David Dyer
9b7d9ceccb
- Add SQLite database initialization and management in inc/db.php - Implement session authentication and CSRF security helpers in inc/auth.php - Implement announcement querying and saving in inc/announcements.php - Add management dashboard, login, and logout in admin/ - Protect db/ directory with Apache access controls
83 lines
2.1 KiB
PHP
83 lines
2.1 KiB
PHP
<?php
|
|
/**
|
|
* Auth & session helper
|
|
*/
|
|
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
// Configure secure session cookie defaults
|
|
session_set_cookie_params([
|
|
'lifetime' => 86400 * 7, // 7 days
|
|
'path' => '/',
|
|
'httponly' => true,
|
|
'samesite' => 'Lax'
|
|
]);
|
|
session_start();
|
|
}
|
|
|
|
require_once __DIR__ . '/db.php';
|
|
|
|
function is_authenticated(): bool {
|
|
return !empty($_SESSION['admin_user_id']);
|
|
}
|
|
|
|
function require_auth(): void {
|
|
if (!is_authenticated()) {
|
|
header('Location: login.php');
|
|
exit;
|
|
}
|
|
}
|
|
|
|
function get_logged_in_user(): ?array {
|
|
if (!is_authenticated()) {
|
|
return null;
|
|
}
|
|
return [
|
|
'id' => $_SESSION['admin_user_id'],
|
|
'username' => $_SESSION['admin_username'] ?? 'admin',
|
|
'role' => $_SESSION['admin_role'] ?? 'admin'
|
|
];
|
|
}
|
|
|
|
function authenticate_user(string $username, string $password): bool {
|
|
$pdo = get_db();
|
|
$stmt = $pdo->prepare("SELECT * FROM users WHERE username = ?");
|
|
$stmt->execute([trim($username)]);
|
|
$user = $stmt->fetch();
|
|
|
|
if ($user && password_verify($password, $user['password_hash'])) {
|
|
session_regenerate_id(true);
|
|
$_SESSION['admin_user_id'] = $user['id'];
|
|
$_SESSION['admin_username'] = $user['username'];
|
|
$_SESSION['admin_role'] = $user['role'];
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
function logout_user(): void {
|
|
$_SESSION = [];
|
|
if (ini_get("session.use_cookies")) {
|
|
$params = session_get_cookie_params();
|
|
setcookie(session_name(), '', time() - 42000,
|
|
$params["path"], $params["domain"],
|
|
$params["secure"], $params["httponly"]
|
|
);
|
|
}
|
|
session_destroy();
|
|
}
|
|
|
|
function get_csrf_token(): string {
|
|
if (empty($_SESSION['csrf_token'])) {
|
|
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
|
|
}
|
|
return $_SESSION['csrf_token'];
|
|
}
|
|
|
|
function verify_csrf_token(?string $token): bool {
|
|
if (empty($_SESSION['csrf_token']) || empty($token)) {
|
|
return false;
|
|
}
|
|
return hash_equals($_SESSION['csrf_token'], $token);
|
|
}
|