['file'] ?? '');
$relFile = ltrim($relFile, '/');
foreach (explode('/', $relFile) as $seg) {
if ($seg === '..' || $seg === '.') {
header('Location: /admin/theme-edit?theme=' . urlencode($theme));
exit;
}
}
$base = basename($relFile);
if ($base === '' || $base[0] === '.') {
header('Location: /admin/theme-edit?theme=' . urlencode($theme));
exit;
}
// Protect theme.json from deletion
if ($relFile === 'theme.json') {
header('Location: /admin/theme-edit?theme=' . urlencode($theme) . '&msg=' . urlencode('theme.json kan niet verwijderd worden.') . '&msgtype=danger');
exit;
}
$fullPath = $realThemeDir . '/' . $relFile;
$realPath = realpath($fullPath);
if ($realPath === false || strpos($realPath, $realThemeDir) !== 0 || !is_file($realPath)) {
header('Location: /admin/theme-edit?theme=' . urlencode($theme));
exit;
}
$deleted = @unlink($realPath);
if ($deleted) {
adminLog($config, 'info', $user['username'] . ' verwijderde ' . $theme . '/' . $relFile);
$msg = 'Bestand verwijderd.';
$type = 'success';
} else {
$err = error_get_last();
$msg = 'Verwijderen mislukt: ' . ($err['message'] ?? 'onbekend');
$type = 'danger';
}
$redir = '/admin/theme-edit?theme=' . urlencode($theme) . '&file=' . urlencode('theme.json');
$redir .= '&msg=' . urlencode($msg) . '&msgtype=' . urlencode($type);
header('Location: ' . $redir);
exit;
}
/**
* Handle moving a single file within a theme to another folder inside the same theme.
* Mirrors handlePluginsFileMove.
*/
function handleThemeFileMove($auth, $config, $twig, $user, $csrf): void
{
$theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_GET['theme'] ?? $_POST['theme'] ?? '');
if ($theme === '') {
header('Location: /admin/theme');
exit;
}
$themesDir = __DIR__ . '/../themes';
$realThemeDir = realpath(rtrim($themesDir, '/') . '/' . $theme);
if (!$realThemeDir || !is_dir($realThemeDir)) {
header('Location: /admin/theme');
exit;
}
$relFile = str_replace(['../', '..\\', './'], '', $_GET['file'] ?? $_POST['file'] ?? '');
$relFile = ltrim($relFile, '/');
foreach (explode('/', $relFile) as $seg) {
if ($seg === '..' || $seg === '.') {
header('Location: /admin/theme-edit?theme=' . urlencode($theme));
exit;
}
}
$base = basename($relFile);
if ($base === '' || $base[0] === '.') {
header('Location: /admin/theme-edit?theme=' . urlencode($theme));
exit;
}
if ($relFile === 'theme.json') {
header('Location: /admin/theme-edit?theme=' . urlencode($theme) . '&msg=' . urlencode('theme.json kan niet verplaatst worden.') . '&msgtype=danger');
exit;
}
$fullPath = $realThemeDir . '/' . $relFile;
$realPath = realpath($fullPath);
if ($realPath === false || strpos($realPath, $realThemeDir) !== 0 || !is_file($realPath)) {
header('Location: /admin/theme-edit?theme=' . urlencode($theme));
exit;
}
$message = '';
$messageType = '';
$directories = [''];
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($realThemeDir, RecursiveDirectoryIterator::SKIP_DOTS),
RecursiveIteratorIterator::SELF_FIRST
);
$currentDir = trim(dirname($relFile), '.\\/');
foreach ($iterator as $file) {
if (!$file->isDir()) continue;
$realDir = $file->getRealPath();
if ($realDir === false || strpos($realDir, $realThemeDir) !== 0) continue;
$relDir = ltrim(substr($realDir, strlen($realThemeDir) + 1), '/\\');
$relDir = str_replace('\\', '/', $relDir);
if ($relDir === $currentDir) continue;
if ($relDir !== '' && $relDir[0] === '.') continue;
$directories[] = $relDir;
}
$directories = array_unique($directories);
sort($directories);
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$dest = str_replace(['../', '..\\', './'], '', $_POST['destination'] ?? '');
$dest = ltrim($dest, '/');
foreach (explode('/', $dest) as $seg) {
if ($seg === '..' || $seg === '.') {
$message = 'Ongeldige doelmap.';
$messageType = 'danger';
break;
}
}
if ($message === '') {
$destDir = $dest === '' ? $realThemeDir : $realThemeDir . '/' . $dest;
$realDestDir = realpath($destDir);
if (!$realDestDir || !is_dir($realDestDir) || strpos($realDestDir, $realThemeDir) !== 0) {
$message = 'Doelmap bestaat niet.';
$messageType = 'danger';
} else {
$newPath = $realDestDir . '/' . basename($realPath);
if (file_exists($newPath)) {
$message = 'Bestand bestaat al op de bestemming.';
$messageType = 'danger';
} elseif (rename($realPath, $newPath)) {
adminLog($config, 'info', $user['username'] . ' verplaatste ' . $theme . '/' . $relFile . ' naar ' . $theme . '/' . ($dest ? $dest . '/' : '') . basename($relFile));
$newRel = $dest === '' ? basename($relFile) : $dest . '/' . basename($relFile);
header('Location: /admin/theme-edit?theme=' . urlencode($theme) . '&file=' . urlencode($newRel) . '&msg=' . urlencode('Bestand verplaatst.') . '&msgtype=success');
exit;
} else {
$err = error_get_last();
$message = 'Verplaatsen mislukt: ' . ($err['message'] ?? 'onbekend');
$messageType = 'danger';
}
}
}
}
}
echo $twig->render('pages/theme-move-form.twig', [
'user' => $user,
'route' => 'theme-file-move',
'csrf_token' => $csrf,
'themeName' => $theme,
'relFile' => $relFile,
'itemName' => basename($relFile),
'itemDir' => trim(dirname($relFile), '.\\/'),
'directories' => $directories,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
/**
* Handle theme activation: sets active_theme in config.json.
*/
function handleThemeActivate($auth, $config, $user): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/theme');
exit;
}
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/theme');
exit;
}
$theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['theme'] ?? '');
if ($theme === '') {
header('Location: /admin/theme');
exit;
}
$themesDir = __DIR__ . '/../themes';
if (!is_dir($themesDir . '/' . $theme)) {
header('Location: /admin/theme?msg=' . urlencode('Thema bestaat niet.') . '&msgtype=danger');
exit;
}
$configFile = $config['config_json'];
$siteConfig = file_exists($configFile) ? json_decode(file_get_contents($configFile), true) : [];
$siteConfig['active_theme'] = $theme;
file_put_contents($configFile, json_encode($siteConfig, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES));
adminLog($config, 'info', $user['username'] . ' activeerde thema ' . $theme);
header('Location: /admin/theme?msg=' . urlencode('Thema "' . htmlspecialchars($theme) . '" geactiveerd.') . '&msgtype=success');
exit;
}
/**
* Handle theme deletion: only non-active, non-default themes can be removed.
*/
function handleThemeDelete($auth, $config, $user): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/theme');
exit;
}
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/theme');
exit;
}
$theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['theme'] ?? '');
if ($theme === '' || $theme === 'default') {
adminLog($config, 'warning', $user['username'] . ' probeerde default thema te verwijderen');
header('Location: /admin/theme?msg=' . urlencode('Default thema kan niet verwijderd worden.') . '&msgtype=danger');
exit;
}
$configFile = $config['config_json'];
$siteConfig = file_exists($configFile) ? json_decode(file_get_contents($configFile), true) : [];
if (($siteConfig['active_theme'] ?? 'default') === $theme) {
header('Location: /admin/theme?msg=' . urlencode('Actief thema kan niet verwijderd worden. Activeer eerst een ander thema.') . '&msgtype=danger');
exit;
}
$themesDir = __DIR__ . '/../themes';
$themeDir = $themesDir . '/' . $theme;
$realThemeDir = realpath($themeDir);
$realThemesRoot = realpath($themesDir);
if (!$realThemeDir || !$realThemesRoot || strpos($realThemeDir, $realThemesRoot) !== 0 || !is_dir($realThemeDir)) {
header('Location: /admin/theme?msg=' . urlencode('Thema bestaat niet.') . '&msgtype=danger');
exit;
}
removeDirRecursive($realThemeDir);
adminLog($config, 'info', $user['username'] . ' verwijderde thema ' . $theme);
header('Location: /admin/theme?msg=' . urlencode('Thema "' . htmlspecialchars($theme) . '" verwijderd.') . '&msgtype=success');
exit;
}
/**
* Handle SCSS compilation for a theme. Uses ThemeManager.compileCss(true).
*/
function handleThemeScss($auth, $config, $user): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/theme');
exit;
}
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/theme');
exit;
}
$theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['theme'] ?? '');
if ($theme === '') {
header('Location: /admin/theme');
exit;
}
$themesDir = __DIR__ . '/../themes';
if (!is_dir($themesDir . '/' . $theme)) {
header('Location: /admin/theme?msg=' . urlencode('Thema bestaat niet.') . '&msgtype=danger');
exit;
}
// Build a minimal config to feed ThemeManager
$themeConfig = ['active_theme' => $theme, 'theme_dir' => $themesDir . '/' . $theme, 'theme' => []];
$themeJsonFile = $themesDir . '/' . $theme . '/theme.json';
if (is_file($themeJsonFile)) {
$themeConfig['theme'] = json_decode(file_get_contents($themeJsonFile), true) ?? [];
}
$msg = '';
$type = 'info';
if (!class_exists('ThemeManager')) {
require_once __DIR__ . '/../cms/core/class/ThemeManager.php';
}
try {
$tm = new ThemeManager($themeConfig);
$result = $tm->compileCss(true);
if ($result !== null) {
$msg = 'SCSS gecompileerd voor ' . htmlspecialchars($theme) . '.';
$type = 'success';
adminLog($config, 'info', $user['username'] . ' compileerde SCSS voor ' . $theme);
} else {
$msg = 'SCSS compilatie mislukt voor ' . htmlspecialchars($theme) . '. Controleer of assets/scss/theme.scss bestaat.';
$type = 'danger';
adminLog($config, 'error', $user['username'] . ' SCSS compilatie mislukt voor ' . $theme);
}
} catch (\Throwable $e) {
$msg = 'SCSS compilatie fout: ' . htmlspecialchars($e->getMessage());
$type = 'danger';
adminLog($config, 'error', $user['username'] . ' SCSS compilatie fout voor ' . $theme . ': ' . $e->getMessage());
}
$redir = '/admin/theme?msg=' . urlencode($msg) . '&msgtype=' . urlencode($type);
header('Location: ' . $redir);
exit;
}
function handlePlugins($auth, $config, $twig, $user, $csrf): void
{
$pluginsDir = $config['plugins_dir'];
$configFile = $config['config_json'];
$siteConfig = file_exists($configFile) ? json_decode(file_get_contents($configFile), true) : [];
$enabledPlugins = $siteConfig['enabled_plugins'] ?? [];
$plugins = [];
foreach (glob($pluginsDir . '*', GLOB_ONLYDIR) as $pluginDir) {
$pluginName = basename($pluginDir);
$pluginJson = $pluginDir . '/plugin.json';
$pluginData = [
'name' => $pluginName,
'enabled' => in_array($pluginName, $enabledPlugins),
'protected' => isProtectedPlugin($pluginName),
'type' => 'content',
];
if (file_exists($pluginJson)) {
$data = json_decode(file_get_contents($pluginJson), true);
$pluginData = array_merge($pluginData, $data);
}
$pluginFile = $pluginDir . '/' . $pluginName . '.php';
if (file_exists($pluginFile) && !isset($pluginData['type'])) {
$source = file_get_contents($pluginFile);
if (preg_match("/'type'\s*=>\s*'([^']+)'/", $source, $m)) {
$pluginData['type'] = $m[1];
}
}
$plugins[] = $pluginData;
}
$route = 'plugins';
echo $twig->render('pages/plugins.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'plugins' => $plugins,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => '',
'message_type' => 'info',
]);
}
function handlePluginsNew($auth, $config, $twig, $user, $csrf): void
{
$message = '';
$messageType = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$pluginName = trim($_POST['name'] ?? '');
if (!empty($pluginName)) {
$pluginName = preg_replace('/[^a-zA-Z0-9_-]/', '-', $pluginName);
$pluginsDir = $config['plugins_dir'];
$newPluginDir = $pluginsDir . $pluginName;
if (!file_exists($newPluginDir)) {
@mkdir($newPluginDir, 0755, true);
$pluginJson = [
'name' => ucfirst($pluginName),
'version' => '1.0.0',
'author' => $user['username'],
];
file_put_contents($newPluginDir . '/plugin.json', json_encode($pluginJson, JSON_PRETTY_PRINT));
file_put_contents($newPluginDir . '/' . $pluginName . '.php', "render('pages/plugins-new.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handlePluginsEdit($auth, $config, $twig, $user, $csrf): void
{
$pluginsDir = $config['plugins_dir'];
$plugin = $_GET['plugin'] ?? '';
$plugin = preg_replace('/[^a-zA-Z0-9_-]/', '', $plugin);
// Block editing protected plugins
if (isProtectedPlugin($plugin)) {
adminLog($config, 'warning', $user['username'] . ' probeerde essentiële plugin ' . $plugin . ' te bewerken');
header('Location: /admin/plugins');
exit;
}
$pluginDir = $pluginsDir . $plugin;
$realPluginDir = realpath($pluginDir);
// Plugin must exist as a directory
if (!$realPluginDir || !is_dir($realPluginDir)) {
header('Location: /admin/plugins');
exit;
}
// Editable file extensions within a plugin
$editableExts = ['php', 'json', 'md', 'html', 'css', 'scss', 'js'];
// Resolve the requested file (defaults to .php)
$defaultFile = $plugin . '.php';
$relFile = $_GET['file'] ?? $defaultFile;
// Normalise: strip leading slashes, prevent path traversal
$relFile = str_replace(['../', '..\\', './'], '', $relFile);
$relFile = ltrim($relFile, '/');
$fullPath = $realPluginDir . '/' . $relFile;
$realPath = realpath($fullPath);
// Validate path stays within the plugin dir
if ($realPath === false || strpos($realPath, $realPluginDir) !== 0) {
// Fall back to default file
$relFile = $defaultFile;
$realPath = realpath($realPluginDir . '/' . $defaultFile);
}
$message = '';
$messageType = '';
// Carry over flash messages from redirect (upload/delete handlers)
if (isset($_GET['msg']) && is_string($_GET['msg']) && $_GET['msg'] !== '') {
$message = $_GET['msg'];
$messageType = $_GET['msgtype'] ?? 'info';
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} elseif (($_POST['action'] ?? '') === 'new_file') {
// Create a new file inside the plugin dir
$newName = trim($_POST['new_filename'] ?? '');
$newName = preg_replace('/[^a-zA-Z0-9._\-\/]/', '', $newName);
$newName = ltrim($newName, '/');
// Strip any traversal attempts
$newName = str_replace(['../', '..\\', './'], '', $newName);
// Reject any path segment that is '..' (extra traversal guard)
$segments = explode('/', $newName);
$traversal = false;
foreach ($segments as $seg) {
if ($seg === '..' || $seg === '.') { $traversal = true; break; }
}
if ($newName === '' || $newName === '.' || $traversal) {
$message = 'Ongeldige bestandsnaam.';
$messageType = 'danger';
} else {
$newFullPath = $realPluginDir . '/' . $newName;
$parentPath = dirname($newFullPath);
// Create parent dirs if needed (e.g. assets/css/)
if (!is_dir($parentPath)) {
@mkdir($parentPath, 0755, true);
}
$parentReal = realpath($parentPath);
if ($parentReal === false || strpos($parentReal, $realPluginDir) !== 0) {
$message = 'Ongeldig pad.';
$messageType = 'danger';
} else {
$newReal = $parentReal . '/' . basename($newFullPath);
if (file_exists($newReal)) {
$message = 'Bestand bestaat al.';
$messageType = 'danger';
} else {
$ext = strtolower(pathinfo($newName, PATHINFO_EXTENSION));
$stub = '';
if ($ext === 'php') {
$stub = "render('pages/plugins-edit.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'pluginName' => $plugin,
'pluginDir' => $pluginDir,
'relFile' => $relFile,
'fileName' => basename($relFile),
'fileExt' => $fileExt,
'fileContent' => $fileContent,
'isEditable' => $isEditable,
'files' => $files,
'editableExts' => $editableExts,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => $isEditable,
'mediaPluginName' => $plugin,
'message' => $message,
'message_type' => $messageType,
]);
}
/**
* Handle file upload into a plugin's assets/ directory.
* Files land in plugins//assets//. The target
* subdir is taken from ?dir= (defaults to the assets root). Only media
* and asset file types are allowed (images, video, audio, pdf, css, scss, js).
*
* Path-traversal protection: plugin name is sanitised, the resolved target
* directory must live inside the real plugin assets dir.
*/
function handlePluginsFileUpload($auth, $config, $user): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/plugins');
exit;
}
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/plugins');
exit;
}
$plugin = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['plugin'] ?? '');
if (isProtectedPlugin($plugin)) {
adminLog($config, 'warning', $user['username'] . ' probeerde upload in beschermde plugin ' . $plugin);
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
$pluginsDir = $config['plugins_dir'];
$assetsRoot = realpath(rtrim($pluginsDir, '/') . '/' . $plugin . '/assets');
if (!$assetsRoot || !is_dir($assetsRoot)) {
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
// Optional subdir within assets/ (e.g. "css" or "images")
$subdir = str_replace(['../', '..\\', './'], '', $_POST['dir'] ?? '');
$subdir = ltrim($subdir, '/');
$targetDir = $assetsRoot . '/' . $subdir;
$realTarget = realpath($targetDir);
// If the subdir does not exist yet, create it and re-resolve
if ($realTarget === false) {
if (!@mkdir($targetDir, 0755, true)) {
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
$realTarget = realpath($targetDir);
}
if (!$realTarget || strpos($realTarget, $assetsRoot) !== 0 || !is_dir($realTarget)) {
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
$allowedExt = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'pdf', 'zip', 'mp4', 'webm', 'ogg', 'mp3', 'wav', 'mov', 'avi', 'css', 'scss', 'js', 'json', 'html', 'md'];
$uploaded = 0;
$errors = [];
if (!empty($_FILES['file']['name'])) {
foreach ($_FILES['file']['name'] as $i => $name) {
if ($_FILES['file']['error'][$i] !== UPLOAD_ERR_OK) continue;
$ext = strtolower(pathinfo($name, PATHINFO_EXTENSION));
if (!in_array($ext, $allowedExt, true)) {
$errors[] = htmlspecialchars($name) . ' (niet toegestaan type)';
continue;
}
$filename = preg_replace('/[^a-zA-Z0-9._-]/', '_', $name);
$dest = $realTarget . '/' . $filename;
$n = 1;
while (file_exists($dest)) {
$p = pathinfo($filename);
$dest = $realTarget . '/' . $p['filename'] . '_' . $n . '.' . ($p['extension'] ?? $ext);
$n++;
}
if (move_uploaded_file($_FILES['file']['tmp_name'][$i], $dest)) {
$uploaded++;
} else {
$errors[] = htmlspecialchars($name);
}
}
}
$msg = [];
$type = 'info';
if ($uploaded > 0) {
$msg[] = $uploaded . ' bestand(en) geüpload.';
$type = 'success';
adminLog($config, 'info', $user['username'] . ' uploadde naar ' . $plugin . '/assets/' . ($subdir ? $subdir . '/' : '') . ' (' . $uploaded . ' bestanden)');
}
if (!empty($errors)) {
$msg[] = 'Fouten: ' . implode(', ', $errors);
$type = $type === 'success' ? 'success' : 'danger';
}
$redir = '/admin/plugins-edit?plugin=' . urlencode($plugin);
if (!empty($msg)) {
$redir .= '&msg=' . urlencode(implode(' ', $msg)) . '&msgtype=' . urlencode($type);
}
header('Location: ' . $redir);
exit;
}
/**
* Handle deletion of a single file inside a plugin directory.
* Refuses to delete directories, dotfiles and any path that escapes the
* plugin directory. Protected plugins are blocked.
*/
function handlePluginsFileDelete($auth, $config, $user): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/plugins');
exit;
}
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/plugins');
exit;
}
$plugin = preg_replace('/[^a-zA-Z0-9_-]/', '', $_POST['plugin'] ?? '');
if (isProtectedPlugin($plugin)) {
adminLog($config, 'warning', $user['username'] . ' probeerde bestand te verwijderen in beschermde plugin ' . $plugin);
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
$pluginsDir = $config['plugins_dir'];
$realPluginDir = realpath(rtrim($pluginsDir, '/') . '/' . $plugin);
if (!$realPluginDir || !is_dir($realPluginDir)) {
header('Location: /admin/plugins');
exit;
}
$relFile = str_replace(['../', '..\\', './'], '', $_POST['file'] ?? '');
$relFile = ltrim($relFile, '/');
// Reject path segments that are '..' or '.'
foreach (explode('/', $relFile) as $seg) {
if ($seg === '..' || $seg === '.') {
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
}
// Refuse dotfiles
$base = basename($relFile);
if ($base === '' || $base[0] === '.') {
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
$fullPath = $realPluginDir . '/' . $relFile;
$realPath = realpath($fullPath);
if ($realPath === false || strpos($realPath, $realPluginDir) !== 0 || !is_file($realPath)) {
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
$deleted = @unlink($realPath);
if ($deleted) {
adminLog($config, 'info', $user['username'] . ' verwijderde ' . $plugin . '/' . $relFile);
$msg = 'Bestand verwijderd.';
$type = 'success';
} else {
$err = error_get_last();
$msg = 'Verwijderen mislukt: ' . ($err['message'] ?? 'onbekend');
$type = 'danger';
}
// After deletion, fall back to the main plugin file
$redir = '/admin/plugins-edit?plugin=' . urlencode($plugin) . '&file=' . urlencode($plugin . '.php');
$redir .= '&msg=' . urlencode($msg) . '&msgtype=' . urlencode($type);
header('Location: ' . $redir);
exit;
}
/**
* Handle moving a single file within a plugin directory to another folder
* inside the same plugin. Renders a move form (GET) with a dropdown of
* available folders, and performs the rename (move) on POST.
*
* Path-traversal protection: the source and destination must both resolve
* inside the real plugin directory. Protected plugins are blocked.
*/
function handlePluginsFileMove($auth, $config, $twig, $user, $csrf): void
{
$plugin = preg_replace('/[^a-zA-Z0-9_-]/', '', $_GET['plugin'] ?? $_POST['plugin'] ?? '');
if (isProtectedPlugin($plugin)) {
adminLog($config, 'warning', $user['username'] . ' probeerde bestand te verplaatsen in beschermde plugin ' . $plugin);
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
$pluginsDir = $config['plugins_dir'];
$realPluginDir = realpath(rtrim($pluginsDir, '/') . '/' . $plugin);
if (!$realPluginDir || !is_dir($realPluginDir)) {
header('Location: /admin/plugins');
exit;
}
$relFile = str_replace(['../', '..\\', './'], '', $_GET['file'] ?? $_POST['file'] ?? '');
$relFile = ltrim($relFile, '/');
foreach (explode('/', $relFile) as $seg) {
if ($seg === '..' || $seg === '.') {
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
}
$base = basename($relFile);
if ($base === '' || $base[0] === '.') {
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
$fullPath = $realPluginDir . '/' . $relFile;
$realPath = realpath($fullPath);
if ($realPath === false || strpos($realPath, $realPluginDir) !== 0 || !is_file($realPath)) {
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin));
exit;
}
$message = '';
$messageType = '';
// Collect all directories within the plugin (as relative paths), excluding
// the directory the file currently lives in. The plugin root ("") is always
// offered as a destination.
$directories = [''];
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($realPluginDir, RecursiveDirectoryIterator::SKIP_DOTS),
RecursiveIteratorIterator::SELF_FIRST
);
$currentDir = trim(dirname($relFile), '.\\/');
foreach ($iterator as $file) {
if (!$file->isDir()) continue;
$realDir = $file->getRealPath();
if ($realDir === false || strpos($realDir, $realPluginDir) !== 0) continue;
$relDir = ltrim(substr($realDir, strlen($realPluginDir) + 1), '/\\');
$relDir = str_replace('\\', '/', $relDir);
// Skip the source file's own directory (no-op move)
if ($relDir === $currentDir) continue;
// Skip dotfile dirs
if ($relDir !== '' && $relDir[0] === '.') continue;
$directories[] = $relDir;
}
$directories = array_unique($directories);
sort($directories);
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$dest = str_replace(['../', '..\\', './'], '', $_POST['destination'] ?? '');
$dest = ltrim($dest, '/');
foreach (explode('/', $dest) as $seg) {
if ($seg === '..' || $seg === '.') {
$message = 'Ongeldige doelmap.';
$messageType = 'danger';
break;
}
}
if ($message === '') {
$destDir = $dest === '' ? $realPluginDir : $realPluginDir . '/' . $dest;
$realDestDir = realpath($destDir);
if (!$realDestDir || !is_dir($realDestDir) || strpos($realDestDir, $realPluginDir) !== 0) {
$message = 'Doelmap bestaat niet.';
$messageType = 'danger';
} else {
$newPath = $realDestDir . '/' . basename($realPath);
if (file_exists($newPath)) {
$message = 'Bestand bestaat al op de bestemming.';
$messageType = 'danger';
} elseif (rename($realPath, $newPath)) {
adminLog($config, 'info', $user['username'] . ' verplaatste ' . $plugin . '/' . $relFile . ' naar ' . $plugin . '/' . ($dest ? $dest . '/' : '') . basename($relFile));
$newRel = $dest === '' ? basename($relFile) : $dest . '/' . basename($relFile);
header('Location: /admin/plugins-edit?plugin=' . urlencode($plugin) . '&file=' . urlencode($newRel) . '&msg=' . urlencode('Bestand verplaatst.') . '&msgtype=success');
exit;
} else {
$err = error_get_last();
$message = 'Verplaatsen mislukt: ' . ($err['message'] ?? 'onbekend');
$messageType = 'danger';
}
}
}
}
}
echo $twig->render('pages/plugins-move-form.twig', [
'user' => $user,
'route' => 'plugins-file-move',
'csrf_token' => $csrf,
'pluginName' => $plugin,
'relFile' => $relFile,
'itemName' => basename($relFile),
'itemDir' => trim(dirname($relFile), '.\\/'),
'directories' => $directories,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handlePluginsConfig($auth, $config, $twig, $user, $csrf): void
{
$pluginsDir = $config['plugins_dir'];
$plugin = $_GET['plugin'] ?? '';
$plugin = preg_replace('/[^a-zA-Z0-9_-]/', '', $plugin);
$pluginDir = $pluginsDir . $plugin;
$pluginJsonFile = $pluginDir . '/plugin.json';
$configJsonFile = $pluginDir . '/config.json';
$message = '';
$messageType = '';
// Load plugin.json to get the settings schema
$pluginJson = [];
if (file_exists($pluginJsonFile)) {
$pluginJson = json_decode(file_get_contents($pluginJsonFile), true) ?? [];
}
$settingsSchema = $pluginJson['settings'] ?? [];
// Load current config.json (overrides)
$currentConfig = [];
if (file_exists($configJsonFile)) {
$currentConfig = json_decode(file_get_contents($configJsonFile), true) ?? [];
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
// Build new config from POST values based on the schema
$newConfig = [];
foreach ($settingsSchema as $setting) {
$key = $setting['key'] ?? '';
if ($key === '') continue;
$type = $setting['type'] ?? 'text';
if ($type === 'checkbox') {
$newConfig[$key] = isset($_POST['setting_' . $key]);
} elseif ($type === 'number') {
$newConfig[$key] = (int)($_POST['setting_' . $key] ?? 0);
} elseif ($type === 'multi-select') {
$newConfig[$key] = $_POST['setting_' . $key] ?? [];
} else {
$newConfig[$key] = trim($_POST['setting_' . $key] ?? '');
}
}
file_put_contents($configJsonFile, json_encode($newConfig, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE));
adminLog($config, 'info', $user['username'] . ' bewerkte plugin config ' . $plugin);
$message = 'Plugin configuratie opgeslagen.';
$messageType = 'success';
// Reload current config so the form shows the new values
$currentConfig = $newConfig;
}
}
// Build resolved values: defaults from schema + overrides from config.json
$resolvedConfig = [];
foreach ($settingsSchema as $setting) {
$key = $setting['key'] ?? '';
if ($key === '') continue;
$resolvedConfig[$key] = array_key_exists($key, $currentConfig)
? $currentConfig[$key]
: ($setting['default'] ?? null);
}
// Resolve setting labels/help text via plugin translations.
// A setting may declare `label_key`/`help_key` pointing at a key in the
// plugin's language//admin.php file. If present and resolved, the
// translated value is exposed as `resolved_label`/`resolved_help` on the
// setting. The Twig template falls back to the raw `label`/`help` from
// plugin.json when these are empty.
$siteConfigForPluginI18n = file_exists($config['config_json'])
? (json_decode(file_get_contents($config['config_json']), true) ?? [])
: [];
$pluginAdminLang = $siteConfigForPluginI18n['admin_language']
?? ($siteConfigForPluginI18n['language']['default'] ?? 'nl');
$pluginSiteDefaultLang = $siteConfigForPluginI18n['language']['default'] ?? 'nl';
$pluginPm = new PluginManager($config['plugins_dir'], [], $pluginSiteDefaultLang);
$pluginT = $pluginPm->getPluginTranslations($plugin, $pluginAdminLang, 'admin');
foreach ($settingsSchema as &$setting) {
$labelKey = $setting['label_key'] ?? '';
$helpKey = $setting['help_key'] ?? '';
$setting['resolved_label'] = ($labelKey !== '' && isset($pluginT[$labelKey])) ? $pluginT[$labelKey] : '';
$setting['resolved_help'] = ($helpKey !== '' && isset($pluginT[$helpKey])) ? $pluginT[$helpKey] : '';
// Resolve option labels for select/multi-select via option_label_key
$optionLabelKey = $setting['option_label_key'] ?? '';
if ($optionLabelKey !== '' && isset($pluginT[$optionLabelKey]) && is_array($pluginT[$optionLabelKey])) {
$setting['resolved_options'] = $pluginT[$optionLabelKey];
} else {
$setting['resolved_options'] = null;
}
}
unset($setting);
$route = 'plugins-config';
echo $twig->render('pages/plugin-config.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'pluginName' => $plugin,
'pluginJson' => $pluginJson,
'settingsSchema' => $settingsSchema,
'resolvedConfig' => $resolvedConfig,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handlePluginsToggle($auth, $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/plugins');
exit;
}
$user = $auth->getCurrentUser();
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/plugins');
exit;
}
$plugin = $_POST['plugin'] ?? '';
$plugin = preg_replace('/[^a-zA-Z0-9_-]/', '', $plugin);
// Block toggling protected plugins
if (isProtectedPlugin($plugin)) {
adminLog($config, 'warning', $user['username'] . ' probeerde essentiële plugin ' . $plugin . ' te deactiveren');
header('Location: /admin/plugins');
exit;
}
$configFile = $config['config_json'];
$siteConfig = file_exists($configFile) ? json_decode(file_get_contents($configFile), true) : [];
$enabledPlugins = $siteConfig['enabled_plugins'] ?? [];
if (in_array($plugin, $enabledPlugins)) {
$enabledPlugins = array_diff($enabledPlugins, [$plugin]);
adminLog($config, 'info', $user['username'] . ' deactiveerde plugin ' . $plugin);
} else {
$enabledPlugins[] = $plugin;
adminLog($config, 'info', $user['username'] . ' activeerde plugin ' . $plugin);
}
$siteConfig['enabled_plugins'] = array_values($enabledPlugins);
file_put_contents($configFile, json_encode($siteConfig, JSON_PRETTY_PRINT | JSON_UNESCAPED_UNICODE));
header('Location: /admin/plugins');
exit;
}
function handlePluginsDelete($auth, $config): void
{
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
header('Location: /admin/plugins');
exit;
}
$user = $auth->getCurrentUser();
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
header('Location: /admin/plugins');
exit;
}
$plugin = $_POST['plugin'] ?? '';
$plugin = preg_replace('/[^a-zA-Z0-9_-]/', '', $plugin);
// Block deleting protected plugins
if (isProtectedPlugin($plugin)) {
adminLog($config, 'warning', $user['username'] . ' probeerde essentiële plugin ' . $plugin . ' te verwijderen');
header('Location: /admin/plugins');
exit;
}
$pluginsDir = $config['plugins_dir'];
$pluginDir = $pluginsDir . $plugin;
if (is_dir($pluginDir)) {
// Remove plugin directory recursively
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($pluginDir, RecursiveDirectoryIterator::SKIP_DOTS),
RecursiveIteratorIterator::SELF_FIRST
);
foreach ($iterator as $file) {
if ($file->isDir()) {
rmdir($file->getPathname());
} else {
unlink($file->getPathname());
}
}
rmdir($pluginDir);
adminLog($config, 'info', $user['username'] . ' verwijderde plugin ' . $plugin);
}
header('Location: /admin/plugins');
exit;
}
function handleUsers($auth, $config, $twig, $user, $csrf): void
{
$message = '';
$messageType = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$action = $_POST['action'] ?? '';
if ($action === 'delete') {
$deleteUser = $_POST['delete_username'] ?? '';
if ($deleteUser !== $user['username']) {
$result = $auth->deleteUser($deleteUser);
$message = $result['message'];
$messageType = $result['success'] ? 'success' : 'danger';
} else {
$message = 'Je kunt jezelf niet verwijderen.';
$messageType = 'danger';
}
} elseif ($action === 'change_role') {
$roleUser = $_POST['role_username'] ?? '';
$newRole = $_POST['new_role'] ?? '';
$result = $auth->changeRole($roleUser, $newRole);
$message = $result['message'];
$messageType = $result['success'] ? 'success' : 'danger';
}
}
}
$route = 'users';
$users = $auth->getUsers();
$roles = AdminAuth::getRoles();
// Search and filter
$search = trim($_GET['search'] ?? '');
$roleFilter = $_GET['role'] ?? '';
if ($search !== '') {
$users = array_filter($users, function($u) use ($search) {
return stripos($u['username'], $search) !== false
|| stripos($u['email'] ?? '', $search) !== false
|| stripos($u['author_name'] ?? '', $search) !== false;
});
}
if ($roleFilter !== '') {
$users = array_filter($users, function($u) use ($roleFilter) {
return $u['role'] === $roleFilter;
});
}
echo $twig->render('pages/users.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'users' => $users,
'roles' => $roles,
'search' => $search,
'role_filter' => $roleFilter,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handleUsersEdit($auth, $config, $twig, $user, $csrf): void
{
$targetUsername = $_GET['user'] ?? '';
$targetUsername = preg_replace('/[^a-zA-Z0-9_\-]/', '', $targetUsername);
if ($targetUsername === '') {
header('Location: /admin/users');
exit;
}
$message = '';
$messageType = '';
// Password change is only allowed when the real role is admin
// (i.e. not when testing via role-switch)
$canChangePassword = $auth->getRealRole() === 'admin';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$action = $_POST['action'] ?? '';
if ($action === 'profile') {
$profileEmail = trim($_POST['profile_email'] ?? '');
$profileAuthorName = trim($_POST['profile_author_name'] ?? '');
$profileAuthorEmail = trim($_POST['profile_author_email'] ?? '');
$result = $auth->updateUserProfile($targetUsername, $profileEmail, $profileAuthorName, $profileAuthorEmail);
$message = $result['message'];
$messageType = $result['success'] ? 'success' : 'danger';
} elseif ($action === 'change_role') {
$newRole = $_POST['new_role'] ?? '';
$result = $auth->changeRole($targetUsername, $newRole);
$message = $result['message'];
$messageType = $result['success'] ? 'success' : 'danger';
} elseif ($action === 'change_password') {
if (!$canChangePassword) {
$message = 'Je mag geen wachtwoorden wijzigen in deze rol.';
$messageType = 'danger';
} else {
$newPassword = $_POST['new_password'] ?? '';
$result = $auth->changePassword($targetUsername, $newPassword);
$message = $result['message'];
$messageType = $result['success'] ? 'success' : 'danger';
}
} elseif ($action === 'delete') {
if ($targetUsername !== $user['username']) {
$result = $auth->deleteUser($targetUsername);
header('Location: /admin/users?msg=' . urlencode($result['message']));
exit;
} else {
$message = 'Je kunt jezelf niet verwijderen.';
$messageType = 'danger';
}
}
}
}
$users = $auth->getUsers();
if (!isset($users[$targetUsername])) {
header('Location: /admin/users');
exit;
}
$targetUser = $users[$targetUsername];
$roles = AdminAuth::getRoles();
$isSelf = ($targetUsername === $user['username']);
echo $twig->render('pages/users-edit.twig', [
'user' => $user,
'route' => 'users',
'csrf_token' => $csrf,
'target_user' => $targetUser,
'is_self' => $isSelf,
'can_change_password' => $canChangePassword,
'roles' => $roles,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handleUsersNew($auth, $config, $twig, $user, $csrf): void
{
$message = '';
$messageType = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!$auth->verifyCsrf($_POST['csrf_token'] ?? '')) {
$message = 'Ongeldige CSRF token.';
$messageType = 'danger';
} else {
$newUsername = trim($_POST['new_username'] ?? '');
$newPassword = $_POST['new_password'] ?? '';
$newRole = $_POST['new_role'] ?? 'content-manager';
$newEmail = trim($_POST['new_email'] ?? '');
$newAuthorName = trim($_POST['new_author_name'] ?? '');
$newAuthorEmail = trim($_POST['new_author_email'] ?? '');
$result = $auth->addUser($newUsername, $newPassword, $newRole, $newEmail, $newAuthorName, $newAuthorEmail);
if ($result['success']) {
header('Location: /admin/users-edit?user=' . urlencode($newUsername) . '&msg=' . urlencode($result['message']));
exit;
}
$message = $result['message'];
$messageType = 'danger';
}
}
$roles = AdminAuth::getRoles();
echo $twig->render('pages/users-new.twig', [
'user' => $user,
'route' => 'users',
'csrf_token' => $csrf,
'roles' => $roles,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => $message,
'message_type' => $messageType,
]);
}
function handleGuide($auth, $config, $twig, $user, $csrf): void
{
$lang = $_GET['lang'] ?? 'nl';
$page = $_GET['page'] ?? '';
$rootDir = realpath(__DIR__ . '/..');
// Get guide file
if ($page) {
$guideFile = $rootDir . '/guide/' . $lang . '/' . $page . '.md';
} else {
$guideFile = $rootDir . '/guide/' . $lang . '/index.md';
}
// Fallback to English
if (!file_exists($guideFile) && $lang !== 'en') {
$guideFile = $rootDir . '/guide/en/' . ($page ? $page . '.md' : 'index.md');
}
// Load content
if (!file_exists($guideFile)) {
$content = 'Handleiding niet gevonden.
';
} else {
$content = file_get_contents($guideFile);
// Parse Markdown with Table support
if (class_exists('League\CommonMark\Environment\Environment')) {
$environment = new \League\CommonMark\Environment\Environment([
'html_input' => 'strip',
'heading_permalink' => [
'symbol' => '',
'aria_hidden' => true,
'html_class' => 'heading-permalink',
'id_prefix' => '',
'fragment_prefix' => '',
'apply_id_to_heading' => true,
'insert' => 'after',
'min_heading_level' => 1,
'max_heading_level' => 6,
'title' => 'Permalink',
],
]);
$environment->addExtension(new \League\CommonMark\Extension\CommonMark\CommonMarkCoreExtension());
$environment->addExtension(new \League\CommonMark\Extension\Table\TableExtension());
$environment->addExtension(new \League\CommonMark\Extension\HeadingPermalink\HeadingPermalinkExtension());
$converter = new \League\CommonMark\MarkdownConverter($environment);
$content = $converter->convert($content)->getContent();
} else {
$content = nl2br(htmlspecialchars($content));
}
}
// Build guide navigation sidebar using Navigation plugin
$guideNav = '';
$navPluginFile = $rootDir . '/plugins/Navigation/Navigation.php';
if (file_exists($navPluginFile)) {
require_once $navPluginFile;
if (class_exists('Navigation')) {
$navPlugin = new Navigation();
$guideNav = $navPlugin->getSidebarContent();
}
}
// Build breadcrumbs
$breadcrumbs = [];
if ($page) {
$parts = explode('/', $page);
$path = '';
foreach ($parts as $part) {
$path .= ($path ? '/' : '') . $part;
$breadcrumbs[] = [
'title' => str_replace('-', ' ', ucfirst($part)),
'url' => $path,
];
}
}
echo $twig->render('pages/guide.twig', [
'user' => $user,
'route' => 'guide',
'csrf_token' => $csrf,
'lang' => $lang,
'page' => $page,
'guide_breadcrumbs' => $breadcrumbs,
'guide_lang' => $lang,
'guide_page' => $page,
'content' => $content,
'guide_nav' => $guideNav,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => '',
'message_type' => 'info',
]);
}
function handleUpdate($auth, $config, $twig, $user, $csrf): void
{
$versionFile = __DIR__ . '/../version.php';
$versionInfo = file_exists($versionFile) ? include $versionFile : [];
$versionInfo['version'] = $versionInfo['version'] ?? '0.0.0';
$isGitWritable = is_writable(__DIR__ . '/../.git');
$route = 'update';
echo $twig->render('pages/update.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'version' => $versionInfo['version'],
'isGitWritable' => $isGitWritable,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => '',
'message_type' => 'info',
]);
}
function handleMedia($auth, $config, $twig, $user, $csrf): void
{
$contentDir = $config['content_dir'];
$subdir = $_GET['dir'] ?? '';
$subdir = str_replace(['../', '..\\'], '', $subdir);
$fullPath = rtrim($contentDir, '/') . '/' . $subdir;
$items = scanContentDir($fullPath, $subdir);
$route = 'media';
echo $twig->render('pages/media.twig', [
'user' => $user,
'route' => $route,
'csrf_token' => $csrf,
'subdir' => $subdir,
'items' => $items,
'sidebar_color' => getSidebarColor($config),
'needs_editor' => false,
'message' => '',
'message_type' => 'info',
]);
}
/**
* JSON endpoint that returns the list of media files (images, video, audio,
* documents), recursively. Used by the in-editor media modal so the user can
* pick a file and insert it into the content without leaving the editor.
*
* Scope:
* - Default (no ?plugin=): scans the content directory, URLs are /content/...
* - With ?plugin=: scans plugins//assets/, URLs are
* /plugins//assets/...
*
* Path-traversal protection: every resolved real path must start with the
* resolved base directory (content dir or plugin assets dir).
*
* Output: [{name, path, url, extension, is_image, size, modified}, ...]
*/
function handleMediaList($auth, $config): void
{
header('Content-Type: application/json; charset=utf-8');
$mediaExts = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'pdf', 'mp4', 'webm', 'ogg', 'mp3', 'wav', 'mov', 'avi'];
$imageExts = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg'];
// Determine the scan root and the URL prefix based on the scope
$plugin = preg_replace('/[^a-zA-Z0-9_-]/', '', $_GET['plugin'] ?? '');
$theme = preg_replace('/[^a-zA-Z0-9_-]/', '', $_GET['theme'] ?? '');
if ($plugin !== '') {
$pluginsDir = $config['plugins_dir'];
$baseDir = rtrim($pluginsDir, '/') . '/' . $plugin . '/assets';
$urlPrefix = '/plugins/' . $plugin . '/assets/';
} elseif ($theme !== '') {
$themesDir = __DIR__ . '/../themes';
$baseDir = rtrim($themesDir, '/') . '/' . $theme . '/assets';
$urlPrefix = '/themes/' . $theme . '/assets/';
} else {
$baseDir = $config['content_dir'];
$urlPrefix = '/content/';
}
$realBase = realpath($baseDir);
if (!$realBase || !is_dir($realBase)) {
echo json_encode([]);
return;
}
$items = [];
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($realBase, RecursiveDirectoryIterator::SKIP_DOTS)
);
foreach ($iterator as $fileInfo) {
if (!$fileInfo->isFile()) {
continue;
}
$name = $fileInfo->getFilename();
// Skip hidden / dotfiles (incl. .gitkeep)
if ($name !== '' && $name[0] === '.') {
continue;
}
$ext = strtolower($fileInfo->getExtension());
if (!in_array($ext, $mediaExts, true)) {
continue;
}
$realPath = $fileInfo->getRealPath();
// Safety: must live inside the scan base
if ($realPath === false || strpos($realPath, $realBase) !== 0) {
continue;
}
$relPath = substr($realPath, strlen($realBase) + 1);
$relPath = str_replace('\\', '/', $relPath);
$items[] = [
'name' => $name,
'path' => $relPath,
'url' => $urlPrefix . implode('/', array_map('rawurlencode', explode('/', $relPath))),
'extension' => $ext,
'is_image' => in_array($ext, $imageExts, true),
'size' => formatSize($fileInfo->getSize()),
'modified' => date('Y-m-d H:i', $fileInfo->getMTime()),
];
}
// Sort: images first, then other media, alphabetically by name
usort($items, function ($a, $b) {
if ($a['is_image'] && !$b['is_image']) return -1;
if (!$a['is_image'] && $b['is_image']) return 1;
return strcasecmp($a['path'], $b['path']);
});
echo json_encode($items, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
}
// ============================================================================
// HELPER FUNCTIONS (from original admin.php)
// ============================================================================
function adminLog(array $config, string $level, string $message): void
{
$logFile = $config['log_file'];
$dir = dirname($logFile);
if (!is_dir($dir)) {
@mkdir($dir, 0755, true);
}
$timestamp = date('Y-m-d H:i:s');
$ip = RequestLogger::getClientIp();
@file_put_contents($logFile, "[{$timestamp}] [{$level}] [{$ip}] {$message}\n", FILE_APPEND);
if (class_exists('LogManager')) {
LogManager::log(LogManager::EVENT_ADMIN, $level, $message, ['ip' => $ip]);
}
}
function countFiles(string $dir, array $extensions = []): int
{
$count = 0;
if (!is_dir($dir)) return 0;
$iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dir));
foreach ($iterator as $file) {
if ($file->isFile()) {
if (empty($extensions) || in_array($file->getExtension(), $extensions)) {
$count++;
}
}
}
return $count;
}
function countDirs(string $dir): int
{
$count = 0;
if (!is_dir($dir)) return 0;
$iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dir));
foreach ($iterator as $file) {
if ($file->isDir() && !str_starts_with($file->getFilename(), '.')) {
$count++;
}
}
return $count;
}
function countEnabledPlugins(string $pluginsDir, string $configJson): int
{
$config = file_exists($configJson) ? json_decode(file_get_contents($configJson), true) : [];
$enabled = $config['enabled_plugins'] ?? [];
return count($enabled);
}
function dirSize(string $dir): int
{
$size = 0;
if (!is_dir($dir)) return 0;
$iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dir));
foreach ($iterator as $file) {
if ($file->isFile()) {
$size += $file->getSize();
}
}
return $size;
}
function formatSize(int $bytes): string
{
$units = ['B', 'KB', 'MB', 'GB', 'TB'];
$i = 0;
while ($bytes >= 1024 && $i < count($units) - 1) {
$bytes /= 1024;
$i++;
}
return round($bytes, 2) . ' ' . $units[$i];
}
function scanContentDir(string $fullPath, string $subdir): array
{
$items = [];
if (!is_dir($fullPath)) return $items;
$files = scandir($fullPath);
foreach ($files as $file) {
if ($file === '.' || $file === '..' || str_starts_with($file, '.')) {
continue;
}
$path = $fullPath . '/' . $file;
$isDir = is_dir($path);
$items[] = [
'name' => $file,
'path' => $subdir ? $subdir . '/' . $file : $file,
'is_dir' => $isDir,
'extension' => $isDir ? '' : strtolower(pathinfo($file, PATHINFO_EXTENSION)),
'size' => $isDir ? '-' : formatSize(filesize($path)),
'modified' => date('Y-m-d H:i', filemtime($path)),
];
}
// Sort: directories first, then files, alphabetically
usort($items, function($a, $b) {
if ($a['is_dir'] && !$b['is_dir']) return -1;
if (!$a['is_dir'] && $b['is_dir']) return 1;
return strcasecmp($a['name'], $b['name']);
});
return $items;
}
/**
* Unified editor file-tree scanner (Fase 4 refactor).
* scanPluginFiles/scanThemeFiles/scanContentFiles below are thin wrappers
* around scanEditorFiles() for backwards compatibility with existing call sites.
*/
/**
* Scan a directory and return a nested file tree for the editor sidebar.
* Unified helper used by the plugin, theme and content editors (Fase 4 refactor).
*
* Scope:
* - 'plugin': no extra skips (dotfiles always skipped)
* - 'theme': skips `assets/css_compiled/` (runtime artefact, read-only)
* - 'content': no extra skips (.bak/.git are dotfiles, already skipped)
*
* Path-traversal protection: only direct scandir() of validated paths is used;
* the real base directory is the anchor and every resolved child path is
* checked to stay within it.
*
* @param string $dir Absolute path to the directory to scan
* @param string $scope One of: 'plugin', 'theme', 'content'
* @return array Nested list of nodes: [name, path, is_dir, extension, size, modified, children]
*/
function scanEditorFiles(string $dir, string $scope = 'plugin'): array
{
$realBase = realpath($dir);
if (!$realBase || !is_dir($realBase)) {
return [];
}
// Determine which relative paths to skip per scope
$skipPaths = [];
if ($scope === 'theme') {
$skipPaths['assets/css_compiled'] = true;
}
return scanEditorFilesNode($realBase, '', $realBase, $skipPaths);
}
/**
* Recursive helper for scanEditorFiles(). Builds one level of the tree.
*
* @param string $absDir Absolute path of the directory to scan
* @param string $relPath Relative path of $absDir within the base (empty for root)
* @param string $realBase The real base root (for path-traversal guard)
* @param array $skipPaths Map of relative paths to skip (e.g. ['assets/css_compiled' => true])
*/
function scanEditorFilesNode(string $absDir, string $relPath, string $realBase, array $skipPaths = []): array
{
$nodes = [];
if (!is_dir($absDir)) {
return $nodes;
}
$entries = scandir($absDir);
natcasesort($entries);
foreach ($entries as $entry) {
if ($entry === '.' || $entry === '..') {
continue;
}
// Skip hidden / dotfiles (incl. .gitkeep, .mtime, .bak, .git)
if ($entry !== '' && $entry[0] === '.') {
continue;
}
$childRelPath = $relPath === '' ? $entry : ($relPath . '/' . $entry);
// Skip scope-specific paths (e.g. theme css_compiled runtime artefact)
if (isset($skipPaths[$childRelPath])) {
continue;
}
$absChild = $absDir . '/' . $entry;
$realChild = realpath($absChild);
// Safety: every child must live inside the base dir
if ($realChild === false || strpos($realChild, $realBase) !== 0) {
continue;
}
$isDir = is_dir($realChild);
$node = [
'name' => $entry,
'path' => $childRelPath,
'is_dir' => $isDir,
'extension' => $isDir ? '' : strtolower(pathinfo($entry, PATHINFO_EXTENSION)),
'size' => $isDir ? '-' : formatSize(filesize($realChild)),
'modified' => date('Y-m-d H:i', filemtime($realChild)),
'children' => [],
];
if ($isDir) {
$node['children'] = scanEditorFilesNode($realChild, $childRelPath, $realBase, $skipPaths);
}
$nodes[] = $node;
}
// Sort: directories first, then files, alphabetically (case-insensitive)
usort($nodes, function ($a, $b) {
if ($a['is_dir'] && !$b['is_dir']) return -1;
if (!$a['is_dir'] && $b['is_dir']) return 1;
return strcasecmp($a['name'], $b['name']);
});
return $nodes;
}
/**
* Backwards-compatible wrappers (delegates to scanEditorFiles).
* Kept so existing call sites (handlePluginsEdit, handleThemeEdit, handleContentFiles)
* keep working unchanged during/after the Fase 4 refactor.
*/
function scanPluginFiles(string $pluginDir): array
{
return scanEditorFiles($pluginDir, 'plugin');
}
function scanThemeFiles(string $themeDir): array
{
return scanEditorFiles($themeDir, 'theme');
}
function scanContentFiles(string $contentDir): array
{
return scanEditorFiles($contentDir, 'content');
}
/**
* Language-prefixed files (nl./en.) are stripped of their prefix for the key.
* Directories are included if they contain content (represented by their path).
*
* @param string $contentDir Absolute path to the content directory
* @return array Sorted list of [pageKey => displayLabel]
*/
function collectContentPages(string $contentDir): array
{
$pages = [];
$realBase = realpath($contentDir);
if (!$realBase || !is_dir($realBase)) {
return $pages;
}
$iterator = new RecursiveIteratorIterator(
new RecursiveDirectoryIterator($realBase, RecursiveDirectoryIterator::SKIP_DOTS)
);
$langRegex = '/^(nl|en|de|fr)\./';
foreach ($iterator as $fileInfo) {
if (!$fileInfo->isFile()) {
continue;
}
$ext = strtolower($fileInfo->getExtension());
if (!in_array($ext, ['md', 'php', 'html'], true)) {
continue;
}
$relative = substr($fileInfo->getRealPath(), strlen($realBase) + 1);
$relative = str_replace('\\', '/', $relative);
// Skip hidden / dash-prefixed segments (private assets etc.)
$skip = false;
foreach (explode('/', $relative) as $segment) {
if ($segment !== '' && ($segment[0] === '.' || $segment[0] === '-')) {
$skip = true;
break;
}
}
if ($skip) {
continue;
}
// Strip extension
$key = preg_replace('/\.(md|php|html)$/i', '', $relative);
// Strip language prefix from the filename component
$dirPart = dirname($key);
$dirPart = ($dirPart === '.' || $dirPart === '') ? '' : $dirPart . '/';
$filePart = basename($key);
if (preg_match($langRegex, $filePart, $m)) {
$filePart = substr($filePart, strlen($m[1]) + 1);
}
$key = $dirPart . $filePart;
// folder/index -> folder
if (str_ends_with($key, '/index')) {
$key = substr($key, 0, -6);
}
if ($key === '') {
$key = 'index';
}
$label = ucfirst(str_replace(['-', '/'], [' ', ' / '], $key));
$pages[$key] = $label;
}
ksort($pages);
return $pages;
}
function updateContentFrontmatter(string $content, string $key, string $value): string
{
if (preg_match('/^---\s*\n(.+?)\n---\s*\n(.*)$/s', $content, $m)) {
$frontmatter = $m[1];
$body = $m[2];
$lines = explode("\n", $frontmatter);
$found = false;
foreach ($lines as $i => $line) {
if (str_starts_with($line, $key . ':')) {
$lines[$i] = $key . ': ' . $value;
$found = true;
break;
}
}
if (!$found) {
$lines[] = $key . ': ' . $value;
}
return "---\n" . implode("\n", $lines) . "\n---\n" . $body;
}
return "---\n" . $key . ': ' . $value . "\n---\n\n" . $content;
}
function extractFrontmatterValue(string $content, string $key): string
{
if (preg_match('/^---\s*\n(.+?)\n---/s', $content, $m)) {
$frontmatter = $m[1];
if (preg_match('/^' . preg_quote($key, '/') . ': (.+?)$/m', $frontmatter, $mm)) {
return trim($mm[1]);
}
}
return '';
}
function extractLanguagePrefix(string $file): string
{
$parts = explode('/', $file);
$filename = end($parts);
if (preg_match('/^(nl|en|de|fr|es)\./', $filename, $m)) {
return $m[1];
}
return 'nl';
}
function backupContentFile(string $filePath): void
{
$backupDir = dirname($filePath) . '/.bak';
if (!is_dir($backupDir)) {
@mkdir($backupDir, 0755, true);
}
$backupFile = $backupDir . '/' . basename($filePath) . '.' . date('YmdHis');
@copy($filePath, $backupFile);
}