includes/auth.php - master - TorX/rasp

includes/auth.php
90 строк2 KB
tormovies
Rewrite the app as plain PHP so it runs on shared hosting without Node.
06 авг 2026, 00:17
06 авг 2026, 00:17b4b9ea6
<?php
declare(strict_types=1);

require_once __DIR__ . '/db.php';
require_once __DIR__ . '/helpers.php';

function start_admin_session(): void
{
    if (session_status() === PHP_SESSION_ACTIVE) {
        return;
    }

    $name = (string) (app_config()['session_name'] ?? 'raspisanie_admin');
    if ($name === '' || !preg_match('/^[A-Za-z0-9_-]+$/', $name)) {
        $name = 'raspisanie_admin';
    }
    session_name($name);

    // Drop broken cookies (e.g. leftover from other stacks / wrong SID).
    if (isset($_COOKIE[$name])) {
        $sid = (string) $_COOKIE[$name];
        if ($sid === '' || strlen($sid) > 128 || !preg_match('/^[A-Za-z0-9,-]+$/', $sid)) {
            unset($_COOKIE[$name]);
            setcookie($name, '', [
                'expires' => time() - 42000,
                'path' => '/',
                'httponly' => true,
                'samesite' => 'Lax',
            ]);
        }
    }

    $savePath = dirname(__DIR__) . DIRECTORY_SEPARATOR . 'storage' . DIRECTORY_SEPARATOR . 'sessions';
    if (!is_dir($savePath)) {
        mkdir($savePath, 0775, true);
    }
    session_save_path($savePath);

    session_start([
        'cookie_lifetime' => 0,
        'cookie_path' => '/',
        'cookie_httponly' => true,
        'cookie_samesite' => 'Lax',
        'use_strict_mode' => true,
        'use_only_cookies' => true,
    ]);
}

function is_admin(): bool
{
    start_admin_session();
    return !empty($_SESSION['admin_ok']);
}

function require_admin(): void
{
    if (!is_admin()) {
        redirect('/admin/login.php');
    }
}

function attempt_login(string $password): bool
{
    start_admin_session();
    $expected = (string) (app_config()['admin_password'] ?? 'admin');
    if (!hash_equals($expected, $password)) {
        return false;
    }
    session_regenerate_id(true);
    $_SESSION['admin_ok'] = true;
    return true;
}

function logout_admin(): void
{
    start_admin_session();
    $_SESSION = [];
    if (ini_get('session.use_cookies')) {
        $p = session_get_cookie_params();
        setcookie(session_name(), '', [
            'expires' => time() - 42000,
            'path' => $p['path'] ?: '/',
            'domain' => $p['domain'] ?? '',
            'secure' => (bool) $p['secure'],
            'httponly' => (bool) $p['httponly'],
            'samesite' => 'Lax',
        ]);
    }
    session_destroy();
}