revise backend

Web/includes/auth.php

@@ -0,0 +1,28 @@
+<?php
+/** Shared session checks. Database, form and session keys retain their legacy names. */
+function requireLogin(string $loginUrl): void {
+    if (session_status() !== PHP_SESSION_ACTIVE) {
+        session_start();
+    }
+    if (!isset($_SESSION['uname'])) {
+        header('Location: ' . $loginUrl);
+        exit;
+    }
+}
+
+function hasPermission(string $permission): bool {
+    return !empty($_SESSION[$permission]);
+}
+
+function requirePermission(string $permission, string $message): void {
+    if (!hasPermission($permission)) {
+        http_response_code(403);
+        exit($message);
+    }
+}
+
+function isPasswordValid(string $password): bool {
+    return strlen($password) >= 8
+        && preg_match('/[0-9]/', $password) === 1
+        && preg_match('/[A-Z]/', $password) === 1;
+}

Web/includes/remotepaths.php

@@ -22,3 +22,25 @@ function remoteDirname(string $path): string {
     $parent = rtrim(substr($path, 0, $separator), '/');
     return $parent === '' ? '/' : $parent;
 }
+
+/** Compare directory boundaries, so /data-other is not considered part of /data. */
+function isRemotePathWithin(string $path, string $basePath): bool {
+    $path = normalizePath($path);
+    $basePath = normalizePath($basePath);
+    return $path === $basePath || strpos($path, rtrim($basePath, '/') . '/') === 0;
+}
+
+/** Validate a single POSIX filename before joining it to a directory. */
+function isRemoteNameValid(string $name): bool {
+    return $name !== '' && $name !== '.' && $name !== '..'
+        && strpos($name, '/') === false && strpos($name, "\0") === false;
+}
+
+/** Resolve a request path inside the user's configured workspace. */
+function requireRemotePath(string $path, string $basePath): string {
+    if (strpos($path, "\0") !== false || !isRemotePathWithin($path, $basePath)) {
+        http_response_code(403);
+        exit('Path is outside your workspace.');
+    }
+    return normalizePath($path);
+}