manager/includes/auth.php

<?php

declare(strict_types=1);

// Admin session, password check and CSRF for the management UI. Merges the two
// near-identical login halves of the PSA update-server/manage.php and
// backup-server/manage.php into one implementation.

require_once __DIR__ . "/bootstrap.php";

function manageStartSession(): void
{
    if (session_status() !== PHP_SESSION_NONE) {
        return;
    }

    $isHttps =
        (!empty($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] !== "off") ||
        (isset($_SERVER["SERVER_PORT"]) && (int) $_SERVER["SERVER_PORT"] === 443) ||
        strtolower((string) ($_SERVER["HTTP_X_FORWARDED_PROTO"] ?? "")) === "https";

    ini_set("session.use_strict_mode", "1");
    ini_set("session.cookie_httponly", "1");
    ini_set("session.cookie_secure", $isHttps ? "1" : "0");
    ini_set("session.cookie_samesite", "Lax");
    session_name("manage_session");
    session_start();
}

function managePasswordConfigured(): bool
{
    if (defined("MANAGE_ADMIN_PASSWORD_HASH")) {
        $hash = trim((string) MANAGE_ADMIN_PASSWORD_HASH);
        if ($hash !== "" && !str_contains($hash, "replace-this")) {
            return true;
        }
    }

    return defined("MANAGE_ADMIN_PASSWORD") && trim((string) MANAGE_ADMIN_PASSWORD) !== "";
}

function managePasswordMatches(string $password): bool
{
    if (defined("MANAGE_ADMIN_PASSWORD_HASH")) {
        $hash = trim((string) MANAGE_ADMIN_PASSWORD_HASH);
        if ($hash !== "" && !str_contains($hash, "replace-this")) {
            return password_verify($password, $hash);
        }
    }

    if (defined("MANAGE_ADMIN_PASSWORD")) {
        return hash_equals((string) MANAGE_ADMIN_PASSWORD, $password);
    }

    return false;
}

function manageIsLoggedIn(): bool
{
    return !empty($_SESSION["manage_logged_in"]);
}

function manageLogin(): void
{
    session_regenerate_id(true);
    $_SESSION["manage_logged_in"] = true;
    $_SESSION["manage_logged_in_at"] = time();
}

function manageLogout(): void
{
    unset(
        $_SESSION["manage_logged_in"],
        $_SESSION["manage_logged_in_at"],
        $_SESSION["manage_csrf_token"],
    );
}

// Redirects to the login page instead of rendering. Every admin page calls this
// as its first statement after the includes.
function manageRequireLogin(): void
{
    manageStartSession();
    if (manageIsLoggedIn()) {
        return;
    }

    $target = basename((string) ($_SERVER["SCRIPT_NAME"] ?? ""));
    header("Location: login.php?next=" . rawurlencode($target));
    exit;
}

function manageCsrfToken(): string
{
    if (empty($_SESSION["manage_csrf_token"])) {
        $_SESSION["manage_csrf_token"] = bin2hex(random_bytes(32));
    }

    return (string) $_SESSION["manage_csrf_token"];
}

function manageCsrfIsValid(string $token): bool
{
    return !empty($_SESSION["manage_csrf_token"]) &&
        hash_equals((string) $_SESSION["manage_csrf_token"], $token);
}

function manageCsrfField(): string
{
    return '<input type="hidden" name="csrf_token" value="' .
        manageEscape(manageCsrfToken()) .
        '">';
}

// Guard for every mutating POST in the admin UI.
function manageRequireCsrf(): void
{
    if (!manageCsrfIsValid((string) ($_POST["csrf_token"] ?? ""))) {
        throw new RuntimeException(
            "Ungültiges Sicherheitstoken. Bitte die Seite neu laden und erneut versuchen.",
        );
    }
}