Merge pull request 'Dev' (#2) from dev into main

Reviewed-on: #2

auth.php

@@ -0,0 +1,91 @@
+<?php
+/**
+ * Web & PC Studio - Authenticatie & Beveiligingsmodule
+ * Veilig sessiebeheer, CSRF-protectie en one-way cryptografische verificatie.
+ */
+
+// Veilige sessie instellingen
+if (session_status() === PHP_SESSION_NONE) {
+    ini_set('session.cookie_httponly', '1');
+    ini_set('session.use_only_cookies', '1');
+    ini_set('session.cookie_samesite', 'Strict');
+    if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
+        ini_set('session.cookie_secure', '1');
+    }
+    session_start();
+}
+
+// One-way cryptografische hashes (Nooit plaintext opgeslagen)
+define('AUTH_USER_HASH', 'ef8d40929f6f50e1f52009fbe94cf5a81b8373b90ed2bd130e85dcb4169c5cb4');
+define('AUTH_PASS_HASH', '$2y$12$RQFrfxgd5ZiHQAcMX2DDluDW072QG/aDTDE50ORz3drcNnbZzl0AK');
+
+/**
+ * Controleert of de huidige bezoeker geauthenticeerd is.
+ */
+function is_logged_in() {
+    if (!empty($_SESSION['wpc_auth']) && $_SESSION['wpc_auth'] === true) {
+        // Sessie timeout na 2 uur inactiviteit
+        if (isset($_SESSION['wpc_last_activity']) && (time() - $_SESSION['wpc_last_activity'] > 7200)) {
+            logout();
+            return false;
+        }
+        $_SESSION['wpc_last_activity'] = time();
+        return true;
+    }
+    return false;
+}
+
+/**
+ * Blokkeert ongeautoriseerde toegang en stuurt door naar het inlogscherm.
+ */
+function require_auth() {
+    if (!is_logged_in()) {
+        // Als het een asynchrone AJAX aanroep is, geef HTTP 401 Unauthorized
+        if (!empty($_SERVER['HTTP_X_REQUESTED_WITH']) || isset($_GET['action']) || isset($_GET['api'])) {
+            header('HTTP/1.1 401 Unauthorized');
+            header('Content-Type: application/json; charset=utf-8');
+            echo json_encode(['status' => 'unauthorized', 'message' => 'Sessie verlopen of niet ingelogd.']);
+            exit;
+        }
+
+        $redirect = urlencode($_SERVER['REQUEST_URI'] ?? 'index.php');
+        header("Location: login.php?redirect={$redirect}");
+        exit;
+    }
+}
+
+/**
+ * Genereert een CSRF token voor formulieren.
+ */
+function get_csrf_token() {
+    if (empty($_SESSION['wpc_csrf'])) {
+        $_SESSION['wpc_csrf'] = bin2hex(random_bytes(32));
+    }
+    return $_SESSION['wpc_csrf'];
+}
+
+/**
+ * Valideert het ingediende CSRF token.
+ */
+function verify_csrf_token($token) {
+    if (empty($_SESSION['wpc_csrf']) || empty($token)) {
+        return false;
+    }
+    return hash_equals($_SESSION['wpc_csrf'], $token);
+}
+
+/**
+ * Beëindigt de sessie en ruimt cookies op.
+ */
+function logout() {
+    $_SESSION = [];
+    if (ini_get("session.use_cookies")) {
+        $params = session_get_cookie_params();
+        setcookie(session_name(), '', time() - 42000,
+            $params["path"], $params["domain"],
+            $params["secure"], $params["httponly"]
+        );
+    }
+    @session_destroy();
+}
+

index.php

@@ -4,6 +4,9 @@
  * Hoofdpagina voor status, runtime verificatie en Git webhook deployment tests.
  */
 
+require_once __DIR__ . '/auth.php';
+require_auth();
+
 // Snelle API responder voor AJAX pings
 if (isset($_GET['api']) && $_GET['api'] === 'status') {
     header('Content-Type: application/json; charset=utf-8');
@@ -23,9 +26,10 @@ date_default_timezone_set('Europe/Amsterdam');
 $serverTime = date('d-m-Y H:i:s');
 $phpVersion = PHP_VERSION;
 $serverSoftware = $_SERVER['SERVER_SOFTWARE'] ?? 'Apache / Nginx';
-$host = $_SERVER['HTTP_HOST'] ?? 'www.webenpcstudio.nl';
+$host = $_SERVER['HTTP_HOST'] ?? 'server.webenpcstudio.nl';
 $clientIp = $_SERVER['REMOTE_ADDR'] ?? 'Onbekend';
 $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'HTTPS' : 'HTTP';
+$loggedUser = $_SESSION['wpc_user_email'] ?? 'niek.rabelink@gmail.com';
 
 // Git repository inspectie (met veilige fallback)
 $activeBranch = 'dev';
@@ -91,9 +95,10 @@ if (empty($commits)) {
             </div>
             <div class="nav-status">
                 <button class="btn btn-secondary btn-sm theme-btn" onclick="toggleTheme()">🌙 Thema</button>
+                <a href="logout.php" class="btn btn-secondary btn-sm" style="color: #f87171;" title="Veilig uitloggen">🚪 Uitloggen</a>
                 <span class="nav-badge">
                     <span class="pulse-dot"></span>
-                    Git Live
+                    server.webenpcstudio.nl
                 </span>
             </div>
         </nav>
@@ -102,7 +107,7 @@ if (empty($commits)) {
         <header class="hero">
             <h1>Systeem Dashboard &amp; Git Status</h1>
             <p>
-                Realtime omgevingsstatus, Git webhook deploy-verificatie en server-runtime monitoring voor www.webenpcstudio.nl.
+                Realtime omgevingsstatus, Git webhook deploy-verificatie en server-runtime monitoring voor <strong>server.webenpcstudio.nl</strong>.
             </p>
         </header>
 

lab.php

@@ -4,6 +4,9 @@
  * Diepgaande diagnostische suite voor CPU, NVMe Disk I/O, RAM en HTTP Concurrency.
  */
 
+require_once __DIR__ . '/auth.php';
+require_auth();
+
 // Helper functies voor benchmarks
 function benchmarkCPU() {
     $start = microtime(true);
@@ -387,6 +390,7 @@ $serverSoftware = $_SERVER['SERVER_SOFTWARE'] ?? 'Apache / Nginx';
                 <button class="btn btn-secondary btn-sm" id="sound-btn" onclick="toggleAudio()" title="Schakel geluid in/uit">
                     <span id="sound-icon">🔈</span> Geluid: <span id="sound-status">Uit</span>
                 </button>
+                <a href="logout.php" class="btn btn-secondary btn-sm" style="color: #f87171;" title="Veilig uitloggen">🚪 Uitloggen</a>
             </div>
         </nav>
 
@@ -403,7 +407,7 @@ $serverSoftware = $_SERVER['SERVER_SOFTWARE'] ?? 'Apache / Nginx';
             <div style="flex: 1; min-width: 280px;">
                 <h2 style="font-size: 1.3rem; color: var(--text-main); margin-bottom: 6px;">⚡ Volledige Server Benchmark</h2>
                 <p style="font-size: 0.88rem; color: var(--text-muted); margin-bottom: 18px;">
-                    Voert in één geautomatiseerde cyclus alle 5 hardware- &amp; softwaretests uit op www.webenpcstudio.nl.
+                    Voert in één geautomatiseerde cyclus alle 5 hardware- &amp; softwaretests uit op <strong>server.webenpcstudio.nl</strong>.
                 </p>
                 <div style="display: flex; gap: 8px; align-items: center; flex-wrap: wrap;">
                     <button class="btn btn-primary" id="btn-run-all" onclick="runFullBenchmark()">
@@ -900,7 +904,7 @@ $serverSoftware = $_SERVER['SERVER_SOFTWARE'] ?? 'Apache / Nginx';
 
         function copyReport() {
             let report = "=== WEB & PC STUDIO - WEBSERVER BENCHMARK RAPPORT ===\n" +
-                `Domein: www.webenpcstudio.nl\n` +
+                `Domein: server.webenpcstudio.nl\n` +
                 `Datum: ${new Date().toLocaleString('nl-NL')}\n\n`;
 
             if (lastReport) {

login.php

@@ -0,0 +1,287 @@
+<?php
+/**
+ * Web & PC Studio - Beveiligd Inlogscherm
+ * Server-side authenticatie voor server.webenpcstudio.nl met brute-force protectie.
+ */
+
+require_once __DIR__ . '/auth.php';
+
+// Als gebruiker al ingelogd is, direct doorsturen
+if (is_logged_in()) {
+    header('Location: index.php');
+    exit;
+}
+
+$error = '';
+$lockoutTime = 300; // 5 minuten blokkade bij te veel pogingen
+
+// Initialiseer rate limiting
+if (!isset($_SESSION['login_attempts'])) {
+    $_SESSION['login_attempts'] = 0;
+    $_SESSION['last_attempt_time'] = time();
+}
+
+// Controleer of de gebruiker tijdelijk geblokkeerd is
+if ($_SESSION['login_attempts'] >= 5) {
+    $timePassed = time() - $_SESSION['last_attempt_time'];
+    if ($timePassed < $lockoutTime) {
+        $remaining = ceil(($lockoutTime - $timePassed) / 60);
+        $error = "Te veel mislukte inlogpogingen. Probeer het over {$remaining} minuten opnieuw.";
+    } else {
+        // Reset na verloop van blokkade
+        $_SESSION['login_attempts'] = 0;
+    }
+}
+
+// Verwerk inlogverzoek
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && empty($error)) {
+    $csrfToken = $_POST['csrf_token'] ?? '';
+    $username = trim($_POST['username'] ?? '');
+    $password = $_POST['password'] ?? '';
+
+    // Kleine vertraging tegen timing-aanvallen
+    usleep(200000);
+
+    if (!verify_csrf_token($csrfToken)) {
+        $error = 'Beveiligingstoken (CSRF) ongeldig of verlopen. Ververs de pagina.';
+    } else {
+        // Vergelijk gebruikersnaam hash (timing-safe) en wachtwoord via bcrypt
+        $userMatches = hash_equals(AUTH_USER_HASH, hash('sha256', strtolower($username)));
+        $passMatches = password_verify($password, AUTH_PASS_HASH);
+
+        if ($userMatches && $passMatches) {
+            // Sessie fixatie voorkomen via regeneratie
+            session_regenerate_id(true);
+
+            $_SESSION['wpc_auth'] = true;
+            $_SESSION['wpc_user_email'] = htmlspecialchars($username);
+            $_SESSION['wpc_last_activity'] = time();
+            $_SESSION['login_attempts'] = 0;
+
+            // Veilige doorverwijzing
+            $redirect = $_GET['redirect'] ?? 'index.php';
+            // Alleen relatieve redirects toestaan
+            if (empty($redirect) || strpos($redirect, '://') !== false || strpos($redirect, '//') === 0) {
+                $redirect = 'index.php';
+            }
+
+            header("Location: {$redirect}");
+            exit;
+        } else {
+            $_SESSION['login_attempts']++;
+            $_SESSION['last_attempt_time'] = time();
+            $attemptsLeft = max(0, 5 - $_SESSION['login_attempts']);
+            $error = "Ongeldige gebruikersnaam of wachtwoord. (Nog {$attemptsLeft} pogingen)";
+        }
+    }
+}
+
+$csrfToken = get_csrf_token();
+$logoutMessage = isset($_GET['logout']) ? 'U bent succesvol en veilig uitgelogd.' : '';
+?>
+<!DOCTYPE html>
+<html lang="nl">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Web &amp; PC Studio - Beveiligde Toegang</title>
+    <link rel="stylesheet" href="style.css">
+    <script src="theme.js"></script>
+    <style>
+        body {
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            min-height: 100vh;
+            padding: 20px;
+        }
+
+        .login-card {
+            width: 100%;
+            max-width: 440px;
+            background: var(--bg-surface);
+            backdrop-filter: blur(20px);
+            -webkit-backdrop-filter: blur(20px);
+            border: 1px solid var(--border-subtle);
+            border-radius: var(--radius-xl);
+            padding: 38px 32px;
+            box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.6);
+            text-align: left;
+        }
+
+        .login-header {
+            text-align: center;
+            margin-bottom: 28px;
+        }
+
+        .login-logo {
+            background: linear-gradient(135deg, var(--primary), var(--accent));
+            width: 52px;
+            height: 52px;
+            border-radius: 14px;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-weight: 800;
+            font-size: 1.5rem;
+            color: white;
+            box-shadow: 0 6px 20px var(--primary-glow);
+            margin: 0 auto 16px;
+        }
+
+        .login-title {
+            font-size: 1.45rem;
+            font-weight: 800;
+            color: var(--text-main);
+            margin-bottom: 6px;
+        }
+
+        .login-subtitle {
+            font-size: 0.85rem;
+            color: var(--text-muted);
+        }
+
+        .form-group {
+            margin-bottom: 18px;
+        }
+
+        .form-label {
+            display: block;
+            font-size: 0.82rem;
+            font-weight: 600;
+            color: var(--text-muted);
+            margin-bottom: 6px;
+        }
+
+        .input-wrap {
+            position: relative;
+            display: flex;
+            align-items: center;
+        }
+
+        .form-control {
+            width: 100%;
+            background: rgba(0, 0, 0, 0.35);
+            border: 1px solid var(--border-subtle);
+            border-radius: var(--radius-md);
+            padding: 12px 14px;
+            color: var(--text-main);
+            font-size: 0.92rem;
+            outline: none;
+            transition: all 0.2s ease;
+        }
+
+        [data-theme="light"] .form-control {
+            background: rgba(241, 245, 249, 0.8);
+        }
+
+        .form-control:focus {
+            border-color: var(--primary);
+            box-shadow: 0 0 0 3px var(--primary-glow);
+        }
+
+        .toggle-pwd {
+            position: absolute;
+            right: 12px;
+            background: transparent;
+            border: none;
+            color: var(--text-subtle);
+            cursor: pointer;
+            font-size: 1rem;
+            padding: 4px;
+        }
+
+        .alert-error {
+            background: rgba(239, 68, 68, 0.12);
+            border: 1px solid rgba(239, 68, 68, 0.3);
+            color: #f87171;
+            padding: 12px 14px;
+            border-radius: var(--radius-md);
+            font-size: 0.84rem;
+            margin-bottom: 20px;
+        }
+
+        .alert-success {
+            background: rgba(16, 185, 129, 0.12);
+            border: 1px solid rgba(16, 185, 129, 0.3);
+            color: #34d399;
+            padding: 12px 14px;
+            border-radius: var(--radius-md);
+            font-size: 0.84rem;
+            margin-bottom: 20px;
+        }
+
+        .login-footer {
+            margin-top: 24px;
+            padding-top: 18px;
+            border-top: 1px solid var(--border-subtle);
+            display: flex;
+            justify-content: space-between;
+            align-items: center;
+            font-size: 0.78rem;
+            color: var(--text-subtle);
+        }
+    </style>
+</head>
+<body>
+    <div class="login-card">
+        <!-- Logo & Header -->
+        <div class="login-header">
+            <div class="login-logo">🔒</div>
+            <h1 class="login-title">Beveiligde Toegang</h1>
+            <p class="login-subtitle">server.webenpcstudio.nl &bull; Testdrive Hub</p>
+        </div>
+
+        <?php if (!empty($logoutMessage)): ?>
+            <div class="alert-success"><?= htmlspecialchars($logoutMessage); ?></div>
+        <?php endif; ?>
+
+        <?php if (!empty($error)): ?>
+            <div class="alert-error"><?= htmlspecialchars($error); ?></div>
+        <?php endif; ?>
+
+        <!-- Formulier -->
+        <form method="POST" action="">
+            <input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken); ?>">
+
+            <div class="form-group">
+                <label class="form-label" for="username">Gebruikersnaam (E-mail):</label>
+                <div class="input-wrap">
+                    <input type="email" id="username" name="username" class="form-control" 
+                           placeholder="naam@domein.nl" required autofocus autocomplete="username">
+                </div>
+            </div>
+
+            <div class="form-group" style="margin-bottom: 24px;">
+                <label class="form-label" for="password">Wachtwoord:</label>
+                <div class="input-wrap">
+                    <input type="password" id="password" name="password" class="form-control" 
+                           placeholder="••••••••••••" required autocomplete="current-password">
+                    <button type="button" class="toggle-pwd" onclick="togglePasswordVisibility()" title="Toon/verberg wachtwoord">👁️</button>
+                </div>
+            </div>
+
+            <button type="submit" class="btn btn-primary" style="width: 100%; padding: 12px; font-size: 0.95rem;">
+                Inloggen op Server
+            </button>
+        </form>
+
+        <div class="login-footer">
+            <span>TLS / SSL Beveiligd</span>
+            <button class="btn btn-secondary btn-sm theme-btn" onclick="toggleTheme()" style="padding: 4px 8px;">🌙 Thema</button>
+        </div>
+    </div>
+
+    <script>
+        function togglePasswordVisibility() {
+            const pwdInput = document.getElementById('password');
+            if (pwdInput.type === 'password') {
+                pwdInput.type = 'text';
+            } else {
+                pwdInput.type = 'password';
+            }
+        }
+    </script>
+</body>
+</html>
+

logout.php

@@ -0,0 +1,10 @@
+<?php
+/**
+ * Web & PC Studio - Veilige Uitlogmodule
+ */
+
+require_once __DIR__ . '/auth.php';
+logout();
+header('Location: login.php?logout=1');
+exit;
+

tools.php

@@ -4,6 +4,9 @@
  * Technische inspectie en utilities voor serverbeheer, DNS en debugging.
  */
 
+require_once __DIR__ . '/auth.php';
+require_auth();
+
 // PHP Backend AJAX handler
 if (isset($_GET['action'])) {
     header('Content-Type: application/json; charset=utf-8');
@@ -154,9 +157,10 @@ $loadDisplay = $load ? implode(' / ', array_map(function($v) { return round($v,
             </div>
             <div class="nav-status">
                 <button class="btn btn-secondary btn-sm theme-btn" onclick="toggleTheme()">🌙 Thema</button>
+                <a href="logout.php" class="btn btn-secondary btn-sm" style="color: #f87171;" title="Veilig uitloggen">🚪 Uitloggen</a>
                 <span class="nav-badge">
                     <span class="pulse-dot"></span>
-                    Git Live
+                    server.webenpcstudio.nl
                 </span>
             </div>
         </nav>