Merge pull request #37 from andydixon/development

Fix hiding clone buttons. Fixes #18

README.md

@@ -25,7 +25,7 @@ Ready to get started? Just follow these simple steps:
 
 * Drop the CMS folder into your static website.
 * Add the uploads folder to your site as well.
-* Open /cms/init.php and edit the credentials for any users you want to set up.
+* Open /cms/config.php and edit the credentials for any users you want to set up.
 * Update the div elements you want to make editable by adding the class editable.
 * Visit /cms/, log in, and start editing!
 
@@ -33,7 +33,7 @@ That’s it! You’re up and running.
 
 ## Requirements
 
-* PHP 8 running on a Linux server. (May work on Windows servers, but don't want to stoop to that level)
+* PHP 8 running on Linux
 
 ## Known Bugs & Issues
 

cms/config.php

@@ -0,0 +1,18 @@
+<?php
+/*
+ * Authentication stores the usernames and passwords for people to be able to use the CMS.
+ * This will be used as well to write to the audit log once it has been implemented in code.
+ */
+
+$config = [
+    'authentication' => [
+        // Add more users as needed - its 'username'=>'password' if you hadn't have guessed
+        'admin' => 'password123',
+    ],
+    // Enable the auditing system
+    'audit' => true,
+    // Set to true if you do not want to see the welcome page and want to go straight to your site
+    'skipWelcomePage' => false,
+    // Show full URL of the page being edited on the control bar
+    'showFullUrl' => true
+];

cms/controller/index.php

@@ -1,67 +1,13 @@
 <?php
-require_once "../neoCMSCore.php";
+require_once "../config.php";
-require_once "../init.php";
 
-switch ($_REQUEST["action"]) {
+spl_autoload_register(function ($class) {
-    case "save":
+    $classPath = str_replace('\\', DIRECTORY_SEPARATOR, $class);
-        header('Content-type: application/json');
+    require_once "../src/{$classPath}.php";
-        if (!empty($_POST['uri']) && !empty($_POST['content'])) {
+});
-            $_SESSION['core']->saveContent($_POST['uri'], $_POST['content']);
-            echo json_encode(array('message' => 'Page has been saved'));
-        } else {
-            echo json_encode(array('error' => 'Unable to save page'));
-        }
-        break;
 
-    /**
+use NeoCMS\CMSController;
-     * getTemplates AJAX call to get list of files
-     */
-    case "getTemplates":
-        header('Content-type: application/json');
-        $files = array_diff(scandir("../templates/"), array('..', '.'));
-        $returnArray = [];
-        foreach ($files as $file) {
-            $returnArray[] = array("id" => $file, "name" => str_replace(array(".html", ".htm"), "", $file));
-        }
-        echo json_encode($returnArray);
-        break;
 
-    /**
+// Instantiate the controller with necessary dependencies
-     * newPage AJAX call to take a template file and create a new page
+$controller = new CMSController($config ?? []);
-     */
+$controller->handleRequest();
-    case "newPage":
-        header('Content-type: application/json');
-
-        $filename = str_replace("..", "", $_POST['filename']);
-        $template = str_replace("..", "", $_POST['template']);
-        if (!str_ends_with($filename, ".htm") && !str_ends_with($filename, ".html")) {
-            $filename .= ".html";
-        }
-
-        // Some vhosts can supply a trailing slash on DOCUMENT_ROOT so tidy it up
-        $destination = str_replace("//", "/", $_SERVER['DOCUMENT_ROOT'] . "/" . $filename);
-
-
-        if (!file_exists("../templates/" . $template)) die(json_encode(array("error" => "Template not found")));
-        if (file_exists($destination)) die(json_encode(array("error" => "Page or file already exists")));
-
-        file_put_contents($destination, file_get_contents("../templates/" . $template));
-        if (!file_exists($destination)) die(json_encode(array("error" => "Template copy failed")));
-        echo json_encode(array("ok" => "DONE_THE_NEEDFUL", "url" => str_replace("//", "/", "/" . $filename)));
-        break;
-
-    case "getPages":
-        header('Content-type: application/json');
-        $it = new RecursiveDirectoryIterator("../../");
-        $returnArray = [];
-        foreach (new RecursiveIteratorIterator($it) as $file) {
-            // Strip document root from URI, so relative
-            $file = str_replace($_SERVER["DOCUMENT_ROOT"], "", $file->getRealPath());
-
-            if (!str_starts_with($file, "/cms/") && (str_ends_with($file, ".html") || str_ends_with($file, ".htm")))
-                $returnArray[] = array("name" => $file, "url" => $file);
-        }
-        echo json_encode($returnArray);
-        break;
-
-}

cms/css/editor.css

@@ -34,12 +34,27 @@ body {
 
 .controls .buttonContainer {
     width: 400px;
-    margin: 12px auto;
+    margin: 12px 0;
+    position: absolute;
+    right: 110px;
+}
+
+.controls #urlbox {
+    margin: 15px 150px;
+    text-align: center;
+    font-size: 1.5em;
+    color: black;
+    position: absolute;
+}
+
+.controls #urlbox div {
+    float: right;
+    margin-left: 10px;
 }
 
 .controls .loggedInDetails {
     position: absolute;
-    top: 12px;
+    top: 20px;
     right: 10px;
 }
 
@@ -61,11 +76,11 @@ body {
     border: 1px solid #1f2f47;
     display: inline-block;
     cursor: pointer;
-    color: #ffffff;
+    color: #ffffff !important;
     font-family: Arial, Helvetica, sans-serif;
     font-size: 15px;
     padding: 6px 13px;
-    text-decoration: none;
+    text-decoration: none !important;
     text-shadow: 0 1px 0 #263666;
 }
 

cms/image_upload.php

@@ -1,41 +1,95 @@
 <?php
-// Allowed MIME types
+// upload.php
-$allowed_types = ['image/jpeg', 'image/png', 'image/gif'];
+
+require_once "config.php";
+
+// Autoload classes (if not using Composer)
+spl_autoload_register(function ($class) {
+    $classPath = str_replace('\\', DIRECTORY_SEPARATOR, $class);
+    require_once "./src/{$classPath}.php";
+});
+
+use NeoCMS\Authentication;
+
+// Ensure the user is authenticated
+$authentication = new Authentication($config['authentication']??[]);
+if (!$authentication->isLoggedIn()) {
+    http_response_code(401);
+    header('Content-Type: application/json');
+    echo json_encode(['error' => 'Unauthorised']);
+    exit;
+}
+
+// Set appropriate headers
+header('Content-Type: application/json');
+
+// Allowed MIME types and extensions
+$allowed_types = [
+    'image/jpeg' => 'jpg',
+    'image/png'  => 'png',
+    'image/gif'  => 'gif',
+    'text/pdf'  => 'pdf',
+    'text/docx'  => 'docx',
+    'text/xlsx'  => 'xlsx',
+    'text/doc' => 'doc',
+];
+
+// Maximum file size in bytes (50MB)
+$max_file_size = 50 * 1024 * 1024;
 
 // Check if a file has been uploaded
-if (isset($_FILES['file'])) {
+if (isset($_FILES['file']) && $_FILES['file']['error'] === UPLOAD_ERR_OK) {
     $file = $_FILES['file'];
 
+    // Check file size
+    if ($file['size'] > $max_file_size) {
+        http_response_code(400);
+        echo json_encode(['error' => 'File size exceeds the maximum limit.']);
+        exit;
+    }
+
     // Validate the file type
-    $finfo = finfo_open(FILEINFO_MIME_TYPE);
+    $finfo     = finfo_open(FILEINFO_MIME_TYPE);
     $mime_type = finfo_file($finfo, $file['tmp_name']);
     finfo_close($finfo);
 
-    if (!in_array($mime_type, $allowed_types)) {
+    if (!array_key_exists($mime_type, $allowed_types)) {
         http_response_code(400);
         echo json_encode(['error' => 'Invalid file type.']);
         exit;
     }
 
-    // Set the upload directory
+    // Validate that the file is a real image
-    $upload_dir = '../uploads/';
+    if (getimagesize($file['tmp_name']) === false) {
-
+        http_response_code(400);
-    // Ensure the upload directory exists
+        echo json_encode(['error' => 'Uploaded file is not a valid image.']);
-    if (!is_dir($upload_dir)) {
+        exit;
-        mkdir($upload_dir, 0777, true);
     }
 
     // Generate a unique name for the image
-    $extension = pathinfo($file['name'], PATHINFO_EXTENSION);
+    $extension = $allowed_types[$mime_type];
-    $filename = uniqid() . '.' . $extension;
+    $filename  = uniqid('', true) . '.' . $extension;
+
+    // Set the upload directory
+    $upload_dir = realpath(__DIR__ . '/../uploads') . DIRECTORY_SEPARATOR;
+
+    // Ensure the upload directory exists
+    if (!is_dir($upload_dir) && !mkdir($upload_dir, 0755, true)) {
+        http_response_code(500);
+        echo json_encode(['error' => 'Failed to create upload directory.']);
+        exit;
+    }
 
     // Set the target file path
     $target_file = $upload_dir . $filename;
 
     // Move the uploaded file to the target directory
     if (move_uploaded_file($file['tmp_name'], $target_file)) {
+        // Set file permissions
+        chmod($target_file, 0644);
+
         // Return a JSON response with the image location
-        $location = $target_file;
+        $location = '/uploads/' . $filename;
         echo json_encode(['location' => $location]);
     } else {
         // Return an error response
@@ -43,7 +97,34 @@ if (isset($_FILES['file'])) {
         echo json_encode(['error' => 'Failed to move uploaded file.']);
     }
 } else {
-    // No file was uploaded
+    // Handle upload errors
+    $error_message = 'No file uploaded.';
+    if (isset($_FILES['file']['error'])) {
+        switch ($_FILES['file']['error']) {
+            case UPLOAD_ERR_INI_SIZE:
+            case UPLOAD_ERR_FORM_SIZE:
+                $error_message = 'File size exceeds the maximum limit.';
+                break;
+            case UPLOAD_ERR_PARTIAL:
+                $error_message = 'The uploaded file was only partially uploaded.';
+                break;
+            case UPLOAD_ERR_NO_FILE:
+                $error_message = 'No file was uploaded.';
+                break;
+            case UPLOAD_ERR_NO_TMP_DIR:
+                $error_message = 'Missing a temporary folder.';
+                break;
+            case UPLOAD_ERR_CANT_WRITE:
+                $error_message = 'Failed to write file to disk.';
+                break;
+            case UPLOAD_ERR_EXTENSION:
+                $error_message = 'A PHP extension stopped the file upload.';
+                break;
+            default:
+                $error_message = 'Unknown upload error.';
+                break;
+        }
+    }
     http_response_code(400);
-    echo json_encode(['error' => 'No file uploaded.']);
+    echo json_encode(['error' => $error_message]);
-}
+}

cms/index.php

@@ -1,7 +1,24 @@
 <?php
-require_once "neoCMSCore.php";
+require_once "config.php";
-require_once "init.php";
+// Autoload classes (if not using Composer)
+spl_autoload_register(function ($class) {
+    $classPath = str_replace('\\', DIRECTORY_SEPARATOR, $class);
+    require_once "./src/{$classPath}.php";
+});
+
+use NeoCMS\Authentication;
+
+// Instantiate the Authentication class
+$authentication = new Authentication($config['authentication']??[]);
+
+// Check if the user is logged in
+if (!$authentication->isLoggedIn()) {
+    // Redirect to the login page
+    header("Location: /cms/login/");
+    exit;
+}
 ?>
+
 <!DOCTYPE html>
 <html lang="en-gb">
 <head>
@@ -28,6 +45,7 @@ require_once "init.php";
 <div class="pageContainer">
     <div class="controls">
         <div class="logo"></div>
+       <?php if($config['showFullUrl']) echo '<div id="urlbox"></div>';?>
         <div class="buttonContainer">
             <ul>
                 <li><a href="#" id="selectPage" class="blueButton">Select Page</a></li>
@@ -36,7 +54,7 @@ require_once "init.php";
             </ul>
         </div>
         <div class="loggedInDetails">
-            Logged in as: <?php echo $_SESSION["core"]->getLoggedinUser(); ?><br />
+            Logged in as: <?php echo $authentication->getLoggedinUser(); ?><br />
             <?php
             if ( ! is_writable("logs/")) {
                 echo "<span class='redText'>Make /cms/logs/ writeable!</span>";
@@ -44,7 +62,7 @@ require_once "init.php";
             ?>
         </div>
     </div>
-    <iframe id="frameContainer" src="<?php echo $skipWelcomePage ? "/" : "welcome.html"; ?>" class="frame"></iframe>
+    <iframe id="frameContainer" src="<?php echo $config['skipWelcomePage'] ? "/" : "welcome.html"; ?>" class="frame"></iframe>
 </div>
 <!-- Modal -->
 <div id="editModal" class="modal fade" role="dialog">

cms/init.php

@@ -1,59 +0,0 @@
-<?php
-/*
- * Authentication stores the usernames and passwords for people to be able to use the CMS.
- * This will be used as well to write to the audit log once it has been implemented in code.
- */
-$authentication = [
-    "admin" => "password",
-    "editor" => "password",
-];
-
-// Set to true if you do not want to see the welcome page and want to go straight to your site
-$skipWelcomePage = false;
-
-/**
- * DO NOT CHANGE ANYTHING BENEATH THIS LINE - IT WILL BUGGER STUFF UP
- */
-session_start();
-require_once "neoCMSCore.php";
-
-if (empty($_SESSION["core"])) {
-    $_SESSION["core"] = new neoCMSCore();
-    $_SESSION["core"]->users = $authentication;
-}
-if (!$_SESSION["core"]->isLoggedIn() && stripos($_SERVER['REQUEST_URI'], "/login") === FALSE) {
-    header('Location: /cms/login');
-    die("Redirecting to login..");
-}
-
-
-// str_starts_with compatibility for php 7
-if (!function_exists('str_starts_with')) {
-    function str_starts_with($haystack, $needle): bool
-    {
-        //str_starts_with(string $haystack, string $needle): bool
-
-        $strlen_needle = mb_strlen($needle);
-        if (mb_substr($haystack, 0, $strlen_needle) == $needle) {
-            return true;
-        }
-        return false;
-    }
-}
-
-//str_ends_with compatibility for php 7
-if (!function_exists('str_ends_with')) {
-    function str_ends_with($haystack, $needle): bool
-    {
-        //str_starts_with(string $haystack, string $needle): bool
-
-        $strlen_needle = mb_strlen($needle);
-        if (mb_substr($haystack, -$strlen_needle, $strlen_needle) == $needle) {
-            return true;
-        }
-        return false;
-    }
-}
-
-$_SESSION["core"]->version = '2.00';
-

cms/js/cms.js

@@ -43,6 +43,7 @@ $(document).ready(function () {
                         images_upload_credentials: true,
                         force_br_newlines: false,
                         force_p_newlines: false,
+                        license_key: 'gpl',
                         forced_root_block: 'aaa',
                         newline_behavior: 'linebreak'
                     });
@@ -265,6 +266,7 @@ $(document).ready(function () {
             $(this).find('.buttonContainer').remove();
             addButtonsToNeoDupe(this);
         });
+        $('#urlbox').html("<strong>Editing:</strong> <div>"+$(iframeDoc)[0].URL+"</div>");
     }
 
     // Function to add buttons to a neo-dupe element inside the iframe
@@ -283,6 +285,8 @@ $(document).ready(function () {
         $buttonContainer.css("position", "absolute");
         $buttonContainer.css("top", "5px");
         $buttonContainer.css("right", "5px");
+        $buttonContainer.css("z-index","9999");
+
 
         var $duplicateBeforeButton = $(iframeDoc.createElement('button'));
         $duplicateBeforeButton.addClass('duplicate-btn-before').text('◀️').prop('title', 'Clone before');

cms/login/index.php

@@ -1,19 +1,49 @@
 <?php
-require_once "../neoCMSCore.php";
+// login.php
-require_once "../init.php";
+
-// Initialize error message variable
+require_once "../config.php";
+
+// Autoload classes (if not using Composer)
+spl_autoload_register(function ($class) {
+    $classPath = str_replace('\\', DIRECTORY_SEPARATOR, $class);
+    require_once "../src/{$classPath}.php";
+});
+
+use NeoCMS\Authentication;
+use NeoCMS\Logger;
+
+// Initialise error message variable
 $error = '';
 
-if (isset($_POST['username']) && isset($_POST['password'])) {
+// Instantiate the Authentication and Logger classes
-    if (!$_SESSION['core']->login($_POST['username'], $_POST['password'])) {
+$authentication = new Authentication($config['authentication']??[]);
-        $error = "Invalid username or password";
+$logger = new Logger($config['audit']??true);
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
+    $username = $_POST['username'] ?? '';
+    $password = $_POST['password'] ?? '';
+
+    if ($authentication->login($username, $password)) {
+        // Log successful login
+        $logger->write(
+            "User login for $username was successful from {$_SERVER['REMOTE_ADDR']}",
+            $username
+        );
+
+        // Redirect to the CMS dashboard or desired page
+        header("Location: /cms/");
+        exit("Well done, champ! You got this!! <3");
     } else {
-        header("Location:/cms/");
+        // Log failed login attempt
-        die("Well done, champ! You got this!! <3");
+        $logger->write(
+            "User login for $username was denied due to incorrect credentials from {$_SERVER['REMOTE_ADDR']}",
+            $username
+        );
+
+        $error = "Invalid username or password";
     }
 }
 ?>
-
 <!DOCTYPE html>
 <html lang="en">
 <head>

cms/neoCMSCore.php

@@ -1,63 +0,0 @@
-<?php
-
-class neoCMSCore
-{
-
-    public bool $auditEnabled = true;
-    public array $users = [];
-    public bool $loggedIn = false;
-    public string $version = '2.0';
-    private string $loggedInUser = '';
-
-    public function __construct()
-    {
-
-    }
-
-    public function login($username, $password)
-    {
-        $this->loggedIn = (!empty($this->users[$username]) && $this->users[$username] == $password);
-        if ($this->loggedIn) $this->loggedInUser = $username;
-        $this->writeAudit("User login for " . $username . " was " . ($this->loggedIn ? "successful" : "denied due to incorrect credentials") . " from " . $_SERVER['REMOTE_ADDR']);
-        return $this->loggedIn;
-    }
-
-    /**
-     * Write an entry into the audit log
-     * @param $value
-     * @return void
-     */
-    public function writeAudit($value): void
-    {
-        if ($this->auditEnabled)
-            file_put_contents(__DIR__ . "/logs/" . date('y-m-d-') . "audit.txt", date('Y-m-d H:i:s') . "\t" . $this->loggedInUser . "\t" . trim($value) . "\n", FILE_APPEND);
-    }
-
-    public function isLoggedIn()
-    {
-        return $this->loggedIn;
-    }
-
-    public function getLoggedinUser(): string
-    {
-        return $this->loggedInUser;
-    }
-
-    public function saveContent($uri, $content): void
-    {
-        $this->writeAudit("Content for " . $uri . " was saved.");
-        $uri = str_replace("../", "./", $uri);
-
-        //check to see if we're dealing with a default (index.htm{l}) page
-        if (str_ends_with($uri, "/") || $uri == '/') {
-            if (file_exists($_SERVER['DOCUMENT_ROOT'] . $uri . 'index.htm')) {
-                $uri = $uri . '/index.htm';
-            } elseif (file_exists($_SERVER['DOCUMENT_ROOT'] . $uri . 'index.html')) {
-                $uri = $uri . '/index.html';
-            } else {
-                die('Unknown default file:' . $uri);
-            }
-        }
-        file_put_contents($_SERVER['DOCUMENT_ROOT'] . $uri, $content);
-    }
-}

cms/src/NeoCMS/Authentication.php

@@ -0,0 +1,59 @@
+<?php
+
+namespace NeoCMS;
+
+class Authentication
+{
+    private $credentials;
+
+    public function __construct(array $credentials)
+    {
+        session_start();
+        $this->credentials = $credentials;
+    }
+
+    /**
+     * Logs a user into the CMS
+     * @param $username
+     * @param $password
+     * @return bool
+     */
+    public function login($username, $password)
+    {
+        if (!empty($this->credentials[$username]) && $this->credentials[$username] === $password) {
+            $_SESSION['loggedIn'] = true;
+            $_SESSION['loggedInUser'] = $username;
+            return true;
+        }
+
+        $_SESSION['loggedIn'] = false;
+        return false;
+    }
+
+    /**
+     * Checks if a user has logged in
+     * @return bool
+     */
+    public function isLoggedIn(): bool
+    {
+        return $_SESSION['loggedIn'] ?? false;
+    }
+
+    /**
+     * Returns the user logged in
+     * @return string
+     */
+    public function getLoggedInUser(): string
+    {
+        return $_SESSION['loggedInUser'] ?? 'Not logged in';
+    }
+
+    /**
+     * Destroy the session
+     * @return void
+     */
+    public function logout()
+    {
+        session_destroy();
+    }
+}

cms/src/NeoCMS/CMSController.php

@@ -0,0 +1,286 @@
+<?php
+namespace NeoCMS;
+
+class CMSController
+{
+    private array $config;
+    private Authentication $authentication;
+    private Logger $logger;
+    private array $request;
+    private string $templatesDir;
+    private string $documentRoot;
+
+    public function __construct($config)
+    {
+        $this->config = $config;
+        $this->authentication = new Authentication($config['authentication']);
+        $this->logger = new Logger($config['audit']);
+        $this->request = $_REQUEST;
+        $this->templatesDir = realpath(__DIR__ . '/../../templates/') . DIRECTORY_SEPARATOR;
+        $this->documentRoot = rtrim(realpath($_SERVER['DOCUMENT_ROOT']), DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
+    }
+
+    /**
+     * Handle an AJAX call
+     * @return void
+     */
+    public function handleRequest(): void
+    {
+        $action = $this->request['action'] ?? null;
+
+        if (!$action) {
+            $this->sendJsonResponse(['error' => 'No action specified']);
+            return;
+        }
+
+        // Check if the user is authenticated for actions that require it
+        if (in_array($action, ['save', 'newPage']) && !$this->authentication->isLoggedIn()) {
+            $this->sendJsonResponse(['error' => 'Not authenticated']);
+            return;
+        }
+
+        $methodName = $action . 'Action';
+        if (method_exists($this, $methodName)) {
+            try {
+                $this->$methodName();
+            } catch (\Exception $e) {
+                $this->sendJsonResponse(['error' => $e->getMessage()]);
+            }
+        } else {
+            $this->sendJsonResponse(['error' => 'Unknown action']);
+        }
+    }
+
+    /**
+     * Saves a page to the filesystem
+     * @return void
+     * @throws \Exception
+     */
+    private function saveAction(): void
+    {
+        $this->ensurePostRequest();
+        $uri = $_POST['uri'] ?? '';
+        $content = $_POST['content'] ?? '';
+
+        if (empty($uri) || empty($content)) {
+            $this->sendJsonResponse(['error' => 'URI and content are required']);
+            return;
+        }
+
+        $filename = $this->saveContent($uri, $content);
+        $this->sendJsonResponse([
+            'message' => 'Page has been saved',
+            'destination' => $filename,
+        ]);
+    }
+
+    /**
+     * Returns back a JSON object containing templates
+     * @return void
+     */
+    private function getTemplatesAction(): void
+    {
+        $files = array_diff(scandir($this->templatesDir), ['..', '.']);
+        $templates = [];
+
+        foreach ($files as $file) {
+            $templates[] = [
+                'id' => $file,
+                'name' => pathinfo($file, PATHINFO_FILENAME),
+            ];
+        }
+
+        $this->sendJsonResponse($templates);
+    }
+
+    /**
+     * Create a new page based on a template file
+     * @return void
+     * @throws \Exception
+     */
+    private function newPageAction(): void
+    {
+        $this->ensurePostRequest();
+        $filename = $_POST['filename'] ?? '';
+        $template = $_POST['template'] ?? '';
+
+        $filename = $this->sanitiseFileName($filename);
+        $template = $this->sanitiseFileName($template);
+
+        if (!$filename || !$template) {
+            $this->sendJsonResponse(['error' => 'Filename and template are required']);
+            return;
+        }
+
+        if (!preg_match('/\.(html|htm)$/', $filename)) {
+            $filename .= '.html';
+        }
+
+        $destination = $this->documentRoot . ltrim($filename, DIRECTORY_SEPARATOR);
+        $templatePath = realpath($this->templatesDir . $template);
+
+        if (!$templatePath || strpos($templatePath, $this->templatesDir) !== 0) {
+            $this->sendJsonResponse(['error' => 'Template not found']);
+            return;
+        }
+
+        if (file_exists($destination)) {
+            $this->sendJsonResponse(['error' => 'Page or file already exists']);
+            return;
+        }
+
+        if (!copy($templatePath, $destination)) {
+            $this->sendJsonResponse(['error' => 'Template copy failed']);
+            return;
+        }
+
+        $this->logger->write(
+            "Created new page: $filename from template $template",
+            $this->authentication->getLoggedInUser()
+        );
+
+        $this->sendJsonResponse([
+            'ok' => 'DONE_THE_NEEDFUL',
+            'url' => '/' . ltrim($filename, '/'),
+        ]);
+    }
+
+    /**
+     * Get list of pages and return as a JSON response
+     * @return void
+     */
+    private function getPagesAction(): void
+    {
+        $iterator = new \RecursiveIteratorIterator(
+            new \RecursiveDirectoryIterator($this->documentRoot)
+        );
+        $pages = [];
+
+        foreach ($iterator as $file) {
+            if (!$file->isFile()) {
+                continue;
+            }
+
+            $filePath = $file->getRealPath();
+
+            // Exclude CMS directory
+            if (strpos($filePath, $this->documentRoot . 'cms' . DIRECTORY_SEPARATOR) === 0) {
+                continue;
+            }
+
+            // Include only .html and .htm files
+            if (preg_match('/\.(html|htm)$/i', $filePath)) {
+                $relativePath = str_replace($this->documentRoot, '/', $filePath);
+                $pages[] = [
+                    'name' => $relativePath,
+                    'url' => $relativePath,
+                ];
+            }
+        }
+
+        $this->sendJsonResponse($pages);
+    }
+
+    /**
+     * Do the actual save to the filesystem and return back the path
+     * @param $uri
+     * @param $content
+     * @return string
+     * @throws \Exception
+     */
+    private function saveContent($uri, $content): string
+    {
+        $uri = $this->sanitiseUri($uri);
+        $filePath = $this->resolveUriToFilePath($uri);
+
+        if (file_put_contents($filePath, $content) === false) {
+            throw new \Exception('Failed to save content');
+        }
+
+        $this->logger->write(
+            "Content for $uri was saved.",
+            $this->authentication->getLoggedInUser()
+        );
+
+        return $uri;
+    }
+
+    /**
+     * Identify the file to write to
+     * @param $uri
+     * @return string
+     * @throws \Exception
+     */
+    private function resolveUriToFilePath($uri): string
+    {
+        $path = $this->documentRoot . ltrim($uri, '/');
+
+        if (is_dir($path)) {
+            $indexFiles = ['index.html', 'index.htm'];
+            foreach ($indexFiles as $indexFile) {
+                if (file_exists($path . $indexFile)) {
+                    $path .= $indexFile;
+                    break;
+                }
+            }
+            if (is_dir($path)) {
+                throw new \Exception('No default index file found in directory: ' . $uri);
+            }
+        } else {
+            if (!preg_match('/\.(html|htm)$/i', $path)) {
+                $path .= '.html';
+            }
+        }
+
+        $realPath = realpath($path);
+        if (!$realPath || strpos($realPath, $this->documentRoot) !== 0) {
+            throw new \Exception('Invalid file path');
+        }
+
+        return $realPath;
+    }
+
+    /**
+     * Sanitise the filename
+     * @param $filename
+     * @return string
+     */
+    private function sanitiseFileName($filename): string
+    {
+        return preg_replace('/[^a-zA-Z0-9_\-\.]/', '', basename($filename));
+    }
+
+    /**
+     * Sanitise a URI
+     * @param $uri
+     * @return string
+     */
+    private function sanitiseUri($uri): string
+    {
+        $uri = filter_var($uri, FILTER_SANITIZE_URL);
+        return preg_replace('#(\.\./|/\.{2})#', '', $uri);
+    }
+
+    /**
+     * Ensure that the controller is not being spammed by GET or other rubbish
+     * @return void
+     * @throws \Exception
+     */
+    private function ensurePostRequest(): void
+    {
+        if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+            throw new \Exception('Invalid request method');
+        }
+    }
+
+    /**
+     * Send the JSON response
+     * @param $data
+     * @return void
+     */
+    private function sendJsonResponse($data): void
+    {
+        header('Content-Type: application/json');
+        echo json_encode($data);
+    }
+}

cms/src/NeoCMS/Logger.php

@@ -0,0 +1,46 @@
+<?php
+namespace NeoCMS;
+
+class Logger
+{
+    private $auditEnabled;
+    private $logsDir;
+
+    public function __construct($auditEnabled)
+    {
+        $this->auditEnabled = $auditEnabled;
+
+        $this->logsDir = __DIR__ . '/../../logs';
+        $this->logsDir = rtrim($this->logsDir, '/\\') . DIRECTORY_SEPARATOR;
+
+        // Ensure the logs directory exists
+        if (!is_dir($this->logsDir)) {
+            if (!mkdir($this->logsDir, 0755, true)) {
+                throw new \Exception('Failed to create logs directory: ' . $this->logsDir);
+            }
+        }
+    }
+
+    /**
+     * Write an entry to the log
+     * @param $message
+     * @param $user
+     * @return void
+     */
+    public function write($message, $user): void
+    {
+        if (!$this->auditEnabled) {
+            return;
+        }
+
+        $logFile = $this->logsDir . date('Y-m-d') . '-audit.txt';
+        $entry = sprintf(
+            "[%s]\tUser: %s\t%s\n",
+            date('Y-m-d H:i:s'),
+            $user,
+            trim($message)
+        );
+
+        file_put_contents($logFile, $entry, FILE_APPEND);
+    }
+}

cms/welcome.html

@@ -94,24 +94,6 @@
     </div>
 </section>
 
-<!-- Requirements Section -->
-<section class="container my-5">
-    <h2 class="text-center mb-4">Requirements 📝</h2>
-    <p class="text-center">NeoCMS requires the following:</p>
-    <ul class="list-group list-group-flush">
-        <li class="list-group-item">PHP 8 running on a Linux server. (May work on Windows servers, but we don't want to stoop to that level 😉)</li>
-    </ul>
-</section>
-
-<!-- Known Issues Section -->
-<section class="container my-5">
-    <h2 class="text-center mb-4">Known Bugs &amp; Issues 🐞</h2>
-    <ul class="list-group list-group-flush editable" style="cursor: default;">
-        <li class="list-group-item"><strong>File Uploads (non-image):</strong> Currently, file uploads are not fully implemented. We're working on it!</li>
-        <li class="list-group-item"><strong>Testing:</strong> The system is functional, but it hasn’t been fully tested in all scenarios.</li>
-    </ul>
-</section>
-
 <!-- License Section -->
 <section class="container my-5">
     <h2 class="text-center mb-4">License 📄</h2>