asd

public/page/debug.php

@@ -1,4 +1,16 @@
 <?php
+$isList = (isset($_GET['list']) && $_GET['list'] === '1');
+$isRaw = (isset($_GET['raw']) && $_GET['raw'] === '1');
+
+if ($isList || $isRaw) {
+    if (!auth_is_admin()) {
+        http_response_code(403);
+        header('Content-Type: text/plain; charset=utf-8');
+        echo 'forbidden';
+        return;
+    }
+}
+
 require_admin();
 
 if (!defined('APP_DEBUG_TOOL') || !APP_DEBUG_TOOL) {
@@ -8,6 +20,12 @@ if (!defined('APP_DEBUG_TOOL') || !APP_DEBUG_TOOL) {
 
 $debugDir = __DIR__ . '/../../debug';
 if (!is_dir($debugDir)) {
+    if ($isList || $isRaw) {
+        http_response_code(404);
+        header('Content-Type: text/plain; charset=utf-8');
+        echo 'debug_dir_missing';
+        return;
+    }
     echo '<div class="card">Debug-Verzeichnis fehlt.</div>';
     return;
 }
@@ -28,13 +46,13 @@ if ($selected !== '' && preg_match('/^[a-zA-Z0-9._-]+$/', $selected)) {
     }
 }
 
-if (isset($_GET['list']) && $_GET['list'] === '1') {
+if ($isList) {
     header('Content-Type: application/json; charset=utf-8');
     echo json_encode($files);
     return;
 }
 
-if (isset($_GET['raw']) && $_GET['raw'] === '1') {
+if ($isRaw) {
     header('Content-Type: text/plain; charset=utf-8');
     $tail = isset($_GET['tail']) ? (int)$_GET['tail'] : 0;
     if ($tail > 0 && $content !== null) {