Fix HTTP 500 on live after login, unify database config in config.php, sanitize env example, and harden pentest security

Update config/config.php
Update config/.env.example
2026-09-09 17:52:11 +02:00 · 2026-09-09 14:51:33 +00:00 · 2026-09-09 14:50:54 +00:00
14 changed files with 408 additions and 225 deletions
@@ -8,16 +8,3 @@ Thumbs.db
 *.log
 .vscode/
 .idea/
-
-# Environment
-.env
-.env*.local
-
-# Systeem & Editor
-.DS_Store
-Thumbs.db
-*.log
-.vscode/
-.idea/
-config/.env.example
-config/config.php
@@ -0,0 +1,38 @@
+# =========================================================================
+# Fociz Pentest & Security Hardening (.htaccess)
+# =========================================================================
+
+# 1. Schakel directory listing uit
+Options -Indexes
+
+# 2. Blokkeer directe toegang tot verborgen systeembestanden (.env, .git, etc.)
+<FilesMatch "^\.">
+    <IfModule authz_core_module>
+        Require all denied
+    </IfModule>
+    <IfModule !authz_core_module>
+        Order deny,allow
+        Deny from all
+    </IfModule>
+</FilesMatch>
+
+# 3. Blokkeer directe toegang tot gevoelige bestandsformaten
+<FilesMatch "\.(sql|log|example|md|json|lock|bak|conf)$">
+    <IfModule authz_core_module>
+        Require all denied
+    </IfModule>
+    <IfModule !authz_core_module>
+        Order deny,allow
+        Deny from all
+    </IfModule>
+</FilesMatch>
+
+# 4. Beveiligingsheaders
+<IfModule mod_headers.c>
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set X-Frame-Options "SAMEORIGIN"
+    Header always set X-XSS-Protection "1; mode=block"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+    Header always set Permissions-Policy "camera=(), microphone=(), geolocation=()"
+    Header unset X-Powered-By
+</IfModule>
@@ -152,23 +152,49 @@ $tenantForConsent = !empty($appConfig['tenant_id']) ? $appConfig['tenant_id'] :
 $adminConsentUrl = "https://login.microsoftonline.com/" . urlencode($tenantForConsent) . "/adminconsent?client_id=" . urlencode($appConfig['client_id']) . "&redirect_uri=" . urlencode($redirectUri);

 // Statistieken ophalen voor Systeem & Team Monitor
-$totalUsers = (int)$db->query("SELECT COUNT(*) FROM users")->fetchColumn();
-$totalAdmins = (int)$db->query("SELECT COUNT(*) FROM users WHERE role = 'ADMIN'")->fetchColumn();
-$totalMembers = $totalUsers - $totalAdmins;
-$pendingInvites = (int)$db->query("SELECT COUNT(*) FROM invites WHERE used_at IS NULL AND expires_at > NOW()")->fetchColumn();
+$totalUsers = 0;
+$totalAdmins = 0;
+$totalMembers = 0;
+$pendingInvites = 0;
+$outlookConnectedCount = 0;
+$jiraConnectedCount = 0;
+$recentUsers = [];

-$outlookConnectedCount = (int)$db->query("SELECT COUNT(*) FROM integrations WHERE provider = 'OUTLOOK' AND access_token IS NOT NULL")->fetchColumn();
-$jiraConnectedCount = (int)$db->query("SELECT COUNT(*) FROM integrations WHERE provider = 'JIRA' AND settings LIKE '%jira_api_token%' AND settings NOT LIKE '%\"jira_api_token\":\"\"%'")->fetchColumn();
+try {
+    $totalUsers = (int)$db->query("SELECT COUNT(*) FROM users")->fetchColumn();
+    $totalAdmins = (int)$db->query("SELECT COUNT(*) FROM users WHERE role = 'ADMIN'")->fetchColumn();
+    $totalMembers = $totalUsers - $totalAdmins;
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen user stats: " . $e->getMessage());
+}

-// Haal recente gebruikers op voor snelle inspectie
-$recentUsers = $db->query("
+try {
+    $pendingInvites = (int)$db->query("SELECT COUNT(*) FROM invites WHERE used_at IS NULL AND expires_at > NOW()")->fetchColumn();
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen invites stats: " . $e->getMessage());
+    ensure_tables_exist($db);
+}
+
+try {
+    $outlookConnectedCount = (int)$db->query("SELECT COUNT(*) FROM integrations WHERE provider = 'OUTLOOK' AND access_token IS NOT NULL")->fetchColumn();
+    $jiraConnectedCount = (int)$db->query("SELECT COUNT(*) FROM integrations WHERE provider = 'JIRA' AND settings LIKE '%jira_api_token%' AND settings NOT LIKE '%\"jira_api_token\":\"\"%'")->fetchColumn();
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen integrations stats: " . $e->getMessage());
+    ensure_tables_exist($db);
+}
+
+try {
+    $recentUsers = $db->query("
        SELECT u.id, u.name, u.email, u.role, u.created_at,
               (SELECT COUNT(*) FROM integrations i WHERE i.user_id = u.id AND i.provider = 'OUTLOOK' AND i.access_token IS NOT NULL) as has_outlook,
               (SELECT COUNT(*) FROM integrations i WHERE i.user_id = u.id AND i.provider = 'JIRA' AND i.settings LIKE '%jira_api_token%' AND i.settings NOT LIKE '%\"jira_api_token\":\"\"%') as has_jira
        FROM users u
        ORDER BY u.created_at DESC
        LIMIT 6
-")->fetchAll();
+    ")->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen recente gebruikers: " . $e->getMessage());
+}

 $pageTitle = 'Systeembeheer & Integraties — Fociz';
 require_once __DIR__ . '/includes/header.php';
@@ -29,14 +29,20 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['
 }

 // Haal alle sessies op
-$stmtSessions = $db->query("
+$sessions = [];
+try {
+    $stmtSessions = $db->query("
        SELECT s.*, u.name as creator_name,
               (SELECT COUNT(*) FROM brainstorm_cards WHERE session_id = s.id) as cards_count
        FROM brainstorm_sessions s
        JOIN users u ON s.created_by_id = u.id
        ORDER BY s.created_at DESC
-");
-$sessions = $stmtSessions->fetchAll();
+    ");
+    $sessions = $stmtSessions->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen brainstorm sessies: " . $e->getMessage());
+    ensure_tables_exist($db);
+}
 require_once __DIR__ . '/includes/header.php';
 ?>

@@ -1,26 +1,28 @@
-# MariaDB Verbinding
-DB_HOST="192.168.2.33"
+# =========================================================================
+# FOCIZ OMGEVINGSCONFIGURATIE VOORBEELD (TEMPLATE)
+# =========================================================================
+# Alle actieve database- en applicatie-instellingen staan centraal in:
+# config/config.php
+#
+# Indien gewenst kan een lokaal .env bestand in de hoofdmap worden geplaatst
+# om specifieke variabelen lokaal te overschrijven.
+
+DB_HOST="127.0.0.1"
 DB_PORT="3306"
-DB_NAME="focizdev"
-DB_USER="focizdev_user"
-DB_PASS="F0c1z_Dev_Secure_2026!"
+DB_NAME="fociz"
+DB_USER="fociz_user"
+DB_PASS=""

-# Omgeving: 'development' (knippert rood) of 'live' (knippert groen)
-APP_ENV="development"
+APP_ENV="live"
+APP_URL="https://www.fociz.nl"
+APP_SECRET=""

-# Applicatie URL (voor uitnodigingslinks en OAuth redirects: https://dev.fociz.nl of https://fociz.nl)
-APP_URL="https://dev.fociz.nl"
-
-# Applicatie Geheime Sleutel (willekeurige tekenreeks)
-APP_SECRET="fociz-maria-db-super-secret-key-998877"
-
-# Microsoft 365 / Outlook (Optionele globale defaults; kan ook via web UI worden ingesteld)
 MICROSOFT_CLIENT_ID=""
 MICROSOFT_CLIENT_SECRET=""
-MICROSOFT_TENANT_ID="common"
+MICROSOFT_TENANT_ID=""

-# Atlassian Jira Cloud (Optionele globale defaults; kan ook via web UI worden ingesteld)
 JIRA_DOMAIN=""
 JIRA_EMAIL=""
 JIRA_API_TOKEN=""

+
@@ -0,0 +1,8 @@
+# Beveiliging van de interne configuratiemap
+<IfModule authz_core_module>
+    Require all denied
+</IfModule>
+<IfModule !authz_core_module>
+    Order deny,allow
+    Deny from all
+</IfModule>
@@ -1,36 +1,41 @@
 <?php
 /**
- * Fociz Applicatie- en Databaseconfiguratie
- * Laadt automatisch .env (of .env.example indien .env niet bestaat)
+ * Fociz Centrale Applicatie- en Databaseconfiguratie
+ * Alle configuratie staat overzichtelijk en veilig in dit ene bestand.
 */

+// Blokkeer directe HTTP toegang tot dit configuratiebestand (Pen Test Beveiliging)
+if (basename($_SERVER['SCRIPT_FILENAME'] ?? '') === 'config.php') {
+    http_response_code(403);
+    exit('Toegang geweigerd.');
+}
+
+// Stuur direct strenge beveiligingsheaders mee op elk verzoek (Pen Test Beveiliging)
+if (!headers_sent()) {
+    header('X-Content-Type-Options: nosniff');
+    header('X-Frame-Options: SAMEORIGIN');
+    header('X-XSS-Protection: 1; mode=block');
+    header('Referrer-Policy: strict-origin-when-cross-origin');
+    header('Permissions-Policy: camera=(), microphone=(), geolocation=()');
+    header_remove('X-Powered-By');
+}
+@ini_set('expose_php', 'off');
+
+// 1. Optionele .env inlezing uit de hoofdmap (uitsluitend .env, GEEN .env.example fallback)
 $envVars = [];
-
-// 1. Zoek naar .env of val terug op config/.env.example
-$envCandidates = [
-    __DIR__ . '/../.env',
-    __DIR__ . '/.env.example',
-    __DIR__ . '/../.env.example',
-];
-
-foreach ($envCandidates as $envFile) {
-    if (file_exists($envFile)) {
+$envFile = __DIR__ . '/../.env';
+if (file_exists($envFile)) {
    $lines = file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
    if ($lines !== false) {
        foreach ($lines as $line) {
            $line = trim($line);
-                // Negeer lege regels en commentaarregels (# of //)
            if ($line === '' || str_starts_with($line, '#') || str_starts_with($line, '//')) {
                continue;
            }
            if (strpos($line, '=') !== false) {
                list($name, $value) = explode('=', $line, 2);
                $name = trim($name);
-                    $value = trim($value);
-                    // Verwijder omlijstende aanhalingstekens (" of ')
                $value = trim($value, " \t\n\r\0\x0B\"'");
-
-                    // Sla op in array en zet in globale PHP variabelen
                $envVars[$name] = $value;
                $_ENV[$name] = $value;
                $_SERVER[$name] = $value;
@@ -38,8 +43,6 @@ foreach ($envCandidates as $envFile) {
            }
        }
    }
-        break; // Stop zodra we het eerste geldige bestand hebben ingeladen
-    }
 }

 /**
@@ -65,23 +68,32 @@ if (!function_exists('fociz_env')) {
    }
 }

-// MariaDB Verbindingsgegevens (uit .env of .env.example)
+// =========================================================================
+// 2. CENTRALE DATABASE CONFIGURATIE (DE ENIGE BRON VAN WAARHEID)
+// =========================================================================
 define('DB_HOST', fociz_env('DB_HOST', '192.168.2.33'));
 define('DB_PORT', fociz_env('DB_PORT', '3306'));
-define('DB_NAME', fociz_env('DB_NAME', 'focizdev'));
-define('DB_USER', fociz_env('DB_USER', 'focizdev_user'));
-define('DB_PASS', fociz_env('DB_PASS', 'F0c1z_Dev_Secure_2026!'));
+define('DB_NAME', fociz_env('DB_NAME', 'fociz'));
+define('DB_USER', fociz_env('DB_USER', 'focizlive_user'));
+define('DB_PASS', fociz_env('DB_PASS', 'F0c1z_Live_Secure_2026!'));
 define('DB_CHARSET', 'utf8mb4');

+// =========================================================================
+// 3. APPLICATIE INSTELLINGEN & OMGEVING
+// =========================================================================
+define('APP_NAME', 'Fociz');
+define('APP_ENV', fociz_env('APP_ENV', 'live')); // 'live' of 'development'
+define('APP_SECRET', fociz_env('APP_SECRET', 'fociz-maria-db-super-secret-key-998877'));
+
 // Bepaal de dynamische of geconfigureerde applicatie URL
 if (!function_exists('fociz_detect_app_url')) {
    function fociz_detect_app_url(): string {
        $envUrl = fociz_env('APP_URL');
-        if (!empty($envUrl) && !str_contains($envUrl, 'uw-domein.nl') && !str_contains($envUrl, 'www.fociz.nl')) {
+        if (!empty($envUrl) && !str_contains($envUrl, 'uw-domein.nl')) {
            return rtrim($envUrl, '/');
        }

-        // Dynamische detectie op basis van het huidige domein (werkt direct op dev.fociz.nl én fociz.nl)
+        // Dynamische detectie op basis van het huidige domein (werkt direct op www.fociz.nl én dev.fociz.nl)
        if (!empty($_SERVER['HTTP_HOST'])) {
            $isHttps = (
                (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
@@ -93,22 +105,49 @@ if (!function_exists('fociz_detect_app_url')) {
            return $scheme . $_SERVER['HTTP_HOST'];
        }

-        // Standaard fallback per omgeving
-        return (defined('APP_ENV') && APP_ENV === 'live') ? 'https://fociz.nl' : 'https://dev.fociz.nl';
+        return (defined('APP_ENV') && APP_ENV === 'live') ? 'https://www.fociz.nl' : 'https://dev.fociz.nl';
    }
 }
-
-// Applicatie instellingen
-define('APP_NAME', 'Fociz');
-define('APP_ENV', fociz_env('APP_ENV', 'development')); // 'development' of 'live'
 define('APP_URL', fociz_detect_app_url());
-define('APP_SECRET', fociz_env('APP_SECRET', 'fociz-maria-db-super-secret-key-998877'));

 // Tijdzone
 date_default_timezone_set('Europe/Amsterdam');

-// Foutrapportage: in development tonen we fouten direct op het scherm
-if (APP_ENV !== 'live') {
+// =========================================================================
+// 4. VEILIGE FOUTAFHANDELING & PEN TEST BESCHERMING
+// =========================================================================
+if (APP_ENV === 'live') {
+    ini_set('display_errors', '0');
+    ini_set('display_startup_errors', '0');
+    error_reporting(E_ALL & ~E_DEPRECATED & ~E_STRICT);
+
+    // Registreer een nette noodfoutpagina voor onverhoopte fatale PHP fouten
+    register_shutdown_function(function() {
+        $error = error_get_last();
+        if ($error && in_array($error['type'], [E_ERROR, E_CORE_ERROR, E_COMPILE_ERROR, E_PARSE])) {
+            error_log("Fociz Fatal Error: [{$error['type']}] {$error['message']} in {$error['file']}:{$error['line']}");
+            if (!headers_sent()) {
+                http_response_code(500);
+            }
+            if (isset($_SESSION['user_role']) && $_SESSION['user_role'] === 'ADMIN') {
+                echo "<div style='font-family: monospace; background: #0c0f17; color: #ef4444; padding: 25px; margin: 20px; border-radius: 12px; border: 1px solid #dc2626;'>
+                    <h3>⚠️ Fociz Systeemfout (Alleen zichtbaar voor Beheerder)</h3>
+                    <p><strong>Fout:</strong> " . htmlspecialchars($error['message']) . "</p>
+                    <p><strong>Bestand:</strong> " . htmlspecialchars($error['file']) . " op regel " . $error['line'] . "</p>
+                </div>";
+            } else {
+                echo "<div style='font-family: sans-serif; background: #0c0f17; color: #f8fafc; min-height: 100vh; display: flex; align-items: center; justify-content: center;'>
+                    <div style='max-width: 480px; text-align: center; padding: 40px;'>
+                        <div style='width: 48px; height: 48px; margin: 0 auto 16px; border-radius: 12px; background: rgba(99, 102, 241, 0.1); border: 1px solid rgba(99, 102, 241, 0.3); display: flex; align-items: center; justify-content: center; color: #818cf8; font-weight: bold;'>F</div>
+                        <h2 style='font-size: 20px; margin-bottom: 8px;'>Er is iets misgegaan</h2>
+                        <p style='color: #94a3b8; font-size: 14px; line-height: 1.5;'>De pagina kon niet worden geladen. Probeer de pagina te vernieuwen of log opnieuw in.</p>
+                        <a href='/auth/login.php' style='display: inline-block; margin-top: 20px; padding: 10px 20px; border-radius: 8px; background: #4f46e5; color: white; text-decoration: none; font-size: 13px; font-weight: 600;'>Naar Inloggen</a>
+                    </div>
+                </div>";
+            }
+        }
+    });
+} else {
    ini_set('display_errors', '1');
    ini_set('display_startup_errors', '1');
    error_reporting(E_ALL);
@@ -1,8 +1,14 @@
 <?php
 /**
- * MariaDB PDO Databaseverbinding & Automatische Migratie
+ * MariaDB PDO Databaseverbinding & Automatische Tabellencontrole
 */

+// Blokkeer directe HTTP toegang (Pen Test Beveiliging)
+if (basename($_SERVER['SCRIPT_FILENAME'] ?? '') === 'database.php') {
+    http_response_code(403);
+    exit('Toegang geweigerd.');
+}
+
 require_once __DIR__ . '/config.php';

 function get_db_connection(): PDO {
@@ -15,11 +21,11 @@ function get_db_connection(): PDO {
    // 1. Controleer of de PDO MySQL/MariaDB driver aanwezig is in PHP
    $availableDrivers = PDO::getAvailableDrivers();
    if (!in_array('mysql', $availableDrivers)) {
-        $driversList = !empty($availableDrivers) ? implode(', ', $availableDrivers) : 'geen';
+        error_log("PDO MySQL driver (pdo_mysql) ontbreekt in PHP.");
        die("
-            <div style='font-family: -apple-system, BlinkMacSystemFont, Segoe UI, Roboto, sans-serif; background: #0c0f17; color: #f1f5f9; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 20px;'>
-                <div style='max-width: 580px; background: #111827; border: 1px solid #ef4444; border-radius: 16px; padding: 30px; box-shadow: 0 20px 25px -5px rgba(0,0,0,0.5);'>
-                    <h2 style='color: #ef4444; margin-top: 0;'>⚠️ PHP MySQL Driver Ontbreekt (pdo_mysql)</h2>
+            <div style='font-family: sans-serif; background: #0c0f17; color: #f1f5f9; min-height: 100vh; display: flex; align-items: center; justify-content: center; padding: 20px;'>
+                <div style='max-width: 580px; background: #111827; border: 1px solid #ef4444; border-radius: 16px; padding: 30px;'>
+                    <h2 style='color: #ef4444; margin-top: 0;'>⚠️ Database Driver Ontbreekt</h2>
                    <p style='color: #94a3b8; font-size: 14px;'>De extensie <strong>pdo_mysql</strong> is niet actief in deze PHP-omgeving.</p>
                </div>
            </div>
@@ -45,19 +51,16 @@ function get_db_connection(): PDO {
    );

    // 2. CHECK: Bestaat de database al?
-    // We proberen eerst direct verbinding te maken met de database.
-    // Als de database al bestaat, lukt dit direct zonder database-aanmaakrechten te vereisen!
    try {
        $pdo = new PDO($dsnWithDb, DB_USER, DB_PASS, $options);
-        
-        // De database bestaat al! Controleer enkel of de tabellen al aanwezig zijn
        ensure_tables_exist($pdo);
        return $pdo;

    } catch (PDOException $e) {
+        error_log("MariaDB Verbindingsfout [{$e->getCode()}]: {$e->getMessage()}");
+
        // Foutcode 1049 betekent: Database 'DB_NAME' bestaat nog NIET op de MariaDB server
        if ($e->getCode() == 1049 || str_contains($e->getMessage(), 'Unknown database')) {
-            // Probeer de database eenmalig aan te maken indien de gebruiker CREATE rechten heeft
            try {
                $serverDsn = sprintf('mysql:host=%s;port=%s;charset=%s', DB_HOST, DB_PORT, DB_CHARSET);
                $serverPdo = new PDO($serverDsn, DB_USER, DB_PASS, $options);
@@ -66,32 +69,29 @@ function get_db_connection(): PDO {
                    DB_NAME
                ));
                
-                // Nu opnieuw verbinden met de nieuw aangemaakte database
                $pdo = new PDO($dsnWithDb, DB_USER, DB_PASS, $options);
                ensure_tables_exist($pdo);
                return $pdo;

            } catch (PDOException $createEx) {
-                die("
-                    <div style='font-family: sans-serif; background: #0c0f17; color: #fff; padding: 40px; text-align: center; min-height: 100vh; display: flex; align-items: center; justify-content: center;'>
-                        <div style='max-width: 500px; background: #111827; border: 1px solid #f59e0b; border-radius: 16px; padding: 30px; text-align: left;'>
-                            <h2 style='color: #f59e0b; margin-top: 0;'>⚠️ Database '" . htmlspecialchars(DB_NAME) . "' bestaat nog niet</h2>
-                            <p style='color: #94a3b8; font-size: 14px; line-height: 1.6;'>
-                                De database <strong>" . htmlspecialchars(DB_NAME) . "</strong> bestaat nog niet op MariaDB server <strong>" . htmlspecialchars(DB_HOST) . "</strong> en de gebruiker <em>" . htmlspecialchars(DB_USER) . "</em> heeft geen rechten om automatisch databases aan te maken.
-                            </p>
-                            <p style='color: #cbd5e1; font-size: 13px;'>
-                                Maak de database <code>" . htmlspecialchars(DB_NAME) . "</code> eenmalig aan via phpMyAdmin, HeidiSQL of de MariaDB CLI:
-                            </p>
-                            <code style='display: block; background: #000; color: #4ade80; padding: 10px; border-radius: 8px; font-size: 12px; margin: 10px 0;'>
-                                CREATE DATABASE IF NOT EXISTS `" . htmlspecialchars(DB_NAME) . "` CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
-                            </code>
-                        </div>
-                    </div>
-                ");
+                error_log("Kan database " . DB_NAME . " niet automatisch aanmaken: " . $createEx->getMessage());
            }
        }

-        // Andere verbindingsfout (bijv. verkeerd wachtwoord, poort of host onbereikbaar)
+        // Pen Test beveiliging: in live omgeving geen interne IP's of database-details tonen!
+        if (defined('APP_ENV') && APP_ENV === 'live') {
+            die("
+                <div style='font-family: sans-serif; background: #0c0f17; color: #fff; padding: 40px; text-align: center; min-height: 100vh; display: flex; align-items: center; justify-content: center;'>
+                    <div style='max-width: 480px; background: #111827; border: 1px solid #334155; border-radius: 16px; padding: 30px; text-align: center;'>
+                        <div style='width: 48px; height: 48px; margin: 0 auto 16px; border-radius: 12px; background: rgba(239, 68, 68, 0.1); border: 1px solid rgba(239, 68, 68, 0.3); display: flex; align-items: center; justify-content: center; color: #f87171; font-weight: bold;'>⚠️</div>
+                        <h2 style='color: #f87171; margin-top: 0; font-size: 18px;'>Database Tijdelijk Niet Bereikbaar</h2>
+                        <p style='color: #94a3b8; font-size: 13px; line-height: 1.6;'>
+                            Er kon geen veilige verbinding tot stand worden gebracht met de database. Probeer het over enkele ogenblikken opnieuw.
+                        </p>
+                    </div>
+                </div>
+            ");
+        } else {
            die("
                <div style='font-family: sans-serif; background: #0c0f17; color: #fff; padding: 40px; text-align: center; min-height: 100vh; display: flex; align-items: center; justify-content: center;'>
                    <div style='max-width: 520px; background: #111827; border: 1px solid #ef4444; border-radius: 16px; padding: 30px; text-align: left;'>
@@ -107,41 +107,55 @@ function get_db_connection(): PDO {
                </div>
            ");
        }
+    }
 }

 /**
- * Zorgt ervoor dat alle benodigde tabellen uit schema.sql aanwezig zijn in MariaDB
- * Voert niets uit als de tabellen al bestaan!
+ * Zorgt ervoor dat ALLE benodigde tabellen en kolommen uit schema.sql aanwezig zijn in MariaDB
+ * Voert elke tabel individueel uit zodat ontbrekende tabellen direct aangemaakt worden.
 */
 function ensure_tables_exist(PDO $pdo): void {
-    try {
-        // Controleer of de hoofdtabel 'users' al bestaat
-        $result = $pdo->query("SHOW TABLES LIKE 'users'");
-        if ($result && $result->rowCount() > 0) {
-            // Tabellen bestaan al. Voer eventuele niet-destructieve kolom-upgrades uit indien nodig
-            try {
-                $pdo->exec("ALTER TABLE tasks MODIFY external_id VARCHAR(255) NULL");
-            } catch (Throwable $t) {
-                // Kolom bestaat wellicht al of heeft al de juiste lengte
-            }
-            return;
-        }
+    static $tablesChecked = false;
+    if ($tablesChecked) return;
+    $tablesChecked = true;

-        // Tabellen ontbreken nog: voer schema.sql uit statement voor statement
+    try {
        $schemaFile = file_exists(__DIR__ . '/schema.sql') ? (__DIR__ . '/schema.sql') : (__DIR__ . '/../schema.sql');
        if (file_exists($schemaFile)) {
            $sql = file_get_contents($schemaFile);
            $statements = array_filter(array_map('trim', explode(';', $sql)));
            foreach ($statements as $stmt) {
-                // Verwijder eventuele SQL commentaren aan het begin
                $stmtClean = preg_replace('/^--.*$/m', '', $stmt);
                $stmtClean = trim($stmtClean);
                if (!empty($stmtClean)) {
+                    try {
                        $pdo->exec($stmtClean);
+                    } catch (Throwable $t) {
+                        // Stil negeren indien tabel of relatie al bestaat
                    }
                }
            }
-    } catch (Exception $e) {
-        error_log("Fout bij aanmaken tabellen: " . $e->getMessage());
+        }
+
+        // Zorg ervoor dat alle kolommen en upgrades aanwezig zijn
+        $colUpgrades = [
+            "ALTER TABLE tasks MODIFY external_id VARCHAR(255) NULL",
+            "ALTER TABLE tasks ADD COLUMN external_url TEXT NULL AFTER external_id",
+            "ALTER TABLE users ADD COLUMN remember_token VARCHAR(64) NULL AFTER backup_codes",
+            "ALTER TABLE users ADD COLUMN remember_token_expires_at DATETIME NULL AFTER remember_token",
+            "ALTER TABLE users ADD COLUMN notification_settings TEXT NULL AFTER remember_token_expires_at",
+            "ALTER TABLE users ADD COLUMN theme VARCHAR(20) NOT NULL DEFAULT 'dark' AFTER notification_settings",
+            "ALTER TABLE users ADD COLUMN avatar_url VARCHAR(255) NULL AFTER theme",
+            "ALTER TABLE users ADD COLUMN backup_codes TEXT NULL AFTER two_factor_enabled",
+        ];
+        foreach ($colUpgrades as $sql) {
+            try {
+                $pdo->exec($sql);
+            } catch (Throwable $t) {
+                // Stil negeren indien kolom al bestaat
+            }
+        }
+    } catch (Throwable $e) {
+        error_log("Fout bij controleren tabellen: " . $e->getMessage());
    }
 }
@@ -0,0 +1,3 @@
+<?php
+http_response_code(403);
+exit('Toegang geweigerd.');
@@ -3,6 +3,11 @@
 * Authenticatie & Autorisatie Guard voor Fociz
 */

+if (basename($_SERVER['SCRIPT_FILENAME'] ?? '') === 'auth.php') {
+    http_response_code(403);
+    exit('Toegang geweigerd.');
+}
+
 require_once __DIR__ . '/../config/database.php';
 require_once __DIR__ . '/totp.php';

@@ -0,0 +1,3 @@
+<?php
+http_response_code(403);
+exit('Toegang geweigerd.');
@@ -43,11 +43,16 @@ $formattedSelectedDate = $dutchFullDays[(int)date('N', $selectedTs)] . ' ' . dat
 $formattedWeekRange = date('j', $mondayTs) . ' ' . $dutchShortMonths[(int)date('n', $mondayTs)] . ' – ' . date('j', $sundayTs) . ' ' . $dutchShortMonths[(int)date('n', $sundayTs)] . ' ' . date('Y', $sundayTs);

 // 1. Haal integratiestatussen op
-$stmtInt = $db->prepare("SELECT * FROM integrations WHERE user_id = ?");
-$stmtInt->execute([$userId]);
 $userIntegrations = [];
-foreach ($stmtInt->fetchAll() as $row) {
+try {
+    $stmtInt = $db->prepare("SELECT * FROM integrations WHERE user_id = ?");
+    $stmtInt->execute([$userId]);
+    foreach ($stmtInt->fetchAll() as $row) {
        $userIntegrations[$row['provider']] = $row;
+    }
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen integraties: " . $e->getMessage());
+    ensure_tables_exist($db);
 }

 $isOutlookConnected = !empty($userIntegrations['OUTLOOK']['access_token']) && empty($userIntegrations['OUTLOOK']['is_demo_mode']);
@@ -58,12 +63,18 @@ $weekOutlookEvents = [];
 $isLiveOutlook = false;

 if ($isOutlookConnected) {
+    try {
        // Haal afspraken op voor het volledige datumbereik van de week
        $weekOutlookEvents = microsoft_fetch_events_range($userId, $weekStart, $weekEnd);
        $isLiveOutlook = true;

        // Synchroniseer / reconcilieer Fociz taken direct met actuele Outlook data
        microsoft_reconcile_tasks_with_outlook($userId, $weekStart, $weekEnd, $weekOutlookEvents);
+    } catch (Throwable $e) {
+        error_log("Outlook synchronisatiefout in planner: " . $e->getMessage());
+        $isLiveOutlook = false;
+        $weekOutlookEvents = [];
+    }
 } else {
    // Demo data indien Microsoft Outlook nog niet gekoppeld is
    $weekOutlookEvents = [
@@ -101,45 +112,64 @@ if ($isOutlookConnected) {
 }

 // 2. Haal dagplanning op of maak aan voor $selectedDate
-$stmtPlan = $db->prepare("SELECT * FROM daily_plans WHERE user_id = ? AND plan_date = ?");
-$stmtPlan->execute([$userId, $selectedDate]);
-$dailyPlan = $stmtPlan->fetch();
+$dailyPlan = null;
+try {
+    $stmtPlan = $db->prepare("SELECT * FROM daily_plans WHERE user_id = ? AND plan_date = ?");
+    $stmtPlan->execute([$userId, $selectedDate]);
+    $dailyPlan = $stmtPlan->fetch();

-if (!$dailyPlan) {
+    if (!$dailyPlan) {
        $defaultGoal = ($selectedDate === $today) ? 'Mijn belangrijkste doel van vandaag behalen' : 'Focusdoel voor deze dag bepalen';
        $stmtCreatePlan = $db->prepare("
            INSERT INTO daily_plans (user_id, plan_date, focus_goal) 
            VALUES (?, ?, ?)
+            ON DUPLICATE KEY UPDATE id=LAST_INSERT_ID(id)
        ");
        $stmtCreatePlan->execute([$userId, $selectedDate, $defaultGoal]);
        $planId = (int)$db->lastInsertId();
        $dailyPlan = ['id' => $planId, 'plan_date' => $selectedDate, 'focus_goal' => $defaultGoal, 'notes' => ''];
+    }
+} catch (Throwable $e) {
+    error_log("Fout bij dagplanning ophalen/aanmaken: " . $e->getMessage());
+    ensure_tables_exist($db);
+    $dailyPlan = ['id' => 0, 'plan_date' => $selectedDate, 'focus_goal' => 'Mijn belangrijkste doel van vandaag behalen', 'notes' => ''];
 }

+$planId = !empty($dailyPlan['id']) ? (int)$dailyPlan['id'] : 0;
+
 // 3. Haal taken op voor de geselecteerde dag (vers bijgewerkt na eventuele reconciliatie)
-$stmtTasks = $db->prepare("
+$tasks = [];
+try {
+    $stmtTasks = $db->prepare("
        SELECT * FROM tasks 
        WHERE user_id = ? AND (daily_plan_id = ? " . ($selectedDate === $today ? "OR daily_plan_id IS NULL" : "") . ")
        ORDER BY is_completed ASC, priority ASC, time_block_start ASC, created_at DESC
-");
-$stmtTasks->execute([$userId, $dailyPlan['id']]);
-$tasks = $stmtTasks->fetchAll();
+    ");
+    $stmtTasks->execute([$userId, $planId]);
+    $tasks = $stmtTasks->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen taken: " . $e->getMessage());
+}

 // 4. Haal weekstatistieken voor taken op (aantal per dag)
-$stmtWeekTasks = $db->prepare("
+$weekTaskStats = [];
+try {
+    $stmtWeekTasks = $db->prepare("
        SELECT dp.plan_date, COUNT(t.id) as total_tasks, SUM(CASE WHEN t.is_completed = 1 THEN 1 ELSE 0 END) as completed_tasks
        FROM daily_plans dp
        LEFT JOIN tasks t ON t.daily_plan_id = dp.id AND t.user_id = ?
        WHERE dp.user_id = ? AND dp.plan_date BETWEEN ? AND ?
        GROUP BY dp.plan_date
-");
-$stmtWeekTasks->execute([$userId, $userId, $weekStart, $weekEnd]);
-$weekTaskStats = [];
-foreach ($stmtWeekTasks->fetchAll() as $row) {
+    ");
+    $stmtWeekTasks->execute([$userId, $userId, $weekStart, $weekEnd]);
+    foreach ($stmtWeekTasks->fetchAll() as $row) {
        $weekTaskStats[$row['plan_date']] = [
            'total' => (int)$row['total_tasks'],
            'completed' => (int)$row['completed_tasks'],
        ];
+    }
+} catch (Throwable $e) {
+    error_log("Fout bij weekstatistieken ophalen: " . $e->getMessage());
 }

 // Groepeer Outlook afspraken per datum
@@ -174,9 +204,15 @@ for ($i = 0; $i < 7; $i++) {
 }

 // 5. Haal Jira issues op voor de snelle import widget
-$jiraData = jira_get_user_issues($userId);
-$jiraIssues = $jiraData['issues'] ?? [];
-$isJiraLive = !empty($jiraData['success']) && empty($jiraData['is_demo']);
+$jiraIssues = [];
+$isJiraLive = false;
+try {
+    $jiraData = jira_get_user_issues($userId);
+    $jiraIssues = $jiraData['issues'] ?? [];
+    $isJiraLive = !empty($jiraData['success']) && empty($jiraData['is_demo']);
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen Jira issues: " . $e->getMessage());
+}

 // Filter Outlook events die afkomstig zijn van Fociz taken voor de geselecteerde dag om duplicaten op de tijdlijn te voorkomen
 $dayOutlookEvents = $outlookEventsByDate[$selectedDate] ?? [];
@@ -27,10 +27,15 @@ if ($selectedStatus !== 'ALL') {
    $params[] = $selectedStatus;
 }

-$sql .= " ORDER BY r.quarter ASC, r.priority DESC, r.due_date ASC";
-$stmt = $db->prepare($sql);
-$stmt->execute($params);
-$roadmapItems = $stmt->fetchAll();
+$roadmapItems = [];
+try {
+    $stmt = $db->prepare($sql);
+    $stmt->execute($params);
+    $roadmapItems = $stmt->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen roadmap items: " . $e->getMessage());
+    ensure_tables_exist($db);
+}

 $quarters = ['Q1', 'Q2', 'Q3', 'Q4'];
 ?>
@@ -55,15 +55,26 @@ if (isset($_GET['delete_user'])) {
 }

 // Haal alle gebruikers op
-$users = $db->query("SELECT * FROM users ORDER BY created_at DESC")->fetchAll();
+$users = [];
+try {
+    $users = $db->query("SELECT * FROM users ORDER BY created_at DESC")->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen gebruikers: " . $e->getMessage());
+}

 // Haal alle uitnodigingen op
-$invites = $db->query("
+$invites = [];
+try {
+    $invites = $db->query("
        SELECT i.*, u.name as inviter_name 
        FROM invites i 
        JOIN users u ON i.created_by_id = u.id 
        ORDER BY i.created_at DESC
-")->fetchAll();
+    ")->fetchAll() ?: [];
+} catch (Throwable $e) {
+    error_log("Fout bij ophalen uitnodigingen: " . $e->getMessage());
+    ensure_tables_exist($db);
+}

 $pageTitle = 'Team & Uitnodigingen — Fociz';
 require_once __DIR__ . '/includes/header.php';
Author	SHA1	Message	Date
NiekRabelink	5bdaa5fa6e	Fix HTTP 500 on live after login, unify database config in config.php, sanitize env example, and harden pentest security	2026-09-09 17:52:11 +02:00
NiekRabelink	919dbe4aed	Update config/config.php	2026-09-09 14:51:33 +00:00
NiekRabelink	dc28322e98	Update config/.env.example	2026-09-09 14:50:54 +00:00