asdasd

public/index.php

@@ -4,6 +4,20 @@ declare(strict_types=1);
 // boot application (config, autoload, services)
 require_once __DIR__ . '/../config/fileload.php';
 
+// Staging-Access-Protection (Basic Auth)
+if (defined('APP_ENV') && APP_ENV === 'staging') {
+    $authUser = getenv('STAGING_AUTH_USER') ?: 'staging';
+    $authPass = getenv('STAGING_AUTH_PASS') ?: 'staging123';
+    $user = $_SERVER['PHP_AUTH_USER'] ?? null;
+    $pass = $_SERVER['PHP_AUTH_PW'] ?? null;
+    if ($user !== $authUser || $pass !== $authPass) {
+        header('WWW-Authenticate: Basic realm="Staging"');
+        header('HTTP/1.0 401 Unauthorized');
+        echo 'Unauthorized';
+        exit;
+    }
+}
+
 $uriPath = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?: '/';
 $uriPath = preg_replace('~/{2,}~', '/', $uriPath);
 $uriPath = trim($uriPath, '/');