010420262055 first

webphp/src/bootstrap.php

@@ -0,0 +1,64 @@
+<?php
+declare(strict_types=1);
+
+$configFile = __DIR__ . '/config.php';
+if (!is_file($configFile)) {
+    $configFile = __DIR__ . '/config.sample.php';
+}
+
+$config = require $configFile;
+
+if (!isset($config['session_key']) || !is_string($config['session_key'])) {
+    throw new RuntimeException('Missing session_key in config.');
+}
+
+session_name('osmtool_web');
+session_set_cookie_params([
+    'lifetime' => 0,
+    'path' => '/',
+    'secure' => false,
+    'httponly' => true,
+    'samesite' => 'Strict',
+]);
+
+session_start();
+
+if (!isset($_SESSION['session_seed'])) {
+    $_SESSION['session_seed'] = hash('sha256', $config['session_key'] . random_int(1000, 999999));
+}
+
+require_once __DIR__ . '/i18n.php';
+
+function is_logged_in(): bool
+{
+    return isset($_SESSION['auth']) && $_SESSION['auth'] === true;
+}
+
+function require_login(): void
+{
+    if (!is_logged_in()) {
+        header('Location: index.php');
+        exit;
+    }
+}
+
+function csrf_token(): string
+{
+    if (!isset($_SESSION['csrf_token'])) {
+        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+    }
+    return $_SESSION['csrf_token'];
+}
+
+function verify_csrf(?string $token): bool
+{
+    if (!isset($_SESSION['csrf_token']) || !is_string($token)) {
+        return false;
+    }
+    return hash_equals($_SESSION['csrf_token'], $token);
+}
+
+function h(string $value): string
+{
+    return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+}