Build PHP news portal with admin and setup

.htaccess

@@ -0,0 +1,5 @@
+RewriteEngine On
+RewriteBase /
+RewriteCond %{REQUEST_FILENAME} !-f
+RewriteCond %{REQUEST_FILENAME} !-d
+RewriteRule ^(.*)$ public/index.php [QSA,L]

README.md

@@ -1,28 +1,42 @@
-# Decrypt
-### [+] Created By HTR-TECH (@***tahmid.rayat***)
-### [+] Disclaimer :
-***Decrypter is a tool to decrypt Encrypted Bash Scripts into a Readable Format.This Tool is created for Educational Purpose only.I am not responsible for any misuse of this tool.***
-
-<img src="https://raw.githubusercontent.com/htr-tech/release-download/master/images/decrypter.png" alt="" border="0" />
-
-### [+] Installation
-```apt update```
-
-```apt install git python2 -y```
-
-```git clone https://github.com/hax0rtahm1d/decrypt```
-
-```cd decrypt```
-
-```python2 dec.py```
-
-### Or, Use Single Command
-
-```
-apt update && apt install git python2 -y && git clone https://github.com/hax0rtahm1d/decrypt && cd decrypt && python2 dec.py
-```
-
-## [+] Find Me on :
-[![Github](https://img.shields.io/badge/Github-HTR--TECH-green?style=for-the-badge&logo=github)](https://github.com/htr-tech)
-[![Instagram](https://img.shields.io/badge/IG-%40tahmid.rayat-red?style=for-the-badge&logo=instagram)](https://www.instagram.com/tahmid.rayat)
-[![Messenger](https://img.shields.io/badge/Chat-Messenger-blue?style=for-the-badge&logo=messenger)](https://m.me/tahmid.rayat.official)
+# Tin tức PHP + MySQL
+
+Website báo tin tức (frontend + admin) viết thuần PHP 8.x, chạy tốt trên shared hosting Apache + MySQL. Không dùng `.env`; mọi cấu hình nằm trong `config.php`.
+
+## Tính năng chính
+- 3 theme giao diện (A/B/C) đổi nhanh trong trang Admin → Cài đặt.
+- Bài viết hỗ trợ text/ảnh/iframe Telegram embed.
+- Interstitial Shopee hợp lệ: nút chính đi Shopee (target `_blank`), nút phụ bỏ qua đọc bài; có tần suất hiển thị theo session/giờ/số bài.
+- Tracking pageview, click Shopee (lọc bot/UA), thống kê ngày/tháng, export CSV.
+- Admin: đăng nhập (bcrypt), chống brute-force, CSRF token, CRUD bài viết, cài đặt hệ thống, upload logo/banner.
+- Telegram bot: gửi khi publish bài hoặc khi có click Shopee (tùy chọn).
+- Setup wizard: nhập thông số DB → tạo bảng + admin → sinh `config.php`.
+
+## Cấu trúc thư mục
+- `public/`: Front controller `index.php`, asset CSS/JS.
+- `app/Core`: Router, DB, bảo mật, view.
+- `app/Controllers`: Controller frontend & admin.
+- `app/Models`: Model truy vấn PDO.
+- `app/Views`: Template PHP (frontend/admin + partials).
+- `database/schema.sql`: Schema MySQL.
+- `setup.php`: Trang cài đặt nhanh.
+- `docs/DEPLOYMENT.md`: Hướng dẫn deploy Apache/shared hosting.
+
+## Cài đặt nhanh (local hoặc shared hosting)
+1. Upload toàn bộ mã nguồn lên hosting (document root chứa `.htaccess` và thư mục `public`).
+2. Truy cập `https://domain/setup.php`, nhập thông tin DB, base URL, tài khoản admin.
+3. Sau khi thấy thông báo thành công, xóa `setup.php` trên hosting.
+4. Đăng nhập Admin tại `https://domain/admin`.
+
+## Chạy thủ công (không dùng setup wizard)
+1. Copy `config.example.php` → `config.php`, điền thông tin DB/base URL.
+2. Import `database/schema.sql` vào MySQL.
+3. Tạo tài khoản admin: `INSERT INTO users (name,email,password) VALUES ('Admin','admin@example.com', PASSWORD_HASH_HERE);` (dùng `password_hash` PHP).
+4. Đặt DocumentRoot trỏ vào thư mục gốc repo, bật mod_rewrite (đã có `.htaccess`).
+
+## Ghi chú bảo mật
+- Luôn thay `security.csrf_key` trong `config.php`.
+- Upload logo/banner chỉ chấp nhận PNG/JPG/WEBP < 2MB.
+- Luôn xóa `setup.php` sau khi cài đặt.
+
+## License
+MIT

app/Controllers/Admin/ArticleController.php

@@ -0,0 +1,118 @@
+<?php
+namespace App\Controllers\Admin;
+
+use App\Core\View;
+use App\Models\Article;
+use App\Models\Category;
+use App\Models\Setting;
+
+class ArticleController extends BaseAdminController
+{
+    public function index(): void
+    {
+        $this->requireAuth();
+        $page = max(1, (int)($_GET['page'] ?? 1));
+        $data = Article::paginate($page, 15, null, null, true);
+        View::render('admin/articles/index', ['articles' => $data['items'], 'pagination' => $data]);
+    }
+
+    public function create(): void
+    {
+        $this->requireAuth();
+        $categories = Category::all();
+        View::render('admin/articles/form', ['article' => null, 'categories' => $categories]);
+    }
+
+    public function store(): void
+    {
+        $this->requireAuth();
+        verify_csrf();
+        $data = $this->articleDataFromRequest(false);
+        $id = Article::create($data);
+        if ($data['include_id_tail']) {
+            $data['slug'] = rtrim($data['slug'], '-') . '-' . $id;
+            Article::update($id, $data);
+        }
+        $this->maybeNotifyTelegram($data['title']);
+        redirect('admin/articles');
+    }
+
+    public function edit(array $params): void
+    {
+        $this->requireAuth();
+        $id = (int)$params['id'];
+        $article = Article::findById($id);
+        $categories = Category::all();
+        View::render('admin/articles/form', ['article' => $article, 'categories' => $categories]);
+    }
+
+    public function update(array $params): void
+    {
+        $this->requireAuth();
+        verify_csrf();
+        $id = (int)$params['id'];
+        $data = $this->articleDataFromRequest(true, $id);
+        Article::update($id, $data);
+        redirect('admin/articles');
+    }
+
+    public function delete(array $params): void
+    {
+        $this->requireAuth();
+        verify_csrf();
+        Article::delete((int)$params['id']);
+        redirect('admin/articles');
+    }
+
+    public function copy(array $params): void
+    {
+        $this->requireAuth();
+        verify_csrf();
+        Article::copy((int)$params['id']);
+        redirect('admin/articles');
+    }
+
+    private function articleDataFromRequest(bool $hasId = false, int $id = 0): array
+    {
+        $title = $_POST['title'] ?? '';
+        $slug = $_POST['slug'] ?: slugify($title);
+        $includeIdTail = !empty($_POST['include_id_tail']);
+        $slugWithTail = $slug;
+        if ($includeIdTail && $hasId) {
+            $slugWithTail .= '-' . $id;
+        }
+        return [
+            'title' => $title,
+            'slug' => $slugWithTail,
+            'meta_title' => $_POST['meta_title'] ?? $title,
+            'meta_description' => $_POST['meta_description'] ?? '',
+            'keywords' => $_POST['keywords'] ?? '',
+            'og_image' => $_POST['og_image'] ?? '',
+            'content' => $_POST['content'] ?? '',
+            'category_id' => (int)($_POST['category_id'] ?? 0),
+            'tags' => $_POST['tags'] ?? '',
+            'status' => $_POST['status'] ?? 'draft',
+            'include_id_tail' => $includeIdTail,
+            'published_at' => $_POST['published_at'] ?: date('Y-m-d H:i:s'),
+        ];
+    }
+
+    private function maybeNotifyTelegram(string $title): void
+    {
+        $settings = Setting::getAll();
+        if (empty($settings['telegram_enabled'])) {
+            return;
+        }
+        $token = $settings['telegram_token'] ?? '';
+        $chatId = $settings['telegram_chat_id'] ?? '';
+        if (!$token || !$chatId) {
+            return;
+        }
+        $url = "https://api.telegram.org/bot{$token}/sendMessage";
+        $payload = http_build_query([
+            'chat_id' => $chatId,
+            'text' => 'Bài mới: ' . $title,
+        ]);
+        @file_get_contents($url . '?' . $payload);
+    }
+}

app/Controllers/Admin/AuthController.php

@@ -0,0 +1,45 @@
+<?php
+namespace App\Controllers\Admin;
+
+use App\Core\View;
+use App\Models\User;
+
+class AuthController
+{
+    public function showLogin(): void
+    {
+        View::render('admin/login', ['error' => null]);
+    }
+
+    public function login(): void
+    {
+        verify_csrf();
+        $email = $_POST['email'] ?? '';
+        $password = $_POST['password'] ?? '';
+        $_SESSION['login_attempts'] = $_SESSION['login_attempts'] ?? 0;
+        $_SESSION['login_locked_until'] = $_SESSION['login_locked_until'] ?? 0;
+        if (time() < $_SESSION['login_locked_until']) {
+            View::render('admin/login', ['error' => 'Tạm khóa đăng nhập, thử lại sau ít phút.']);
+            return;
+        }
+        $user = User::findByEmail($email);
+        if ($user && password_verify($password, $user['password'])) {
+            $_SESSION['admin_id'] = $user['id'];
+            $_SESSION['admin_name'] = $user['name'];
+            $_SESSION['login_attempts'] = 0;
+            $_SESSION['login_locked_until'] = 0;
+            redirect('admin');
+        }
+        $_SESSION['login_attempts']++;
+        if ($_SESSION['login_attempts'] >= 5) {
+            $_SESSION['login_locked_until'] = time() + 300;
+        }
+        View::render('admin/login', ['error' => 'Sai email hoặc mật khẩu']);
+    }
+
+    public function logout(): void
+    {
+        session_destroy();
+        redirect('admin/login');
+    }
+}

app/Controllers/Admin/BaseAdminController.php

@@ -0,0 +1,12 @@
+<?php
+namespace App\Controllers\Admin;
+
+class BaseAdminController
+{
+    protected function requireAuth(): void
+    {
+        if (empty($_SESSION['admin_id'])) {
+            redirect('admin/login');
+        }
+    }
+}

app/Controllers/Admin/DashboardController.php

@@ -0,0 +1,40 @@
+<?php
+namespace App\Controllers\Admin;
+
+use App\Core\View;
+use App\Models\Article;
+use App\Models\Stat;
+use App\Models\Setting;
+
+class DashboardController extends BaseAdminController
+{
+    public function index(): void
+    {
+        $this->requireAuth();
+        $stats = Stat::totals();
+        $daily = Stat::daily();
+        $byArticle = Stat::byArticle();
+        $settings = Setting::getAll();
+        View::render('admin/dashboard', [
+            'stats' => $stats,
+            'daily' => $daily,
+            'byArticle' => $byArticle,
+            'settings' => $settings,
+        ]);
+    }
+
+    public function resetStats(): void
+    {
+        $this->requireAuth();
+        verify_csrf();
+        Stat::reset();
+        $logs = Setting::get('reset_logs', []);
+        $logs[] = [
+            'by' => $_SESSION['admin_name'] ?? 'unknown',
+            'at' => date('Y-m-d H:i:s'),
+        ];
+        Setting::set('reset_logs', $logs);
+        $_SESSION['flash'] = 'Đã reset thống kê.';
+        redirect('admin');
+    }
+}

app/Controllers/Admin/ReportController.php

@@ -0,0 +1,21 @@
+<?php
+namespace App\Controllers\Admin;
+
+use App\Models\Stat;
+
+class ReportController extends BaseAdminController
+{
+    public function exportCsv(): void
+    {
+        $this->requireAuth();
+        $rows = Stat::byArticle();
+        header('Content-Type: text/csv');
+        header('Content-Disposition: attachment; filename="article_stats.csv"');
+        $out = fopen('php://output', 'w');
+        fputcsv($out, ['ID', 'Tiêu đề', 'View', 'Click']);
+        foreach ($rows as $row) {
+            fputcsv($out, [$row['id'], $row['title'], $row['views'] ?? 0, $row['clicks'] ?? 0]);
+        }
+        fclose($out);
+    }
+}

app/Controllers/Admin/SettingsController.php

@@ -0,0 +1,69 @@
+<?php
+namespace App\Controllers\Admin;
+
+use App\Core\Security;
+use App\Core\View;
+use App\Models\Setting;
+
+class SettingsController extends BaseAdminController
+{
+    public function index(): void
+    {
+        $this->requireAuth();
+        $settings = Setting::getAll();
+        View::render('admin/settings', ['settings' => $settings]);
+    }
+
+    public function save(): void
+    {
+        $this->requireAuth();
+        verify_csrf();
+        $data = [
+            'site_name' => $_POST['site_name'] ?? 'Tin tức',
+            'site_description' => $_POST['site_description'] ?? '',
+            'footer_text' => $_POST['footer_text'] ?? '',
+            'theme' => $_POST['theme'] ?? 'theme-a',
+            'shopee_link' => $_POST['shopee_link'] ?? '',
+            'interstitial_enabled' => !empty($_POST['interstitial_enabled']),
+            'interstitial_frequency' => (int)($_POST['interstitial_frequency'] ?? 1),
+            'interstitial_unit' => $_POST['interstitial_unit'] ?? 'session',
+            'bot_list' => array_filter(array_map('trim', explode("\n", $_POST['bot_list'] ?? 'bot'))),
+            'view_cooldown_seconds' => (int)($_POST['view_cooldown_seconds'] ?? 120),
+            'click_cooldown_seconds' => (int)($_POST['click_cooldown_seconds'] ?? 300),
+            'telegram_enabled' => !empty($_POST['telegram_enabled']),
+            'telegram_click_enabled' => !empty($_POST['telegram_click_enabled']),
+            'telegram_token' => $_POST['telegram_token'] ?? '',
+            'telegram_chat_id' => $_POST['telegram_chat_id'] ?? '',
+            'logo' => $this->handleUpload('logo', $_POST['current_logo'] ?? ''),
+            'banner' => $this->handleUpload('banner', $_POST['current_banner'] ?? ''),
+        ];
+        foreach ($data as $key => $value) {
+            Setting::set($key, $value);
+        }
+        $_SESSION['flash'] = 'Đã lưu cài đặt';
+        redirect('admin/settings');
+    }
+
+    private function handleUpload(string $field, string $current): string
+    {
+        if (!isset($_FILES[$field]) || $_FILES[$field]['error'] !== UPLOAD_ERR_OK) {
+            return $current;
+        }
+        $file = $_FILES[$field];
+        if ($file['size'] > 2 * 1024 * 1024) {
+            return $current;
+        }
+        $finfo = finfo_open(FILEINFO_MIME_TYPE);
+        $mime = finfo_file($finfo, $file['tmp_name']);
+        finfo_close($finfo);
+        $allowed = ['image/png' => 'png', 'image/jpeg' => 'jpg', 'image/webp' => 'webp'];
+        if (!isset($allowed[$mime])) {
+            return $current;
+        }
+        $ext = $allowed[$mime];
+        $name = Security::sanitizeFilename($field . '-' . time() . '.' . $ext);
+        $path = __DIR__ . '/../../../public/uploads/' . $name;
+        move_uploaded_file($file['tmp_name'], $path);
+        return 'uploads/' . $name;
+    }
+}