$now) {
$error = '登录暂时锁定，请稍后再试。';
} else {
$q = db()->prepare('SELECT * FROM admins WHERE username = :username LIMIT 1');
$q->execute([':username' => mb_substr(trim((string) ($_POST['username'] ?? '')), 0, 80)]);
$admin = $q->fetch();
if ($admin && password_verify((string) ($_POST['password'] ?? ''), $admin['password_hash'])) {
session_regenerate_id(true); $_SESSION['admin_id'] = $admin['id']; unset($_SESSION['login_attempts'], $_SESSION['login_locked_until']); redirect('admin.php');
}
$_SESSION['login_attempts'] = (int) ($_SESSION['login_attempts'] ?? 0) + 1;
if ($_SESSION['login_attempts'] >= 5) $_SESSION['login_locked_until'] = $now + 300;
$error = '用户名或密码错误。';
}
} else {
require_admin();
if ($action === 'logout') { $_SESSION = []; session_destroy(); redirect('admin.php'); }
if ($action === 'settings') {
$q = db()->prepare('INSERT INTO settings(setting_key,setting_value,updated_at) VALUES(:key,:value,CURRENT_TIMESTAMP) ON CONFLICT(setting_key) DO UPDATE SET setting_value=excluded.setting_value,updated_at=CURRENT_TIMESTAMP');
foreach ((array) ($_POST['settings'] ?? []) as $key => $value) if (preg_match('/^[A-Z0-9_]{1,100}$/', (string) $key)) { $q->execute([':key' => $key, ':value' => mb_substr(trim((string) $value), 0, 5000)]); }
}
if ($action === 'category') {
$q = db()->prepare('INSERT INTO categories(parent_id,name,slug,sort_order) VALUES(:parent,:name,:slug,:sort) ON CONFLICT(slug) DO UPDATE SET parent_id=excluded.parent_id,name=excluded.name,sort_order=excluded.sort_order');
$q->execute([':parent' => max(0, (int) ($_POST['parent_id'] ?? 0)), ':name' => post_text('name', 160), ':slug' => preg_replace('/[^a-zA-Z0-9_-]/', '-', post_text('slug', 160)), ':sort' => (int) ($_POST['sort_order'] ?? 0)]);
}
if ($action === 'article') {
$slug = preg_replace('/[^a-zA-Z0-9_-]/', '-', post_text('slug', 180));
$q = db()->prepare('INSERT INTO articles(category_id,title,slug,summary,cover_image,content,published,sort_order,published_at) VALUES(:category,:title,:slug,:summary,:cover,:content,:published,:sort,:published_at) ON CONFLICT(slug) DO UPDATE SET category_id=excluded.category_id,title=excluded.title,summary=excluded.summary,cover_image=excluded.cover_image,content=excluded.content,published=excluded.published,sort_order=excluded.sort_order,published_at=excluded.published_at,updated_at=CURRENT_TIMESTAMP');
$q->execute([':category' => max(0, (int) ($_POST['category_id'] ?? 0)), ':title' => post_text('title', 255), ':slug' => $slug, ':summary' => post_text('summary', 5000), ':cover' => post_text('cover_image', 500), ':content' => (string) ($_POST['content'] ?? ''), ':published' => isset($_POST['published']) ? 1 : 0, ':sort' => (int) ($_POST['sort_order'] ?? 0), ':published_at' => post_text('published_at', 30) ?: null]);
}
if ($action === 'slide') { $q=db()->prepare('INSERT INTO slides(title,image_url,link_url,sort_order,enabled) VALUES(:title,:image,:link,:sort,:enabled)'); $q->execute([':title'=>post_text('title',255),':image'=>post_text('image_url',500),':link'=>post_text('link_url',500),':sort'=>(int)($_POST['sort_order']??0),':enabled'=>isset($_POST['enabled'])?1:0]); }
if ($action === 'link') { $q=db()->prepare('INSERT INTO links(name,url,logo_url,sort_order,enabled) VALUES(:name,:url,:logo,:sort,:enabled)'); $q->execute([':name'=>post_text('name',160),':url'=>post_text('url',500),':logo'=>post_text('logo_url',500),':sort'=>(int)($_POST['sort_order']??0),':enabled'=>isset($_POST['enabled'])?1:0]); }
if ($action === 'delete') { $table = (string) ($_POST['table'] ?? ''); if (in_array($table, ['categories','articles','slides','links'], true)) { $q=db()->prepare('DELETE FROM ' . $table . ' WHERE id = :id'); $q->execute([':id'=>max(0,(int)($_POST['id']??0))]); } }
if ($action === 'upload_media' && isset($_FILES['media'])) {
$file = $_FILES['media']; $allowed = ['image/jpeg'=>'jpg','image/png'=>'png','image/gif'=>'gif','image/webp'=>'webp'];
if ($file['error'] !== UPLOAD_ERR_OK || $file['size'] > 10 * 1024 * 1024) exit('Invalid upload.');
$mime = (new finfo(FILEINFO_MIME_TYPE))->file($file['tmp_name']);
if (!isset($allowed[$mime]) || @getimagesize($file['tmp_name']) === false) exit('Only valid JPG, PNG, GIF or WebP images are allowed.');
$name = bin2hex(random_bytes(16)) . '.' . $allowed[$mime]; $dir = dirname(__DIR__) . '/public/uploads';
if (!is_dir($dir)) mkdir($dir, 0750, true); if (!move_uploaded_file($file['tmp_name'], $dir . '/' . $name)) exit('Could not store upload.');
$q=db()->prepare('INSERT INTO media(original_name,file_name,mime_type,file_size) VALUES(:original,:file,:mime,:size)'); $q->execute([':original'=>mb_substr((string)$file['name'],0,255),':file'=>$name,':mime'=>$mime,':size'=>(int)$file['size']]);
}
redirect('admin.php?saved=1');
}
}
if (!is_admin()): ?>CMS 登录
CMS 管理后台
query('SELECT * FROM categories ORDER BY sort_order,id')->fetchAll(); $articles = db()->query('SELECT * FROM articles ORDER BY id DESC LIMIT 50')->fetchAll(); $slides = db()->query('SELECT * FROM slides ORDER BY sort_order,id')->fetchAll(); $links = db()->query('SELECT * FROM links ORDER BY sort_order,id')->fetchAll(); $media = db()->query('SELECT * FROM media ORDER BY id DESC LIMIT 50')->fetchAll();
?>CMS 管理后台