elwig-www/www/clients.php

<?php
require "format.inc";
include "credentials.inc";
$TITLE = 'Mandanten';
$CREDENTIALS ??= [];
$clients = array_keys($CREDENTIALS);

$format = get_fmt();

$path = $_SERVER['PATH_INFO'];
if ($path == '') {
    if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
        header('Status: 405');
        header('Allow: GET');
        if ($format === 'text') {
            header('Content-Type: text/plain; charset=UTF-8');
            echo "405 Method Not Allowed :(\n";
        } else if ($format === 'json') {
            header('Content-Type: application/json; charset=UTF-8');
            echo "{\"status\": \"error\", \"errors\": [{\"message\": \"Method not allowed\"}]}\n";
        } else {
            header('Content-Type: text/html; charset=UTF-8');
            header('Content-Length: 0');
        }
        exit();
    }

    if ($format === 'text') {
        header('Content-Type: text/plain; charset=UTF-8');
        foreach ($clients as $c)
            echo "$c\n";
    } else if ($format === 'json') {
        header('Content-Type: application/json; charset=UTF-8');
        echo "{\"status\": \"success\", \"data\": [";
        $first = true;
        foreach ($clients as $c) {
            if (!$first) echo ",";
            echo "\n  {\"name\": \"$c\"}";
            $first = false;
        }
        echo "\n]}\n";
    } else if ($format === 'html') {
        header('Content-Type: text/html; charset=UTF-8');
        require "header.inc"; ?>
    <h1>Mandanten</h1>
    <table>
        <thead><tr><th>Name</th></tr></thead>
        <tbody>
<?php foreach ($clients as $c) {
            echo "            <tr><td><a href='clients/$c'>$c</a></td></tr>\n";
        } ?>
        </tbody>
    </table>
    <p><a href="clients?format=json">JSON-Format</a></p>
<?php require "footer.inc";
    }
    exit();
}

foreach ($clients as $c) {
    if ($path !== "/$c" && !str_starts_with($path, "/$c/"))
        continue;

    header('Content-Type: text/plain; charset=UTF-8');

    if (!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW']) ||
        !array_key_exists($_SERVER['PHP_AUTH_USER'], $CREDENTIALS[$c]) || $_SERVER['PHP_AUTH_PW'] !== $CREDENTIALS[$c][$_SERVER['PHP_AUTH_USER']])
    {
        header('Status: 401');
        header('WWW-Authenticate: Basic realm="Elwig"');
        exit("401 Unauthorized :(\n");
    } elseif ($path === "/$c") {
        header("Location: $c/");
        header('Status: 303');
        exit("303 See Other :)\n");
    } elseif ($path === "/$c/") {
        if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
            header("Status: 405");
            header("Allow: GET");
            exit("405 Method Not Allowed :(\n");
        }
        system("ls -Al .data/clients/$c/");
        exit();
    }
    $file = substr($path, strlen("/$c/"));
    $path = ".clients/$c/$file";
    if (str_contains($file, '/')) {
        header("Status: 400");
        exit("400 Bad Request :(\n");
    } elseif ($_SERVER['REQUEST_METHOD'] === 'GET') {
        $size = filesize($path);
        if ($size === false) {
            header("Status: 404");
            exit("404 Not Found :(\n");
        }
        $type = mime_content_type($path);
        header("Content-Type: $type");
        header("Content-Disposition: attachment; filename=\"$file\"");
        header("Content-Length: $size");
        readfile($path);
    } elseif ($_SERVER['REQUEST_METHOD'] === 'PUT') {
        $putdata = fopen('php://input', 'r');
        $fp = fopen($path, 'wb');
        if ($fp === false) {
            header("Status: 500");
            exit("500 Internal Server Error :(\n");
        }
        while ($data = fread($putdata, 4096))
            fwrite($fp, $data);
        fclose($fp);
        fclose($putdata);
        header("Status: 201");
        exit("201 Created :)\n");
    } elseif ($_SERVER['REQUEST_METHOD'] === 'DELETE') {
        if (unlink($path) === false) {
            header("Status: 500");
            exit("500 Internal Server Error :(\n");
        }
        exit("200 OK :)\n");
    } else {
        header("Status: 405");
        header("Allow: GET, PUT, DELETE");
        exit("405 Method Not Allowed :(\n");
    }

    exit();
}

header("Status: 404");
if ($format === 'text') {
    header('Content-Type: text/plain; charset=UTF-8');
    echo "404 Not Found :(\n";
} else if ($format === 'json') {
    header('Content-Type: application/json; charset=UTF-8');
    echo "{\"status\": \"error\", \"errors\": [{\"message\": \"Not found\"}]}\n";
} else {
    header('Content-Type: text/html; charset=UTF-8');
    header('Content-Length: 0');
}
exit();