From 027a9fb23326ff5939cc8a2d964a4ff7d178ed93 Mon Sep 17 00:00:00 2001
From: severak <strajt@dalten.cz>
Date: Tue, 4 Feb 2020 11:36:20 +0100
Subject: [PATCH] Implemented non-public stats.

---
 stats.php | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/stats.php b/stats.php
index 75f5416..74ddee6 100644
--- a/stats.php
+++ b/stats.php
@@ -6,11 +6,20 @@ $config = require 'config.php';
 $pdo = new MyPDO('sqlite:' . __DIR__ . '/' . $config['database']);
 
 $site = false;
+$error = false;
 
 if (!empty($_GET['for'])) {
     $site = $pdo->run('SELECT * FROM sites WHERE host=?', [$_GET['for']])->fetch();
+
+    if ($site && $site['stats_public']==0) {
+        if (!isset($_GET['key']) || $_GET['key']!=$site['stats_key']) {
+            // we need password
+            $site = false;
+            $error = 'These stats are locked. You need to provide right ?key in URL.';
+        }
+    }
+
     if ($site) {
-        // TODO - for now all stats are de-facto public, this should not be true
 
         $labels = $visits = $uniques = [];
         for ($d=14; $d>=0; $d--) {
@@ -180,6 +189,8 @@ if (count($byRefs)) {
 
     <?php
 
+} elseif ($error) {
+    echo '<br><strong>'.$error.'</strong>';
 } else {
     echo '<table><tr><th>Site</th><th>domain</th><th>#visits</th></tr>';
     foreach ($sites as $site) {