E.Noorlander
3a55ea4db6
- Reorganize admin into admin/theme/default/ (views + assets) - Rename GuideNav to Navigation plugin (essential, protected) - Plugin assets support (SCSS/CSS) loaded after theme CSS - User roles: Admin, Content Manager, BI Manager, Site Admin - Role-based access control (RBAC) for admin routes and sidebar - Guide restructure: sub-topics in separate folders with sidebar nav - Dynamic breadcrumb for homepage and subdirectories - Fix theme path traversal (../../ -> ../) in admin.php - Fix CodeMirror mode load order (xml -> css -> js -> htmlmixed -> php) - Fix editor-toolbar.js null checks for plugin edit pages - Layout select from theme.json with live frontmatter update - Footer sticky at bottom of viewport (min-height: 100vh) - Breadcrumb color fix (var(--nav-font) -> var(--header-bg)) - Remove language switcher from guide pages - Update README.md and README.en.md - Bump version to 2.5.1
561 B
561 B
Beveiliging
XSS preventie
// Altijd escapen
echo htmlspecialchars($userInput, ENT_QUOTES, 'UTF-8');
// In Twig (automatisch)
{{ userVariable }}
CSRF tokens
// Genereren
$csrf = $auth->getCsrfToken();
// Verifiëren
if (!$auth->verifyCsrf($_POST['csrf_token'])) {
die('Ongeldige CSRF token');
}
Path traversal preventie
// Gebruik realpath() en check prefix
$realPath = realpath($filePath);
$realContentDir = realpath($contentDir);
if (strpos($realPath, $realContentDir) !== 0) {
die('Ongeldig pad');
}