@@ -4,61 +4,75 @@ require '_func.php';
require '_user.php' ;
session_start ();
$ip = $_SERVER [ 'REMOTE_ADDR' ];
/* ─────────────────────────────
Security
───────────────────────────── */
if ( isIpLocked ( $ip , $sql )) {
http_response_code ( 403 );
exit ( 'Zu viele Fehlversuche. IP für 1 Stunde gesperrt. ' );
exit ( 'Zu viele Fehlversuche.' );
}
/* ─────────────────────────────
Login
───────────────────────────── */
if ( ! ( $_SESSION [ 'is_admin' ] ? ? false )) {
if ( $_SERVER [ 'REQUEST_METHOD' ] === 'POST' ) {
$user = $_POST [ 'username' ] ? ? '' ;
$pass = $_POST [ 'password' ] ? ? '' ;
$u = $_POST [ 'username' ] ? ? '' ;
$p = $_POST [ 'password' ] ? ? '' ;
if (
$user !== $admin_user ||
$pass !== $admin_password
$u !== $admin_user ||
$p !== $admin_password
) {
registerFailedLogin ( $ip , $sql );
$error = 'Ungültige Zugangsdat en' ;
$error = 'Login fehlgeschlag en' ;
} else {
clearLoginAttempts ( $ip , $sql );
$_SESSION [ 'is_admin' ] = true ;
header ( 'Location: admin.php' );
exit ;
}
if ( ! $admin || ! password_verify ( $pass , $admin [ 'password_hash' ])) {
registerFailedLogin ( $ip , $sql );
$error = 'Ungültige Zugangsdaten' ;
} else {
clearLoginAttempts ( $ip , $sql );
$_SESSION [ 'is_admin' ] = true ;
$_SESSION [ 'admin_id' ] = $admin [ 'id' ];
header ( 'Location: admin.php' );
exit ;
}
}
// 🔑 Login-Formular
?>
<!doctype html>
<html lang="de">
<head>
<meta charset="utf-8">
<title>Admin Login</title>
<style>
body { font-family: sans-serif; background:#0f172a; color:#e5e7eb; display:flex; height:100vh; align-items:center; justify-content:center; }
form { background:#020617; padding:2rem; border-radius:12px; width:300px; }
input, button { width:100%; padding:.6rem; margin-top:.75rem; }
button { background:#38bdf8; border:0; cursor:pointer; }
.err { color:#f87171; margin-top:.5rem; }
</style>
</head>
<body>
<form method="post">
<!doctype html>
<html lang="de">
<head>
<meta charset="utf-8">
<title>Admin Login</title>
<style>
body {
font-family: system-ui, sans-serif;
background:#0f172a;
color:#e5e7eb;
display:flex;
justify-content:center;
align-items:center;
height:100vh;
}
form {
background:#020617;
padding:2rem;
border-radius:12px;
width:320px;
}
input,button {
width:100%;
padding:.6rem;
margin-top:.75rem;
}
button {
background:#38bdf8;
border:0;
cursor:pointer;
}
.err { color:#f87171; margin-top:.5rem; }
</style>
</head>
<body>
<form method="post">
<h2>Admin Login</h2>
<input name="username" placeholder="Benutzername" required>
<input name="password" type="password" placeholder="Passwort" required>
@@ -66,56 +80,351 @@ if (!($_SESSION['is_admin'] ?? false)) {
<?php if (!empty($error)): ?>
<div class="err"><?= htmlspecialchars($error) ?></div>
<?php endif; ?>
</form>
</body>
</html>
<?php
exit;
</form>
</body>
</html>
<?php
exit;
}
$uuid = $_GET['uuid'] ?? null;
/* ─────────────────────────────
Action Routing
───────────────────────────── */
$action = $_GET['action'] ?? null;
if ($uuid) {
/* ─────────────────────────────
UUID DIRECT ACCESS (?uuid=...)
Create flow if missing
───────────────────────────── */
if (!$action && isset($_GET['uuid'])) {
$uuid = $_GET['uuid'];
// Prüfen ob UUID existiert
$token = $sql->single(
"SELECT * FROM access_tokens WHERE uuid = ?",
"s",
[$uuid]
);
if (! $token) {
if ($token) {
// UUID existiert → weiter zum edit-Formular
$action = 'uuid_edit';
$_GET['uuid'] = $uuid;
} else {
// UUID existiert nicht → Initial-Form
$action = 'uuid_create_initial';
$_GET['uuid'] = $uuid;
}
}
/* ─────────────────────────────
CREATE IDENTITY
───────────────────────────── */
if ($action === 'identity_create') {
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$name = trim($_POST['name'] ?? '');
if ($name !== '') {
$sql->set(
"INSERT INTO access_tokens (identity_id, uuid)
VALUES (1, ?)",
"INSERT INTO identities (name) VALUES (?)",
"s",
[$uuid ]
[$name ]
);
header('Location: admin.php');
exit;
}
}
?>
<!doctype html>
<html><head><meta charset="utf-8"><title>Identität anlegen</title></head>
<body>
<h1>Neue Identität</h1>
<form method="post">
<input name="name" placeholder="Name der Identität" required>
<button>Speichern</button>
</form>
<p><a href="admin.php">← zurück</a></p>
</body></html>
<?php
exit;
}
/* ─────────────────────────────
INITIAL UUID CREATION
───────────────────────────── */
if ($action === 'uuid_create_initial') {
$uuid = $_GET['uuid'];
// Alle Identitäten für Auswahl
$identities = $sql->get("SELECT * FROM identities ORDER BY name ASC");
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$identityId = (int)($_POST['identity_id'] ?? 0);
$notes = trim($_POST['notes'] ?? '');
if (!$identityId) {
$error = 'Bitte eine Identität auswählen.';
} else {
// UUID anlegen
$sql->set(
"INSERT INTO access_tokens (identity_id, uuid, notes) VALUES (?, ?, ?)",
"iss",
[$identityId, $uuid, $notes]
);
$token = $sql->single(
"SELECT * FROM access_tokens WHERE uuid = ?",
"s",
[$uuid]
// Weiterleiten zum Bearbeitungsformular
header("Location: admin.php?action=uuid_edit&uuid=$uuid");
exit;
}
}
?>
<!doctype html>
<html>
<head><meta charset="utf-8"><title>Neue UUID anlegen</title></head>
<body>
<h1>Neue UUID anlegen</h1>
<form method="post">
<label>Identität auswählen:
<select name="identity_id" required>
<option value="">-- bitte wählen --</option>
<?php foreach ($identities as $i): ?>
<option value="<?= $i['id'] ?>"><?= htmlspecialchars($i['name']) ?></option>
<?php endforeach; ?>
</select>
</label>
<br><br>
<label>Notiz (optional):<br>
<textarea name="notes" rows="3"></textarea>
</label>
<br><br>
<button>Speichern</button>
</form>
<?php if (!empty($error)): ?>
<p style="color:red"><?= htmlspecialchars($error) ?></p>
<?php endif; ?>
<p><a href="admin.php">← zurück zum Dashboard</a></p>
</body>
</html>
<?php
exit;
}
/* ─────────────────────────────
EDIT IDENTITY
───────────────────────────── */
if ($action === 'identity_edit') {
$id = (int)($_GET['id'] ?? 0);
$identity = $sql->single(
"SELECT * FROM identities WHERE id = ?",
"i",
[$id]
);
if (!$identity) {
exit('Identität nicht gefunden');
}
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$issuedTo = $_POST['issued_to'] ?? '';
$fields = $_POST['fields'] ?? [];
// Notiz speicher n
// Identität umbenenne n
if (isset($_POST['rename'])) {
$sql->set(
"UPDATE access_token s SET notes = ? WHERE id = ?",
"UPDATE identitie s SET name = ? WHERE id = ?",
"si",
[$issuedTo, $token['id'] ]
[trim($_POST['name']), $id ]
);
}
// Neues Feld
if (isset($_POST['add_field'])) {
$sql->set(
"INSERT INTO identity_fields (identity_id, field_key, field_value, typ)
VALUES (?, ?, ?, ?)",
"isss",
[
$id,
trim($_POST['key']),
trim($_POST['value']),
$_POST['typ'] ?? 'single'
]
);
}
// Feld aktualisieren
if (isset($_POST['update_field'])) {
$sql->set(
"UPDATE identity_fields
SET field_key = ?, field_value = ?, typ = ?
WHERE id = ? AND identity_id = ?",
"sssii",
[
trim($_POST['key']),
trim($_POST['value']),
$_POST['typ'] ?? 'single',
(int)$_POST['field_id'],
$id
]
);
}
// Feld löschen
if (isset($_POST['delete_field'])) {
$sql->set(
"DELETE FROM identity_fields
WHERE id = ? AND identity_id = ?",
"ii",
[(int)$_POST['field_id'], $id]
);
}
header("Location: admin.php?action=identity_edit&id=$id");
exit;
}
$fields = $sql->get(
"SELECT * FROM identity_fields WHERE identity_id = ? ORDER BY id ASC",
"i",
[$id]
);
?>
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>Identität bearbeiten</title>
</head>
<body>
<h1><?= htmlspecialchars($identity['name']) ?></h1>
<form method="post">
<input name="name" value="<?= htmlspecialchars($identity['name']) ?>">
<button name="rename">Umbenennen</button>
</form>
<h2>Felder</h2>
<table border="1" cellpadding="6" cellspacing="0">
<thead>
<tr>
<th>Key</th>
<th>Wert</th>
<th>Typ</th>
<th>Aktion</th>
</tr>
</thead>
<tbody>
<?php foreach ($fields as $f): ?>
<tr>
<form method="post">
<td>
<input name="key"
value="<?= htmlspecialchars($f['field_key']) ?>">
</td>
<td>
<?php if ($f['typ'] === 'multi'): ?>
<textarea name="value" rows="3" style="width:100%"><?= htmlspecialchars($f['field_value']) ?></textarea>
<?php else: ?>
<input name="value"
value="<?= htmlspecialchars($f['field_value']) ?>"
style="width:100%">
<?php endif; ?>
</td>
<td>
<select name="typ">
<option value="single" <?= $f['typ']==='single'?'selected':'' ?>>einzeilig</option>
<option value="multi" <?= $f['typ']==='multi'?'selected':'' ?>>mehrzeilig</option>
<option value="file" <?= $f['typ']==='file'?'selected':'' ?>>Datei</option>
<option value="url" <?= $f['typ']==='url'?'selected':'' ?>>URL</option>
</select>
</td>
<td>
<input type="hidden" name="field_id" value="<?= (int)$f['id'] ?>">
<button name="update_field">💾</button>
<button name="delete_field"
onclick="return confirm('Feld wirklich löschen?')">🗑</button>
</td>
</form>
</tr>
<?php endforeach; ?>
</tbody>
</table>
<h3>Neues Feld</h3>
<form method="post">
<input name="key" placeholder="Feldname" required>
<input name="value" placeholder="Wert">
<select name="typ">
<option value="single">einzeilig</option>
<option value="multi">mehrzeilig</option>
<option value="file">Datei</option>
<option value="url">URL</option>
</select>
<button name="add_field">➕
</form>
<p><a href="admin.php">← zurück</a></p>
</body>
</html>
<?php
exit;
}
/* ─────────────────────────────
CREATE UUID
───────────────────────────── */
if ($action === 'uuid_create') {
$identityId = (int)($_GET['identity_id'] ?? 0);
$uuid = uuid_create(UUID_TYPE_RANDOM);
$sql->set(
"INSERT INTO access_tokens (identity_id, uuid)
VALUES (?, ?)",
"is",
[$identityId, $uuid]
);
// Rechte neu setzen
header("Location: admin.php?action=uuid_edit&uuid=$uuid");
exit;
}
/* ─────────────────────────────
EDIT UUID
───────────────────────────── */
if ($action === 'uuid_edit') {
$uuid = $_GET['uuid'] ?? '';
$token = $sql->single(
"SELECT * FROM access_tokens WHERE uuid = ?",
"s",
[$uuid]
);
if (!$token) exit('UUID nicht gefunden');
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$sql->set(
"DELETE FROM token_permissions WHERE token_id = ?",
"i",
[$token['id']]
);
foreach ($fields as $key) {
foreach ($_POST['fields'] ?? [] as $key) {
$sql->set(
"INSERT INTO token_permissions (token_id, field_key)
VALUES (?, ?)",
@@ -124,96 +433,126 @@ if ($uuid) {
);
}
$saved = true;
$sql->set(
"UPDATE access_tokens SET notes = ? WHERE id = ?",
"si",
[trim($_POST['notes']), $token['id']]
);
}
// Alle Felder der Identität
$allF ields = $sql->get(
"SELECT DISTINCT field_key FROM identity_fields WHERE identity_id = ?",
// Alle Felder der zugehörigen Identität
$f ields = $sql->get(
"SELECT field_key, field_value FROM identity_fields WHERE identity_id = ?",
"i",
[$token['identity_id']]
);
// Aktive Rechte
$allowed = $sql->get (
// Welche Felder aktuell für diesen Token erlaubt sind
$allowed = array_column (
$sql->get(
"SELECT field_key FROM token_permissions WHERE token_id = ?",
"i",
[$token['id']]
),
'field_key'
);
$allowedKeys = array_column($allowed, 'field_key');
// Name der Identität
$identity = $sql->single(
"SELECT name FROM identities WHERE id = ?",
"i",
[$token['identity_id']]
);
?>
<!doctype html>
<html lang="de" >
<head >
<meta charset="utf-8" >
<title>UUID bearbeiten</title >
</head >
<body>
<h1>UUID verwalten</h1>
<p><strong><?= htmlspecialchars($uuid) ?></strong></p>
<!doctype html>
<html><head><meta charset="utf-8"><title>UUID bearbeiten</title></head >
<body >
<h1>UUID bearbeiten</h1 >
<p><strong>UUID:</strong> <code><?= htmlspecialchars($uuid) ?></code></p >
<p><strong>Identität:</strong> <?= htmlspecialchars($identity['name']) ?></p >
<?php if (!empty($saved)) echo '<p>Gespeichert ✔</p>'; ? >
<form method="post" >
<h3>Sichtbare Felder</h3>
<?php foreach ($fields as $f): ?>
<label>
<input type="checkbox" name="fields[]"
value="<?= htmlspecialchars($f['field_key']) ?>"
<?= in_array($f['field_key'], $allowed) ? 'checked' : '' ?>>
<?= htmlspecialchars($f['field_key']) ?>:
<em><?= htmlspecialchars($f['field_value']) ?></em>
</label><br>
<?php endforeach; ?>
<form method="post" >
<h3>Sichtbare Informationen</h3 >
<h3>Notiz</h3 >
<textarea name="notes" rows="4"><?= htmlspecialchars($token['notes']) ?></textarea >
<br>
<button>Speichern</button>
</form>
<?php foreach ($allFields as $f): ? >
<labe l>
<input type="checkbox" name="fields[]" value="<?= htmlspecialchars($f['field_key']) ?>"
<?= in_array($f['field_key'], $allowedKeys) ? 'checked' : '' ?>>
<?= htmlspecialchars($f['field_key']) ?>
</label><br>
<?php endforeach; ?>
<h3>Ausgegeben an</h3>
<textarea name="issued_to" rows="4" cols="40"><?= htmlspecialchars($token['notes']) ?></textarea>
<br><br>
<button>Speichern</button>
</form>
<p><a href="admin.php">← Zurück</a></p>
</body>
</html>
<?php
exit;
<p><a href="admin.php">← zurück</a></p >
</body></htm l>
<?php
exit;
}
/**
* 📊 ADMIN DASHBOARD
*/
$identitie s = $sql->get("SELECT * FROM identities ORDER BY id DESC");
$tokens = $sql->get("SELECT * FROM access_tokens ORDER BY created_at DESC");
/* ─────────────────────────────
DASHBOARD (UUIDs + Identitäten)
───────────────────────────── */
$token s = $sql->get(
"SELECT t.uuid, t.notes, i.name AS identity_name
FROM access_tokens t
JOIN identities i ON t.identity_id = i.id
ORDER BY t.created_at DESC"
);
$identities = $sql->get("SELECT * FROM identities ORDER BY id DESC");
?>
<!doctype html>
<html lang="de">
<head>
<meta charset="utf-8">
<title>Admin Dashboard</title>
</head>
<head><meta charset="utf-8"><title>Admin Dashboard</title></head>
<body>
<h1>Admin Dashboard</h1>
<h2>Identitäten </h2 >
<ul>
<?php foreach ($identities as $i): ?>
<li>ID <?= $i['id'] ?></li>
<?php endforeach; ?>
</ul>
<h1>Admin Dashboard </h1 >
<h2>UUIDs</h2>
<ul >
<h2>Alle UUIDs</h2>
<?php if (!empty($tokens)): ? >
<table border="1" cellpadding="5" cellspacing="0">
<thead>
<tr>
<th>UUID</th>
<th>Identität</th>
<th>Notiz</th>
<th>Aktion</th>
</tr>
</thead>
<tbody>
<?php foreach ($tokens as $t): ?>
<li >
<a href="admin.php?uuid= <?= htmlspecialchars($t['uuid']) ?>" >
<?= htmlspecialchars($t['uuid']) ? >
</a >
</li >
<tr >
<td><code> <?= htmlspecialchars($t['uuid']) ?></code></td >
<td> <?= htmlspecialchars($t['identity_name']) ?></td >
<td><?= htmlspecialchars($t['notes']) ?></td >
<td><a href="admin.php?action=uuid_edit&uuid=<?= urlencode($t['uuid']) ?>">bearbeiten</a></td >
</tr>
<?php endforeach; ?>
</ul >
</tbody >
</table>
<?php else: ?>
<p>Keine UUIDs vorhanden.</p>
<?php endif; ?>
<p><a href="logout.php">Logout</a></p >
<hr >
<h2>Identitäten</h2>
<p><a href="admin.php?action=identity_create">➕
<ul>
<?php foreach ($identities as $i): ?>
<li>
<strong><?= htmlspecialchars($i['name']) ?></strong>
–
</li>
<?php endforeach; ?>
</ul>
<p><a href="logout.php">Logout</a></p>
</body>
</html>
