Auth on delete protection change

scripts/play.php

@@ -20,6 +20,10 @@ $home = shell_exec("awk -F: '/1000/{print $6}' /etc/passwd");
 $home = trim($home);
 
 if(isset($_GET['excludefile'])) {
+  if(isset($_SERVER['PHP_AUTH_USER'])) {
+    $submittedpwd = $_SERVER['PHP_AUTH_PW'];
+    $submitteduser = $_SERVER['PHP_AUTH_USER'];
+    if($submittedpwd == $config['CADDY_PWD'] && $submitteduser == 'birdnet'){
       if(!file_exists($home."/BirdNET-Pi/scripts/disk_check_exclude.txt")) {
         file_put_contents($home."/BirdNET-Pi/scripts/disk_check_exclude.txt", "##start\n##end");
       }
@@ -45,6 +49,18 @@ if(isset($_GET['excludefile'])) {
         echo "OK";
         die();
       }
+    } else {
+      header('WWW-Authenticate: Basic realm="My Realm"');
+      header('HTTP/1.0 401 Unauthorized');
+      echo 'You must be authenticated to change the protection of files.';
+      exit;
+    }
+  } else {
+    header('WWW-Authenticate: Basic realm="My Realm"');
+    header('HTTP/1.0 401 Unauthorized');
+    echo 'You must be authenticated to change the protection of files.';
+    exit;
+  }
 }
 
 if(isset($_GET['bydate'])){
@@ -121,6 +137,7 @@ if(isset($_GET['bydate'])){
 function toggleLock(filename, type, elem) {
   const xhttp = new XMLHttpRequest();
   xhttp.onload = function() {
+    if(this.responseText == "OK"){
       if(type == "add") {
        elem.setAttribute("src","images/lock.svg");
        elem.setAttribute("title", "This file is delete protected.");
@@ -131,6 +148,7 @@ function toggleLock(filename, type, elem) {
        elem.setAttribute("onclick", elem.getAttribute("onclick").replace("del","add"));
       }
     }
+  }
   if(type == "add") {
     xhttp.open("GET", "play.php?excludefile="+filename+"&exclude_add=true", true);
   } else {