NiekRabelink/Testdrive
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Dev #2

Merged
NiekRabelink merged 2 commits from dev into main 2026-09-07 11:32:35 +00:00
Conversation 0 Commits 2 Files Changed 6
+407 -6
6 changed files with 407 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth.php
+91
View File
@@ -0,0 +1,91 @@
<?php
/**
* Web & PC Studio - Authenticatie & Beveiligingsmodule
* Veilig sessiebeheer, CSRF-protectie en one-way cryptografische verificatie.
*/
// Veilige sessie instellingen
if (session_status() === PHP_SESSION_NONE) {
ini_set('session.cookie_httponly', '1');
ini_set('session.use_only_cookies', '1');
ini_set('session.cookie_samesite', 'Strict');
if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') {
ini_set('session.cookie_secure', '1');
}
session_start();
}
// One-way cryptografische hashes (Nooit plaintext opgeslagen)
define('AUTH_USER_HASH', 'ef8d40929f6f50e1f52009fbe94cf5a81b8373b90ed2bd130e85dcb4169c5cb4');
define('AUTH_PASS_HASH', '$2y$12$RQFrfxgd5ZiHQAcMX2DDluDW072QG/aDTDE50ORz3drcNnbZzl0AK');
/**
* Controleert of de huidige bezoeker geauthenticeerd is.
*/
function is_logged_in() {
if (!empty($_SESSION['wpc_auth']) && $_SESSION['wpc_auth'] === true) {
// Sessie timeout na 2 uur inactiviteit
if (isset($_SESSION['wpc_last_activity']) && (time() - $_SESSION['wpc_last_activity'] > 7200)) {
logout();
return false;
}
$_SESSION['wpc_last_activity'] = time();
return true;
}
return false;
}
/**
* Blokkeert ongeautoriseerde toegang en stuurt door naar het inlogscherm.
*/
function require_auth() {
if (!is_logged_in()) {
// Als het een asynchrone AJAX aanroep is, geef HTTP 401 Unauthorized
if (!empty($_SERVER['HTTP_X_REQUESTED_WITH']) || isset($_GET['action']) || isset($_GET['api'])) {
header('HTTP/1.1 401 Unauthorized');
header('Content-Type: application/json; charset=utf-8');
echo json_encode(['status' => 'unauthorized', 'message' => 'Sessie verlopen of niet ingelogd.']);
exit;
}
$redirect = urlencode($_SERVER['REQUEST_URI'] ?? 'index.php');
header("Location: login.php?redirect={$redirect}");
exit;
}
}
/**
* Genereert een CSRF token voor formulieren.
*/
function get_csrf_token() {
if (empty($_SESSION['wpc_csrf'])) {
$_SESSION['wpc_csrf'] = bin2hex(random_bytes(32));
}
return $_SESSION['wpc_csrf'];
}
/**
* Valideert het ingediende CSRF token.
*/
function verify_csrf_token($token) {
if (empty($_SESSION['wpc_csrf']) || empty($token)) {
return false;
}
return hash_equals($_SESSION['wpc_csrf'], $token);
}
/**
* Beëindigt de sessie en ruimt cookies op.
*/
function logout() {
$_SESSION = [];
if (ini_get("session.use_cookies")) {
$params = session_get_cookie_params();
setcookie(session_name(), '', time() - 42000,
$params["path"], $params["domain"],
$params["secure"], $params["httponly"]
);
}
@session_destroy();
}
index.php
+8 -3
View File
@@ -4,6 +4,9 @@
* Hoofdpagina voor status, runtime verificatie en Git webhook deployment tests.
*/
require_once __DIR__ . '/auth.php';
require_auth();
// Snelle API responder voor AJAX pings
if (isset($_GET['api']) && $_GET['api'] === 'status') {
header('Content-Type: application/json; charset=utf-8');
@@ -23,9 +26,10 @@ date_default_timezone_set('Europe/Amsterdam');
$serverTime = date('d-m-Y H:i:s');
$phpVersion = PHP_VERSION;
$serverSoftware = $_SERVER['SERVER_SOFTWARE'] ?? 'Apache / Nginx';
$host = $_SERVER['HTTP_HOST'] ?? 'www.webenpcstudio.nl';
$host = $_SERVER['HTTP_HOST'] ?? 'server.webenpcstudio.nl';
$clientIp = $_SERVER['REMOTE_ADDR'] ?? 'Onbekend';
$protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'HTTPS' : 'HTTP';
$loggedUser = $_SESSION['wpc_user_email'] ?? 'niek.rabelink@gmail.com';
// Git repository inspectie (met veilige fallback)
$activeBranch = 'dev';
@@ -91,9 +95,10 @@ if (empty($commits)) {
</div>
<div class="nav-status">
<button class="btn btn-secondary btn-sm theme-btn" onclick="toggleTheme()">🌙 Thema</button>
<a href="logout.php" class="btn btn-secondary btn-sm" style="color: #f87171;" title="Veilig uitloggen">🚪 Uitloggen</a>
<span class="nav-badge">
<span class="pulse-dot"></span>
Git Live
server.webenpcstudio.nl
</span>
</div>
</nav>
@@ -102,7 +107,7 @@ if (empty($commits)) {
<header class="hero">
<h1>Systeem Dashboard &amp; Git Status</h1>
<p>
Realtime omgevingsstatus, Git webhook deploy-verificatie en server-runtime monitoring voor www.webenpcstudio.nl.
Realtime omgevingsstatus, Git webhook deploy-verificatie en server-runtime monitoring voor <strong>server.webenpcstudio.nl</strong>.
</p>
</header>
lab.php
+6 -2
View File
@@ -4,6 +4,9 @@
* Diepgaande diagnostische suite voor CPU, NVMe Disk I/O, RAM en HTTP Concurrency.
*/
require_once __DIR__ . '/auth.php';
require_auth();
// Helper functies voor benchmarks
function benchmarkCPU() {
$start = microtime(true);
@@ -387,6 +390,7 @@ $serverSoftware = $_SERVER['SERVER_SOFTWARE'] ?? 'Apache / Nginx';
<button class="btn btn-secondary btn-sm" id="sound-btn" onclick="toggleAudio()" title="Schakel geluid in/uit">
<span id="sound-icon">🔈</span> Geluid: <span id="sound-status">Uit</span>
</button>
<a href="logout.php" class="btn btn-secondary btn-sm" style="color: #f87171;" title="Veilig uitloggen">🚪 Uitloggen</a>
</div>
</nav>
@@ -403,7 +407,7 @@ $serverSoftware = $_SERVER['SERVER_SOFTWARE'] ?? 'Apache / Nginx';
<div style="flex: 1; min-width: 280px;">
<h2 style="font-size: 1.3rem; color: var(--text-main); margin-bottom: 6px;">⚡ Volledige Server Benchmark</h2>
<p style="font-size: 0.88rem; color: var(--text-muted); margin-bottom: 18px;">
Voert in één geautomatiseerde cyclus alle 5 hardware- &amp; softwaretests uit op www.webenpcstudio.nl.
Voert in één geautomatiseerde cyclus alle 5 hardware- &amp; softwaretests uit op <strong>server.webenpcstudio.nl</strong>.
</p>
<div style="display: flex; gap: 8px; align-items: center; flex-wrap: wrap;">
<button class="btn btn-primary" id="btn-run-all" onclick="runFullBenchmark()">
@@ -900,7 +904,7 @@ $serverSoftware = $_SERVER['SERVER_SOFTWARE'] ?? 'Apache / Nginx';
function copyReport() {
let report = "=== WEB & PC STUDIO - WEBSERVER BENCHMARK RAPPORT ===\n" +
`Domein: www.webenpcstudio.nl\n` +
`Domein: server.webenpcstudio.nl\n` +
`Datum: ${new Date().toLocaleString('nl-NL')}\n\n`;
if (lastReport) {
login.php
+287
View File
@@ -0,0 +1,287 @@
<?php
/**
* Web & PC Studio - Beveiligd Inlogscherm
* Server-side authenticatie voor server.webenpcstudio.nl met brute-force protectie.
*/
require_once __DIR__ . '/auth.php';
// Als gebruiker al ingelogd is, direct doorsturen
if (is_logged_in()) {
header('Location: index.php');
exit;
}
$error = '';
$lockoutTime = 300; // 5 minuten blokkade bij te veel pogingen
// Initialiseer rate limiting
if (!isset($_SESSION['login_attempts'])) {
$_SESSION['login_attempts'] = 0;
$_SESSION['last_attempt_time'] = time();
}
// Controleer of de gebruiker tijdelijk geblokkeerd is
if ($_SESSION['login_attempts'] >= 5) {
$timePassed = time() - $_SESSION['last_attempt_time'];
if ($timePassed < $lockoutTime) {
$remaining = ceil(($lockoutTime - $timePassed) / 60);
$error = "Te veel mislukte inlogpogingen. Probeer het over {$remaining} minuten opnieuw.";
} else {
// Reset na verloop van blokkade
$_SESSION['login_attempts'] = 0;
}
}
// Verwerk inlogverzoek
if ($_SERVER['REQUEST_METHOD'] === 'POST' && empty($error)) {
$csrfToken = $_POST['csrf_token'] ?? '';
$username = trim($_POST['username'] ?? '');
$password = $_POST['password'] ?? '';
// Kleine vertraging tegen timing-aanvallen
usleep(200000);
if (!verify_csrf_token($csrfToken)) {
$error = 'Beveiligingstoken (CSRF) ongeldig of verlopen. Ververs de pagina.';
} else {
// Vergelijk gebruikersnaam hash (timing-safe) en wachtwoord via bcrypt
$userMatches = hash_equals(AUTH_USER_HASH, hash('sha256', strtolower($username)));
$passMatches = password_verify($password, AUTH_PASS_HASH);
if ($userMatches && $passMatches) {
// Sessie fixatie voorkomen via regeneratie
session_regenerate_id(true);
$_SESSION['wpc_auth'] = true;
$_SESSION['wpc_user_email'] = htmlspecialchars($username);
$_SESSION['wpc_last_activity'] = time();
$_SESSION['login_attempts'] = 0;
// Veilige doorverwijzing
$redirect = $_GET['redirect'] ?? 'index.php';
// Alleen relatieve redirects toestaan
if (empty($redirect) || strpos($redirect, '://') !== false || strpos($redirect, '//') === 0) {
$redirect = 'index.php';
}
header("Location: {$redirect}");
exit;
} else {
$_SESSION['login_attempts']++;
$_SESSION['last_attempt_time'] = time();
$attemptsLeft = max(0, 5 - $_SESSION['login_attempts']);
$error = "Ongeldige gebruikersnaam of wachtwoord. (Nog {$attemptsLeft} pogingen)";
}
}
}
$csrfToken = get_csrf_token();
$logoutMessage = isset($_GET['logout']) ? 'U bent succesvol en veilig uitgelogd.' : '';
?>
<!DOCTYPE html>
<html lang="nl">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Web &amp; PC Studio - Beveiligde Toegang</title>
<link rel="stylesheet" href="style.css">
<script src="theme.js"></script>
<style>
body {
display: flex;
align-items: center;
justify-content: center;
min-height: 100vh;
padding: 20px;
}
.login-card {
width: 100%;
max-width: 440px;
background: var(--bg-surface);
backdrop-filter: blur(20px);
-webkit-backdrop-filter: blur(20px);
border: 1px solid var(--border-subtle);
border-radius: var(--radius-xl);
padding: 38px 32px;
box-shadow: 0 25px 50px -12px rgba(0, 0, 0, 0.6);
text-align: left;
}
.login-header {
text-align: center;
margin-bottom: 28px;
}
.login-logo {
background: linear-gradient(135deg, var(--primary), var(--accent));
width: 52px;
height: 52px;
border-radius: 14px;
display: flex;
align-items: center;
justify-content: center;
font-weight: 800;
font-size: 1.5rem;
color: white;
box-shadow: 0 6px 20px var(--primary-glow);
margin: 0 auto 16px;
}
.login-title {
font-size: 1.45rem;
font-weight: 800;
color: var(--text-main);
margin-bottom: 6px;
}
.login-subtitle {
font-size: 0.85rem;
color: var(--text-muted);
}
.form-group {
margin-bottom: 18px;
}
.form-label {
display: block;
font-size: 0.82rem;
font-weight: 600;
color: var(--text-muted);
margin-bottom: 6px;
}
.input-wrap {
position: relative;
display: flex;
align-items: center;
}
.form-control {
width: 100%;
background: rgba(0, 0, 0, 0.35);
border: 1px solid var(--border-subtle);
border-radius: var(--radius-md);
padding: 12px 14px;
color: var(--text-main);
font-size: 0.92rem;
outline: none;
transition: all 0.2s ease;
}
[data-theme="light"] .form-control {
background: rgba(241, 245, 249, 0.8);
}
.form-control:focus {
border-color: var(--primary);
box-shadow: 0 0 0 3px var(--primary-glow);
}
.toggle-pwd {
position: absolute;
right: 12px;
background: transparent;
border: none;
color: var(--text-subtle);
cursor: pointer;
font-size: 1rem;
padding: 4px;
}
.alert-error {
background: rgba(239, 68, 68, 0.12);
border: 1px solid rgba(239, 68, 68, 0.3);
color: #f87171;
padding: 12px 14px;
border-radius: var(--radius-md);
font-size: 0.84rem;
margin-bottom: 20px;
}
.alert-success {
background: rgba(16, 185, 129, 0.12);
border: 1px solid rgba(16, 185, 129, 0.3);
color: #34d399;
padding: 12px 14px;
border-radius: var(--radius-md);
font-size: 0.84rem;
margin-bottom: 20px;
}
.login-footer {
margin-top: 24px;
padding-top: 18px;
border-top: 1px solid var(--border-subtle);
display: flex;
justify-content: space-between;
align-items: center;
font-size: 0.78rem;
color: var(--text-subtle);
}
</style>
</head>
<body>
<div class="login-card">
<!-- Logo & Header -->
<div class="login-header">
<div class="login-logo">🔒</div>
<h1 class="login-title">Beveiligde Toegang</h1>
<p class="login-subtitle">server.webenpcstudio.nl &bull; Testdrive Hub</p>
</div>
<?php if (!empty($logoutMessage)): ?>
<div class="alert-success"><?= htmlspecialchars($logoutMessage); ?></div>
<?php endif; ?>
<?php if (!empty($error)): ?>
<div class="alert-error"><?= htmlspecialchars($error); ?></div>
<?php endif; ?>
<!-- Formulier -->
<form method="POST" action="">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars($csrfToken); ?>">
<div class="form-group">
<label class="form-label" for="username">Gebruikersnaam (E-mail):</label>
<div class="input-wrap">
<input type="email" id="username" name="username" class="form-control"
placeholder="naam@domein.nl" required autofocus autocomplete="username">
</div>
</div>
<div class="form-group" style="margin-bottom: 24px;">
<label class="form-label" for="password">Wachtwoord:</label>
<div class="input-wrap">
<input type="password" id="password" name="password" class="form-control"
placeholder="••••••••••••" required autocomplete="current-password">
<button type="button" class="toggle-pwd" onclick="togglePasswordVisibility()" title="Toon/verberg wachtwoord">👁️</button>
</div>
</div>
<button type="submit" class="btn btn-primary" style="width: 100%; padding: 12px; font-size: 0.95rem;">
Inloggen op Server
</button>
</form>
<div class="login-footer">
<span>TLS / SSL Beveiligd</span>
<button class="btn btn-secondary btn-sm theme-btn" onclick="toggleTheme()" style="padding: 4px 8px;">🌙 Thema</button>
</div>
</div>
<script>
function togglePasswordVisibility() {
const pwdInput = document.getElementById('password');
if (pwdInput.type === 'password') {
pwdInput.type = 'text';
} else {
pwdInput.type = 'password';
}
}
</script>
</body>
</html>
logout.php
+10
View File
@@ -0,0 +1,10 @@
<?php
/**
* Web & PC Studio - Veilige Uitlogmodule
*/
require_once __DIR__ . '/auth.php';
logout();
header('Location: login.php?logout=1');
exit;
tools.php
+5 -1
View File
@@ -4,6 +4,9 @@
* Technische inspectie en utilities voor serverbeheer, DNS en debugging.
*/
require_once __DIR__ . '/auth.php';
require_auth();
// PHP Backend AJAX handler
if (isset($_GET['action'])) {
header('Content-Type: application/json; charset=utf-8');
@@ -154,9 +157,10 @@ $loadDisplay = $load ? implode(' / ', array_map(function($v) { return round($v,
</div>
<div class="nav-status">
<button class="btn btn-secondary btn-sm theme-btn" onclick="toggleTheme()">🌙 Thema</button>
<a href="logout.php" class="btn btn-secondary btn-sm" style="color: #f87171;" title="Veilig uitloggen">🚪 Uitloggen</a>
<span class="nav-badge">
<span class="pulse-dot"></span>
Git Live
server.webenpcstudio.nl
</span>
</div>
</nav>