login change

src/functions.php

@@ -76,39 +76,78 @@ function tpl_add_style(string $href, string $pos = 'header', ?string $version =
 
 function tpl(string $file, string $type = 'structure', string $site = 'main'): void
 {
-
-    // Basisordner
     $base = __DIR__ . '/../partials/';
 
-    // Erlaubte Typen & Sites
-    $allowedTypes = ['structure', 'landing'];
-    $allowedSites = ['main', 'fakecheck','login'];
-
-    // Validierung
-    if (!in_array($type, $allowedTypes)) {
-        $type = 'structure';
+    // VALIDIERUNG: Nur einfache Check, kein Path-Traversal
+    if (preg_match('/[^a-zA-Z0-9_\-]/', $file)) {
+        echo "<!-- tpl(): Ungültiger Template-Name -->";
+        return;
+    }
+    if (preg_match('/[^a-zA-Z0-9_\-]/', $type)) {
+        echo "<!-- tpl(): Ungültiger Type -->";
+        return;
+    }
+    if (preg_match('/[^a-zA-Z0-9_\-]/', $site)) {
+        echo "<!-- tpl(): Ungültiger Site -->";
+        return;
     }
 
-    if (!in_array($site, $allowedSites)) {
-        $site = 'main';
-    }
-
-    // Zielpfad konstruieren
     if ($type === 'landing') {
-        // landing -> landing/{site}/{file}.php
         $path = $base . "landing/$site/$file.php";
     } else {
-        // structure -> structure/{file}.php
         $path = $base . "structure/$file.php";
     }
-    // 🔹 alle globalen Variablen (aus index.php) in den lokalen Scope holen
+
     extract($GLOBALS, EXTR_SKIP);
 
-    // Datei laden
     if (file_exists($path)) {
         include $path;
     } else {
         echo "<!-- tpl(): Datei nicht gefunden: $path -->";
     }
-
+}
+
+
+/**
+ * Flash-Meldung setzen (wird genau einmal nach Redirect angezeigt).
+ *
+ * @param string $type    z.B. 'success', 'error', 'info', 'warning'
+ * @param string $message Die Meldung für den Nutzer
+ */
+function flash_set(string $type, string $message, string $context = null): void
+{
+    if (session_status() !== PHP_SESSION_ACTIVE) {
+        @session_start();
+    }
+
+    $_SESSION['flash'] = [
+        'type'    => $type,
+        'message' => $message,
+        'context' => $context,
+    ];
+}
+
+/**
+ * Flash-Meldung holen und direkt löschen (Einmal-Anzeige).
+ *
+ * @return array|null ['type' => 'success|error|info|warning', 'message' => '...']
+ */
+function flash_get(): ?array
+{
+    if (session_status() !== PHP_SESSION_ACTIVE) {
+        @session_start();
+    }
+
+    if (empty($_SESSION['flash']) || !is_array($_SESSION['flash'])) {
+        return null;
+    }
+
+    $flash = $_SESSION['flash'];
+    unset($_SESSION['flash']);
+
+    $flash['type']    = $flash['type']    ?? 'info';
+    $flash['message'] = $flash['message'] ?? '';
+    $flash['context'] = $flash['context'] ?? null;
+
+    return $flash;
 }