David Dyer
c7b836bcf2
- Created `admin-head.php` for consistent <head> markup across admin pages. - Created `admin-nav.php` for shared navigation bar, reducing duplication. - Updated all admin pages (account, hours, index, login, menu, users) to utilize the new components. - Added security headers to `auth.php` and `index.php` for improved security. - Introduced `security-headers.php` to manage security headers across the application. - Moved inline styles from admin pages to SCSS files to comply with Content Security Policy (CSP). - Normalized file permissions during build process to prevent permission issues on deployment.
47 lines
1.6 KiB
PHP
47 lines
1.6 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
/**
|
|
* Shared admin navigation bar. Every admin page calls
|
|
* render_admin_nav($user, '<key>') where it used to repeat the markup.
|
|
*
|
|
* $active is one of the ADMIN_NAV_LINKS keys, or 'account' for the
|
|
* My Account page (which highlights the username link instead).
|
|
*/
|
|
|
|
const ADMIN_NAV_LINKS = [
|
|
// key => [href, label, admin-only]
|
|
'announcements' => ['index.php', 'Announcements', false],
|
|
'menu' => ['menu.php', 'Menu', false],
|
|
'users' => ['users.php', 'Users', true],
|
|
'hours' => ['hours.php', 'Hours', false],
|
|
];
|
|
|
|
function render_admin_nav(array $user, string $active): void {
|
|
$isAdmin = ($user['role'] ?? '') === 'admin';
|
|
$current = static fn (string $key): string =>
|
|
$key === $active ? ' class="active" aria-current="page"' : '';
|
|
?>
|
|
<nav class="admin-nav">
|
|
<div class="container admin-nav-inner">
|
|
<a href="index.php" class="admin-brand">
|
|
<img src="../assets/knot.png" alt="" class="knot">
|
|
<span>The Old Fitz Admin</span>
|
|
</a>
|
|
<div class="admin-nav-links">
|
|
<?php foreach (ADMIN_NAV_LINKS as $key => [$href, $label, $adminOnly]): ?>
|
|
<?php if (!$adminOnly || $isAdmin): ?>
|
|
<a href="<?= $href ?>"<?= $current($key) ?>><?= $label ?></a>
|
|
<?php endif; ?>
|
|
<?php endforeach; ?>
|
|
</div>
|
|
<div class="admin-user">
|
|
<a href="../" target="_blank" rel="noopener">View Public Site ↗</a>
|
|
<a href="account.php" class="admin-account-link<?= $active === 'account' ? ' active' : '' ?>" title="My Account"<?= $active === 'account' ? ' aria-current="page"' : '' ?>><?= htmlspecialchars($user['username']) ?></a>
|
|
<a href="logout.php">Sign Out</a>
|
|
</div>
|
|
</div>
|
|
</nav>
|
|
<?php
|
|
}
|