Update Dockerfile to disable AllowOverride for production, enhance admin.php to handle missing FLIXCOOKS_ADMIN_KEY with a user-friendly error page, and remove .htaccess file. Adjust documentation to reflect these changes and clarify admin key configuration.

2026-05-23 13:29:35 +02:00
parent 830950ad66
commit d8bb062c63
5 changed files with 32 additions and 9 deletions
@@ -2,9 +2,36 @@
 session_start();
 require __DIR__ . '/helpers.php';

-$ADMIN_KEY = getenv('FLIXCOOKS_ADMIN_KEY') ?: 'vFDH.N_tVLEKNdR3fhLs';
+$ADMIN_KEY = getenv('FLIXCOOKS_ADMIN_KEY') ?: '';
 $authed = isset($_SESSION['fc_admin']) && $_SESSION['fc_admin'] === true;

+if ($ADMIN_KEY === '') {
+    http_response_code(503);
+    ?>
+    <!doctype html>
+    <html lang="en">
+    <head>
+      <meta charset="UTF-8">
+      <meta name="viewport" content="width=device-width, initial-scale=1.0">
+      <title>FlixCooks Admin Unavailable</title>
+      <link rel="stylesheet" href="/assets/style.css">
+      <style>
+        body { display: grid; place-items: center; min-height: 100vh; }
+        .login-card { background: #fff; padding: 24px; border-radius: 16px; box-shadow: var(--shadow); width: min(420px, 90vw); }
+        .error { color: #b00020; margin: 0; }
+      </style>
+    </head>
+    <body>
+      <div class="login-card">
+        <h1>Admin unavailable</h1>
+        <p class="error">FLIXCOOKS_ADMIN_KEY is not configured.</p>
+      </div>
+    </body>
+    </html>
+    <?php
+    exit;
+}
+
 if (!$authed && isset($_POST['password'])) {
    if (hash_equals($ADMIN_KEY, $_POST['password'])) {
        $_SESSION['fc_admin'] = true;