SWAMPy

✎ CARVE FLESH

EDITING: api_auth.php

<?php
require_once __DIR__ . '/../config.php';

session_name(SESSION_NAME);
session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'secure' => true,       // requires HTTPS — cPanel domains should have this via AutoSSL
    'httponly' => true,
    'samesite' => 'None',   // required: the admin dashboard is a different origin now
]);
session_start();

function is_logged_in(): bool
{
    return !empty($_SESSION['admin_id']);
}

/** Call at the top of any admin/*.php endpoint. Replies 401 JSON instead of redirecting. */
function require_login_api(): void
{
    if (!is_logged_in()) {
        json_response(['error' => 'Not authenticated.'], 401);
    }
}

function csrf_token(): string
{
    if (empty($_SESSION['csrf'])) {
        $_SESSION['csrf'] = bin2hex(random_bytes(32));
    }
    return $_SESSION['csrf'];
}

/**
 * The dashboard sends the token back as an X-CSRF-Token header (issued at
 * login) rather than a hidden form field, since these are JSON/fetch calls,
 * not browser form posts.
 */
function require_valid_csrf_api(): void
{
    $token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
    if (!hash_equals($_SESSION['csrf'] ?? '', $token)) {
        json_response(['error' => 'Invalid or expired session token. Please log in again.'], 403);
    }
}

/** Reads a JSON request body into an associative array. */
function json_body(): array
{
    $raw = file_get_contents('php://input');
    $data = json_decode($raw, true);
    return is_array($data) ? $data : [];
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 api_auth.php	PHP	1.5 KB	2026-09-09 10:08	EDIT
📄 cors.php	PHP	1.7 KB	2026-09-09 10:08	EDIT
📄 upload.php	PHP	2 KB	2026-09-09 10:08	EDIT