Spaces:
Running
Running
File size: 3,016 Bytes
c7257f7 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 |
<?php
// Include Composer autoloader
require_once __DIR__ . '/vendor/autoload.php';
// Use Firebase JWT
use Firebase\JWT\JWT;
use Firebase\JWT\Key;
// Show errors for development (disable in production)
ini_set('display_errors', 1);
ini_set('display_startup_errors', 1);
error_reporting(E_ALL);
// Database configuration - using SQLite for development in Replit
define('DB_HOST', '');
define('DB_USER', '');
define('DB_PASS', '');
define('DB_NAME', 'cebelarstvo_cigoj.db');
// Establish database connection (SQLite for now)
try {
$pdo = new PDO("sqlite:" . __DIR__ . "/" . DB_NAME);
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
// Enable foreign key support for SQLite
$pdo->exec('PRAGMA foreign_keys = ON;');
} catch(PDOException $e) {
die("ERROR: Could not connect to database. " . $e->getMessage());
}
// Set headers for API (only set when needed to avoid conflicts with HTML pages)
if (isset($_SERVER['REQUEST_URI']) &&
strpos($_SERVER['REQUEST_URI'], '.php') !== false &&
strpos($_SERVER['REQUEST_URI'], '.html') === false &&
!strpos($_SERVER['REQUEST_URI'], 'backend.html') &&
!strpos($_SERVER['REQUEST_URI'], 'backend.php') &&
!strpos($_SERVER['REQUEST_URI'], 'admin_login.php') &&
!strpos($_SERVER['REQUEST_URI'], 'checkout.php') &&
!strpos($_SERVER['REQUEST_URI'], 'thank_you.php')) {
header("Content-Type: application/json; charset=UTF-8");
// More secure CORS - restrict to localhost for development
$allowed_origins = ['http://localhost:5000', 'https://localhost:5000'];
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
if (in_array($origin, $allowed_origins)) {
header("Access-Control-Allow-Origin: " . $origin);
}
header("Access-Control-Allow-Methods: GET, POST, PUT, DELETE");
header("Access-Control-Allow-Headers: Content-Type, Access-Control-Allow-Headers, Authorization, X-Requested-With");
}
// JWT Secret key - use environment variable for security
$jwt_secret = 'your_hardcoded_secret_here';
define('JWT_SECRET', $jwt_secret);
// JWT verification middleware function - fixed for PHP built-in server
function verifyToken() {
// Use getallheaders() with fallback for PHP built-in server
$headers = function_exists('getallheaders') ? getallheaders() : [];
// Fallback for PHP built-in server
if (empty($headers) && isset($_SERVER['HTTP_AUTHORIZATION'])) {
$headers['Authorization'] = $_SERVER['HTTP_AUTHORIZATION'];
}
if(!isset($headers['Authorization'])) {
http_response_code(401);
echo json_encode(array("message" => "Access Denied. No token provided."));
exit;
}
try {
$token = str_replace('Bearer ', '', $headers['Authorization']);
$decoded = JWT::decode($token, new Key(JWT_SECRET, 'HS256'));
return $decoded;
} catch(Exception $e) {
http_response_code(401);
echo json_encode(array("message" => "Invalid token", "error" => $e->getMessage()));
exit;
}
}
?> |