Poprawka botto bar i wersje językowe

public/staff/auth.php

@@ -26,13 +26,26 @@ function requireAdminAuth(bool $redirectToLogin = true): void
         header('Location: login.php');
         exit;
     }
+
+    http_response_code(401);
+    header('Content-Type: application/json; charset=utf-8');
+    echo json_encode([
+        'status' => 'error',
+        'message' => 'Unauthorized',
+    ], JSON_UNESCAPED_UNICODE);
+    exit;
 }
 
 function attemptAdminLogin(string $username, string $password): bool
 {
     startAdminSession();
 
-    if (hash_equals(ADMIN_USERNAME, $username) && hash_equals(ADMIN_PASSWORD, $password)) {
+    $userOk = hash_equals(ADMIN_USERNAME, $username);
+    $passOk = strlen($password) === strlen(ADMIN_PASSWORD)
+        && hash_equals(ADMIN_PASSWORD, $password);
+
+    if ($userOk && $passOk) {
+        session_regenerate_id(true);
         $_SESSION['staff_logged_in'] = true;
         $_SESSION['staff_username'] = ADMIN_USERNAME;
         return true;