209 lines
9.9 KiB
PHP
209 lines
9.9 KiB
PHP
<?php
|
|
/**
|
|
* Fociz Centrale Applicatie- en Databaseconfiguratie
|
|
* Alle configuratie staat overzichtelijk en veilig in dit ene bestand.
|
|
*/
|
|
|
|
// Blokkeer directe HTTP toegang tot dit configuratiebestand (Pen Test Beveiliging)
|
|
if (basename($_SERVER['SCRIPT_FILENAME'] ?? '') === 'config.php') {
|
|
http_response_code(403);
|
|
exit('Toegang geweigerd.');
|
|
}
|
|
|
|
// Stuur direct strenge beveiligingsheaders mee op elk verzoek (Pen Test Beveiliging)
|
|
if (!headers_sent()) {
|
|
header('X-Content-Type-Options: nosniff');
|
|
header('X-Frame-Options: SAMEORIGIN');
|
|
header('X-XSS-Protection: 1; mode=block');
|
|
header('Referrer-Policy: strict-origin-when-cross-origin');
|
|
header('Permissions-Policy: camera=(), microphone=(), geolocation=()');
|
|
header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.tailwindcss.com https://unpkg.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' data: https://fonts.gstatic.com; img-src 'self' data: https:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'");
|
|
if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
|
|
header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
|
|
}
|
|
header_remove('X-Powered-By');
|
|
}
|
|
@ini_set('expose_php', 'off');
|
|
|
|
// 1. .env inlezing (controleert eerst server root .env en dan config/.env)
|
|
$envVars = [];
|
|
$envLocations = [__DIR__ . '/../.env', __DIR__ . '/.env'];
|
|
foreach ($envLocations as $envFile) {
|
|
if (file_exists($envFile)) {
|
|
$lines = file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
|
|
if ($lines !== false) {
|
|
foreach ($lines as $line) {
|
|
$line = trim($line);
|
|
if ($line === '' || str_starts_with($line, '#') || str_starts_with($line, '//')) {
|
|
continue;
|
|
}
|
|
if (strpos($line, '=') !== false) {
|
|
list($name, $value) = explode('=', $line, 2);
|
|
$name = trim($name);
|
|
$value = trim($value, " \t\n\r\0\x0B\"'");
|
|
$envVars[$name] = $value;
|
|
$_ENV[$name] = $value;
|
|
$_SERVER[$name] = $value;
|
|
@putenv("{$name}={$value}");
|
|
}
|
|
}
|
|
}
|
|
break; // Eerste gevonden .env bestand is leidend
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Veilige helper om een omgevingsvariabele op te vragen
|
|
*/
|
|
if (!function_exists('fociz_env')) {
|
|
function fociz_env(string $key, $default = null) {
|
|
global $envVars;
|
|
if (isset($envVars[$key]) && $envVars[$key] !== '') {
|
|
return $envVars[$key];
|
|
}
|
|
if (isset($_ENV[$key]) && $_ENV[$key] !== '') {
|
|
return $_ENV[$key];
|
|
}
|
|
if (isset($_SERVER[$key]) && $_SERVER[$key] !== '') {
|
|
return $_SERVER[$key];
|
|
}
|
|
$val = @getenv($key);
|
|
if ($val !== false && $val !== '') {
|
|
return $val;
|
|
}
|
|
return $default;
|
|
}
|
|
}
|
|
|
|
// =========================================================================
|
|
// 2. APPLICATIE INSTELLINGEN & OMGEVINGSDETECTIE
|
|
// =========================================================================
|
|
define('APP_NAME', 'Fociz');
|
|
|
|
// Automatische omgevingsdetectie:
|
|
// 1. Hostname/domeinnaam is altijd leidend voor productiebeveiliging
|
|
$detectedHost = strtolower($_SERVER['HTTP_HOST'] ?? '');
|
|
$isDevHost = (
|
|
str_contains($detectedHost, 'dev.') ||
|
|
str_contains($detectedHost, 'localhost') ||
|
|
str_contains($detectedHost, '127.0.0.1')
|
|
);
|
|
$isLiveHost = (
|
|
!empty($detectedHost) &&
|
|
!$isDevHost &&
|
|
(str_contains($detectedHost, 'fociz.nl') || str_contains($detectedHost, 'live'))
|
|
);
|
|
|
|
// Bepaal APP_ENV: op live domeinen (bijv. www.fociz.nl of fociz.nl) ALTIJD 'live'
|
|
// zodat een per ongeluk meegekomen dev-configuratie NOOIT productie kan beïnvloeden.
|
|
if ($isLiveHost) {
|
|
$effectiveEnv = 'live';
|
|
} elseif ($isDevHost) {
|
|
$effectiveEnv = 'development';
|
|
} else {
|
|
$effectiveEnv = fociz_env('APP_ENV', 'live');
|
|
}
|
|
define('APP_ENV', $effectiveEnv);
|
|
define('APP_SECRET', fociz_env('APP_SECRET', 'fociz-maria-db-super-secret-key-998877'));
|
|
|
|
// =========================================================================
|
|
// 3. CENTRALE DATABASE CONFIGURATIE (OMGEVINGSAFHANKELIJK & GIT-VEILIG)
|
|
// =========================================================================
|
|
$isDevEnv = (APP_ENV === 'development');
|
|
define('DB_HOST', fociz_env('DB_HOST', '192.168.2.33'));
|
|
define('DB_PORT', fociz_env('DB_PORT', '3306'));
|
|
|
|
// Veiligheidswaarborg: op het live domein of live omgeving NOOIT per ongeluk de dev database gebruiken
|
|
if ($isLiveHost || APP_ENV === 'live') {
|
|
$rawDbName = fociz_env('DB_NAME');
|
|
$rawDbUser = fociz_env('DB_USER');
|
|
$rawDbPass = fociz_env('DB_PASS');
|
|
|
|
define('DB_NAME', (!empty($rawDbName) && $rawDbName !== 'focizdev') ? $rawDbName : 'fociz');
|
|
define('DB_USER', (!empty($rawDbUser) && $rawDbUser !== 'focizdev_user') ? $rawDbUser : 'focizlive_user');
|
|
define('DB_PASS', (!empty($rawDbPass) && $rawDbPass !== 'F0c1z_Dev_Secure_2026!') ? $rawDbPass : 'F0c1z_Live_Secure_2026!');
|
|
} else {
|
|
define('DB_NAME', fociz_env('DB_NAME', 'focizdev'));
|
|
define('DB_USER', fociz_env('DB_USER', 'focizdev_user'));
|
|
define('DB_PASS', fociz_env('DB_PASS', 'F0c1z_Dev_Secure_2026!'));
|
|
}
|
|
define('DB_CHARSET', 'utf8mb4');
|
|
|
|
// Bepaal de dynamische of geconfigureerde applicatie URL
|
|
if (!function_exists('fociz_detect_app_url')) {
|
|
function fociz_detect_app_url(): string {
|
|
$envUrl = fociz_env('APP_URL');
|
|
if (!empty($envUrl) && !str_contains($envUrl, 'uw-domein.nl')) {
|
|
return rtrim($envUrl, '/');
|
|
}
|
|
|
|
// Dynamische detectie op basis van het huidige domein (werkt direct op www.fociz.nl én dev.fociz.nl)
|
|
if (!empty($_SERVER['HTTP_HOST'])) {
|
|
$isHttps = (
|
|
(!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ||
|
|
(!empty($_SERVER['HTTP_X_FORWARDED_PROTO']) && strtolower($_SERVER['HTTP_X_FORWARDED_PROTO']) === 'https') ||
|
|
(!empty($_SERVER['HTTP_X_FORWARDED_SSL']) && $_SERVER['HTTP_X_FORWARDED_SSL'] === 'on') ||
|
|
(isset($_SERVER['SERVER_PORT']) && (int)$_SERVER['SERVER_PORT'] === 443)
|
|
);
|
|
$scheme = $isHttps ? 'https://' : 'http://';
|
|
return $scheme . $_SERVER['HTTP_HOST'];
|
|
}
|
|
|
|
return (defined('APP_ENV') && APP_ENV === 'live') ? 'https://www.fociz.nl' : 'https://dev.fociz.nl';
|
|
}
|
|
}
|
|
define('APP_URL', fociz_detect_app_url());
|
|
|
|
// Tijdzone
|
|
date_default_timezone_set('Europe/Amsterdam');
|
|
|
|
// =========================================================================
|
|
// 3b. SMTP MAIL SERVER CONFIGURATIE
|
|
// =========================================================================
|
|
define('SMTP_HOST', fociz_env('SMTP_HOST', 'mail.fociz.nl'));
|
|
define('SMTP_PORT', (int)fociz_env('SMTP_PORT', 587));
|
|
define('SMTP_USER', fociz_env('SMTP_USER', 'info@fociz.nl'));
|
|
define('SMTP_PASS', fociz_env('SMTP_PASS', '6swpQSBg5uWFmjar7F6a'));
|
|
define('SMTP_SECURE', fociz_env('SMTP_SECURE', 'tls')); // 'tls' (STARTTLS port 587) of 'ssl' (port 465)
|
|
define('SMTP_FROM_EMAIL', fociz_env('SMTP_FROM_EMAIL', 'info@fociz.nl'));
|
|
define('SMTP_FROM_NAME', fociz_env('SMTP_FROM_NAME', 'Fociz'));
|
|
define('SMTP_REPLY_TO', fociz_env('SMTP_REPLY_TO', 'info@fociz.nl'));
|
|
|
|
// =========================================================================
|
|
// 4. VEILIGE FOUTAFHANDELING & PEN TEST BESCHERMING
|
|
// =========================================================================
|
|
if (APP_ENV === 'live') {
|
|
ini_set('display_errors', '0');
|
|
ini_set('display_startup_errors', '0');
|
|
error_reporting(E_ALL & ~E_DEPRECATED & ~E_STRICT);
|
|
|
|
// Registreer een nette noodfoutpagina voor onverhoopte fatale PHP fouten
|
|
register_shutdown_function(function() {
|
|
$error = error_get_last();
|
|
if ($error && in_array($error['type'], [E_ERROR, E_CORE_ERROR, E_COMPILE_ERROR, E_PARSE])) {
|
|
error_log("Fociz Fatal Error: [{$error['type']}] {$error['message']} in {$error['file']}:{$error['line']}");
|
|
$showDiagnostics = (isset($_SESSION['user_role']) && $_SESSION['user_role'] === 'ADMIN');
|
|
if ($showDiagnostics) {
|
|
echo "<div style='font-family: monospace; background: #0c0f17; color: #ef4444; padding: 25px; margin: 20px; border-radius: 12px; border: 1px solid #dc2626;'>
|
|
<h3>⚠️ Fociz Systeemfout (Diagnostiek)</h3>
|
|
<p><strong>Fout:</strong> " . htmlspecialchars($error['message']) . "</p>
|
|
<p><strong>Bestand:</strong> " . htmlspecialchars($error['file']) . " op regel " . $error['line'] . "</p>
|
|
</div>";
|
|
} else {
|
|
echo "<div style='font-family: sans-serif; background: #0c0f17; color: #f8fafc; min-height: 100vh; display: flex; align-items: center; justify-content: center;'>
|
|
<div style='max-width: 480px; text-align: center; padding: 40px;'>
|
|
<div style='width: 48px; height: 48px; margin: 0 auto 16px; border-radius: 12px; background: rgba(99, 102, 241, 0.1); border: 1px solid rgba(99, 102, 241, 0.3); display: flex; align-items: center; justify-content: center; color: #818cf8; font-weight: bold;'>F</div>
|
|
<h2 style='font-size: 20px; margin-bottom: 8px;'>Er is iets misgegaan</h2>
|
|
<p style='color: #94a3b8; font-size: 14px; line-height: 1.5;'>De pagina kon niet worden geladen. Probeer de pagina te vernieuwen of log opnieuw in.</p>
|
|
<a href='/auth/login.php' style='display: inline-block; margin-top: 20px; padding: 10px 20px; border-radius: 8px; background: #4f46e5; color: white; text-decoration: none; font-size: 13px; font-weight: 600;'>Naar Inloggen</a>
|
|
</div>
|
|
</div>";
|
|
}
|
|
}
|
|
});
|
|
} else {
|
|
ini_set('display_errors', '1');
|
|
ini_set('display_startup_errors', '1');
|
|
error_reporting(E_ALL);
|
|
}
|