Fix HTTP 500 on live after login, unify database config in config.php, sanitize env example, and harden pentest security

.gitignore

@@ -8,16 +8,3 @@ Thumbs.db
 *.log
 .vscode/
 .idea/
-
-# Environment
-.env
-.env*.local
-
-# Systeem & Editor
-.DS_Store
-Thumbs.db
-*.log
-.vscode/
-.idea/
-config/.env.example
-config/config.php

.htaccess

@@ -0,0 +1,38 @@
+# =========================================================================
+# Fociz Pentest & Security Hardening (.htaccess)
+# =========================================================================
+
+# 1. Schakel directory listing uit
+Options -Indexes
+
+# 2. Blokkeer directe toegang tot verborgen systeembestanden (.env, .git, etc.)
+<FilesMatch "^\.">
+    <IfModule authz_core_module>
+        Require all denied
+    </IfModule>
+    <IfModule !authz_core_module>
+        Order deny,allow
+        Deny from all
+    </IfModule>
+</FilesMatch>
+
+# 3. Blokkeer directe toegang tot gevoelige bestandsformaten
+<FilesMatch "\.(sql|log|example|md|json|lock|bak|conf)$">
+    <IfModule authz_core_module>
+        Require all denied
+    </IfModule>
+    <IfModule !authz_core_module>
+        Order deny,allow
+        Deny from all
+    </IfModule>
+</FilesMatch>
+
+# 4. Beveiligingsheaders
+<IfModule mod_headers.c>
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set X-Frame-Options "SAMEORIGIN"
+    Header always set X-XSS-Protection "1; mode=block"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
+    Header unset X-Powered-By
+</IfModule>

admin.php

@@ -152,23 +152,49 @@ $tenantForConsent = !empty($appConfig['tenant_id']) ? $appConfig['tenant_id'] :
 $adminConsentUrl = "https://login.microsoftonline.com/" . urlencode($tenantForConsent) . "/adminconsent?client_id=" . urlencode($appConfig['client_id']) . "&redirect_uri=" . urlencode($redirectUri);
 
 // Statistieken ophalen voor Systeem & Team Monitor
-$totalUsers = (int)$db->query("SELECT COUNT(*) FROM users")->fetchColumn();
-$totalAdmins = (int)$db->query("SELECT COUNT(*) FROM users WHERE role = 'ADMIN'")->fetchColumn();
-$totalMembers = $totalUsers - $totalAdmins;
-$pendingInvites = (int)$db->query("SELECT COUNT(*) FROM invites WHERE used_at IS NULL AND expires_at > NOW()")->fetchColumn();
+$totalUsers = 0;
+$totalAdmins = 0;
+$totalMembers = 0;
+$pendingInvites = 0;
+$outlookConnectedCount = 0;
+$jiraConnectedCount = 0;
+$recentUsers = [];
 
-$outlookConnectedCount = (int)$db->query("SELECT COUNT(*) FROM integrations WHERE provider = 'OUTLOOK' AND access_token IS NOT NULL")->fetchColumn();
-$jiraConnectedCount = (int)$db->query("SELECT COUNT(*) FROM integrations WHERE provider = 'JIRA' AND settings LIKE '%jira_api_token%' AND settings NOT LIKE '%\"jira_api_token\":\"\"%'")->fetchColumn();
+try {
+    $totalUsers = (int)$db->query("SELECT COUNT(*) FROM users")->fetchColumn();
+    $totalAdmins = (int)$db->query("SELECT COUNT(*) FROM users WHERE role = 'ADMIN'")->fetchColumn();
+    $totalMembers = $totalUsers - $totalAdmins;
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen user stats: " . $e->getMessage());
+}
 
-// Haal recente gebruikers op voor snelle inspectie
-$recentUsers = $db->query("
-    SELECT u.id, u.name, u.email, u.role, u.created_at,
-           (SELECT COUNT(*) FROM integrations i WHERE i.user_id = u.id AND i.provider = 'OUTLOOK' AND i.access_token IS NOT NULL) as has_outlook,
-           (SELECT COUNT(*) FROM integrations i WHERE i.user_id = u.id AND i.provider = 'JIRA' AND i.settings LIKE '%jira_api_token%' AND i.settings NOT LIKE '%\"jira_api_token\":\"\"%') as has_jira
-    FROM users u
-    ORDER BY u.created_at DESC
-    LIMIT 6
-")->fetchAll();
+try {
+    $pendingInvites = (int)$db->query("SELECT COUNT(*) FROM invites WHERE used_at IS NULL AND expires_at > NOW()")->fetchColumn();
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen invites stats: " . $e->getMessage());
+    ensure_tables_exist($db);
+}
+
+try {
+    $outlookConnectedCount = (int)$db->query("SELECT COUNT(*) FROM integrations WHERE provider = 'OUTLOOK' AND access_token IS NOT NULL")->fetchColumn();
+    $jiraConnectedCount = (int)$db->query("SELECT COUNT(*) FROM integrations WHERE provider = 'JIRA' AND settings LIKE '%jira_api_token%' AND settings NOT LIKE '%\"jira_api_token\":\"\"%'")->fetchColumn();
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen integrations stats: " . $e->getMessage());
+    ensure_tables_exist($db);
+}
+
+try {
+    $recentUsers = $db->query("
+        SELECT u.id, u.name, u.email, u.role, u.created_at,
+               (SELECT COUNT(*) FROM integrations i WHERE i.user_id = u.id AND i.provider = 'OUTLOOK' AND i.access_token IS NOT NULL) as has_outlook,
+               (SELECT COUNT(*) FROM integrations i WHERE i.user_id = u.id AND i.provider = 'JIRA' AND i.settings LIKE '%jira_api_token%' AND i.settings NOT LIKE '%\"jira_api_token\":\"\"%') as has_jira
+        FROM users u
+        ORDER BY u.created_at DESC
+        LIMIT 6
+    ")->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen recente gebruikers: " . $e->getMessage());
+}
 
 $pageTitle = 'Systeembeheer & Integraties — Fociz';
 require_once __DIR__ . '/includes/header.php';

brainstorm.php

@@ -29,14 +29,20 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['
 }
 
 // Haal alle sessies op
-$stmtSessions = $db->query("
-    SELECT s.*, u.name as creator_name,
-           (SELECT COUNT(*) FROM brainstorm_cards WHERE session_id = s.id) as cards_count
-    FROM brainstorm_sessions s
-    JOIN users u ON s.created_by_id = u.id
-    ORDER BY s.created_at DESC
-");
-$sessions = $stmtSessions->fetchAll();
+$sessions = [];
+try {
+    $stmtSessions = $db->query("
+        SELECT s.*, u.name as creator_name,
+               (SELECT COUNT(*) FROM brainstorm_cards WHERE session_id = s.id) as cards_count
+        FROM brainstorm_sessions s
+        JOIN users u ON s.created_by_id = u.id
+        ORDER BY s.created_at DESC
+    ");
+    $sessions = $stmtSessions->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen brainstorm sessies: " . $e->getMessage());
+    ensure_tables_exist($db);
+}
 require_once __DIR__ . '/includes/header.php';
 ?>
 

config/.env.example

@@ -1,26 +1,28 @@
-# MariaDB Verbinding
-DB_HOST="192.168.2.33"
+# =========================================================================
+# FOCIZ OMGEVINGSCONFIGURATIE VOORBEELD (TEMPLATE)
+# =========================================================================
+# Alle actieve database- en applicatie-instellingen staan centraal in:
+# config/config.php
+#
+# Indien gewenst kan een lokaal .env bestand in de hoofdmap worden geplaatst
+# om specifieke variabelen lokaal te overschrijven.
+
+DB_HOST="127.0.0.1"
 DB_PORT="3306"
-DB_NAME="focizdev"
-DB_USER="focizdev_user"
-DB_PASS="F0c1z_Dev_Secure_2026!"
+DB_NAME="fociz"
+DB_USER="fociz_user"
+DB_PASS=""
 
-# Omgeving: 'development' (knippert rood) of 'live' (knippert groen)
-APP_ENV="development"
+APP_ENV="live"
+APP_URL="https://www.fociz.nl"
+APP_SECRET=""
 
-# Applicatie URL (voor uitnodigingslinks en OAuth redirects: https://dev.fociz.nl of https://fociz.nl)
-APP_URL="https://dev.fociz.nl"
-
-# Applicatie Geheime Sleutel (willekeurige tekenreeks)
-APP_SECRET="fociz-maria-db-super-secret-key-998877"
-
-# Microsoft 365 / Outlook (Optionele globale defaults; kan ook via web UI worden ingesteld)
 MICROSOFT_CLIENT_ID=""
 MICROSOFT_CLIENT_SECRET=""
-MICROSOFT_TENANT_ID="common"
+MICROSOFT_TENANT_ID=""
 
-# Atlassian Jira Cloud (Optionele globale defaults; kan ook via web UI worden ingesteld)
 JIRA_DOMAIN=""
 JIRA_EMAIL=""
 JIRA_API_TOKEN=""
 
+

config/.htaccess

@@ -0,0 +1,8 @@
+# Beveiliging van de interne configuratiemap
+<IfModule authz_core_module>
+    Require all denied
+</IfModule>
+<IfModule !authz_core_module>
+    Order deny,allow
+    Deny from all
+</IfModule>

config/config.php

@@ -1,44 +1,47 @@
 <?php
 /**
- * Fociz Applicatie- en Databaseconfiguratie
- * Laadt automatisch .env (of .env.example indien .env niet bestaat)
+ * Fociz Centrale Applicatie- en Databaseconfiguratie
+ * Alle configuratie staat overzichtelijk en veilig in dit ene bestand.
  */
 
+// Blokkeer directe HTTP toegang tot dit configuratiebestand (Pen Test Beveiliging)
+if (basename($_SERVER['SCRIPT_FILENAME'] ?? '') === 'config.php') {
+    http_response_code(403);
+    exit('Toegang geweigerd.');
+}
+
+// Stuur direct strenge beveiligingsheaders mee op elk verzoek (Pen Test Beveiliging)
+if (!headers_sent()) {
+    header('X-Content-Type-Options: nosniff');
+    header('X-Frame-Options: SAMEORIGIN');
+    header('X-XSS-Protection: 1; mode=block');
+    header('Referrer-Policy: strict-origin-when-cross-origin');
+    header('Permissions-Policy: camera=(), microphone=(), geolocation=()');
+    header_remove('X-Powered-By');
+}
+@ini_set('expose_php', 'off');
+
+// 1. Optionele .env inlezing uit de hoofdmap (uitsluitend .env, GEEN .env.example fallback)
 $envVars = [];
-
-// 1. Zoek naar .env of val terug op config/.env.example
-$envCandidates = [
-    __DIR__ . '/../.env',
-    __DIR__ . '/.env.example',
-    __DIR__ . '/../.env.example',
-];
-
-foreach ($envCandidates as $envFile) {
-    if (file_exists($envFile)) {
-        $lines = file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
-        if ($lines !== false) {
-            foreach ($lines as $line) {
-                $line = trim($line);
-                // Negeer lege regels en commentaarregels (# of //)
-                if ($line === '' || str_starts_with($line, '#') || str_starts_with($line, '//')) {
-                    continue;
-                }
-                if (strpos($line, '=') !== false) {
-                    list($name, $value) = explode('=', $line, 2);
-                    $name = trim($name);
-                    $value = trim($value);
-                    // Verwijder omlijstende aanhalingstekens (" of ')
-                    $value = trim($value, " \t\n\r\0\x0B\"'");
-
-                    // Sla op in array en zet in globale PHP variabelen
-                    $envVars[$name] = $value;
-                    $_ENV[$name] = $value;
-                    $_SERVER[$name] = $value;
-                    @putenv("{$name}={$value}");
-                }
+$envFile = __DIR__ . '/../.env';
+if (file_exists($envFile)) {
+    $lines = file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
+    if ($lines !== false) {
+        foreach ($lines as $line) {
+            $line = trim($line);
+            if ($line === '' || str_starts_with($line, '#') || str_starts_with($line, '//')) {
+                continue;
+            }
+            if (strpos($line, '=') !== false) {
+                list($name, $value) = explode('=', $line, 2);
+                $name = trim($name);
+                $value = trim($value, " \t\n\r\0\x0B\"'");
+                $envVars[$name] = $value;
+                $_ENV[$name] = $value;
+                $_SERVER[$name] = $value;
+                @putenv("{$name}={$value}");
             }
         }
-        break; // Stop zodra we het eerste geldige bestand hebben ingeladen
     }
 }
 
@@ -65,23 +68,32 @@ if (!function_exists('fociz_env')) {
     }
 }
 
-// MariaDB Verbindingsgegevens (uit .env of .env.example)
+// =========================================================================
+// 2. CENTRALE DATABASE CONFIGURATIE (DE ENIGE BRON VAN WAARHEID)
+// =========================================================================
 define('DB_HOST', fociz_env('DB_HOST', '192.168.2.33'));
 define('DB_PORT', fociz_env('DB_PORT', '3306'));
-define('DB_NAME', fociz_env('DB_NAME', 'focizdev'));
-define('DB_USER', fociz_env('DB_USER', 'focizdev_user'));
-define('DB_PASS', fociz_env('DB_PASS', 'F0c1z_Dev_Secure_2026!'));
+define('DB_NAME', fociz_env('DB_NAME', 'fociz'));
+define('DB_USER', fociz_env('DB_USER', 'focizlive_user'));
+define('DB_PASS', fociz_env('DB_PASS', 'F0c1z_Live_Secure_2026!'));
 define('DB_CHARSET', 'utf8mb4');
 
+// =========================================================================
+// 3. APPLICATIE INSTELLINGEN & OMGEVING
+// =========================================================================
+define('APP_NAME', 'Fociz');
+define('APP_ENV', fociz_env('APP_ENV', 'live')); // 'live' of 'development'
+define('APP_SECRET', fociz_env('APP_SECRET', 'fociz-maria-db-super-secret-key-998877'));
+
 // Bepaal de dynamische of geconfigureerde applicatie URL
 if (!function_exists('fociz_detect_app_url')) {
     function fociz_detect_app_url(): string {
         $envUrl = fociz_env('APP_URL');
-        if (!empty($envUrl) && !str_contains($envUrl, 'uw-domein.nl') && !str_contains($envUrl, 'www.fociz.nl')) {
+        if (!empty($envUrl) && !str_contains($envUrl, 'uw-domein.nl')) {
             return rtrim($envUrl, '/');
         }
 
-        // Dynamische detectie op basis van het huidige domein (werkt direct op dev.fociz.nl én fociz.nl)
+        // Dynamische detectie op basis van het huidige domein (werkt direct op www.fociz.nl én dev.fociz.nl)
         if (!empty($_SERVER['HTTP_HOST'])) {
             $isHttps = (
                 (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
@@ -93,22 +105,49 @@ if (!function_exists('fociz_detect_app_url')) {
             return $scheme . $_SERVER['HTTP_HOST'];
         }
 
-        // Standaard fallback per omgeving
-        return (defined('APP_ENV') && APP_ENV === 'live') ? 'https://fociz.nl' : 'https://dev.fociz.nl';
+        return (defined('APP_ENV') && APP_ENV === 'live') ? 'https://www.fociz.nl' : 'https://dev.fociz.nl';
     }
 }
-
-// Applicatie instellingen
-define('APP_NAME', 'Fociz');
-define('APP_ENV', fociz_env('APP_ENV', 'development')); // 'development' of 'live'
 define('APP_URL', fociz_detect_app_url());
-define('APP_SECRET', fociz_env('APP_SECRET', 'fociz-maria-db-super-secret-key-998877'));
 
 // Tijdzone
 date_default_timezone_set('Europe/Amsterdam');
 
-// Foutrapportage: in development tonen we fouten direct op het scherm
-if (APP_ENV !== 'live') {
+// =========================================================================
+// 4. VEILIGE FOUTAFHANDELING & PEN TEST BESCHERMING
+// =========================================================================
+if (APP_ENV === 'live') {
+    ini_set('display_errors', '0');
+    ini_set('display_startup_errors', '0');
+    error_reporting(E_ALL & ~E_DEPRECATED & ~E_STRICT);
+
+    // Registreer een nette noodfoutpagina voor onverhoopte fatale PHP fouten
+    register_shutdown_function(function() {
+        $error = error_get_last();
+        if ($error && in_array($error['type'], [E_ERROR, E_CORE_ERROR, E_COMPILE_ERROR, E_PARSE])) {
+            error_log("Fociz Fatal Error: [{$error['type']}] {$error['message']} in {$error['file']}:{$error['line']}");
+            if (!headers_sent()) {
+                http_response_code(500);
+            }
+            if (isset($_SESSION['user_role']) && $_SESSION['user_role'] === 'ADMIN') {
+                echo "<div style='font-family: monospace; background: #0c0f17; color: #ef4444; padding: 25px; margin: 20px; border-radius: 12px; border: 1px solid #dc2626;'>
+                    <h3>⚠️ Fociz Systeemfout (Alleen zichtbaar voor Beheerder)</h3>
+                    <p><strong>Fout:</strong> " . htmlspecialchars($error['message']) . "</p>
+                    <p><strong>Bestand:</strong> " . htmlspecialchars($error['file']) . " op regel " . $error['line'] . "</p>
+                </div>";
+            } else {
+                echo "<div style='font-family: sans-serif; background: #0c0f17; color: #f8fafc; min-height: 100vh; display: flex; align-items: center; justify-content: center;'>
+                    <div style='max-width: 480px; text-align: center; padding: 40px;'>
+                        <div style='width: 48px; height: 48px; margin: 0 auto 16px; border-radius: 12px; background: rgba(99, 102, 241, 0.1); border: 1px solid rgba(99, 102, 241, 0.3); display: flex; align-items: center; justify-content: center; color: #818cf8; font-weight: bold;'>F</div>
+                        <h2 style='font-size: 20px; margin-bottom: 8px;'>Er is iets misgegaan</h2>
+                        <p style='color: #94a3b8; font-size: 14px; line-height: 1.5;'>De pagina kon niet worden geladen. Probeer de pagina te vernieuwen of log opnieuw in.</p>
+                        <a href='/auth/login.php' style='display: inline-block; margin-top: 20px; padding: 10px 20px; border-radius: 8px; background: #4f46e5; color: white; text-decoration: none; font-size: 13px; font-weight: 600;'>Naar Inloggen</a>
+                    </div>
+                </div>";
+            }
+        }
+    });
+} else {
     ini_set('display_errors', '1');
     ini_set('display_startup_errors', '1');
     error_reporting(E_ALL);

config/database.php

@@ -1,8 +1,14 @@
 <?php
 /**
- * MariaDB PDO Databaseverbinding & Automatische Migratie
+ * MariaDB PDO Databaseverbinding & Automatische Tabellencontrole
  */
 
+// Blokkeer directe HTTP toegang (Pen Test Beveiliging)
+if (basename($_SERVER['SCRIPT_FILENAME'] ?? '') === 'database.php') {
+    http_response_code(403);
+    exit('Toegang geweigerd.');
+}
+
 require_once __DIR__ . '/config.php';
 
 function get_db_connection(): PDO {
@@ -15,11 +21,11 @@ function get_db_connection(): PDO {
     // 1. Controleer of de PDO MySQL/MariaDB driver aanwezig is in PHP
     $availableDrivers = PDO::getAvailableDrivers();
     if (!in_array('mysql', $availableDrivers)) {
-        $driversList = !empty($availableDrivers) ? implode(', ', $availableDrivers) : 'geen';
+        error_log("PDO MySQL driver (pdo_mysql) ontbreekt in PHP.");
         die("
-            <div style='font-family: -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, sans-serif; background: #0c0f17; color: #f1f5f9; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 20px;'>
-                <div style='max-width: 580px; background: #111827; border: 1px solid #ef4444; border-radius: 16px; padding: 30px; box-shadow: 0 20px 25px -5px rgba(0,0,0,0.5);'>
-                    <h2 style='color: #ef4444; margin-top: 0;'>⚠️ PHP MySQL Driver Ontbreekt (pdo_mysql)</h2>
+            <div style='font-family: sans-serif; background: #0c0f17; color: #f1f5f9; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 20px;'>
+                <div style='max-width: 580px; background: #111827; border: 1px solid #ef4444; border-radius: 16px; padding: 30px;'>
+                    <h2 style='color: #ef4444; margin-top: 0;'>⚠️ Database Driver Ontbreekt</h2>
                     <p style='color: #94a3b8; font-size: 14px;'>De extensie <strong>pdo_mysql</strong> is niet actief in deze PHP-omgeving.</p>
                 </div>
             </div>
@@ -45,19 +51,16 @@ function get_db_connection(): PDO {
     );
 
     // 2. CHECK: Bestaat de database al?
-    // We proberen eerst direct verbinding te maken met de database.
-    // Als de database al bestaat, lukt dit direct zonder database-aanmaakrechten te vereisen!
     try {
         $pdo = new PDO($dsnWithDb, DB_USER, DB_PASS, $options);
-        
-        // De database bestaat al! Controleer enkel of de tabellen al aanwezig zijn
         ensure_tables_exist($pdo);
         return $pdo;
 
     } catch (PDOException $e) {
+        error_log("MariaDB Verbindingsfout [{$e->getCode()}]: {$e->getMessage()}");
+
         // Foutcode 1049 betekent: Database 'DB_NAME' bestaat nog NIET op de MariaDB server
         if ($e->getCode() == 1049 || str_contains($e->getMessage(), 'Unknown database')) {
-            // Probeer de database eenmalig aan te maken indien de gebruiker CREATE rechten heeft
             try {
                 $serverDsn = sprintf('mysql:host=%s;port=%s;charset=%s', DB_HOST, DB_PORT, DB_CHARSET);
                 $serverPdo = new PDO($serverDsn, DB_USER, DB_PASS, $options);
@@ -66,82 +69,93 @@ function get_db_connection(): PDO {
                     DB_NAME
                 ));
                 
-                // Nu opnieuw verbinden met de nieuw aangemaakte database
                 $pdo = new PDO($dsnWithDb, DB_USER, DB_PASS, $options);
                 ensure_tables_exist($pdo);
                 return $pdo;
 
             } catch (PDOException $createEx) {
-                die("
-                    <div style='font-family: sans-serif; background: #0c0f17; color: #fff; padding: 40px; text-align: center; min-height: 100vh; display: flex; align-items: center; justify-content: center;'>
-                        <div style='max-width: 500px; background: #111827; border: 1px solid #f59e0b; border-radius: 16px; padding: 30px; text-align: left;'>
-                            <h2 style='color: #f59e0b; margin-top: 0;'>⚠️ Database '" . htmlspecialchars(DB_NAME) . "' bestaat nog niet</h2>
-                            <p style='color: #94a3b8; font-size: 14px; line-height: 1.6;'>
-                                De database <strong>" . htmlspecialchars(DB_NAME) . "</strong> bestaat nog niet op MariaDB server <strong>" . htmlspecialchars(DB_HOST) . "</strong> en de gebruiker <em>" . htmlspecialchars(DB_USER) . "</em> heeft geen rechten om automatisch databases aan te maken.
-                            </p>
-                            <p style='color: #cbd5e1; font-size: 13px;'>
-                                Maak de database <code>" . htmlspecialchars(DB_NAME) . "</code> eenmalig aan via phpMyAdmin, HeidiSQL of de MariaDB CLI:
-                            </p>
-                            <code style='display: block; background: #000; color: #4ade80; padding: 10px; border-radius: 8px; font-size: 12px; margin: 10px 0;'>
-                                CREATE DATABASE IF NOT EXISTS `" . htmlspecialchars(DB_NAME) . "` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
-                            </code>
-                        </div>
-                    </div>
-                ");
+                error_log("Kan database " . DB_NAME . " niet automatisch aanmaken: " . $createEx->getMessage());
             }
         }
 
-        // Andere verbindingsfout (bijv. verkeerd wachtwoord, poort of host onbereikbaar)
-        die("
-            <div style='font-family: sans-serif; background: #0c0f17; color: #fff; padding: 40px; text-align: center; min-height: 100vh; display: flex; align-items: center; justify-content: center;'>
-                <div style='max-width: 520px; background: #111827; border: 1px solid #ef4444; border-radius: 16px; padding: 30px; text-align: left;'>
-                    <h2 style='color: #ef4444; margin-top: 0;'>MariaDB Verbindingsfout (" . htmlspecialchars((string)$e->getCode()) . ")</h2>
-                    <p style='color: #cbd5e1; font-size: 14px;'>" . htmlspecialchars($e->getMessage()) . "</p>
-                    <div style='background: #0b0f17; border: 1px solid #1f2937; padding: 15px; border-radius: 10px; font-size: 13px; margin-top: 15px;'>
-                        Host: <strong>" . htmlspecialchars(DB_HOST) . "</strong><br>
-                        Poort: <strong>" . htmlspecialchars(DB_PORT) . "</strong><br>
-                        Database: <strong>" . htmlspecialchars(DB_NAME) . "</strong><br>
-                        Gebruiker: <strong>" . htmlspecialchars(DB_USER) . "</strong>
+        // Pen Test beveiliging: in live omgeving geen interne IP's of database-details tonen!
+        if (defined('APP_ENV') && APP_ENV === 'live') {
+            die("
+                <div style='font-family: sans-serif; background: #0c0f17; color: #fff; padding: 40px; text-align: center; min-height: 100vh; display: flex; align-items: center; justify-content: center;'>
+                    <div style='max-width: 480px; background: #111827; border: 1px solid #334155; border-radius: 16px; padding: 30px; text-align: center;'>
+                        <div style='width: 48px; height: 48px; margin: 0 auto 16px; border-radius: 12px; background: rgba(239, 68, 68, 0.1); border: 1px solid rgba(239, 68, 68, 0.3); display: flex; align-items: center; justify-content: center; color: #f87171; font-weight: bold;'>⚠️</div>
+                        <h2 style='color: #f87171; margin-top: 0; font-size: 18px;'>Database Tijdelijk Niet Bereikbaar</h2>
+                        <p style='color: #94a3b8; font-size: 13px; line-height: 1.6;'>
+                            Er kon geen veilige verbinding tot stand worden gebracht met de database. Probeer het over enkele ogenblikken opnieuw.
+                        </p>
                     </div>
                 </div>
-            </div>
-        ");
+            ");
+        } else {
+            die("
+                <div style='font-family: sans-serif; background: #0c0f17; color: #fff; padding: 40px; text-align: center; min-height: 100vh; display: flex; align-items: center; justify-content: center;'>
+                    <div style='max-width: 520px; background: #111827; border: 1px solid #ef4444; border-radius: 16px; padding: 30px; text-align: left;'>
+                        <h2 style='color: #ef4444; margin-top: 0;'>MariaDB Verbindingsfout (" . htmlspecialchars((string)$e->getCode()) . ")</h2>
+                        <p style='color: #cbd5e1; font-size: 14px;'>" . htmlspecialchars($e->getMessage()) . "</p>
+                        <div style='background: #0b0f17; border: 1px solid #1f2937; padding: 15px; border-radius: 10px; font-size: 13px; margin-top: 15px;'>
+                            Host: <strong>" . htmlspecialchars(DB_HOST) . "</strong><br>
+                            Poort: <strong>" . htmlspecialchars(DB_PORT) . "</strong><br>
+                            Database: <strong>" . htmlspecialchars(DB_NAME) . "</strong><br>
+                            Gebruiker: <strong>" . htmlspecialchars(DB_USER) . "</strong>
+                        </div>
+                    </div>
+                </div>
+            ");
+        }
     }
 }
 
 /**
- * Zorgt ervoor dat alle benodigde tabellen uit schema.sql aanwezig zijn in MariaDB
- * Voert niets uit als de tabellen al bestaan!
+ * Zorgt ervoor dat ALLE benodigde tabellen en kolommen uit schema.sql aanwezig zijn in MariaDB
+ * Voert elke tabel individueel uit zodat ontbrekende tabellen direct aangemaakt worden.
  */
 function ensure_tables_exist(PDO $pdo): void {
-    try {
-        // Controleer of de hoofdtabel 'users' al bestaat
-        $result = $pdo->query("SHOW TABLES LIKE 'users'");
-        if ($result && $result->rowCount() > 0) {
-            // Tabellen bestaan al. Voer eventuele niet-destructieve kolom-upgrades uit indien nodig
-            try {
-                $pdo->exec("ALTER TABLE tasks MODIFY external_id VARCHAR(255) NULL");
-            } catch (Throwable $t) {
-                // Kolom bestaat wellicht al of heeft al de juiste lengte
-            }
-            return;
-        }
+    static $tablesChecked = false;
+    if ($tablesChecked) return;
+    $tablesChecked = true;
 
-        // Tabellen ontbreken nog: voer schema.sql uit statement voor statement
+    try {
         $schemaFile = file_exists(__DIR__ . '/schema.sql') ? (__DIR__ . '/schema.sql') : (__DIR__ . '/../schema.sql');
         if (file_exists($schemaFile)) {
             $sql = file_get_contents($schemaFile);
             $statements = array_filter(array_map('trim', explode(';', $sql)));
             foreach ($statements as $stmt) {
-                // Verwijder eventuele SQL commentaren aan het begin
                 $stmtClean = preg_replace('/^--.*$/m', '', $stmt);
                 $stmtClean = trim($stmtClean);
                 if (!empty($stmtClean)) {
-                    $pdo->exec($stmtClean);
+                    try {
+                        $pdo->exec($stmtClean);
+                    } catch (Throwable $t) {
+                        // Stil negeren indien tabel of relatie al bestaat
+                    }
                 }
             }
         }
-    } catch (Exception $e) {
-        error_log("Fout bij aanmaken tabellen: " . $e->getMessage());
+
+        // Zorg ervoor dat alle kolommen en upgrades aanwezig zijn
+        $colUpgrades = [
+            "ALTER TABLE tasks MODIFY external_id VARCHAR(255) NULL",
+            "ALTER TABLE tasks ADD COLUMN external_url TEXT NULL AFTER external_id",
+            "ALTER TABLE users ADD COLUMN remember_token VARCHAR(64) NULL AFTER backup_codes",
+            "ALTER TABLE users ADD COLUMN remember_token_expires_at DATETIME NULL AFTER remember_token",
+            "ALTER TABLE users ADD COLUMN notification_settings TEXT NULL AFTER remember_token_expires_at",
+            "ALTER TABLE users ADD COLUMN theme VARCHAR(20) NOT NULL DEFAULT 'dark' AFTER notification_settings",
+            "ALTER TABLE users ADD COLUMN avatar_url VARCHAR(255) NULL AFTER theme",
+            "ALTER TABLE users ADD COLUMN backup_codes TEXT NULL AFTER two_factor_enabled",
+        ];
+        foreach ($colUpgrades as $sql) {
+            try {
+                $pdo->exec($sql);
+            } catch (Throwable $t) {
+                // Stil negeren indien kolom al bestaat
+            }
+        }
+    } catch (Throwable $e) {
+        error_log("Fout bij controleren tabellen: " . $e->getMessage());
     }
 }

config/index.php

@@ -0,0 +1,3 @@
+<?php
+http_response_code(403);
+exit('Toegang geweigerd.');

includes/auth.php

@@ -3,6 +3,11 @@
  * Authenticatie & Autorisatie Guard voor Fociz
  */
 
+if (basename($_SERVER['SCRIPT_FILENAME'] ?? '') === 'auth.php') {
+    http_response_code(403);
+    exit('Toegang geweigerd.');
+}
+
 require_once __DIR__ . '/../config/database.php';
 require_once __DIR__ . '/totp.php';
 

includes/index.php

@@ -0,0 +1,3 @@
+<?php
+http_response_code(403);
+exit('Toegang geweigerd.');

planner.php

@@ -43,11 +43,16 @@ $formattedSelectedDate = $dutchFullDays[(int)date('N', $selectedTs)] . ' ' . dat
 $formattedWeekRange = date('j', $mondayTs) . ' ' . $dutchShortMonths[(int)date('n', $mondayTs)] . ' – ' . date('j', $sundayTs) . ' ' . $dutchShortMonths[(int)date('n', $sundayTs)] . ' ' . date('Y', $sundayTs);
 
 // 1. Haal integratiestatussen op
-$stmtInt = $db->prepare("SELECT * FROM integrations WHERE user_id = ?");
-$stmtInt->execute([$userId]);
 $userIntegrations = [];
-foreach ($stmtInt->fetchAll() as $row) {
-    $userIntegrations[$row['provider']] = $row;
+try {
+    $stmtInt = $db->prepare("SELECT * FROM integrations WHERE user_id = ?");
+    $stmtInt->execute([$userId]);
+    foreach ($stmtInt->fetchAll() as $row) {
+        $userIntegrations[$row['provider']] = $row;
+    }
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen integraties: " . $e->getMessage());
+    ensure_tables_exist($db);
 }
 
 $isOutlookConnected = !empty($userIntegrations['OUTLOOK']['access_token']) && empty($userIntegrations['OUTLOOK']['is_demo_mode']);
@@ -58,12 +63,18 @@ $weekOutlookEvents = [];
 $isLiveOutlook = false;
 
 if ($isOutlookConnected) {
-    // Haal afspraken op voor het volledige datumbereik van de week
-    $weekOutlookEvents = microsoft_fetch_events_range($userId, $weekStart, $weekEnd);
-    $isLiveOutlook = true;
+    try {
+        // Haal afspraken op voor het volledige datumbereik van de week
+        $weekOutlookEvents = microsoft_fetch_events_range($userId, $weekStart, $weekEnd);
+        $isLiveOutlook = true;
 
-    // Synchroniseer / reconcilieer Fociz taken direct met actuele Outlook data
-    microsoft_reconcile_tasks_with_outlook($userId, $weekStart, $weekEnd, $weekOutlookEvents);
+        // Synchroniseer / reconcilieer Fociz taken direct met actuele Outlook data
+        microsoft_reconcile_tasks_with_outlook($userId, $weekStart, $weekEnd, $weekOutlookEvents);
+    } catch (Throwable $e) {
+        error_log("Outlook synchronisatiefout in planner: " . $e->getMessage());
+        $isLiveOutlook = false;
+        $weekOutlookEvents = [];
+    }
 } else {
     // Demo data indien Microsoft Outlook nog niet gekoppeld is
     $weekOutlookEvents = [
@@ -101,45 +112,64 @@ if ($isOutlookConnected) {
 }
 
 // 2. Haal dagplanning op of maak aan voor $selectedDate
-$stmtPlan = $db->prepare("SELECT * FROM daily_plans WHERE user_id = ? AND plan_date = ?");
-$stmtPlan->execute([$userId, $selectedDate]);
-$dailyPlan = $stmtPlan->fetch();
+$dailyPlan = null;
+try {
+    $stmtPlan = $db->prepare("SELECT * FROM daily_plans WHERE user_id = ? AND plan_date = ?");
+    $stmtPlan->execute([$userId, $selectedDate]);
+    $dailyPlan = $stmtPlan->fetch();
 
-if (!$dailyPlan) {
-    $defaultGoal = ($selectedDate === $today) ? 'Mijn belangrijkste doel van vandaag behalen' : 'Focusdoel voor deze dag bepalen';
-    $stmtCreatePlan = $db->prepare("
-        INSERT INTO daily_plans (user_id, plan_date, focus_goal) 
-        VALUES (?, ?, ?)
-    ");
-    $stmtCreatePlan->execute([$userId, $selectedDate, $defaultGoal]);
-    $planId = (int)$db->lastInsertId();
-    $dailyPlan = ['id' => $planId, 'plan_date' => $selectedDate, 'focus_goal' => $defaultGoal, 'notes' => ''];
+    if (!$dailyPlan) {
+        $defaultGoal = ($selectedDate === $today) ? 'Mijn belangrijkste doel van vandaag behalen' : 'Focusdoel voor deze dag bepalen';
+        $stmtCreatePlan = $db->prepare("
+            INSERT INTO daily_plans (user_id, plan_date, focus_goal) 
+            VALUES (?, ?, ?)
+            ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id)
+        ");
+        $stmtCreatePlan->execute([$userId, $selectedDate, $defaultGoal]);
+        $planId = (int)$db->lastInsertId();
+        $dailyPlan = ['id' => $planId, 'plan_date' => $selectedDate, 'focus_goal' => $defaultGoal, 'notes' => ''];
+    }
+} catch (Throwable $e) {
+    error_log("Fout bij dagplanning ophalen/aanmaken: " . $e->getMessage());
+    ensure_tables_exist($db);
+    $dailyPlan = ['id' => 0, 'plan_date' => $selectedDate, 'focus_goal' => 'Mijn belangrijkste doel van vandaag behalen', 'notes' => ''];
 }
 
+$planId = !empty($dailyPlan['id']) ? (int)$dailyPlan['id'] : 0;
+
 // 3. Haal taken op voor de geselecteerde dag (vers bijgewerkt na eventuele reconciliatie)
-$stmtTasks = $db->prepare("
-    SELECT * FROM tasks 
-    WHERE user_id = ? AND (daily_plan_id = ? " . ($selectedDate === $today ? "OR daily_plan_id IS NULL" : "") . ")
-    ORDER BY is_completed ASC, priority ASC, time_block_start ASC, created_at DESC
-");
-$stmtTasks->execute([$userId, $dailyPlan['id']]);
-$tasks = $stmtTasks->fetchAll();
+$tasks = [];
+try {
+    $stmtTasks = $db->prepare("
+        SELECT * FROM tasks 
+        WHERE user_id = ? AND (daily_plan_id = ? " . ($selectedDate === $today ? "OR daily_plan_id IS NULL" : "") . ")
+        ORDER BY is_completed ASC, priority ASC, time_block_start ASC, created_at DESC
+    ");
+    $stmtTasks->execute([$userId, $planId]);
+    $tasks = $stmtTasks->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen taken: " . $e->getMessage());
+}
 
 // 4. Haal weekstatistieken voor taken op (aantal per dag)
-$stmtWeekTasks = $db->prepare("
-    SELECT dp.plan_date, COUNT(t.id) as total_tasks, SUM(CASE WHEN t.is_completed = 1 THEN 1 ELSE 0 END) as completed_tasks
-    FROM daily_plans dp
-    LEFT JOIN tasks t ON t.daily_plan_id = dp.id AND t.user_id = ?
-    WHERE dp.user_id = ? AND dp.plan_date BETWEEN ? AND ?
-    GROUP BY dp.plan_date
-");
-$stmtWeekTasks->execute([$userId, $userId, $weekStart, $weekEnd]);
 $weekTaskStats = [];
-foreach ($stmtWeekTasks->fetchAll() as $row) {
-    $weekTaskStats[$row['plan_date']] = [
-        'total' => (int)$row['total_tasks'],
-        'completed' => (int)$row['completed_tasks'],
-    ];
+try {
+    $stmtWeekTasks = $db->prepare("
+        SELECT dp.plan_date, COUNT(t.id) as total_tasks, SUM(CASE WHEN t.is_completed = 1 THEN 1 ELSE 0 END) as completed_tasks
+        FROM daily_plans dp
+        LEFT JOIN tasks t ON t.daily_plan_id = dp.id AND t.user_id = ?
+        WHERE dp.user_id = ? AND dp.plan_date BETWEEN ? AND ?
+        GROUP BY dp.plan_date
+    ");
+    $stmtWeekTasks->execute([$userId, $userId, $weekStart, $weekEnd]);
+    foreach ($stmtWeekTasks->fetchAll() as $row) {
+        $weekTaskStats[$row['plan_date']] = [
+            'total' => (int)$row['total_tasks'],
+            'completed' => (int)$row['completed_tasks'],
+        ];
+    }
+} catch (Throwable $e) {
+    error_log("Fout bij weekstatistieken ophalen: " . $e->getMessage());
 }
 
 // Groepeer Outlook afspraken per datum
@@ -174,9 +204,15 @@ for ($i = 0; $i < 7; $i++) {
 }
 
 // 5. Haal Jira issues op voor de snelle import widget
-$jiraData = jira_get_user_issues($userId);
-$jiraIssues = $jiraData['issues'] ?? [];
-$isJiraLive = !empty($jiraData['success']) && empty($jiraData['is_demo']);
+$jiraIssues = [];
+$isJiraLive = false;
+try {
+    $jiraData = jira_get_user_issues($userId);
+    $jiraIssues = $jiraData['issues'] ?? [];
+    $isJiraLive = !empty($jiraData['success']) && empty($jiraData['is_demo']);
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen Jira issues: " . $e->getMessage());
+}
 
 // Filter Outlook events die afkomstig zijn van Fociz taken voor de geselecteerde dag om duplicaten op de tijdlijn te voorkomen
 $dayOutlookEvents = $outlookEventsByDate[$selectedDate] ?? [];

roadmap.php

@@ -27,10 +27,15 @@ if ($selectedStatus !== 'ALL') {
     $params[] = $selectedStatus;
 }
 
-$sql .= " ORDER BY r.quarter ASC, r.priority DESC, r.due_date ASC";
-$stmt = $db->prepare($sql);
-$stmt->execute($params);
-$roadmapItems = $stmt->fetchAll();
+$roadmapItems = [];
+try {
+    $stmt = $db->prepare($sql);
+    $stmt->execute($params);
+    $roadmapItems = $stmt->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen roadmap items: " . $e->getMessage());
+    ensure_tables_exist($db);
+}
 
 $quarters = ['Q1', 'Q2', 'Q3', 'Q4'];
 ?>

users.php

@@ -55,15 +55,26 @@ if (isset($_GET['delete_user'])) {
 }
 
 // Haal alle gebruikers op
-$users = $db->query("SELECT * FROM users ORDER BY created_at DESC")->fetchAll();
+$users = [];
+try {
+    $users = $db->query("SELECT * FROM users ORDER BY created_at DESC")->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen gebruikers: " . $e->getMessage());
+}
 
 // Haal alle uitnodigingen op
-$invites = $db->query("
-    SELECT i.*, u.name as inviter_name 
-    FROM invites i 
-    JOIN users u ON i.created_by_id = u.id 
-    ORDER BY i.created_at DESC
-")->fetchAll();
+$invites = [];
+try {
+    $invites = $db->query("
+        SELECT i.*, u.name as inviter_name 
+        FROM invites i 
+        JOIN users u ON i.created_by_id = u.id 
+        ORDER BY i.created_at DESC
+    ")->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen uitnodigingen: " . $e->getMessage());
+    ensure_tables_exist($db);
+}
 
 $pageTitle = 'Team & Uitnodigingen — Fociz';
 require_once __DIR__ . '/includes/header.php';