CodePress/public/index.php

<?php
 
require_once __DIR__ . '/../cms/core/index.php';

$config = include __DIR__ . '/../cms/core/config.php';

// Initialize dynamic logging
LogManager::init($config['logging'] ?? []);

// Security headers
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: SAMEORIGIN');
header('X-XSS-Protection: 1; mode=block');
header('Referrer-Policy: strict-origin-when-cross-origin');
header('Content-Security-Policy: default-src \'self\'; script-src \'self\' \'unsafe-inline\'; style-src \'self\' \'unsafe-inline\'; img-src \'self\' data:; font-src \'self\';');
header_remove('X-Powered-By');

// Serve media files from any content/ subdirectory via /-media/
// Serve files from content/-assets/ via /-assets/ (backward compatible)
$requestUri = $_SERVER['REQUEST_URI'] ?? '';
$parsedUrl = parse_url($requestUri);
$path = $parsedUrl['path'] ?? '';

$allowedExt = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'svg', 'pdf', 'zip', 'mp4', 'webm', 'ogg', 'mp3', 'wav'];
$mimeTypes = [
    'jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'png' => 'image/png',
    'gif' => 'image/gif', 'webp' => 'image/webp', 'svg' => 'image/svg+xml',
    'pdf' => 'application/pdf', 'zip' => 'application/zip',
    'mp4' => 'video/mp4', 'webm' => 'video/webm', 'ogg' => 'video/ogg',
    'mp3' => 'audio/mpeg', 'wav' => 'audio/wav',
    'css' => 'text/css', 'js' => 'application/javascript',
];

if (strpos($path, '/-media/') === 0) {
    $relative = ltrim(substr($path, 7), '/');
    $root = realpath(__DIR__ . '/..');
    $filePath = $root . '/content/' . $relative;
    if (strpos($filePath, $root . '/content') === 0) {
        $ext = strtolower(pathinfo($filePath, PATHINFO_EXTENSION));
        if (in_array($ext, $allowedExt) && file_exists($filePath) && !is_dir($filePath)) {
            if (isset($mimeTypes[$ext])) {
                header('Content-Type: ' . $mimeTypes[$ext]);
            }
            readfile($filePath);
            exit;
        }
    }
    http_response_code(404);
    echo '<h1>404 - Not Found</h1>';
    exit;
}

if (strpos($path, '/-assets/') === 0) {
    $relative = ltrim(substr($path, 8), '/');
    $root = realpath(__DIR__ . '/..');

    $servePath = null;
    $candidates = [
        $root . '/content/-assets/' . $relative,
        $root . '/content/' . $relative,
    ];

    foreach ($candidates as $candidate) {
        if (strpos($candidate, $root . '/content') !== 0) continue;
        if (file_exists($candidate) && !is_dir($candidate)) {
            $ext = strtolower(pathinfo($candidate, PATHINFO_EXTENSION));
            if (in_array($ext, $allowedExt)) {
                $servePath = $candidate;
                break;
            }
        }
    }

    if ($servePath !== null) {
        $ext = strtolower(pathinfo($servePath, PATHINFO_EXTENSION));
        if (isset($mimeTypes[$ext])) {
            header('Content-Type: ' . $mimeTypes[$ext]);
        }
        readfile($servePath);
        exit;
    }

    http_response_code(404);
    echo '<h1>404 - Not Found</h1>';
    exit;
}

// Serve dynamic robots.txt
if ($path === '/robots.txt') {
    header('Content-Type: text/plain; charset=utf-8');
    echo BotGuard::generateRobotsTxt($config['security'] ?? []);
    exit;
}

// Block direct access to content files
if (strpos($path, '/content/') === 0) {
    http_response_code(403);
    echo '<h1>403 - Forbidden</h1><p>Access denied.</p>';
    exit;
}

// Load RequestLogger for IP & request logging
require_once __DIR__ . '/../cms/core/class/RequestLogger.php';

// Execute security checks & rate limiting
$clientIp = RequestLogger::getClientIp();
$secSettings = $config['security'] ?? [
    'block_ai_bots' => true,
    'block_scrapers' => true,
    'block_search_engines' => false,
    'block_empty_user_agent' => true,
    'rate_limit_enabled' => true,
    'rate_limit_max' => 60,
    'rate_limit_window' => 60,
];

$userAgent = $_SERVER['HTTP_USER_AGENT'] ?? '';
$analyticsSettings = $config['analytics'] ?? [];
$excludedIps = $analyticsSettings['excluded_ips'] ?? [];
$isAllowedIp = RequestLogger::ipMatchesList($clientIp, $secSettings['allowed_ips'] ?? [])
            || RequestLogger::ipMatchesList($clientIp, $excludedIps);
$requestStatus = 'ok';

if (!$isAllowedIp) {
    // 1. IP Blocklist
    if (in_array($clientIp, $secSettings['blocked_ips'] ?? [], true)) {
        $requestStatus = 'blocked:ip';
    }

    // 2. BotGuard User-Agent check
    if ($requestStatus === 'ok') {
        $botBlockReason = BotGuard::shouldBlock($userAgent, $secSettings);
        if ($botBlockReason !== null) {
            $requestStatus = $botBlockReason;
        }
    }

    // 3. Rate Limiting per IP
    if ($requestStatus === 'ok' && !empty($secSettings['rate_limit_enabled'])) {
        $cacheDir = dirname(__DIR__) . '/admin/storage/cache';
        $rateLimiter = new RateLimiter(
            (int)($secSettings['rate_limit_max'] ?? 60),
            (int)($secSettings['rate_limit_window'] ?? 60),
            new FileCache($cacheDir)
        );
        if (!$rateLimiter->isAllowed($clientIp)) {
            $requestStatus = 'blocked:ratelimit';
        }
    }
}

// Instantiate CMS instance
$cms = new CodePressCMS($config);

// Analytics & GeoIP settings
$analyticsSettings = $config['analytics'] ?? [];
$geoCountry = null;
if (!empty($analyticsSettings['enabled'])) {
    $geoIp = new GeoIP($analyticsSettings);
    $geoCountry = $geoIp->lookupCountry($clientIp);
}

// Apply IP anonymization for storage if enabled
$storedIp = !empty($analyticsSettings['anonymize_ip'])
    ? RequestLogger::anonymizeIp($clientIp)
    : $clientIp;

// Log page view (not for media/assets)
if (!str_starts_with($path, '/-media/') && !str_starts_with($path, '/-assets/')) {
    if (session_status() === PHP_SESSION_NONE) {
        @session_start();
    }
    $loggedInUser = $_SESSION['admin_user'] ?? 'Gast';
    $currentPage = $_GET['page'] ?? $cms->getEffectiveDefaultPage();
    $referrer = $_SERVER['HTTP_REFERER'] ?? '';

    $requestLogFile = dirname(__DIR__) . '/admin/storage/logs/requests.log';
    $logger = new RequestLogger($requestLogFile);
    $logger->log(
        $currentPage,
        $storedIp,
        $userAgent,
        $referrer,
        $loggedInUser,
        $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? '',
        $requestStatus,
        $geoCountry
    );

    // Also record through the dynamic log manager (requests event)
    LogManager::log(LogManager::EVENT_REQUESTS, 'info', 'Request: ' . $currentPage, [
        'ip' => $storedIp,
        'page' => $currentPage,
        'status' => $requestStatus,
        'country' => $geoCountry,
        'user' => $loggedInUser,
    ]);

    // Record aggregated statistics
    if (!empty($analyticsSettings['enabled']) && !in_array($clientIp, $excludedIps, true)) {
        $analytics = new Analytics($analyticsSettings);
        $analytics->record($currentPage, $storedIp, $userAgent, $referrer, $geoCountry, $requestStatus);
    }
}

// Block request if status is not ok
if ($requestStatus !== 'ok') {
    if ($requestStatus === 'blocked:ratelimit') {
        http_response_code(429);
        header('Retry-After: ' . (int)($secSettings['rate_limit_window'] ?? 60));
        echo '<!DOCTYPE html><html lang="nl"><head><meta charset="UTF-8"><title>429 Te Veel Verzoeken</title><meta name="robots" content="noindex,nofollow"></head><body><h1>429 Te Veel Verzoeken</h1><p>Probeer het over een minuut opnieuw.</p></body></html>';
    } else {
        http_response_code(403);
        echo '<!DOCTYPE html><html lang="nl"><head><meta charset="UTF-8"><title>403 Toegang Geweigerd</title><meta name="robots" content="noindex,nofollow"></head><body><h1>403 Toegang Geweigerd</h1><p>Toegang geweigerd.</p></body></html>';
    }
    exit;
}

$cms->render();