Compare commits
2 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 niklas.ortmann
|
b81f0c9e5c | ||
|
niklas.ortmann
|
f8aed4283e |
@@ -27,8 +27,6 @@ $blocks = array_values($blocks); // sequentielle Indizes 0..n-1 sicherstellen
|
||||
-->
|
||||
<form method="post" action="php/controller/createArticle-controller.php" id="editor-form" enctype="multipart/form-data" class="article-editor-scope.editor-container article-editor-scope editor-container">
|
||||
|
||||
<?php csrf_field(); ?>
|
||||
|
||||
<main class="editor-main">
|
||||
<?php include_once "includes/alertMessages.php"?>
|
||||
|
||||
|
||||
@@ -18,8 +18,6 @@ $isEditMode = (isset($_GET["edit"]) && $_GET["edit"] === "1") || !empty($error);
|
||||
|
||||
<form method="post" action="index.php?pfad=profile">
|
||||
|
||||
<?php csrf_field(); ?>
|
||||
|
||||
<label class="input-label">Vorname</label>
|
||||
<input type="text"
|
||||
name="vorname"
|
||||
@@ -84,7 +82,6 @@ $isEditMode = (isset($_GET["edit"]) && $_GET["edit"] === "1") || !empty($error);
|
||||
<br>
|
||||
|
||||
<form action="php/controller/deleteAccount-controller.php" method="POST">
|
||||
<?php csrf_field(); ?>
|
||||
<button type="submit"
|
||||
class="button"
|
||||
onclick="return confirm('Möchtest du deinen Account und alle deine Beiträge wirklich unwiderruflich löschen?');">
|
||||
@@ -158,7 +155,6 @@ $isEditMode = (isset($_GET["edit"]) && $_GET["edit"] === "1") || !empty($error);
|
||||
</a>
|
||||
|
||||
<form action="php/controller/deleteArticle-controller.php" method="POST">
|
||||
<?php csrf_field(); ?>
|
||||
<input type="hidden"
|
||||
name="id"
|
||||
value="<?php echo htmlspecialchars($userArticle->getID()); ?>">
|
||||
|
||||
+18
-33
@@ -45,31 +45,26 @@ if ($replyAuthor === null) {
|
||||
<!-- Metadaten & Titel -->
|
||||
<div class="article-view-top-section">
|
||||
|
||||
<div class="category-and-likes-row">
|
||||
<?php if (isset($category) && !empty($category)): ?>
|
||||
<span class="article-view-category"><?php echo htmlspecialchars($category); ?></span>
|
||||
<?php endif; ?>
|
||||
<div class="category-and-likes-row">
|
||||
<?php if (isset($category) && !empty($category)): ?>
|
||||
<span class="article-view-category"><?php echo htmlspecialchars($category); ?></span>
|
||||
<?php endif; ?>
|
||||
|
||||
<!-- Like-Anzeige und dynamischer Like-Button -->
|
||||
<?php if (isset($articleObj) && $articleObj !== null): ?>
|
||||
<div class="article-view-likes">
|
||||
<span>❤️ <span class="like-count"><?php echo $articleObj->getLikeCount(); ?></span></span>
|
||||
<!-- Like-Anzeige und dynamischer Like-Button -->
|
||||
<?php if (isset($articleObj) && $articleObj !== null): ?>
|
||||
<div class="article-view-likes">
|
||||
<span>❤️ <span class="like-count"><?php echo $articleObj->getLikeCount(); ?></span></span>
|
||||
|
||||
<?php if (isset($_SESSION["user_email"])): ?>
|
||||
<form method="post"
|
||||
action="php/controller/like-controller.php?id=<?php echo $articleObj->getId(); ?>"
|
||||
class="like-toggle-form">
|
||||
<?php csrf_field(); ?>
|
||||
<button type="submit" class="like-toggle-btn">
|
||||
<?php if (isset($_SESSION["user_email"])): ?>
|
||||
<a href="php/controller/like-controller.php?id=<?php echo $articleObj->getId(); ?>" class="like-toggle-btn">
|
||||
<?php echo $articleObj->hasLiked($_SESSION["user_email"]) ? '👎 Gefällt mir nicht mehr' : '👍 Gefällt mir'; ?>
|
||||
</button>
|
||||
</form>
|
||||
<?php else: ?>
|
||||
<span class="login-hint">(Anmelden zum Liken)</span>
|
||||
<?php endif; ?>
|
||||
</div>
|
||||
<?php endif; ?>
|
||||
</div>
|
||||
</a>
|
||||
<?php else: ?>
|
||||
<span class="login-hint">(Anmelden zum Liken)</span>
|
||||
<?php endif; ?>
|
||||
</div>
|
||||
<?php endif; ?>
|
||||
</div>
|
||||
|
||||
<h1 class="article-view-title">
|
||||
<?php if (isset($title)) { echo htmlspecialchars($title); } ?>
|
||||
@@ -207,8 +202,6 @@ if ($replyAuthor === null) {
|
||||
action="index.php?pfad=updateComment"
|
||||
class="edit-comment-form">
|
||||
|
||||
<?php csrf_field(); ?>
|
||||
|
||||
<input type="hidden"
|
||||
name="comment_id"
|
||||
value="<?php echo htmlspecialchars(
|
||||
@@ -246,8 +239,6 @@ if ($replyAuthor === null) {
|
||||
action="index.php?pfad=deleteComment"
|
||||
class="delete-comment-form">
|
||||
|
||||
<?php csrf_field(); ?>
|
||||
|
||||
<input type="hidden"
|
||||
name="comment_id"
|
||||
value="<?php echo htmlspecialchars(
|
||||
@@ -343,8 +334,6 @@ if ($replyAuthor === null) {
|
||||
action="index.php?pfad=updateComment"
|
||||
class="edit-comment-form">
|
||||
|
||||
<?php csrf_field(); ?>
|
||||
|
||||
<input type="hidden"
|
||||
name="comment_id"
|
||||
value="<?php echo htmlspecialchars(
|
||||
@@ -382,8 +371,6 @@ if ($replyAuthor === null) {
|
||||
action="index.php?pfad=deleteComment"
|
||||
class="delete-comment-form">
|
||||
|
||||
<?php csrf_field(); ?>
|
||||
|
||||
<input type="hidden"
|
||||
name="comment_id"
|
||||
value="<?php echo htmlspecialchars(
|
||||
@@ -425,8 +412,6 @@ if ($replyAuthor === null) {
|
||||
method="post"
|
||||
action="php/ajax/add-comment.php">
|
||||
|
||||
<?php csrf_field(); ?>
|
||||
|
||||
<input type="hidden"
|
||||
name="article_id"
|
||||
value="<?php echo htmlspecialchars(
|
||||
@@ -480,4 +465,4 @@ if ($replyAuthor === null) {
|
||||
</div>
|
||||
<?php endif; ?>
|
||||
</section>
|
||||
</main>
|
||||
</main>
|
||||
|
||||
@@ -27,8 +27,6 @@ $blocks = array_values($blocks);
|
||||
-->
|
||||
<form method="post" action="php/controller/updateArticle-controller.php?id=<?php if(isset($id) && !empty($id)){echo htmlspecialchars($id);}else{$_SESSION["message"] = "missing_id";} ?>" id="editor-form" enctype="multipart/form-data" class="article-editor-scope.editor-container article-editor-scope editor-container">
|
||||
|
||||
<?php csrf_field(); ?>
|
||||
|
||||
<main class="editor-main">
|
||||
<?php include_once "includes/alertMessages.php"?>
|
||||
|
||||
|
||||
+1
-27
@@ -250,7 +250,7 @@ CSS für die navbar
|
||||
padding: 2rem 1rem;
|
||||
box-shadow: 2px 0 10px rgba(0,0,0,0.5);
|
||||
overflow-y: auto;
|
||||
|
||||
|
||||
/* Genug Abstand oben rechts, damit Links nicht hinter dem X liegen */
|
||||
padding: 4rem 1.5rem 2rem 1.5rem;
|
||||
}
|
||||
@@ -285,32 +285,6 @@ CSS für die navbar
|
||||
border-bottom: 1px solid #333d43;
|
||||
}
|
||||
|
||||
.nav__logout-form {
|
||||
display: contents;
|
||||
margin: 0;
|
||||
}
|
||||
|
||||
.nav__logout-form .nav__button {
|
||||
width: 100%;
|
||||
height: 100%;
|
||||
}
|
||||
|
||||
.nav__mobile-logout-button {
|
||||
color: #fff;
|
||||
text-decoration: none;
|
||||
font-size: 1.2rem;
|
||||
font-weight: 600;
|
||||
display: block;
|
||||
width: 100%;
|
||||
text-align: left;
|
||||
padding: 0.5rem 1rem;
|
||||
border: none;
|
||||
border-bottom: 1px solid #333d43;
|
||||
background: none;
|
||||
cursor: pointer;
|
||||
font-family: inherit;
|
||||
}
|
||||
|
||||
.nav__mobile-submenu {
|
||||
display: block;
|
||||
list-style: none;
|
||||
|
||||
@@ -89,12 +89,6 @@
|
||||
Es ist ein Datenbankfehler aufgetreten. Bitte versuche es erneut.
|
||||
</p>
|
||||
<?php endif; ?>
|
||||
<?php if (isset($_SESSION["message"]) && $_SESSION["message"] == "invalid_csrf_token"): ?>
|
||||
<p class="alert-message is-error">
|
||||
Deine Sitzung ist abgelaufen oder die Anfrage konnte nicht überprüft werden.
|
||||
Bitte lade die Seite neu und versuche es erneut.
|
||||
</p>
|
||||
<?php endif; ?>
|
||||
<?php
|
||||
unset($_SESSION["message"]);
|
||||
?>
|
||||
?>
|
||||
|
||||
@@ -1,88 +0,0 @@
|
||||
<?php
|
||||
/**
|
||||
* CSRF-Schutz nach dem Synchronizer-Token-Pattern.
|
||||
*
|
||||
* Pro Session wird ein einziges, zufälliges Token erzeugt,
|
||||
* das in jedem Formular als verstecktes Feld mitgeschickt und bei jeder
|
||||
* zustandsändernden Anfrage serverseitig mit dem Session-Token verglichen
|
||||
* wird.
|
||||
*
|
||||
* @author Niklas Ortmann
|
||||
*/
|
||||
|
||||
if (session_status() === PHP_SESSION_NONE) {
|
||||
session_start();
|
||||
}
|
||||
|
||||
/**
|
||||
* Gibt das aktuelle CSRF-Token der Session zurück.
|
||||
*
|
||||
* Existiert noch kein Token, wird eines erzeugt und in der Session
|
||||
* gespeichert.
|
||||
*
|
||||
* @return string Das CSRF-Token
|
||||
*/
|
||||
function csrf_token(): string
|
||||
{
|
||||
if (empty($_SESSION["csrf_token"]) || !is_string($_SESSION["csrf_token"])) {
|
||||
$_SESSION["csrf_token"] = bin2hex(random_bytes(32));
|
||||
}
|
||||
|
||||
return $_SESSION["csrf_token"];
|
||||
}
|
||||
|
||||
/**
|
||||
* Gibt ein verstecktes Formularfeld mit dem aktuellen CSRF-Token aus.
|
||||
*
|
||||
* Wird in jedem Formular benötigt, das eine zustandsändernde
|
||||
* Aktion auslöst.
|
||||
*
|
||||
* @return void
|
||||
*/
|
||||
function csrf_field(): void
|
||||
{
|
||||
echo '<input type="hidden" name="csrf_token" value="'
|
||||
. htmlspecialchars(csrf_token())
|
||||
. '">';
|
||||
}
|
||||
|
||||
/**
|
||||
* Prüft, ob das per POST gesendete CSRF-Token zum Session-Token passt.
|
||||
*
|
||||
* Der Vergleich erfolgt zeitkonstant über hash_equals(), um
|
||||
* Timing-Angriffe auf den Vergleich selbst auszuschließen.
|
||||
*
|
||||
* @return bool true, wenn das Token gültig ist
|
||||
*/
|
||||
function csrf_verify(): bool
|
||||
{
|
||||
$sentToken = $_POST["csrf_token"] ?? "";
|
||||
$sessionToken = $_SESSION["csrf_token"] ?? "";
|
||||
|
||||
if (!is_string($sentToken) || $sentToken === "" || $sessionToken === "") {
|
||||
return false;
|
||||
}
|
||||
|
||||
return hash_equals($sessionToken, $sentToken);
|
||||
}
|
||||
|
||||
/**
|
||||
* Bricht die Anfrage ab und leitet mit einer Fehlermeldung um,
|
||||
* wenn das mitgesendete CSRF-Token ungültig oder nicht vorhanden ist.
|
||||
*
|
||||
* Muss am Anfang jeder zustandsändernden POST-Aktion aufgerufen werden,
|
||||
* bevor irgendeine Änderung an Daten vorgenommen wird.
|
||||
*
|
||||
* @param string $redirectTo Ziel-URL, zu der bei ungültigem Token
|
||||
* weitergeleitet wird
|
||||
* @return void
|
||||
*/
|
||||
function csrf_require_valid(string $redirectTo = "index.php"): void
|
||||
{
|
||||
if (!csrf_verify()) {
|
||||
http_response_code(403);
|
||||
$_SESSION["message"] = "invalid_csrf_token";
|
||||
header("Location: " . $redirectTo);
|
||||
exit();
|
||||
}
|
||||
}
|
||||
+1
-1
@@ -179,4 +179,4 @@ Globales Menü, wird via PHP später in alle Seiten eingebunden
|
||||
<?php endif; ?>
|
||||
|
||||
</div>
|
||||
</nav>
|
||||
</nav>
|
||||
@@ -2,7 +2,6 @@
|
||||
if (session_status() === PHP_SESSION_NONE) {
|
||||
session_start();
|
||||
}
|
||||
include_once "includes/csrf.php";
|
||||
include_once "php/controller/index-controller.php";
|
||||
?>
|
||||
<!DOCTYPE html>
|
||||
@@ -36,7 +35,6 @@ include_once "php/controller/index-controller.php";
|
||||
|
||||
<?php
|
||||
include_once 'includes/navbar.php';
|
||||
include_once "includes/alertMessages.php";
|
||||
|
||||
// Dynamischer Inhalt
|
||||
if (isset($pfad) && $pfad !== "404" && file_exists('content/' . $pfad . '.php')) {
|
||||
|
||||
@@ -109,12 +109,6 @@ document.addEventListener("DOMContentLoaded", function () {
|
||||
action="index.php?pfad=updateComment"
|
||||
class="edit-comment-form"
|
||||
>
|
||||
<input
|
||||
type="hidden"
|
||||
name="csrf_token"
|
||||
value="${escapeHtml(formData.get("csrf_token"))}"
|
||||
>
|
||||
|
||||
<input
|
||||
type="hidden"
|
||||
name="comment_id"
|
||||
@@ -143,12 +137,6 @@ document.addEventListener("DOMContentLoaded", function () {
|
||||
action="index.php?pfad=deleteComment"
|
||||
class="delete-comment-form"
|
||||
>
|
||||
<input
|
||||
type="hidden"
|
||||
name="csrf_token"
|
||||
value="${escapeHtml(formData.get("csrf_token"))}"
|
||||
>
|
||||
|
||||
<input
|
||||
type="hidden"
|
||||
name="comment_id"
|
||||
@@ -199,12 +187,6 @@ document.addEventListener("DOMContentLoaded", function () {
|
||||
action="index.php?pfad=updateComment"
|
||||
class="edit-comment-form"
|
||||
>
|
||||
<input
|
||||
type="hidden"
|
||||
name="csrf_token"
|
||||
value="${escapeHtml(formData.get("csrf_token"))}"
|
||||
>
|
||||
|
||||
<input
|
||||
type="hidden"
|
||||
name="comment_id"
|
||||
@@ -233,12 +215,6 @@ document.addEventListener("DOMContentLoaded", function () {
|
||||
action="index.php?pfad=deleteComment"
|
||||
class="delete-comment-form"
|
||||
>
|
||||
<input
|
||||
type="hidden"
|
||||
name="csrf_token"
|
||||
value="${escapeHtml(formData.get("csrf_token"))}"
|
||||
>
|
||||
|
||||
<input
|
||||
type="hidden"
|
||||
name="comment_id"
|
||||
|
||||
@@ -1,10 +1,6 @@
|
||||
<?php
|
||||
if (session_status() === PHP_SESSION_NONE) {
|
||||
session_start();
|
||||
}
|
||||
|
||||
$_SESSION = [];
|
||||
session_destroy();
|
||||
|
||||
header("Location: ../../index.php");
|
||||
header("Location: index.php");
|
||||
exit();
|
||||
@@ -310,21 +310,20 @@ class DatabaseArticleManager implements ArticleManagerDAO {
|
||||
|
||||
try {
|
||||
$db = $this->getConnection();
|
||||
|
||||
|
||||
$sql = "SELECT id, title, content, author, category, tags, created
|
||||
FROM articles
|
||||
WHERE title LIKE :keyword
|
||||
OR content LIKE :keyword
|
||||
OR tags LIKE :keyword";
|
||||
FROM articles
|
||||
WHERE title LIKE :keyword
|
||||
OR content LIKE :keyword
|
||||
OR tags LIKE :keyword;";
|
||||
|
||||
$command = $db->prepare($sql);
|
||||
if (!$command) {
|
||||
throw new InternalServerErrorException("internal_error");
|
||||
}
|
||||
|
||||
// Wildcards für die Suche hinzufügen
|
||||
// Wildcards für die SQL-Suche hinzufügen
|
||||
$searchParam = '%' . $cleankeyword . '%';
|
||||
|
||||
$success = $command->execute([
|
||||
":keyword" => $searchParam
|
||||
]);
|
||||
@@ -337,10 +336,11 @@ class DatabaseArticleManager implements ArticleManagerDAO {
|
||||
$filteredArticles = [];
|
||||
|
||||
foreach ($rows as $row) {
|
||||
$likes = $this->getLikesForArticle(intval($row['id']));
|
||||
$articleId = intval($row['id']);
|
||||
$likes = $this->getLikesForArticle($articleId);
|
||||
|
||||
$filteredArticles[] = new Article(
|
||||
intval($row['id']),
|
||||
$articleId,
|
||||
$row['title'] ?? '',
|
||||
$row['content'] ?? '',
|
||||
$row['author'] ?? '',
|
||||
@@ -358,6 +358,7 @@ class DatabaseArticleManager implements ArticleManagerDAO {
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
/**
|
||||
* Holt alle User-IDs, die einen bestimmten Beitrag geliked haben.
|
||||
*
|
||||
|
||||
Reference in New Issue
Block a user