David DyerandClaude Sonnet 5
cd4c6c1969
- Admin menu page: mobile item cards now put Actions in the top-right
corner next to Status, matching the desktop row layout instead of
stacking at the bottom; same treatment applied to announcements and
users for consistency across all three admin lists
- Center button label text everywhere via .btn { justify-content: center }
instead of one-off overrides
- Add a Disable/Enable Menu toggle to the admin menu toolbar; the public
menu page shows its existing "menu being updated" message while disabled
- Add an Enabled/Disabled status to user accounts, with its own toggle
badge, guardrails against disabling your own account or the last
enabled account, and an immediate session kick for anyone disabled
mid-session
- Fix the announcement banner / hero tagline "·" separators to hide only
when their neighboring text actually wraps onto a different line,
instead of a fixed breakpoint or always-on dot
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
96 lines
2.6 KiB
PHP
96 lines
2.6 KiB
PHP
<?php
|
|
/**
|
|
* Auth & session helper
|
|
*/
|
|
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
// Configure secure session cookie defaults
|
|
session_set_cookie_params([
|
|
'lifetime' => 86400 * 7, // 7 days
|
|
'path' => '/',
|
|
'httponly' => true,
|
|
'samesite' => 'Lax'
|
|
]);
|
|
session_start();
|
|
}
|
|
|
|
require_once __DIR__ . '/db.php';
|
|
|
|
function is_authenticated(): bool {
|
|
return !empty($_SESSION['admin_user_id']);
|
|
}
|
|
|
|
function require_auth(): void {
|
|
if (!is_authenticated()) {
|
|
header('Location: login.php');
|
|
exit;
|
|
}
|
|
|
|
// A user disabled mid-session should lose access immediately rather
|
|
// than keep it until their session expires — re-check against the DB
|
|
// instead of trusting the session's now-possibly-stale copy.
|
|
$pdo = get_db();
|
|
$stmt = $pdo->prepare("SELECT is_enabled FROM users WHERE id = ?");
|
|
$stmt->execute([$_SESSION['admin_user_id']]);
|
|
$stillEnabled = $stmt->fetchColumn();
|
|
if ($stillEnabled === false || (int) $stillEnabled !== 1) {
|
|
logout_user();
|
|
header('Location: login.php');
|
|
exit;
|
|
}
|
|
}
|
|
|
|
function get_logged_in_user(): ?array {
|
|
if (!is_authenticated()) {
|
|
return null;
|
|
}
|
|
return [
|
|
'id' => $_SESSION['admin_user_id'],
|
|
'username' => $_SESSION['admin_username'] ?? 'admin',
|
|
'role' => $_SESSION['admin_role'] ?? 'admin'
|
|
];
|
|
}
|
|
|
|
function authenticate_user(string $username, string $password): bool {
|
|
$pdo = get_db();
|
|
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
|
|
$stmt->execute([trim($username)]);
|
|
$user = $stmt->fetch();
|
|
|
|
if ($user && (int) $user['is_enabled'] === 1 && password_verify($password, $user['password_hash'])) {
|
|
session_regenerate_id(true);
|
|
$_SESSION['admin_user_id'] = $user['id'];
|
|
$_SESSION['admin_username'] = $user['username'];
|
|
$_SESSION['admin_role'] = $user['role'];
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
function logout_user(): void {
|
|
$_SESSION = [];
|
|
if (ini_get("session.use_cookies")) {
|
|
$params = session_get_cookie_params();
|
|
setcookie(session_name(), '', time() - 42000,
|
|
$params["path"], $params["domain"],
|
|
$params["secure"], $params["httponly"]
|
|
);
|
|
}
|
|
session_destroy();
|
|
}
|
|
|
|
function get_csrf_token(): string {
|
|
if (empty($_SESSION['csrf_token'])) {
|
|
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
|
|
}
|
|
return $_SESSION['csrf_token'];
|
|
}
|
|
|
|
function verify_csrf_token(?string $token): bool {
|
|
if (empty($_SESSION['csrf_token']) || empty($token)) {
|
|
return false;
|
|
}
|
|
return hash_equals($_SESSION['csrf_token'], $token);
|
|
}
|