';
}
}
// All mutations use POST. The action field selects the narrow handler below.
$error = '';
$action = $_POST['action'] ?? '';
// Login verifies the submitted password against the configured password hash.
if ($_SERVER['REQUEST_METHOD'] === 'POST' && $action === 'login') {
$credentials = localpixivCredentials();
$username = trim((string) ($_POST['user'] ?? ''));
$password = (string) ($_POST['pass'] ?? '');
if (localpixivCredentialsConfigured()
&& hash_equals($credentials['user'], $username)
&& password_verify($password, $credentials['hash'])) {
// Redirect-after-POST prevents an accidental login resubmission on refresh.
localpixivSetAdminCookie(localpixivAuthToken(), time() + (30 * 86400));
header('Location: /admin');
exit;
}
$error = localpixivCredentialsConfigured()
? 'Invalid credentials'
: 'Admin credentials are not configured';
} elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && $action === 'logout') {
// Logout is a protected state change rather than an unguarded GET link.
if (!localpixivValidCsrfToken('logout', $_POST['csrf'] ?? null)) {
http_response_code(403);
$error = 'Invalid logout request';
} else {
localpixivSetAdminCookie('', time() - 3600);
header('Location: /admin');
exit;
}
} elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && $action === 'set_public_archive') {
// The homepage checkbox posts here; only a logged-in admin may update the file.
if (!localpixivValidCsrfToken('set_public_archive', $_POST['csrf'] ?? null)) {
http_response_code(403);
$error = 'Invalid settings request';
} else {
$value = isset($_POST['public_archive']) ? 'on' : 'off';
// LOCK_EX prevents concurrent requests from interleaving their writes.
$written = @file_put_contents(__DIR__ . '/config/public', $value . PHP_EOL, LOCK_EX);
if ($written === false) {
http_response_code(500);
$error = 'Unable to save public archive setting';
} else {
header('Location: /?settings=1');
exit;
}
}
}
// Prepare escaped display values only after POST handlers have finished.
$isAdmin = localpixivIsAdmin();
$credentials = localpixivCredentials();
$theme = $_COOKIE['theme'] ?? 'system';
$dataThemeAttr = ($theme === 'light' || $theme === 'dark')
? ' data-theme="' . $theme . '"'
: '';
$siteTitleHtml = htmlspecialchars($sitetitle, ENT_QUOTES, 'UTF-8');
$adminNameHtml = htmlspecialchars($credentials['user'], ENT_QUOTES, 'UTF-8');
?>
>
admin - <?= $siteTitleHtml ?>