mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-06 19:19:19 +02:00
8613f71112
- lib/AdminAuth.php: new class with requireLogin(), login(), logout(), isAuthenticated(); starts session with hardened cookie params (HttpOnly, SameSite=Strict, Secure, Path=/admin) — also resolves item #8 (session cookie hardening) - requireLogin() auto-authenticates from nginx Basic Auth credentials ($_SERVER['PHP_AUTH_PW']) so the user only sees one browser prompt; falls back to /admin/login.php if the proxy is absent/misconfigured - config/admin_credentials.php: gitignored credential store; define ADMIN_PASSWORD_HASH with a bcrypt hash to enable PHP auth - config/admin_credentials.example.php: template for the above - config/bootstrap.php: auto-loads admin_credentials.php if present - .gitignore: exclude config/admin_credentials.php - public/admin/login.php: fallback login form (shown only when nginx Basic Auth is bypassed / proxy absent) - public/admin/logout.php: session destruction + redirect to login - All 7 admin PHP files: replace session_start() with AdminAuth::requireLogin() (defence-in-depth behind nginx Basic Auth) - public/admin/inc/head.php: Déconnexion button when ADMIN_PASSWORD_HASH is defined - nginx/PHP_AUTH_LAYER.md: documents dual-auth architecture, UX flow, and setup instructions - docs/TODO.SECURITY.md: items #2 and #8 moved to Resolved; priority order updated (all CRITICAL done)
146 lines
4.3 KiB
Markdown
146 lines
4.3 KiB
Markdown
# Admin Panel Structure
|
|
|
|
This directory contains the admin panel for managing Post-ERG thesis database.
|
|
|
|
## Directory Structure
|
|
|
|
```
|
|
public/admin/
|
|
├── index.php # List all theses (main page)
|
|
├── add.php # Add new thesis form
|
|
├── edit.php # Edit existing thesis form
|
|
├── import.php # CSV import form
|
|
├── thanks.php # Thank you page after submission
|
|
├── actions/ # Backend processing scripts (no HTML output)
|
|
│ ├── formulaire.php # Process thesis submission from add.php
|
|
│ └── publish.php # Toggle publish/unpublish status
|
|
├── inc/ # Shared templates
|
|
│ ├── head.php # HTML head, CSS, navigation
|
|
│ └── footer.php # HTML footer
|
|
└── data/ # Upload directory (not in git)
|
|
├── theses/ # PDF files
|
|
└── covers/ # Cover images
|
|
```
|
|
|
|
## File Types
|
|
|
|
### User-Facing Templates (Root Directory)
|
|
Files that display HTML to users:
|
|
- **index.php** - Lists all theses with filters and bulk actions
|
|
- **add.php** - Form to add a new thesis
|
|
- **edit.php** - Form to edit an existing thesis
|
|
- **import.php** - CSV import interface
|
|
- **thanks.php** - Success confirmation page
|
|
|
|
### Backend Scripts (actions/)
|
|
Files that process forms and redirect (no HTML output):
|
|
- **formulaire.php** - Processes thesis submission from add.php
|
|
- **publish.php** - Handles publish/unpublish actions
|
|
|
|
### Shared Templates (inc/)
|
|
Reusable HTML components:
|
|
- **head.php** - HTML head, CSS links, navigation menu
|
|
- **footer.php** - HTML footer
|
|
|
|
## Workflow
|
|
|
|
### Adding a Thesis
|
|
1. User visits `add.php` (displays form)
|
|
2. User submits form to `actions/formulaire.php` (processes data)
|
|
3. On success, redirects to `thanks.php?id=123`
|
|
4. On error, redirects back to `add.php` with error message
|
|
|
|
### Publishing/Unpublishing
|
|
1. User clicks publish/unpublish button in `index.php`
|
|
2. Form submits to `actions/publish.php` (processes action)
|
|
3. Redirects back to `index.php` with success/error message
|
|
|
|
## Security
|
|
|
|
- All pages require HTTP Basic Auth (configured in nginx) — primary layer
|
|
- All pages require PHP session auth (`AdminAuth::requireLogin()`) — defence-in-depth
|
|
- CSRF tokens protect all forms
|
|
- File uploads validated and sanitized
|
|
- Database queries use prepared statements
|
|
- Upload directory outside public/ in production
|
|
|
|
See `nginx/PHP_AUTH_LAYER.md` for details on the dual-auth architecture.
|
|
|
|
## Templates
|
|
|
|
The `inc/` folder contains shared templates:
|
|
- `head.php` - Included at the top of each page (DOCTYPE, CSS, nav)
|
|
- `footer.php` - Included at the bottom of each page (closing tags)
|
|
|
|
Usage:
|
|
```php
|
|
<?php include "inc/head.php" ?>
|
|
<!-- Page content here -->
|
|
<?php include "inc/footer.php" ?>
|
|
```
|
|
|
|
## URL Structure
|
|
|
|
- `/admin/` - List theses (index.php)
|
|
- `/admin/add.php` - Add new thesis
|
|
- `/admin/edit.php?id=123` - Edit thesis #123
|
|
- `/admin/import.php` - Import CSV
|
|
- `/admin/thanks.php?id=123` - Thank you page
|
|
|
|
Backend actions (not directly accessed):
|
|
- `/admin/actions/formulaire.php` - Form processor
|
|
- `/admin/actions/publish.php` - Publish toggle
|
|
|
|
## Development
|
|
|
|
### Adding a New Page
|
|
|
|
1. Create the template in `/admin/yourpage.php`:
|
|
```php
|
|
<?php
|
|
require_once __DIR__ . "/../../config/bootstrap.php";
|
|
require_once __DIR__ . '/../../lib/AdminAuth.php';
|
|
AdminAuth::requireLogin();
|
|
$pageTitle = "Your Page Title";
|
|
?>
|
|
<?php include "inc/head.php" ?>
|
|
|
|
<!-- Your content here -->
|
|
|
|
<?php include "inc/footer.php" ?>
|
|
```
|
|
|
|
2. Add navigation link in `inc/head.php` if needed
|
|
|
|
### Adding a New Action
|
|
|
|
1. Create the script in `/admin/actions/youraction.php`:
|
|
```php
|
|
<?php
|
|
require_once __DIR__ . "/../../config/bootstrap.php";
|
|
require_once __DIR__ . '/../../lib/AdminAuth.php';
|
|
AdminAuth::requireLogin();
|
|
|
|
// Verify CSRF token
|
|
if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
|
|
$_SESSION['error'] = "Security error";
|
|
header('Location: ../index.php');
|
|
exit;
|
|
}
|
|
|
|
// Process action...
|
|
|
|
// Redirect
|
|
header('Location: ../yourpage.php');
|
|
exit;
|
|
```
|
|
|
|
2. Create form in template that posts to `actions/youraction.php`
|
|
|
|
## Notes
|
|
|
|
- Bootstrap path from actions/: `__DIR__ . "/../../config/bootstrap.php"`
|
|
- Redirects from actions/: use `../` prefix (e.g., `../index.php`)
|
|
- Database class: `require_once __DIR__ . '/../../lib/Database.php'`
|
|
- All forms must include CSRF token from `$_SESSION['csrf_token']`
|