Enforce authentication on all endpoints

copyFiles.php

@@ -2,9 +2,10 @@
 require_once 'config.php';
 header('Content-Type: application/json');
 
-// Check authentication.
+// Ensure user is authenticated
 if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
     echo json_encode(["error" => "Unauthorized"]);
+    http_response_code(401);
     exit;
 }
 

createFolder.php

@@ -2,6 +2,13 @@
 require 'config.php';
 header('Content-Type: application/json');
 
+// Ensure user is authenticated
+if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
+    echo json_encode(["error" => "Unauthorized"]);
+    http_response_code(401);
+    exit;
+}
+
 // Ensure the request is a POST
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     echo json_encode(['success' => false, 'error' => 'Invalid request method.']);

deleteFolder.php

@@ -2,6 +2,13 @@
 require 'config.php';
 header('Content-Type: application/json');
 
+// Ensure user is authenticated
+if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
+    echo json_encode(["error" => "Unauthorized"]);
+    http_response_code(401);
+    exit;
+}
+
 // Ensure the request is a POST
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     echo json_encode(['success' => false, 'error' => 'Invalid request method.']);

getFileList.php

@@ -5,8 +5,10 @@ header("Pragma: no-cache");
 header("Expires: 0");
 header('Content-Type: application/json');
 
+// Ensure user is authenticated
 if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
     echo json_encode(["error" => "Unauthorized"]);
+    http_response_code(401);
     exit;
 }
 

getFolderList.php

@@ -2,6 +2,13 @@
 require 'config.php';
 header('Content-Type: application/json');
 
+// Ensure user is authenticated
+if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
+    echo json_encode(["error" => "Unauthorized"]);
+    http_response_code(401);
+    exit;
+}
+
 $folderList = [];
 $dir = rtrim(UPLOAD_DIR, '/\\');
 if (is_dir($dir)) {

moveFiles.php

@@ -2,9 +2,10 @@
 require_once 'config.php';
 header('Content-Type: application/json');
 
-// Check authentication.
+// Ensure user is authenticated
 if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
     echo json_encode(["error" => "Unauthorized"]);
+    http_response_code(401);
     exit;
 }
 

renameFile.php

@@ -5,8 +5,10 @@ header("Cache-Control: no-cache, no-store, must-revalidate");
 header("Pragma: no-cache");
 header("Expires: 0");
 
+// Ensure user is authenticated
 if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
     echo json_encode(["error" => "Unauthorized"]);
+    http_response_code(401);
     exit;
 }
 

renameFolder.php

@@ -2,6 +2,13 @@
 require 'config.php';
 header('Content-Type: application/json');
 
+// Ensure user is authenticated
+if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
+    echo json_encode(["error" => "Unauthorized"]);
+    http_response_code(401);
+    exit;
+}
+
 // Ensure the request method is POST
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     echo json_encode(['success' => false, 'error' => 'Invalid request method.']);

upload.php

@@ -2,8 +2,10 @@
 require_once 'config.php';
 header('Content-Type: application/json');
 
+// Ensure user is authenticated
 if (!isset($_SESSION['authenticated']) || $_SESSION['authenticated'] !== true) {
     echo json_encode(["error" => "Unauthorized"]);
+    http_response_code(401);
     exit;
 }