From 17b0557d1d1be45f90e4b6749116525b9aa9f1b2 Mon Sep 17 00:00:00 2001
From: Niek Rabelink <niek.rabelink@gmail.com>
Date: Tue, 8 Sep 2026 14:03:47 +0200
Subject: [PATCH] fix: fix boolean return type in totp.php, handle
 multi-statement sql and enable error reporting

---
 auth/setup.php      |  1 +
 composer.json       |  1 +
 config/config.php   |  7 +++++++
 config/database.php | 15 ++++++++++++---
 includes/auth.php   | 11 +++++++----
 includes/totp.php   |  2 +-
 6 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/auth/setup.php b/auth/setup.php
index a5b1ecd..b85116d 100644
--- a/auth/setup.php
+++ b/auth/setup.php
@@ -15,6 +15,7 @@ if (has_admin_user()) {
 $error = null;
 $success = false;
 $backupCodes = [];
+$email = '';
 
 // Haal of genereer een tijdelijke sessie-sleutel voor de 2FA configuratie
 if (empty($_SESSION['setup_totp_secret'])) {
diff --git a/composer.json b/composer.json
index 43ad1bb..92284f3 100644
--- a/composer.json
+++ b/composer.json
@@ -6,3 +6,4 @@
         "ext-mysqli": "*"
     }
 }
+
diff --git a/config/config.php b/config/config.php
index 45bcd5d..0622306 100644
--- a/config/config.php
+++ b/config/config.php
@@ -80,3 +80,10 @@ define('APP_ENV', fociz_env('APP_ENV', 'development')); // 'development' of 'liv
 
 // Tijdzone
 date_default_timezone_set('Europe/Amsterdam');
+
+// Foutrapportage: in development tonen we fouten direct op het scherm
+if (APP_ENV !== 'live') {
+    ini_set('display_errors', '1');
+    ini_set('display_startup_errors', '1');
+    error_reporting(E_ALL);
+}
diff --git a/config/database.php b/config/database.php
index 305cc45..98e3530 100644
--- a/config/database.php
+++ b/config/database.php
@@ -53,6 +53,9 @@ function get_db_connection(): PDO {
             PDO::ATTR_EMULATE_PREPARES   => false,
             PDO::ATTR_TIMEOUT            => 5,
         ];
+        if (defined('PDO::MYSQL_ATTR_MULTI_STATEMENTS')) {
+            $options[PDO::MYSQL_ATTR_MULTI_STATEMENTS] = true;
+        }
 
         try {
             $pdo = new PDO($dsn, DB_USER, DB_PASS, $options);
@@ -100,10 +103,16 @@ function ensure_tables_exist(PDO $pdo): void {
             $schemaFile = __DIR__ . '/../schema.sql';
             if (file_exists($schemaFile)) {
                 $sql = file_get_contents($schemaFile);
-                $pdo->exec($sql);
+                // Splits op puntkomma om elk CREATE TABLE statement apart uit te voeren
+                $statements = array_filter(array_map('trim', explode(';', $sql)));
+                foreach ($statements as $stmt) {
+                    if (!empty($stmt)) {
+                        $pdo->exec($stmt);
+                    }
+                }
             }
         }
-    } catch (PDOException $e) {
-        // Tabellen bestaan waarschijnlijk al
+    } catch (Exception $e) {
+        error_log("Fout bij uitvoeren schema.sql: " . $e->getMessage());
     }
 }
diff --git a/includes/auth.php b/includes/auth.php
index 5e33ef2..7f1672f 100644
--- a/includes/auth.php
+++ b/includes/auth.php
@@ -13,7 +13,6 @@ function start_secure_session(): void {
         session_set_cookie_params([
             'lifetime' => 7 * 24 * 60 * 60, // 7 dagen
             'path' => '/',
-            'domain' => '',
             'secure' => $isSecure,
             'httponly' => true,
             'samesite' => 'Lax'
@@ -26,9 +25,13 @@ function start_secure_session(): void {
  * Controleert of er al een beheerder bestaat in MariaDB
  */
 function has_admin_user(): bool {
-    $db = get_db_connection();
-    $stmt = $db->query("SELECT COUNT(*) FROM users WHERE role = 'ADMIN'");
-    return ((int)$stmt->fetchColumn()) > 0;
+    try {
+        $db = get_db_connection();
+        $stmt = $db->query("SELECT COUNT(*) FROM users WHERE role = 'ADMIN'");
+        return ((int)$stmt->fetchColumn()) > 0;
+    } catch (Throwable $e) {
+        return false;
+    }
 }
 
 /**
diff --git a/includes/totp.php b/includes/totp.php
index 556e84b..93ec2d2 100644
--- a/includes/totp.php
+++ b/includes/totp.php
@@ -76,7 +76,7 @@ class TOTP {
     /**
      * Verifieert een ingevoerde 6-cijferige 2FA code (met 1 tijdstap speling naar voor/achter)
      */
-    public static function verifyCode(string $secret, string $userInputCode, int $window = 1): boolean {
+    public static function verifyCode(string $secret, string $userInputCode, int $window = 1): bool {
         $userInputCode = trim(str_replace(' ', '', $userInputCode));
         if (strlen($userInputCode) !== 6 || !ctype_digit($userInputCode)) {
             return false;