mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-06 11:09:18 +02:00
8613f71112
- lib/AdminAuth.php: new class with requireLogin(), login(), logout(), isAuthenticated(); starts session with hardened cookie params (HttpOnly, SameSite=Strict, Secure, Path=/admin) — also resolves item #8 (session cookie hardening) - requireLogin() auto-authenticates from nginx Basic Auth credentials ($_SERVER['PHP_AUTH_PW']) so the user only sees one browser prompt; falls back to /admin/login.php if the proxy is absent/misconfigured - config/admin_credentials.php: gitignored credential store; define ADMIN_PASSWORD_HASH with a bcrypt hash to enable PHP auth - config/admin_credentials.example.php: template for the above - config/bootstrap.php: auto-loads admin_credentials.php if present - .gitignore: exclude config/admin_credentials.php - public/admin/login.php: fallback login form (shown only when nginx Basic Auth is bypassed / proxy absent) - public/admin/logout.php: session destruction + redirect to login - All 7 admin PHP files: replace session_start() with AdminAuth::requireLogin() (defence-in-depth behind nginx Basic Auth) - public/admin/inc/head.php: Déconnexion button when ADMIN_PASSWORD_HASH is defined - nginx/PHP_AUTH_LAYER.md: documents dual-auth architecture, UX flow, and setup instructions - docs/TODO.SECURITY.md: items #2 and #8 moved to Resolved; priority order updated (all CRITICAL done)
43 lines
1.2 KiB
PHP
43 lines
1.2 KiB
PHP
<?php
|
|
/**
|
|
* Simple configuration for website
|
|
*/
|
|
|
|
// Define application root
|
|
define('APP_ROOT', dirname(__DIR__));
|
|
|
|
// Storage directory for uploaded files — intentionally outside the webroot
|
|
// so no uploaded content is ever directly web-accessible (items #3 & #4).
|
|
// Files are served through public/media.php which validates paths and MIME types.
|
|
define('STORAGE_ROOT', '/var/www/posterg/storage');
|
|
|
|
// Error reporting
|
|
if (php_sapi_name() === 'cli-server') {
|
|
// Development mode
|
|
error_reporting(E_ALL);
|
|
ini_set('display_errors', '1');
|
|
} else {
|
|
// Production mode
|
|
error_reporting(E_ALL);
|
|
ini_set('display_errors', '0');
|
|
ini_set('log_errors', '1');
|
|
}
|
|
|
|
// Simple helper function for including templates
|
|
function include_template($name) {
|
|
$path = APP_ROOT . '/includes/' . $name;
|
|
if (file_exists($path)) {
|
|
include $path;
|
|
}
|
|
}
|
|
|
|
// Load admin credentials if available (defines ADMIN_PASSWORD_HASH for AdminAuth)
|
|
if (file_exists(APP_ROOT . '/config/admin_credentials.php')) {
|
|
require_once APP_ROOT . '/config/admin_credentials.php';
|
|
}
|
|
|
|
// Autoload Composer dependencies if available
|
|
if (file_exists(APP_ROOT . '/vendor/autoload.php')) {
|
|
require_once APP_ROOT . '/vendor/autoload.php';
|
|
}
|