Security-, Bugfix- und UX-Überarbeitung auf Basis des Code-Reviews
Sicherheit: - Bulk-Erstellung serverseitig auf eingeloggte Nutzer beschränkt; expire_minutes wird validiert (anonym: nur Default/Template-Werte, eingeloggt: max. 1 Jahr) - IP-basiertes Rate-Limit über neue Tabelle request_throttle (Voucher-Erstellung + Passwort-Reset-Anfragen), Session-Fallback für Alt-Installationen; Migration 0002 - session_regenerate_id() nach Login, Secure-Cookie-Flag bei HTTPS - Admin-/Aktiv-Status wird pro Request live aus der DB geprüft (Rechteentzug & Deaktivierung wirken sofort); Schutz vor Selbst-Degradierung im Benutzer-Edit - Alle state-ändernden Admin-Aktionen von GET auf POST umgestellt (kein CSRF-Token mehr in URLs) - login_simple.php (Legacy, Debug-Leak) entfernt; cron_test.php nur noch für Admins; .htaccess auf Apache-2.4-Syntax inkl. cron_test.php - M365 Client Secret wird nicht mehr ins Formular zurückgegeben - Updater: Zip-Slip-/Pfad-Traversal-Schutz, Backup vor dem Anwenden mit automatischem Rollback bei Fehlern, AuditLogger-Bug behoben - cron_sync: Token-Vergleich mit hash_equals; login_attempts-Pruning - CSV-Export gegen Excel-Formula-Injection abgesichert Bugfixes: - M365-Login: Fallback auf userPrincipalName, wenn Graph kein 'mail' liefert (Nutzer ohne Exchange-Postfach konnten sich nie anmelden) - PRG-Pattern überall: F5 erzeugt keine Duplikat-Voucher und wiederholt keine Admin-Aktionen (Session-Flash-Messages) - QR-Code nicht mehr invertiert (schwarz auf weiß, scanbar) - Bulk-Erstellung nutzt den UniFi 'n'-Parameter: 1 API-Call statt n× Login + Voucherlisten-Abruf; exaktes Code-Matching per create_time statt "global neuester Voucher" - Mailer: doppelte Zeilenumbrüche behoben, AUTH nur mit Credentials, SMTP-Dot-Stuffing, CLI-sicherer EHLO-Host - forgot_password: System-URL-Auto-Detect (Reset-Link war sonst relativ/kaputt) + Rate-Limit - Audit-Log-Labels an tatsächliche Action-Keys angepasst; Voucher-Erstellung (einzeln & bulk) wird jetzt auditiert - Site-Edit testet die Verbindung auch ohne Passwortänderung UX/UI: - Alert-/Badge-Styles zentral in global.css mit Dark-Mode-Variablen (vorher 7× dupliziert mit hart codierten Hellfarben) - Sticky-Formulare + Tab-Erhalt nach Validierungsfehlern (Bulk), Settings kehren nach dem Speichern zum aktiven Tab zurück - Gültigkeit menschenlesbar (z.B. "8 Stunden" statt "480 Minuten") - Voucher-Name-Default "Gast/Guest" im öffentlichen Modus - Favicon auch auf Login-/öffentlichen Seiten - Verbindungstest-Button pro Site-Karte (Health-Check) - i18n-Pass: Confirm-Dialoge, Toasts, Fehl-/Erfolgsmeldungen in de/en - Sprachumschalter ohne fetch+reload (kein Re-Submit-Dialog) - A11y: Esc schließt Modals, aria-live für Toasts, aria-labels auf Icon-Buttons; APP_KEY-Warnbanner im Dashboard - Dashboard-Sync: set_time_limit passend zur Site-Anzahl; Voucher-Sync mit Map statt SELECT pro Voucher Tooling: - GitHub-Actions-Workflow: PHP-Lint aller Dateien + de/en-Key-Parität https://claude.ai/code/session_01KKVpVPJjrTKGoRgpJcySD4
This commit is contained in:
Claude
parent
f747a3d429
commit
6e19958a37
31 changed files with 1040 additions and 628 deletions
|
|
@ -45,22 +45,23 @@ $users = $db->fetchAll("SELECT id, name FROM users WHERE is_active = 1 ORDER BY
|
|||
$currentPage = 'audit_log';
|
||||
$adminBase = '';
|
||||
|
||||
// WICHTIG: Die Keys muessen den tatsaechlich via writeAuditLog() geschriebenen
|
||||
// Action-Namen entsprechen (user_create, site_edit, ...), sonst erscheinen
|
||||
// die Eintraege als rohe Keys.
|
||||
$actionLabels = [
|
||||
'voucher_created' => '🎫 Voucher erstellt',
|
||||
'voucher_create' => '🎫 Voucher erstellt',
|
||||
'voucher_bulk' => '🎫 Bulk Voucher',
|
||||
'user_login' => '🔐 Login',
|
||||
'user_logout' => '🚪 Logout',
|
||||
'user_created' => '👤 Benutzer erstellt',
|
||||
'user_updated' => '👤 Benutzer geändert',
|
||||
'user_deleted' => '👤 Benutzer gelöscht',
|
||||
'site_added' => '🌐 Site hinzugefügt',
|
||||
'site_updated' => '🌐 Site geändert',
|
||||
'site_deleted' => '🌐 Site gelöscht',
|
||||
'settings_saved' => '⚙️ Einstellungen gespeichert',
|
||||
'user_create' => '👤 Benutzer erstellt',
|
||||
'user_edit' => '👤 Benutzer geändert',
|
||||
'user_delete' => '👤 Benutzer gelöscht',
|
||||
'site_create' => '🌐 Site hinzugefügt',
|
||||
'site_edit' => '🌐 Site geändert',
|
||||
'site_delete' => '🌐 Site gelöscht',
|
||||
'password_reset' => '🔑 Passwort-Reset',
|
||||
'template_created' => '📋 Profil erstellt',
|
||||
'template_updated' => '📋 Profil geändert',
|
||||
'template_deleted' => '📋 Profil gelöscht',
|
||||
'update_installed' => '🔄 Update installiert',
|
||||
'update_failed' => '🔄 Update fehlgeschlagen',
|
||||
'migrations_run' => '🗄️ Migrationen ausgeführt',
|
||||
];
|
||||
?>
|
||||
<!DOCTYPE html>
|
||||
|
|
@ -81,7 +82,6 @@ $actionLabels = [
|
|||
.table td { padding: 12px 15px; border-bottom: 1px solid var(--border-color); font-size: 13px; color: var(--text-primary); }
|
||||
.table tr:last-child td { border-bottom: none; }
|
||||
.table tr:hover td { background: var(--bg-hover); }
|
||||
.badge { display: inline-block; padding: 3px 9px; border-radius: 5px; font-size: 11px; font-weight: 500; }
|
||||
.filter-bar { display: flex; gap: 12px; flex-wrap: wrap; align-items: flex-end; }
|
||||
.filter-bar select { padding: 9px 12px; border: 2px solid var(--border-color); border-radius: 8px; font-size: 13px; background: var(--bg-input); color: var(--text-primary); }
|
||||
.filter-bar select:focus { outline: none; border-color: var(--accent); }
|
||||
|
|
|
|||
|
|
@ -26,6 +26,9 @@ if (isset($_GET['ajax_stats'])) {
|
|||
$syncErrors = [];
|
||||
|
||||
if ($syncFirst) {
|
||||
// Mehrere Sites werden sequentiell synchronisiert (je bis zu ~15s
|
||||
// bei Timeout) – PHP-Default von 30s reicht dann nicht.
|
||||
@set_time_limit(30 + count($sites) * 20);
|
||||
foreach ($sites as $site) {
|
||||
try {
|
||||
$ctrl = new UniFiController($site['unifi_controller_url'], $site['unifi_username'], Crypto::decrypt($site['unifi_password']), $site['site_id']);
|
||||
|
|
@ -122,11 +125,6 @@ $currentPage = 'dashboard';
|
|||
.table th { text-align: left; padding: 11px 14px; background: var(--bg-table-head); color: var(--text-muted); font-weight: 600; font-size: 12px; text-transform: uppercase; letter-spacing: .5px; }
|
||||
.table td { padding: 13px 14px; border-bottom: 1px solid var(--border-color); color: var(--text-primary); font-size: 14px; }
|
||||
.table tr:last-child td { border-bottom: none; }
|
||||
.badge { display: inline-block; padding: 3px 9px; border-radius: 5px; font-size: 11px; font-weight: 500; }
|
||||
.badge-success { background: #d4edda; color: #155724; }
|
||||
.badge-warning { background: #fff3cd; color: #856404; }
|
||||
.badge-danger { background: #f8d7da; color: #721c24; }
|
||||
.badge-info { background: var(--bg-badge-info); color: var(--text-badge-info); }
|
||||
.btn-primary { background: var(--accent); color: white; }
|
||||
.btn-primary:hover { background: var(--accent-hover); }
|
||||
.btn-success { background: var(--success); color: white; }
|
||||
|
|
@ -161,6 +159,13 @@ $currentPage = 'dashboard';
|
|||
@media(max-width:768px){ .main-content{ margin-left:0!important; } .stats-grid{ grid-template-columns:1fr 1fr; } }
|
||||
</style>
|
||||
|
||||
<?php if (!Crypto::hasKey()): ?>
|
||||
<div class="alert alert-error">
|
||||
<i class="fas fa-exclamation-triangle"></i>
|
||||
<span><?= __('crypto_warning') ?></span>
|
||||
</div>
|
||||
<?php endif; ?>
|
||||
|
||||
<div class="page-header">
|
||||
<div>
|
||||
<h1 class="page-title"><?= __('dashboard_title') ?></h1>
|
||||
|
|
|
|||
|
|
@ -8,6 +8,7 @@ require_once __DIR__ . '/../includes/Database.php';
|
|||
require_once __DIR__ . '/../includes/Auth.php';
|
||||
require_once __DIR__ . '/../includes/Mailer.php';
|
||||
require_once __DIR__ . '/../includes/I18n.php';
|
||||
require_once __DIR__ . '/../includes/Helpers.php';
|
||||
|
||||
$auth = new Auth();
|
||||
$auth->requireAdmin();
|
||||
|
|
@ -72,7 +73,11 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['save_settings'])) {
|
|||
|
||||
if ($formType === 'm365') {
|
||||
$settings['m365_client_id'] = trim($_POST['m365_client_id'] ?? '');
|
||||
$settings['m365_client_secret'] = trim($_POST['m365_client_secret'] ?? '');
|
||||
// Secret nur aktualisieren, wenn eines eingegeben wurde – es wird
|
||||
// (wie das SMTP-Passwort) nicht mehr ins Formular zurueckgegeben.
|
||||
if (!empty($_POST['m365_client_secret'])) {
|
||||
$settings['m365_client_secret'] = trim($_POST['m365_client_secret']);
|
||||
}
|
||||
$settings['m365_tenant_id'] = trim($_POST['m365_tenant_id'] ?? '');
|
||||
}
|
||||
|
||||
|
|
@ -106,7 +111,15 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['save_settings'])) {
|
|||
$db->setSetting($key, $value);
|
||||
}
|
||||
|
||||
$success = __('settings_saved');
|
||||
// PRG + Tab-Anker: F5 speichert nicht erneut, und der Nutzer landet
|
||||
// wieder auf dem Tab, in dem er gespeichert hat.
|
||||
$tabAnchors = [
|
||||
'general' => 'general', 'defaults' => 'defaults', 'm365' => 'm365',
|
||||
'smtp' => 'smtp', 'templates' => 'templates_email', 'system' => 'system',
|
||||
];
|
||||
flashSet(__('settings_saved'));
|
||||
header('Location: settings.php#' . ($tabAnchors[$formType] ?? 'general'));
|
||||
exit;
|
||||
} catch (Exception $e) {
|
||||
$error = 'Fehler: ' . $e->getMessage();
|
||||
}
|
||||
|
|
@ -119,7 +132,9 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['generate_cron_token']
|
|||
$error = __('error_csrf');
|
||||
} else {
|
||||
$db->setSetting('cron_token', bin2hex(random_bytes(32)));
|
||||
$success = 'Neuer Cron-Token wurde generiert!';
|
||||
flashSet(__('cron_token_generated'));
|
||||
header('Location: settings.php#cron');
|
||||
exit;
|
||||
}
|
||||
}
|
||||
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['delete_cron_token'])) {
|
||||
|
|
@ -127,7 +142,9 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['delete_cron_token']))
|
|||
$error = __('error_csrf');
|
||||
} else {
|
||||
$db->setSetting('cron_token', '');
|
||||
$success = 'Cron-Token wurde gelöscht!';
|
||||
flashSet(__('cron_token_deleted'));
|
||||
header('Location: settings.php#cron');
|
||||
exit;
|
||||
}
|
||||
}
|
||||
|
||||
|
|
@ -139,23 +156,29 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['change_password'])) {
|
|||
try {
|
||||
$user = $auth->getCurrentUser();
|
||||
if (!password_verify($_POST['current_password'], $user['password_hash'])) {
|
||||
throw new Exception('Aktuelles Passwort ist falsch');
|
||||
throw new Exception(__('error_pw_current'));
|
||||
}
|
||||
if (strlen($_POST['new_password']) < 8) {
|
||||
throw new Exception(__('settings_pw_minlength'));
|
||||
}
|
||||
if ($_POST['new_password'] !== $_POST['confirm_password']) {
|
||||
throw new Exception('Passwörter stimmen nicht überein');
|
||||
throw new Exception(__('error_pw_mismatch'));
|
||||
}
|
||||
$db->query("UPDATE users SET password_hash = ? WHERE id = ?",
|
||||
[password_hash($_POST['new_password'], PASSWORD_DEFAULT), $user['id']]);
|
||||
$success = __('settings_pw_changed');
|
||||
flashSet(__('settings_pw_changed'));
|
||||
header('Location: settings.php#password');
|
||||
exit;
|
||||
} catch (Exception $e) {
|
||||
$error = $e->getMessage();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if (empty($success) && empty($error) && ($flash = flashGet())) {
|
||||
$success = $flash['message'];
|
||||
}
|
||||
|
||||
$protocol = isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? 'https' : 'http';
|
||||
$host = $_SERVER['HTTP_HOST'];
|
||||
$scriptPath = dirname($_SERVER['SCRIPT_NAME'], 2);
|
||||
|
|
@ -215,9 +238,6 @@ $adminBase = '';
|
|||
<style>
|
||||
.page-header { margin-bottom: 30px; }
|
||||
.page-title { font-size: 28px; font-weight: 600; color: var(--text-primary); margin-bottom: 8px; }
|
||||
.alert { padding: 14px 20px; border-radius: 10px; margin-bottom: 25px; font-size: 14px; display: flex; align-items: center; gap: 10px; }
|
||||
.alert-error { background: #fee; border: 1px solid #fcc; color: #c33; }
|
||||
.alert-success { background: #efe; border: 1px solid #cfc; color: #3c3; }
|
||||
.tab-container { background: var(--bg-card); border-radius: 15px; box-shadow: 0 2px 10px var(--shadow); border: 1px solid var(--border-color); overflow: hidden; }
|
||||
.tab-navigation { display: flex; background: var(--bg-table-head); border-bottom: 2px solid var(--border-color); overflow-x: auto; position: sticky; top: 70px; z-index: 50; }
|
||||
.tab-button { padding: 15px 20px; background: transparent; border: none; border-bottom: 3px solid transparent; cursor: pointer; font-size: 13px; font-weight: 500; color: var(--text-secondary); transition: all 0.3s; white-space: nowrap; display: flex; align-items: center; gap: 7px; }
|
||||
|
|
@ -350,7 +370,7 @@ $adminBase = '';
|
|||
<div style="display: flex; gap: 10px; flex-wrap: wrap; margin-bottom: 20px;">
|
||||
<button onclick="copyToClipboard('<?= htmlspecialchars($cs['cron_token']) ?>')" class="btn btn-secondary"><i class="fas fa-copy"></i> Kopieren</button>
|
||||
<form method="post" style="display:inline;"><input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>"><button type="submit" name="generate_cron_token" class="btn btn-secondary"><i class="fas fa-sync"></i> Neu generieren</button></form>
|
||||
<form method="post" style="display:inline;" onsubmit="return confirm('Token wirklich löschen?');"><input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>"><button type="submit" name="delete_cron_token" class="btn btn-secondary" style="color: var(--danger);"><i class="fas fa-trash"></i> Löschen</button></form>
|
||||
<form method="post" style="display:inline;" onsubmit="return confirm('<?= addslashes(__('confirm_delete_token')) ?>');"><input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>"><button type="submit" name="delete_cron_token" class="btn btn-secondary" style="color: var(--danger);"><i class="fas fa-trash"></i> Löschen</button></form>
|
||||
</div>
|
||||
<?php endif; ?>
|
||||
<?php
|
||||
|
|
@ -389,7 +409,7 @@ $adminBase = '';
|
|||
<input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>">
|
||||
<input type="hidden" name="form_type" value="m365">
|
||||
<div class="form-group"><label>Client ID</label><input type="text" name="m365_client_id" value="<?= htmlspecialchars($cs['m365_client_id']) ?>"></div>
|
||||
<div class="form-group"><label>Client Secret</label><input type="password" name="m365_client_secret" value="<?= htmlspecialchars($cs['m365_client_secret']) ?>"></div>
|
||||
<div class="form-group"><label>Client Secret</label><input type="password" name="m365_client_secret" placeholder="<?= $cs['m365_client_secret'] !== '' ? '••••••••' : '' ?>"><div class="help-text"><?= __('m365_secret_hint') ?></div></div>
|
||||
<div class="form-group"><label>Tenant ID</label><input type="text" name="m365_tenant_id" value="<?= htmlspecialchars($cs['m365_tenant_id']) ?>"></div>
|
||||
<button type="submit" name="save_settings" class="btn btn-primary"><i class="fas fa-save"></i> <?= __('btn_save') ?></button>
|
||||
</form>
|
||||
|
|
|
|||
129
admin/sites.php
129
admin/sites.php
|
|
@ -8,6 +8,7 @@ require_once __DIR__ . '/../includes/Database.php';
|
|||
require_once __DIR__ . '/../includes/Auth.php';
|
||||
require_once __DIR__ . '/../includes/UniFiController.php';
|
||||
require_once __DIR__ . '/../includes/I18n.php';
|
||||
require_once __DIR__ . '/../includes/Helpers.php';
|
||||
|
||||
$auth = new Auth();
|
||||
$auth->requireAdmin();
|
||||
|
|
@ -18,6 +19,31 @@ I18n::init();
|
|||
$error = '';
|
||||
$success = '';
|
||||
|
||||
// AJAX: Verbindungstest mit gespeicherten Zugangsdaten (Health-Check pro Site)
|
||||
if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['ajax_test_site'])) {
|
||||
header('Content-Type: application/json');
|
||||
if (!$auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
|
||||
echo json_encode(['success' => false, 'message' => __('error_csrf')]);
|
||||
exit;
|
||||
}
|
||||
$site = $db->fetchOne("SELECT * FROM sites WHERE id=?", [(int)$_POST['ajax_test_site']]);
|
||||
if (!$site) {
|
||||
echo json_encode(['success' => false, 'message' => __('error_site_not_found')]);
|
||||
exit;
|
||||
}
|
||||
$test = UniFiController::testConnection(
|
||||
$site['unifi_controller_url'],
|
||||
$site['unifi_username'],
|
||||
Crypto::decrypt($site['unifi_password']),
|
||||
$site['site_id']
|
||||
);
|
||||
echo json_encode([
|
||||
'success' => $test === true,
|
||||
'message' => $test === true ? __('site_test_ok') : __('site_test_fail') . ': ' . $test,
|
||||
]);
|
||||
exit;
|
||||
}
|
||||
|
||||
// Edit site
|
||||
if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['edit_site'])) {
|
||||
if (!$auth->validateCsrfToken($_POST['csrf_token']??'')) {
|
||||
|
|
@ -34,15 +60,23 @@ if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['edit_site'])) {
|
|||
if (empty($name)||empty($siteIdStr)||empty($controllerUrl)||empty($username)) throw new Exception(__('error_fill_all'));
|
||||
if (!empty($password)) {
|
||||
$test = UniFiController::testConnection($controllerUrl,$username,$password,$siteIdStr);
|
||||
if ($test !== true) throw new Exception('Verbindung fehlgeschlagen: '.$test);
|
||||
if ($test !== true) throw new Exception(__('site_test_fail').': '.$test);
|
||||
$db->execute("UPDATE sites SET name=?,site_id=?,unifi_controller_url=?,unifi_username=?,unifi_password=?,public_access=? WHERE id=?",
|
||||
[$name,$siteIdStr,$controllerUrl,$username,Crypto::encrypt($password),$publicAccess,$siteId]);
|
||||
} else {
|
||||
// Auch ohne Passwortaenderung testen (mit gespeichertem Passwort) –
|
||||
// sonst fallen Tippfehler in URL/Username erst beim naechsten Voucher auf.
|
||||
$stored = $db->fetchOne("SELECT unifi_password FROM sites WHERE id=?", [$siteId]);
|
||||
if (!$stored) throw new Exception(__('error_site_not_found'));
|
||||
$test = UniFiController::testConnection($controllerUrl,$username,Crypto::decrypt($stored['unifi_password']),$siteIdStr);
|
||||
if ($test !== true) throw new Exception(__('site_test_fail').': '.$test);
|
||||
$db->execute("UPDATE sites SET name=?,site_id=?,unifi_controller_url=?,unifi_username=?,public_access=? WHERE id=?",
|
||||
[$name,$siteIdStr,$controllerUrl,$username,$publicAccess,$siteId]);
|
||||
}
|
||||
$auth->writeAuditLog($_SESSION['user_id'],'site_edit','site',$siteId,"Site {$name} aktualisiert");
|
||||
$success = __('sites_updated');
|
||||
flashSet(__('sites_updated'));
|
||||
header('Location: sites.php');
|
||||
exit;
|
||||
} catch (Exception $e) { $error = $e->getMessage(); }
|
||||
}
|
||||
}
|
||||
|
|
@ -61,36 +95,46 @@ if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['add_site'])) {
|
|||
$publicAccess = isset($_POST['public_access']) ? 1 : 0;
|
||||
if (empty($name)||empty($siteId)||empty($controllerUrl)||empty($username)) throw new Exception(__('error_fill_all'));
|
||||
$test = UniFiController::testConnection($controllerUrl,$username,$password,$siteId);
|
||||
if ($test !== true) throw new Exception('Verbindung fehlgeschlagen: '.$test);
|
||||
if ($test !== true) throw new Exception(__('site_test_fail').': '.$test);
|
||||
$newId = $db->execute("INSERT INTO sites (name,site_id,unifi_controller_url,unifi_username,unifi_password,public_access) VALUES (?,?,?,?,?,?)",
|
||||
[$name,$siteId,$controllerUrl,$username,Crypto::encrypt($password),$publicAccess]);
|
||||
$auth->writeAuditLog($_SESSION['user_id'],'site_create','site',$newId,"Site {$name} erstellt");
|
||||
$success = __('sites_added');
|
||||
flashSet(__('sites_added'));
|
||||
header('Location: sites.php');
|
||||
exit;
|
||||
} catch (Exception $e) { $error = $e->getMessage(); }
|
||||
}
|
||||
}
|
||||
|
||||
// Delete site
|
||||
if (isset($_GET['delete']) && isset($_GET['token'])) {
|
||||
if ($auth->validateCsrfToken($_GET['token'])) {
|
||||
$delId = (int)$_GET['delete'];
|
||||
// Delete site (POST + PRG)
|
||||
if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['delete_site'])) {
|
||||
if ($auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
|
||||
$delId = (int)$_POST['delete_site'];
|
||||
$db->query("DELETE FROM sites WHERE id=?", [$delId]);
|
||||
$auth->writeAuditLog($_SESSION['user_id'],'site_delete','site',$delId,'Site gelöscht');
|
||||
$success = __('sites_deleted');
|
||||
flashSet(__('sites_deleted'));
|
||||
header('Location: sites.php');
|
||||
exit;
|
||||
} else { $error = __('error_csrf'); }
|
||||
}
|
||||
|
||||
// Toggle site
|
||||
if (isset($_GET['toggle']) && isset($_GET['token'])) {
|
||||
if ($auth->validateCsrfToken($_GET['token'])) {
|
||||
$site = $db->fetchOne("SELECT is_active FROM sites WHERE id=?", [(int)$_GET['toggle']]);
|
||||
// Toggle site (POST + PRG)
|
||||
if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['toggle_site'])) {
|
||||
if ($auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
|
||||
$site = $db->fetchOne("SELECT is_active FROM sites WHERE id=?", [(int)$_POST['toggle_site']]);
|
||||
if ($site) {
|
||||
$db->query("UPDATE sites SET is_active=? WHERE id=?", [$site['is_active']?0:1,(int)$_GET['toggle']]);
|
||||
$success = 'Site-Status aktualisiert!';
|
||||
$db->query("UPDATE sites SET is_active=? WHERE id=?", [$site['is_active']?0:1,(int)$_POST['toggle_site']]);
|
||||
flashSet(__('sites_status_updated'));
|
||||
header('Location: sites.php');
|
||||
exit;
|
||||
}
|
||||
} else { $error = __('error_csrf'); }
|
||||
}
|
||||
|
||||
if (empty($success) && empty($error) && ($flash = flashGet())) {
|
||||
$success = $flash['message'];
|
||||
}
|
||||
|
||||
$sites = $db->fetchAll("SELECT * FROM sites ORDER BY name");
|
||||
$currentPage = 'sites';
|
||||
?>
|
||||
|
|
@ -104,9 +148,6 @@ $currentPage = 'sites';
|
|||
<style>
|
||||
.page-header { display: flex; justify-content: space-between; align-items: center; margin-bottom: 28px; flex-wrap: wrap; gap: 12px; }
|
||||
.page-title { font-size: 26px; font-weight: 700; color: var(--text-primary); }
|
||||
.alert { padding: 13px 18px; border-radius: 10px; font-size: 14px; margin-bottom: 20px; }
|
||||
.alert-error { background: #fee; border: 1px solid #fcc; color: #c33; }
|
||||
.alert-success { background: #efe; border: 1px solid #cfc; color: #3c3; }
|
||||
.sites-grid { display: grid; grid-template-columns: repeat(auto-fill, minmax(330px, 1fr)); gap: 18px; }
|
||||
.site-card { background: var(--bg-card); border: 2px solid var(--border-color); border-radius: 14px; padding: 20px; transition: border-color .2s, box-shadow .2s; }
|
||||
.site-card:hover { border-color: var(--accent); box-shadow: 0 4px 14px rgba(102,126,234,.15); }
|
||||
|
|
@ -116,10 +157,6 @@ $currentPage = 'sites';
|
|||
.site-info { margin: 14px 0; font-size: 13px; color: var(--text-secondary); }
|
||||
.site-info-item { display: flex; align-items: center; gap: 8px; margin-bottom: 7px; }
|
||||
.site-actions { display: flex; gap: 7px; margin-top: 14px; padding-top: 14px; border-top: 1px solid var(--border-color); flex-wrap: wrap; }
|
||||
.badge { display: inline-block; padding: 3px 9px; border-radius: 5px; font-size: 11px; font-weight: 500; margin: 2px; }
|
||||
.badge-success { background: #d4edda; color: #155724; }
|
||||
.badge-warning { background: #fff3cd; color: #856404; }
|
||||
.badge-info { background: var(--bg-badge-info); color: var(--text-badge-info); }
|
||||
.btn { padding: 8px 15px; border-radius: 8px; border: none; font-weight: 500; cursor: pointer; text-decoration: none; display: inline-flex; align-items: center; gap: 7px; transition: all .2s; font-size: 13px; }
|
||||
.btn-primary { background: var(--accent); color: white; }
|
||||
.btn-primary:hover { background: var(--accent-hover); }
|
||||
|
|
@ -204,16 +241,27 @@ $currentPage = 'sites';
|
|||
class="btn btn-secondary btn-sm">
|
||||
<i class="fas fa-edit"></i> <?= __('btn_edit') ?>
|
||||
</button>
|
||||
<a href="?toggle=<?= $site['id'] ?>&token=<?= $auth->getCsrfToken() ?>"
|
||||
class="btn btn-secondary btn-sm">
|
||||
<i class="fas fa-<?= $site['is_active'] ? 'pause' : 'play' ?>"></i>
|
||||
<?= $site['is_active'] ? __('sites_deactivate') : __('sites_activate') ?>
|
||||
</a>
|
||||
<a href="?delete=<?= $site['id'] ?>&token=<?= $auth->getCsrfToken() ?>"
|
||||
class="btn btn-danger btn-sm"
|
||||
onclick="return confirm('Möchten Sie diese Site wirklich löschen?')">
|
||||
<i class="fas fa-trash"></i>
|
||||
</a>
|
||||
<form method="post" style="display:inline;">
|
||||
<input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>">
|
||||
<input type="hidden" name="toggle_site" value="<?= $site['id'] ?>">
|
||||
<button type="submit" class="btn btn-secondary btn-sm">
|
||||
<i class="fas fa-<?= $site['is_active'] ? 'pause' : 'play' ?>"></i>
|
||||
<?= $site['is_active'] ? __('sites_deactivate') : __('sites_activate') ?>
|
||||
</button>
|
||||
</form>
|
||||
<button type="button" class="btn btn-secondary btn-sm" onclick="testSite(<?= $site['id'] ?>, this)"
|
||||
title="<?= __('site_test_btn') ?>" aria-label="<?= __('site_test_btn') ?>">
|
||||
<i class="fas fa-plug"></i>
|
||||
</button>
|
||||
<form method="post" style="display:inline;"
|
||||
onsubmit="return confirm('<?= addslashes(__('confirm_delete_site')) ?>')">
|
||||
<input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>">
|
||||
<input type="hidden" name="delete_site" value="<?= $site['id'] ?>">
|
||||
<button type="submit" class="btn btn-danger btn-sm"
|
||||
title="<?= __('btn_delete') ?>" aria-label="<?= __('btn_delete') ?>">
|
||||
<i class="fas fa-trash"></i>
|
||||
</button>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
<?php endforeach; ?>
|
||||
|
|
@ -355,6 +403,23 @@ document.getElementById('editSiteForm').addEventListener('submit', function() {
|
|||
if (e.target === this) closeModal(id);
|
||||
});
|
||||
});
|
||||
|
||||
async function testSite(siteId, btn) {
|
||||
const original = btn.innerHTML;
|
||||
btn.disabled = true;
|
||||
btn.innerHTML = '<i class="fas fa-spinner fa-spin"></i>';
|
||||
try {
|
||||
const fd = new FormData();
|
||||
fd.append('ajax_test_site', siteId);
|
||||
fd.append('csrf_token', '<?= $auth->getCsrfToken() ?>');
|
||||
const result = await fetch('sites.php', { method: 'POST', body: fd }).then(r => r.json());
|
||||
showToast(result.success ? 'success' : 'error', '<?= addslashes(__('site_test_btn')) ?>', result.message);
|
||||
} catch (e) {
|
||||
showToast('error', '<?= addslashes(__('site_test_btn')) ?>', e.message);
|
||||
}
|
||||
btn.disabled = false;
|
||||
btn.innerHTML = original;
|
||||
}
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
|
|||
|
|
@ -7,6 +7,7 @@ require_once __DIR__ . '/../config.php';
|
|||
require_once __DIR__ . '/../includes/Database.php';
|
||||
require_once __DIR__ . '/../includes/Auth.php';
|
||||
require_once __DIR__ . '/../includes/I18n.php';
|
||||
require_once __DIR__ . '/../includes/Helpers.php';
|
||||
|
||||
$auth = new Auth();
|
||||
$auth->requireAdmin();
|
||||
|
|
@ -37,7 +38,9 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['add_template'])) {
|
|||
"INSERT INTO voucher_templates (name, max_uses, expire_minutes, description, created_by) VALUES (?, ?, ?, ?, ?)",
|
||||
[$name, $maxUses, $expireMin, $description, $_SESSION['user_id']]
|
||||
);
|
||||
$success = __('templates_added');
|
||||
flashSet(__('templates_added'));
|
||||
header('Location: templates.php');
|
||||
exit;
|
||||
} catch (Exception $e) {
|
||||
$error = $e->getMessage();
|
||||
}
|
||||
|
|
@ -63,23 +66,31 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['edit_template'])) {
|
|||
"UPDATE voucher_templates SET name=?, max_uses=?, expire_minutes=?, description=?, is_active=? WHERE id=?",
|
||||
[$name, $maxUses, $expireMin, $description, $isActive, $id]
|
||||
);
|
||||
$success = __('templates_updated');
|
||||
flashSet(__('templates_updated'));
|
||||
header('Location: templates.php');
|
||||
exit;
|
||||
} catch (Exception $e) {
|
||||
$error = $e->getMessage();
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Profil löschen
|
||||
if (isset($_GET['delete']) && isset($_GET['token'])) {
|
||||
if ($auth->validateCsrfToken($_GET['token'])) {
|
||||
$db->execute("DELETE FROM voucher_templates WHERE id = ?", [(int)$_GET['delete']]);
|
||||
$success = __('templates_deleted');
|
||||
// Profil löschen (POST + PRG)
|
||||
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['delete_template'])) {
|
||||
if ($auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
|
||||
$db->execute("DELETE FROM voucher_templates WHERE id = ?", [(int)$_POST['delete_template']]);
|
||||
flashSet(__('templates_deleted'));
|
||||
header('Location: templates.php');
|
||||
exit;
|
||||
} else {
|
||||
$error = __('error_csrf');
|
||||
}
|
||||
}
|
||||
|
||||
if (empty($success) && empty($error) && ($flash = flashGet())) {
|
||||
$success = $flash['message'];
|
||||
}
|
||||
|
||||
$templates = $db->fetchAll("SELECT t.*, u.name as creator FROM voucher_templates t LEFT JOIN users u ON t.created_by = u.id ORDER BY t.is_active DESC, t.name");
|
||||
|
||||
$currentPage = 'templates';
|
||||
|
|
@ -95,9 +106,6 @@ $adminBase = '';
|
|||
<style>
|
||||
.page-header { display: flex; justify-content: space-between; align-items: center; margin-bottom: 30px; flex-wrap: wrap; gap: 15px; }
|
||||
.page-title { font-size: 28px; font-weight: 600; color: var(--text-primary); }
|
||||
.alert { padding: 14px 20px; border-radius: 10px; margin-bottom: 25px; font-size: 14px; }
|
||||
.alert-error { background: #fee; border: 1px solid #fcc; color: #c33; }
|
||||
.alert-success { background: #efe; border: 1px solid #cfc; color: #3c3; }
|
||||
.card { background: var(--bg-card); border-radius: 15px; box-shadow: 0 2px 10px var(--shadow); border: 1px solid var(--border-color); overflow: hidden; margin-bottom: 25px; }
|
||||
.card-header { padding: 20px 25px; border-bottom: 1px solid var(--border-color); display: flex; justify-content: space-between; align-items: center; }
|
||||
.card-title { font-size: 18px; font-weight: 600; color: var(--text-primary); }
|
||||
|
|
@ -106,9 +114,6 @@ $adminBase = '';
|
|||
.table td { padding: 14px 15px; border-bottom: 1px solid var(--border-color); color: var(--text-primary); font-size: 14px; }
|
||||
.table tr:last-child td { border-bottom: none; }
|
||||
.table tr:hover td { background: var(--bg-hover); }
|
||||
.badge { display: inline-block; padding: 3px 10px; border-radius: 6px; font-size: 11px; font-weight: 500; }
|
||||
.badge-success { background: #d4edda; color: #155724; }
|
||||
.badge-secondary { background: var(--bg-hover); color: var(--text-muted); }
|
||||
.btn-primary { background: var(--accent); color: white; }
|
||||
.btn-primary:hover { background: var(--accent-hover); }
|
||||
.btn-danger { background: var(--danger); color: white; }
|
||||
|
|
@ -206,9 +211,15 @@ $adminBase = '';
|
|||
<td>
|
||||
<button onclick="openEditModal(<?= $t['id'] ?>, '<?= htmlspecialchars($t['name'], ENT_QUOTES) ?>', <?= (int)$t['max_uses'] ?>, <?= (int)$t['expire_minutes'] ?>, '<?= htmlspecialchars($t['description'] ?? '', ENT_QUOTES) ?>', <?= (int)$t['is_active'] ?>)"
|
||||
class="btn btn-secondary btn-small"><i class="fas fa-edit"></i></button>
|
||||
<a href="?delete=<?= $t['id'] ?>&token=<?= $auth->getCsrfToken() ?>"
|
||||
onclick="return confirm('Profil wirklich löschen?')"
|
||||
class="btn btn-danger btn-small"><i class="fas fa-trash"></i></a>
|
||||
<form method="post" style="display:inline;"
|
||||
onsubmit="return confirm('<?= addslashes(__('confirm_delete_template')) ?>')">
|
||||
<input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>">
|
||||
<input type="hidden" name="delete_template" value="<?= $t['id'] ?>">
|
||||
<button type="submit" class="btn btn-danger btn-small"
|
||||
title="<?= __('btn_delete') ?>" aria-label="<?= __('btn_delete') ?>">
|
||||
<i class="fas fa-trash"></i>
|
||||
</button>
|
||||
</form>
|
||||
</td>
|
||||
</tr>
|
||||
<?php endforeach; ?>
|
||||
|
|
|
|||
114
admin/users.php
114
admin/users.php
|
|
@ -8,6 +8,7 @@ require_once __DIR__ . '/../includes/Database.php';
|
|||
require_once __DIR__ . '/../includes/Auth.php';
|
||||
require_once __DIR__ . '/../includes/Mailer.php';
|
||||
require_once __DIR__ . '/../includes/I18n.php';
|
||||
require_once __DIR__ . '/../includes/Helpers.php';
|
||||
|
||||
$auth = new Auth();
|
||||
$auth->requireAdmin();
|
||||
|
|
@ -20,10 +21,11 @@ I18n::init();
|
|||
$error = '';
|
||||
$success = '';
|
||||
|
||||
// Send password reset link
|
||||
if (isset($_GET['send_reset']) && isset($_GET['token'])) {
|
||||
if ($auth->validateCsrfToken($_GET['token'])) {
|
||||
$targetUser = $db->fetchOne("SELECT * FROM users WHERE id=? AND is_active=1 AND password_hash IS NOT NULL", [(int)$_GET['send_reset']]);
|
||||
// Send password reset link (POST statt GET: kein CSRF-Token in URLs/Referrern,
|
||||
// keine versehentliche Ausloesung durch Link-Prefetching)
|
||||
if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['send_reset'])) {
|
||||
if ($auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
|
||||
$targetUser = $db->fetchOne("SELECT * FROM users WHERE id=? AND is_active=1 AND password_hash IS NOT NULL", [(int)$_POST['send_reset']]);
|
||||
if ($targetUser) {
|
||||
try {
|
||||
$db->execute("DELETE FROM password_reset_tokens WHERE user_id=?", [$targetUser['id']]);
|
||||
|
|
@ -39,12 +41,14 @@ if (isset($_GET['send_reset']) && isset($_GET['token'])) {
|
|||
$resetUrl = $systemUrl . '/reset_password.php?token=' . $token;
|
||||
$mailer->sendRaw($targetUser['email'], $appTitle . ' – Passwort zurücksetzen',
|
||||
"Hallo {$targetUser['name']},\n\nEin Administrator hat für Sie einen Passwort-Reset-Link erstellt:\n\n{$resetUrl}\n\n(Gültig für 1 Stunde)\n\n{$appTitle}");
|
||||
$success = 'Passwort-Reset-Link wurde an ' . htmlspecialchars($targetUser['email']) . ' gesendet.';
|
||||
flashSet(__('reset_link_sent', ['email' => $targetUser['email']]));
|
||||
header('Location: users.php');
|
||||
exit;
|
||||
} catch (Exception $e) {
|
||||
$error = 'Fehler beim Senden: ' . $e->getMessage();
|
||||
}
|
||||
} else {
|
||||
$error = 'Benutzer nicht gefunden oder kein lokales Passwort.';
|
||||
$error = __('reset_link_failed');
|
||||
}
|
||||
} else {
|
||||
$error = __('error_csrf');
|
||||
|
|
@ -60,6 +64,11 @@ if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['edit_user'])) {
|
|||
$userId = (int)$_POST['user_id'];
|
||||
$isAdmin = isset($_POST['is_admin']) ? 1 : 0;
|
||||
$siteIds = $_POST['site_ids'] ?? [];
|
||||
// Lockout-Schutz: Der letzte Weg ins Admin-Panel darf nicht
|
||||
// versehentlich gekappt werden.
|
||||
if ($userId === (int)$_SESSION['user_id'] && !$isAdmin) {
|
||||
throw new Exception(__('error_self_demote'));
|
||||
}
|
||||
$oldUser = $db->fetchOne("SELECT * FROM users WHERE id=?", [$userId]);
|
||||
$oldSites= $db->fetchAll("SELECT s.name FROM sites s INNER JOIN user_site_access usa ON s.id=usa.site_id WHERE usa.user_id=?", [$userId]);
|
||||
$db->query("UPDATE users SET is_admin=? WHERE id=?", [$isAdmin, $userId]);
|
||||
|
|
@ -83,8 +92,10 @@ if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['edit_user'])) {
|
|||
if (!empty($removedSites)) $changes[] = 'Zugriff entfernt von: ' . implode(', ', $removedSites);
|
||||
if ($isAdmin && !$oldUser['is_admin']) $changes[] = 'Sie haben nun Zugriff auf alle Sites';
|
||||
if (!empty($changes)) $mailer->sendUserNotification($oldUser['email'], $oldUser['name'], $changes);
|
||||
$success = __('users_updated') . (!empty($changes) ? ' '.__('users_notified') : '');
|
||||
$auth->writeAuditLog($_SESSION['user_id'], 'user_edit', 'user', $userId, implode('; ', $changes) ?: 'Keine Änderungen');
|
||||
flashSet(__('users_updated') . (!empty($changes) ? ' '.__('users_notified') : ''));
|
||||
header('Location: users.php');
|
||||
exit;
|
||||
} catch (Exception $e) { $error = $e->getMessage(); }
|
||||
}
|
||||
}
|
||||
|
|
@ -103,51 +114,61 @@ if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['add_user'])) {
|
|||
if (empty($email)||empty($name)||empty($password)) throw new Exception(__('error_fill_all'));
|
||||
if (!filter_var($email, FILTER_VALIDATE_EMAIL)) throw new Exception(__('error_email_invalid'));
|
||||
if (strlen($password) < 8) throw new Exception(__('settings_pw_minlength'));
|
||||
if ($db->fetchOne("SELECT id FROM users WHERE email=?", [$email])) throw new Exception('E-Mail bereits vorhanden');
|
||||
if ($db->fetchOne("SELECT id FROM users WHERE email=?", [$email])) throw new Exception(__('error_email_exists'));
|
||||
$userId = $auth->registerUser($email, $name, $password, $isAdmin);
|
||||
if (!$userId) throw new Exception('Benutzer konnte nicht erstellt werden');
|
||||
if (!$userId) throw new Exception(__('error_user_create'));
|
||||
if (!$isAdmin && !empty($siteIds)) {
|
||||
foreach ($siteIds as $siteId) {
|
||||
$db->execute("INSERT INTO user_site_access (user_id, site_id) VALUES (?,?)", [$userId, $siteId]);
|
||||
}
|
||||
}
|
||||
$auth->writeAuditLog($_SESSION['user_id'], 'user_create', 'user', $userId, "Benutzer {$name} erstellt");
|
||||
$success = __('users_added');
|
||||
flashSet(__('users_added'));
|
||||
header('Location: users.php');
|
||||
exit;
|
||||
} catch (Exception $e) { $error = $e->getMessage(); }
|
||||
}
|
||||
}
|
||||
|
||||
// Delete user
|
||||
if (isset($_GET['delete']) && isset($_GET['token'])) {
|
||||
if ($auth->validateCsrfToken($_GET['token'])) {
|
||||
$deleteId = (int)$_GET['delete'];
|
||||
// Delete user (POST + PRG)
|
||||
if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['delete_user'])) {
|
||||
if ($auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
|
||||
$deleteId = (int)$_POST['delete_user'];
|
||||
if ($deleteId === (int)$_SESSION['user_id']) {
|
||||
$error = 'Sie können sich nicht selbst löschen';
|
||||
$error = __('error_self_delete');
|
||||
} else {
|
||||
$db->query("DELETE FROM users WHERE id=?", [$deleteId]);
|
||||
$auth->writeAuditLog($_SESSION['user_id'], 'user_delete', 'user', $deleteId, 'Benutzer gelöscht');
|
||||
$success = __('users_deleted');
|
||||
flashSet(__('users_deleted'));
|
||||
header('Location: users.php');
|
||||
exit;
|
||||
}
|
||||
} else { $error = __('error_csrf'); }
|
||||
}
|
||||
|
||||
// Toggle user active
|
||||
if (isset($_GET['toggle']) && isset($_GET['token'])) {
|
||||
if ($auth->validateCsrfToken($_GET['token'])) {
|
||||
$toggleId = (int)$_GET['toggle'];
|
||||
// Toggle user active (POST + PRG)
|
||||
if ($_SERVER['REQUEST_METHOD']==='POST' && isset($_POST['toggle_user'])) {
|
||||
if ($auth->validateCsrfToken($_POST['csrf_token'] ?? '')) {
|
||||
$toggleId = (int)$_POST['toggle_user'];
|
||||
if ($toggleId === (int)$_SESSION['user_id']) {
|
||||
$error = 'Sie können sich nicht selbst deaktivieren';
|
||||
$error = __('error_self_deactivate');
|
||||
} else {
|
||||
$user = $db->fetchOne("SELECT is_active FROM users WHERE id=?", [$toggleId]);
|
||||
if ($user) {
|
||||
$newStatus = $user['is_active'] ? 0 : 1;
|
||||
$db->query("UPDATE users SET is_active=? WHERE id=?", [$newStatus, $toggleId]);
|
||||
$success = 'Benutzer-Status aktualisiert!';
|
||||
flashSet(__('users_status_updated'));
|
||||
header('Location: users.php');
|
||||
exit;
|
||||
}
|
||||
}
|
||||
} else { $error = __('error_csrf'); }
|
||||
}
|
||||
|
||||
if (empty($success) && empty($error) && ($flash = flashGet())) {
|
||||
$success = $flash['message'];
|
||||
}
|
||||
|
||||
$users = $db->fetchAll("SELECT * FROM users ORDER BY name");
|
||||
$sites = $db->fetchAll("SELECT * FROM sites WHERE is_active=1 ORDER BY name");
|
||||
$userSiteAccess = [];
|
||||
|
|
@ -169,19 +190,11 @@ $currentPage = 'users';
|
|||
.card { background: var(--bg-card); border-radius: 14px; box-shadow: 0 2px 10px var(--shadow); border: 1px solid var(--border-color); overflow: hidden; margin-bottom: 24px; }
|
||||
.card-header { padding: 18px 22px; border-bottom: 1px solid var(--border-color); }
|
||||
.card-title { font-size: 16px; font-weight: 600; color: var(--text-primary); }
|
||||
.alert { padding: 13px 18px; border-radius: 10px; font-size: 14px; margin-bottom: 20px; }
|
||||
.alert-error { background: #fee; border: 1px solid #fcc; color: #c33; }
|
||||
.alert-success { background: #efe; border: 1px solid #cfc; color: #3c3; }
|
||||
.table { width: 100%; border-collapse: collapse; }
|
||||
.table th { text-align: left; padding: 12px 15px; background: var(--bg-table-head); color: var(--text-muted); font-weight: 600; font-size: 12px; text-transform: uppercase; letter-spacing: .5px; }
|
||||
.table td { padding: 13px 15px; border-bottom: 1px solid var(--border-color); color: var(--text-primary); font-size: 14px; }
|
||||
.table tr:last-child td { border-bottom: none; }
|
||||
.table tr:hover { background: var(--bg-hover); }
|
||||
.badge { display: inline-block; padding: 3px 9px; border-radius: 5px; font-size: 11px; font-weight: 500; margin: 2px; }
|
||||
.badge-success { background: #d4edda; color: #155724; }
|
||||
.badge-warning { background: #fff3cd; color: #856404; }
|
||||
.badge-danger { background: #f8d7da; color: #721c24; }
|
||||
.badge-info { background: var(--bg-badge-info); color: var(--text-badge-info); }
|
||||
.btn { padding: 8px 16px; border-radius: 8px; border: none; font-weight: 500; cursor: pointer; text-decoration: none; display: inline-flex; align-items: center; gap: 7px; transition: all .2s; font-size: 13px; }
|
||||
.btn-primary { background: var(--accent); color: white; }
|
||||
.btn-primary:hover { background: var(--accent-hover); }
|
||||
|
|
@ -293,22 +306,35 @@ $currentPage = 'users';
|
|||
<i class="fas fa-edit"></i>
|
||||
</button>
|
||||
<?php if ($user['id'] != $_SESSION['user_id']): ?>
|
||||
<a href="?toggle=<?= $user['id'] ?>&token=<?= $auth->getCsrfToken() ?>"
|
||||
class="btn btn-secondary btn-sm" title="<?= $user['is_active'] ? __('sites_deactivate') : __('sites_activate') ?>">
|
||||
<i class="fas fa-<?= $user['is_active'] ? 'pause' : 'play' ?>"></i>
|
||||
</a>
|
||||
<form method="post" style="display:inline;">
|
||||
<input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>">
|
||||
<input type="hidden" name="toggle_user" value="<?= $user['id'] ?>">
|
||||
<button type="submit" class="btn btn-secondary btn-sm"
|
||||
title="<?= $user['is_active'] ? __('sites_deactivate') : __('sites_activate') ?>"
|
||||
aria-label="<?= $user['is_active'] ? __('sites_deactivate') : __('sites_activate') ?>">
|
||||
<i class="fas fa-<?= $user['is_active'] ? 'pause' : 'play' ?>"></i>
|
||||
</button>
|
||||
</form>
|
||||
<?php if ($smtpEnabled && !empty($user['password_hash'])): ?>
|
||||
<a href="?send_reset=<?= $user['id'] ?>&token=<?= $auth->getCsrfToken() ?>"
|
||||
class="btn btn-warning btn-sm" title="<?= __('users_reset_pw') ?>"
|
||||
onclick="return confirm('Passwort-Reset-Link senden an <?= htmlspecialchars($user['email'], ENT_QUOTES) ?>?')">
|
||||
<i class="fas fa-key"></i>
|
||||
</a>
|
||||
<form method="post" style="display:inline;"
|
||||
onsubmit="return confirm('<?= addslashes(__('confirm_send_reset', ['email' => $user['email']])) ?>')">
|
||||
<input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>">
|
||||
<input type="hidden" name="send_reset" value="<?= $user['id'] ?>">
|
||||
<button type="submit" class="btn btn-warning btn-sm"
|
||||
title="<?= __('users_reset_pw') ?>" aria-label="<?= __('users_reset_pw') ?>">
|
||||
<i class="fas fa-key"></i>
|
||||
</button>
|
||||
</form>
|
||||
<?php endif; ?>
|
||||
<a href="?delete=<?= $user['id'] ?>&token=<?= $auth->getCsrfToken() ?>"
|
||||
class="btn btn-danger btn-sm" title="<?= __('btn_delete') ?>"
|
||||
onclick="return confirm('Benutzer wirklich löschen?')">
|
||||
<i class="fas fa-trash"></i>
|
||||
</a>
|
||||
<form method="post" style="display:inline;"
|
||||
onsubmit="return confirm('<?= addslashes(__('confirm_delete_user')) ?>')">
|
||||
<input type="hidden" name="csrf_token" value="<?= $auth->getCsrfToken() ?>">
|
||||
<input type="hidden" name="delete_user" value="<?= $user['id'] ?>">
|
||||
<button type="submit" class="btn btn-danger btn-sm"
|
||||
title="<?= __('btn_delete') ?>" aria-label="<?= __('btn_delete') ?>">
|
||||
<i class="fas fa-trash"></i>
|
||||
</button>
|
||||
</form>
|
||||
<?php endif; ?>
|
||||
</div>
|
||||
</td>
|
||||
|
|
|
|||
|
|
@ -23,13 +23,19 @@ if (isset($_GET['export_csv']) && isset($_GET['site_id'])) {
|
|||
if (!$site) { http_response_code(404); exit; }
|
||||
$rows = $db->fetchAll("SELECT voucher_code,voucher_name,max_uses,expire_minutes,status,used_count,created_at,expires_at FROM vouchers WHERE site_id=? ORDER BY created_at DESC", [$siteId]);
|
||||
$filename = 'vouchers_' . preg_replace('/[^a-z0-9]/i','_',$site['name']) . '_' . date('Ymd_His') . '.csv';
|
||||
// Schutz vor CSV/Excel-Formula-Injection: Zellen, die mit =, +, -, @ oder
|
||||
// Tab beginnen (Nutzereingabe voucher_name!), mit Apostroph neutralisieren.
|
||||
$csvSafe = function ($v) {
|
||||
$v = (string)$v;
|
||||
return preg_match('/^[=+\-@\t]/', $v) ? "'" . $v : $v;
|
||||
};
|
||||
header('Content-Type: text/csv; charset=UTF-8');
|
||||
header('Content-Disposition: attachment; filename="' . $filename . '"');
|
||||
$out = fopen('php://output','w');
|
||||
fprintf($out, chr(0xEF).chr(0xBB).chr(0xBF));
|
||||
fputcsv($out,['Code','Name','Max. Geräte','Gültigkeit (Min)','Status','Genutzt','Erstellt','Läuft ab'],';');
|
||||
foreach ($rows as $r) {
|
||||
fputcsv($out,[$r['voucher_code'],$r['voucher_name'],$r['max_uses'],$r['expire_minutes'],$r['status'],$r['used_count'],$r['created_at'],$r['expires_at']??''],';');
|
||||
fputcsv($out,[$csvSafe($r['voucher_code']),$csvSafe($r['voucher_name']),$r['max_uses'],$r['expire_minutes'],$r['status'],$r['used_count'],$r['created_at'],$r['expires_at']??''],';');
|
||||
}
|
||||
fclose($out); exit;
|
||||
}
|
||||
|
|
@ -86,9 +92,9 @@ if (isset($_POST['ajax_delete']) && isset($_POST['voucher_id']) && isset($_POST[
|
|||
$ctrl = new UniFiController($site['unifi_controller_url'],$site['unifi_username'],Crypto::decrypt($site['unifi_password']),$site['site_id']);
|
||||
if ($ctrl->deleteVoucher($voucherId)) {
|
||||
$db->execute("DELETE FROM vouchers WHERE unifi_voucher_id=? AND site_id=?", [$voucherId,$siteId]);
|
||||
echo json_encode(['success'=>true,'message'=>'Voucher erfolgreich gelöscht!']);
|
||||
echo json_encode(['success'=>true,'message'=>__('voucher_deleted')]);
|
||||
} else {
|
||||
echo json_encode(['success'=>false,'message'=>'Voucher konnte nicht gelöscht werden']);
|
||||
echo json_encode(['success'=>false,'message'=>__('voucher_delete_failed')]);
|
||||
}
|
||||
} catch (Exception $e) {
|
||||
echo json_encode(['success'=>false,'message'=>'Fehler: '.$e->getMessage()]);
|
||||
|
|
@ -151,11 +157,6 @@ $currentPage = 'vouchers';
|
|||
.table tr:last-child td { border-bottom: none; }
|
||||
.table tr:hover { background: var(--bg-hover); }
|
||||
.table tr.deleting { opacity: .45; pointer-events: none; }
|
||||
.badge { display: inline-block; padding: 3px 9px; border-radius: 5px; font-size: 11px; font-weight: 500; }
|
||||
.badge-success { background: #d4edda; color: #155724; }
|
||||
.badge-warning { background: #fff3cd; color: #856404; }
|
||||
.badge-danger { background: #f8d7da; color: #721c24; }
|
||||
.badge-info { background: var(--bg-badge-info); color: var(--text-badge-info); }
|
||||
code { background: var(--bg-hover); padding: 4px 8px; border-radius: 4px; font-family: 'Courier New', monospace; font-size: 12px; letter-spacing: 1px; }
|
||||
.empty-state { text-align: center; padding: 60px 20px; color: var(--text-muted); }
|
||||
.empty-state i { font-size: 42px; margin-bottom: 18px; opacity: .3; display: block; }
|
||||
|
|
@ -270,7 +271,7 @@ async function loadVouchers(syncFirst=false) {
|
|||
refreshBtn.disabled = false;
|
||||
refreshBtn.innerHTML = `<i class="fas fa-spinner fa-spin"></i> ${syncFirst ? '<?= addslashes(__('btn_refresh')) ?>' : '<?= addslashes(__('btn_refresh')) ?>'}`;
|
||||
|
||||
document.getElementById('voucherContent').innerHTML = `<div class="loading"><i class="fas fa-spinner"></i><span>${syncFirst ? 'Synchronisiere...' : 'Lade...'}</span></div>`;
|
||||
document.getElementById('voucherContent').innerHTML = `<div class="loading"><i class="fas fa-spinner"></i><span>${syncFirst ? '<?= addslashes(__('syncing')) ?>' : '<?= addslashes(__('loading')) ?>'}</span></div>`;
|
||||
|
||||
try {
|
||||
const result = await fetch(`vouchers.php?ajax_get_vouchers=1&site_id=${siteId}${syncFirst?'&sync=1':''}`).then(r=>r.json());
|
||||
|
|
@ -286,7 +287,7 @@ async function loadVouchers(syncFirst=false) {
|
|||
const csvBtn = document.getElementById('csvExportBtn');
|
||||
csvBtn.style.display = 'inline-flex';
|
||||
csvBtn.href = `vouchers.php?export_csv=1&site_id=${siteId}&token=${csrfToken}`;
|
||||
if (syncFirst) showToast('success', '<?= addslashes(__('btn_refresh')) ?>', `${result.count} Vouchers geladen`);
|
||||
if (syncFirst) showToast('success', '<?= addslashes(__('btn_refresh')) ?>', <?= json_encode(__('vouchers_loaded')) ?>.replace('{count}', result.count));
|
||||
} else {
|
||||
document.getElementById('voucherContent').innerHTML = `<div class="empty-state"><i class="fas fa-exclamation-circle" style="color:var(--danger)"></i><p>${result.message}</p></div>`;
|
||||
document.getElementById('statsContainer').style.display = 'none';
|
||||
|
|
@ -378,7 +379,7 @@ function renderVouchers() {
|
|||
|
||||
html += `<tr id="voucher-${v._id}">
|
||||
<td><strong>${createDate.toLocaleDateString('de-DE')}</strong><br><small style="color:var(--text-muted)">${createDate.toLocaleTimeString('de-DE',{hour:'2-digit',minute:'2-digit'})}</small></td>
|
||||
<td><code onclick="copyToClipboard('${escapeHtml(v.formatted_code||'')}','Kopiert!')" title="Kopieren" style="cursor:pointer">${escapeHtml(v.formatted_code||'')}</code></td>
|
||||
<td><code onclick="copyToClipboard('${escapeHtml(v.formatted_code||'')}','<?= addslashes(__('toast_copied')) ?>')" title="<?= addslashes(__('click_to_copy')) ?>" style="cursor:pointer">${escapeHtml(v.formatted_code||'')}</code></td>
|
||||
<td class="voucher-note" title="${escapeHtml(v.note||'-')}">${escapeHtml(v.note||'-')}</td>
|
||||
<td>${statusBadge}</td>
|
||||
<td><div class="usage-info"><span>${v.used}/${v.quota>0?v.quota:'∞'}</span>${v.quota>0?`<div class="usage-bar"><div class="usage-bar-fill" style="width:${usagePct}%"></div></div>`:''}</div></td>
|
||||
|
|
@ -408,7 +409,7 @@ function renderVouchers() {
|
|||
function escapeHtml(t) { const d=document.createElement('div'); d.textContent=t; return d.innerHTML; }
|
||||
|
||||
async function deleteVoucher(voucherId) {
|
||||
if (!confirm('Voucher wirklich löschen?')) return;
|
||||
if (!confirm('<?= addslashes(__('confirm_delete_voucher')) ?>')) return;
|
||||
const row = document.getElementById(`voucher-${voucherId}`);
|
||||
if (row) row.classList.add('deleting');
|
||||
try {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue