<?php
// secure_upload.php

$PASSWORD = "YOUR_PASSWORD"; // Sicheren Wert setzen!
$target_dir = __DIR__ . "/"; // Speichert im gleichen Ordner

// Passwort prüfen
if (!isset($_POST['password']) || $_POST['password'] !== $PASSWORD) {
    http_response_code(403);
    echo json_encode(["error" => "Wrong password"]);
    exit;
}

if (!isset($_FILES["file"])) {
    http_response_code(400);
    echo json_encode(["error" => "No file uploaded"]);
    exit;
}

$target_file = $target_dir . basename($_FILES["file"]["name"]);

// Optional: Dateityp prüfen (nur Bilder)
$allowed = ['jpg', 'jpeg', 'png'];
$ext = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));
if (!in_array($ext, $allowed)) {
    http_response_code(400);
    echo json_encode(["error" => "Invalid file type"]);
    exit;
}

if (move_uploaded_file($_FILES["file"]["tmp_name"], $target_file)) {
    echo json_encode(["success" => true, "url" => "https://www.victorgiers.com/generate3d/" . basename($_FILES["file"]["name"])]);
} else {
    http_response_code(500);
    echo json_encode(["error" => "Failed to move uploaded file"]);
}
?>