manager/admin/login.php

<?php

declare(strict_types=1);

require_once __DIR__ . "/../includes/auth.php";

manageStartSession();

$errors = [];
$messages = [];
$next = basename((string) ($_GET["next"] ?? "index.php"));
if (!array_key_exists($next, manageNavItemsSafe())) {
    $next = "index.php";
}

function manageNavItemsSafe(): array
{
    // Only ever redirect to a known admin page, never to a caller-supplied URL.
    return [
        "index.php" => true,
        "instances.php" => true,
        "releases.php" => true,
        "backups.php" => true,
        "settings.php" => true,
    ];
}

if (manageIsLoggedIn()) {
    header("Location: " . $next);
    exit;
}

if (($_SERVER["REQUEST_METHOD"] ?? "") === "POST") {
    if (!managePasswordConfigured()) {
        $errors[] = "Es ist kein Admin-Passwort konfiguriert. Bitte MANAGE_ADMIN_PASSWORD_HASH in config.php setzen.";
    } elseif (manageLoginIsRateLimited()) {
        $errors[] = "Zu viele Fehlversuche. Bitte später erneut versuchen.";
    } elseif (managePasswordMatches((string) ($_POST["password"] ?? ""))) {
        manageLoginClearRateLimit();
        manageLogin();
        manageLogAccess("Admin login succeeded");
        header("Location: " . $next);
        exit;
    } else {
        manageLoginRecordFailure();
        manageLogError("Admin login failed", [], "WARNING");
        $errors[] = "Falsches Passwort.";
    }
}

?>
<!DOCTYPE html>
<html lang="de">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Anmeldung – Manage</title>
    <link rel="stylesheet" href="../assets/css/style.css">
</head>
<body class="login-body">
<main class="login-panel">
    <h1>Manage</h1>
    <p class="muted"><?php echo manageEscape(manageProductName()); ?></p>

    <?php foreach ($messages as $message): ?>
        <p class="alert alert-success"><?php echo manageEscape($message); ?></p>
    <?php endforeach; ?>
    <?php foreach ($errors as $error): ?>
        <p class="alert alert-error"><?php echo manageEscape($error); ?></p>
    <?php endforeach; ?>

    <form method="POST">
        <div class="form-group">
            <label for="password">Passwort</label>
            <input type="password" id="password" name="password" required autofocus autocomplete="current-password">
        </div>
        <button type="submit" class="btn">Anmelden</button>
    </form>
</main>
</body>
</html>