From 1da4842847cd1da097a1273bcc23c4a702f609a6 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 14:56:25 +0200 Subject: [PATCH 01/37] Update dataSources.local.xml --- .idea/dataSources.local.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.idea/dataSources.local.xml b/.idea/dataSources.local.xml index cdc31de..b341a8a 100644 --- a/.idea/dataSources.local.xml +++ b/.idea/dataSources.local.xml @@ -1,6 +1,6 @@ - + " From 42faab17e8874414354860a05ba40bf5a019f59c Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 14:56:26 +0200 Subject: [PATCH 02/37] Create csrf.php --- includes/csrf.php | 88 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 88 insertions(+) create mode 100644 includes/csrf.php diff --git a/includes/csrf.php b/includes/csrf.php new file mode 100644 index 0000000..db0575e --- /dev/null +++ b/includes/csrf.php @@ -0,0 +1,88 @@ +'; +} + +/** + * Prüft, ob das per POST gesendete CSRF-Token zum Session-Token passt. + * + * Der Vergleich erfolgt zeitkonstant über hash_equals(), um + * Timing-Angriffe auf den Vergleich selbst auszuschließen. + * + * @return bool true, wenn das Token gültig ist + */ +function csrf_verify(): bool +{ + $sentToken = $_POST["csrf_token"] ?? ""; + $sessionToken = $_SESSION["csrf_token"] ?? ""; + + if (!is_string($sentToken) || $sentToken === "" || $sessionToken === "") { + return false; + } + + return hash_equals($sessionToken, $sentToken); +} + +/** + * Bricht die Anfrage ab und leitet mit einer Fehlermeldung um, + * wenn das mitgesendete CSRF-Token ungültig oder nicht vorhanden ist. + * + * Muss am Anfang jeder zustandsändernden POST-Aktion aufgerufen werden, + * bevor irgendeine Änderung an Daten vorgenommen wird. + * + * @param string $redirectTo Ziel-URL, zu der bei ungültigem Token + * weitergeleitet wird + * @return void + */ +function csrf_require_valid(string $redirectTo = "index.php"): void +{ + if (!csrf_verify()) { + http_response_code(403); + $_SESSION["message"] = "invalid_csrf_token"; + header("Location: " . $redirectTo); + exit(); + } +} \ No newline at end of file From ad9a00fd49f487d3b756e0f8776872f6a496cef7 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 14:57:52 +0200 Subject: [PATCH 03/37] csrf.php --- includes/alertMessages.php | 8 +++++++- index.php | 1 + 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/includes/alertMessages.php b/includes/alertMessages.php index 645f532..2c42d14 100644 --- a/includes/alertMessages.php +++ b/includes/alertMessages.php @@ -89,6 +89,12 @@ Es ist ein Datenbankfehler aufgetreten. Bitte versuche es erneut.

+ +

+ Deine Sitzung ist abgelaufen oder die Anfrage konnte nicht überprüft werden. + Bitte lade die Seite neu und versuche es erneut. +

+ +?> \ No newline at end of file diff --git a/index.php b/index.php index 42d054c..b70d61c 100644 --- a/index.php +++ b/index.php @@ -2,6 +2,7 @@ if (session_status() === PHP_SESSION_NONE) { session_start(); } +include_once "includes/csrf.php"; include_once "php/controller/index-controller.php"; ?> From bfb2d2b0d8e1cfee6e645e846d0fe5022f74f59e Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 14:59:45 +0200 Subject: [PATCH 04/37] navbar logout mit post --- css/navbar.css | 22 +++++++++++++++++++++- includes/navbar.php | 16 ++++++++++++---- 2 files changed, 33 insertions(+), 5 deletions(-) diff --git a/css/navbar.css b/css/navbar.css index d7d3d4a..f7e82c9 100644 --- a/css/navbar.css +++ b/css/navbar.css @@ -250,7 +250,7 @@ CSS für die navbar padding: 2rem 1rem; box-shadow: 2px 0 10px rgba(0,0,0,0.5); overflow-y: auto; - + /* Genug Abstand oben rechts, damit Links nicht hinter dem X liegen */ padding: 4rem 1.5rem 2rem 1.5rem; } @@ -285,6 +285,26 @@ CSS für die navbar border-bottom: 1px solid #333d43; } + .nav__logout-form { + margin: 0; + } + + .nav__mobile-logout-button { + color: #fff; + text-decoration: none; + font-size: 1.2rem; + font-weight: 600; + display: block; + width: 100%; + text-align: left; + padding: 0.5rem 1rem; + border: none; + border-bottom: 1px solid #333d43; + background: none; + cursor: pointer; + font-family: inherit; + } + .nav__mobile-submenu { display: block; list-style: none; diff --git a/includes/navbar.php b/includes/navbar.php index c62204e..78d7a3c 100644 --- a/includes/navbar.php +++ b/includes/navbar.php @@ -28,7 +28,12 @@ Globales Menü, wird via PHP später in alle Seiten eingebunden
  • Profil
    • -
  • Abmelden
    • +
  • +
    + + +
    +
  • Beitrag erstellen
    • @@ -158,9 +163,12 @@ Globales Menü, wird via PHP später in alle Seiten eingebunden Beitrag erstellen - - Abmelden - +
    + + +
    From bac296b58acbefed1cda430e57f0aabf8efc10ee Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 15:07:09 +0200 Subject: [PATCH 05/37] Update logout-controller.php --- php/controller/logout-controller.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/php/controller/logout-controller.php b/php/controller/logout-controller.php index 49386ab..d88a634 100644 --- a/php/controller/logout-controller.php +++ b/php/controller/logout-controller.php @@ -2,5 +2,5 @@ $_SESSION = []; session_destroy(); -header("Location: index.php"); +header("Location: ../../index.php"); exit(); \ No newline at end of file From f1703a476e67ebbdc8be07b5656e50256b907c1a Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 15:09:22 +0200 Subject: [PATCH 06/37] Update index.php --- index.php | 1 + 1 file changed, 1 insertion(+) diff --git a/index.php b/index.php index b70d61c..e8c35db 100644 --- a/index.php +++ b/index.php @@ -36,6 +36,7 @@ include_once "php/controller/index-controller.php"; Date: Sun, 19 Jul 2026 15:13:44 +0200 Subject: [PATCH 07/37] debugging --- includes/navbar.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/includes/navbar.php b/includes/navbar.php index 78d7a3c..28fae66 100644 --- a/includes/navbar.php +++ b/includes/navbar.php @@ -164,7 +164,7 @@ Globales Menü, wird via PHP später in alle Seiten eingebunden
    - + From e7e120e5b850e35d59f9325e6a274960e7c5bd0e Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 15:15:03 +0200 Subject: [PATCH 08/37] debugging --- php/controller/logout-controller.php | 1 + 1 file changed, 1 insertion(+) diff --git a/php/controller/logout-controller.php b/php/controller/logout-controller.php index d88a634..40ba82f 100644 --- a/php/controller/logout-controller.php +++ b/php/controller/logout-controller.php @@ -3,4 +3,5 @@ $_SESSION = []; session_destroy(); header("Location: ../../index.php"); +echo "Test"; exit(); \ No newline at end of file From 6546d264b02fe4ec6947b6b5545661c18dfa5b06 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 15:15:30 +0200 Subject: [PATCH 09/37] debugging --- php/controller/logout-controller.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/php/controller/logout-controller.php b/php/controller/logout-controller.php index 40ba82f..49b1b0c 100644 --- a/php/controller/logout-controller.php +++ b/php/controller/logout-controller.php @@ -2,6 +2,6 @@ $_SESSION = []; session_destroy(); -header("Location: ../../index.php"); +//header("Location: ../../index.php"); echo "Test"; exit(); \ No newline at end of file From 80f4b623f900783a06fc69bf107fe905ee46d7f7 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 15:16:22 +0200 Subject: [PATCH 10/37] debugging --- php/controller/logout-controller.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/php/controller/logout-controller.php b/php/controller/logout-controller.php index 49b1b0c..fcd7d8e 100644 --- a/php/controller/logout-controller.php +++ b/php/controller/logout-controller.php @@ -3,5 +3,6 @@ $_SESSION = []; session_destroy(); //header("Location: ../../index.php"); -echo "Test"; +echo $_SESSION["csrf_token"] ?? ""; +echo $SESSION["user_email"] ?? ""; exit(); \ No newline at end of file From 400f01810465f740af63d60c7cbcc067c68a3845 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 15:17:32 +0200 Subject: [PATCH 11/37] debugging --- php/controller/logout-controller.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/php/controller/logout-controller.php b/php/controller/logout-controller.php index fcd7d8e..fe32262 100644 --- a/php/controller/logout-controller.php +++ b/php/controller/logout-controller.php @@ -4,5 +4,5 @@ session_destroy(); //header("Location: ../../index.php"); echo $_SESSION["csrf_token"] ?? ""; -echo $SESSION["user_email"] ?? ""; +echo $_SESSION["user_email"] ?? ""; exit(); \ No newline at end of file From 12a6af55b0869f58b69e643ac8cb028cc6cfa0b2 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 15:19:47 +0200 Subject: [PATCH 12/37] debugging --- php/controller/logout-controller.php | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/php/controller/logout-controller.php b/php/controller/logout-controller.php index fe32262..e02eed6 100644 --- a/php/controller/logout-controller.php +++ b/php/controller/logout-controller.php @@ -1,6 +1,13 @@ Date: Sun, 19 Jul 2026 15:21:16 +0200 Subject: [PATCH 13/37] debugging --- php/controller/logout-controller.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/php/controller/logout-controller.php b/php/controller/logout-controller.php index e02eed6..56a8a87 100644 --- a/php/controller/logout-controller.php +++ b/php/controller/logout-controller.php @@ -1,11 +1,11 @@ Date: Sun, 19 Jul 2026 15:23:46 +0200 Subject: [PATCH 14/37] logout-fix --- includes/navbar.php | 2 +- php/controller/logout-controller.php | 11 ++--------- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/includes/navbar.php b/includes/navbar.php index 28fae66..78d7a3c 100644 --- a/includes/navbar.php +++ b/includes/navbar.php @@ -164,7 +164,7 @@ Globales Menü, wird via PHP später in alle Seiten eingebunden - + diff --git a/php/controller/logout-controller.php b/php/controller/logout-controller.php index 56a8a87..f0ca454 100644 --- a/php/controller/logout-controller.php +++ b/php/controller/logout-controller.php @@ -1,15 +1,8 @@ Date: Sun, 19 Jul 2026 15:25:15 +0200 Subject: [PATCH 15/37] Update logout-controller.php --- php/controller/logout-controller.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/php/controller/logout-controller.php b/php/controller/logout-controller.php index f0ca454..20d522a 100644 --- a/php/controller/logout-controller.php +++ b/php/controller/logout-controller.php @@ -1,5 +1,7 @@ Date: Sun, 19 Jul 2026 15:26:53 +0200 Subject: [PATCH 16/37] Update navbar.css --- css/navbar.css | 1 + 1 file changed, 1 insertion(+) diff --git a/css/navbar.css b/css/navbar.css index f7e82c9..b066805 100644 --- a/css/navbar.css +++ b/css/navbar.css @@ -286,6 +286,7 @@ CSS für die navbar } .nav__logout-form { + display: contents; margin: 0; } From 81a27135d59f60572afb55a11e606a388c6a8311 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 15:28:08 +0200 Subject: [PATCH 17/37] Update navbar.css --- css/navbar.css | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/css/navbar.css b/css/navbar.css index b066805..fa5f5b3 100644 --- a/css/navbar.css +++ b/css/navbar.css @@ -290,6 +290,11 @@ CSS für die navbar margin: 0; } + .nav__logout-form .nav__button { + width: 100%; + height: 100%; + } + .nav__mobile-logout-button { color: #fff; text-decoration: none; From 75f9fdbeb8c58b839fab3fc54bb9dfe49c72ebdc Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 15:31:02 +0200 Subject: [PATCH 18/37] Update navbar.php --- includes/navbar.php | 18 +++++------------- 1 file changed, 5 insertions(+), 13 deletions(-) diff --git a/includes/navbar.php b/includes/navbar.php index 78d7a3c..b16bf03 100644 --- a/includes/navbar.php +++ b/includes/navbar.php @@ -28,12 +28,7 @@ Globales Menü, wird via PHP später in alle Seiten eingebunden
  • Profil
    • -
  • - - - -
    • - +
  • Abmelden
  • Beitrag erstellen
    • @@ -163,12 +158,9 @@ Globales Menü, wird via PHP später in alle Seiten eingebunden Beitrag erstellen -
    - - -
    + + Abmelden + @@ -187,4 +179,4 @@ Globales Menü, wird via PHP später in alle Seiten eingebunden - \ No newline at end of file + From ca746909521a7f560cad5285e9aee554b9791c65 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sun, 19 Jul 2026 15:33:13 +0200 Subject: [PATCH 19/37] Update showArticle.php --- content/showArticle.php | 51 ++++++++++++++++++++++++++--------------- 1 file changed, 33 insertions(+), 18 deletions(-) diff --git a/content/showArticle.php b/content/showArticle.php index c5152c1..254fd4f 100644 --- a/content/showArticle.php +++ b/content/showArticle.php @@ -45,26 +45,31 @@ if ($replyAuthor === null) {
    -
    - - - +
    + + + - - -
    - ❤️ + + +
    + ❤️ - -
    - -
    + + + + + +
    + +

    @@ -202,6 +207,8 @@ if ($replyAuthor === null) { action="index.php?pfad=updateComment" class="edit-comment-form"> + + + + + + + + + + + + + + + + + + Date: Sun, 19 Jul 2026 15:40:16 +0200 Subject: [PATCH 21/37] Update profile.php --- content/profile.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/profile.php b/content/profile.php index 815e5ad..3109587 100644 --- a/content/profile.php +++ b/content/profile.php @@ -18,6 +18,8 @@ $isEditMode = (isset($_GET["edit"]) && $_GET["edit"] === "1") || !empty($error);
    + + +