gea-ecobricks · santichausis · Jul 6, 2026
diff --git a/includes/require-admin.php b/includes/require-admin.php
@@ -0,0 +1,40 @@
+<?php
+// Auth gate for internal admin-only scripts under /scripts/ that write to the
+// database (data migration/processing tools with no public UI entry point).
+//
+// Requires an admin_env.php file at the repo root (NOT committed, like
+// ecobricks_env.php / gobrikconn_env.php) defining a secret token, using
+// PHP's define() function with the constant name ADMIN_TOKEN and a long
+// random string value.
+//
+// Pass it once as ?admin_token=... (or POST field admin_token); the session
+// remembers it so the multi-step migration scripts can keep redirecting to
+// each other without re-authenticating every request.
+
+if (session_status() === PHP_SESSION_NONE) {
+    session_start();
+}
+
+if (empty($_SESSION['gea_admin_authenticated'])) {
+    $adminEnvPath = __DIR__ . '/../admin_env.php';
+
+    if (!file_exists($adminEnvPath)) {
+        if (!headers_sent()) {
+            http_response_code(503);
+        }
+        die('Admin authentication is not configured on this server.');
+    }
+
+    require_once $adminEnvPath;
+
+    $providedToken = (string) ($_POST['admin_token'] ?? $_GET['admin_token'] ?? '');
+
+    if (!defined('ADMIN_TOKEN') || $providedToken === '' || !hash_equals(ADMIN_TOKEN, $providedToken)) {
+        if (!headers_sent()) {
+            http_response_code(403);
+        }
+        die('Forbidden: admin authentication required.');
+    }
+
+    $_SESSION['gea_admin_authenticated'] = true;
+}
diff --git a/scripts/process_ecobrick-full.php b/scripts/process_ecobrick-full.php
@@ -1,3 +1,4 @@
+<?php require_once '../includes/require-admin.php'; ?>
 <!DOCTYPE html>
 <html lang="en">
 <head>

diff --git a/scripts/process_ecobrick-old.php b/scripts/process_ecobrick-old.php
@@ -1,4 +1,4 @@
-
+<?php require_once '../includes/require-admin.php'; ?>
 <!DOCTYPE html>
 <html lang="en">
 <head>

diff --git a/scripts/process_ecobrick.php b/scripts/process_ecobrick.php
@@ -1,3 +1,4 @@
+<?php require_once '../includes/require-admin.php'; ?>
 <!DOCTYPE html>
 <html lang="en">
 <head>

diff --git a/scripts/process_ecobrick_for_maker_id.php b/scripts/process_ecobrick_for_maker_id.php
@@ -1,4 +1,4 @@
-
+<?php require_once '../includes/require-admin.php'; ?>
 <!DOCTYPE html>
 <html lang="en">
 <head>

diff --git a/scripts/process_training.php b/scripts/process_training.php
@@ -2,6 +2,7 @@
 // PART 1 of the code
 // process_training.php
 
+require_once '../includes/require-admin.php';
 include '../ecobricks_env.php';
 
 // Knack API settings

diff --git a/scripts/process_training2.php b/scripts/process_training2.php
@@ -1,8 +1,8 @@
-
 <?php
 // PART 1 of the code
 // process_training2.php
 
+require_once '../includes/require-admin.php';
 include '../ecobricks_env.php';
 
 // Knack API settings

diff --git a/scripts/process_training3.php b/scripts/process_training3.php
@@ -2,6 +2,7 @@
 // PART 1 of the code
 // process_training2.php
 
+require_once '../includes/require-admin.php';
 include '../ecobricks_env.php';
 
 // Knack API settings

diff --git a/scripts/training.php b/scripts/training.php
@@ -1,4 +1,5 @@
 <?php
+require_once '../includes/require-admin.php';
 include '../ecobricks_env.php';
 
 $training_id = $_GET['training_id'];

diff --git a/scripts/update-training-database.php b/scripts/update-training-database.php
@@ -1,5 +1,6 @@
 <?php
 // PART 4: Database Update
+require_once '../includes/require-admin.php';
 include '../ecobricks_env.php';
 
 $training_id = $_GET['training_id'];