admin: disallow access to unauthorised visitors

Regardless of login include, this page can now be retrieved separately
so needs its own user check.

diff --git a/admin.php b/admin.php
index ea84e0b2967f0188bf40fdb5a9b402509453d275..e73f5b5ca7c78cdc5cb77010b985d89fa630869c 100644 (file)
--- a/admin.php
+++ b/admin.php
@@ -1,3 +1,14 @@
+<?php
+if (empty($User['admin'])) {
+       ob_clean();
+       http_response_code(403);
+?>
+<h2>Verboden toegang</h2>
+<p>Deze pagina is alleen voor sitebeheerders toegankelijk.</p>
+<?php
+       return;
+}
+?>
 <h3>Laatste aanpassingen</h3>
 
 <?php