fix: add frame-src CSP for videos.erg.be and depnum.happyngreen.fr

TODO.md

@@ -1,56 +1,3 @@
 # TODO
 
-- [x] Simplify `tfe.php` HTML structure (remove `.tfe-layout` wrapper, remove `.tfe-synopsis-column` wrapper)
+- [x] Fix CSP: add `frame-src` to allow iframes from `videos.erg.be` and `depnum.happyngreen.fr`
-- [x] Simplify `tfe.css` — replace flex-column with grid where possible, merge `.tfe-layout` into `.tfe-content-row`, remove dead wrappers
-- [x] Commit changes
-- [x] Remove "Mo" option from duration — keep only minutes and pages
-- [x] Combine pages and minutes as separate fields (both can be set simultaneously)
-- [x] Fix minutes input visibility (can't see what's typed)
-- [x] Add `has_annexes` checkbox to form + DB column
-- [x] Display duration on admin backoffice recap page
-- [x] Update public TFE page duration display for new combined format
-- [x] Fix `handleAutosaveResponse is not defined` — load `autosave-handler.js` on about_page edit view
-- [x] Fix `handleAutosaveResponse is not defined` in admin add/edit — function was scoped inside IIFE bundle, not on window
-- [x] Fix search result cards: title and author always below image/gradient, remove text overlay on placeholder gradient
-- [x] Change search results to 10 per page with HTMX pagination (no-JS fallback preserved)
-- [x] Bump to 15 results/page, make results area vertically scrollable, sticky pagination at viewport bottom
-- [x] Fix HTMX targetError: move #search-results wrapper inside fragment so it survives outerHTML swaps
-- [x] Add range counter to results header (e.g. "1–15 sur 112 résultats")
-- [x] Collapsible filter controls with <details>/<summary> + active filter badge on mobile
-- [x] Responsive paginator: hide first/last buttons on mobile, smaller touch targets
-- [x] Compact range counter on mobile: "1–15 / 112" instead of full "1–15 sur 112 résultats"
-- [x] Remove orientation display from search result card meta
-- [x] Add bulk select/delete to tmp cleanup dialog (like admin/index.php pattern)
-- [x] Move cleanup UI from modal to dedicated page (like add.php/edit.php)
-- [x] Replace <details> with <fieldset>/<legend> in cleanup fragments (like contenus.php)
-- [x] Standardise test group recipes: lint-php, lint-css, lint-js, test + add fix recipe + make lint pass clean
-- [x] Remove Mot de passe column from acces.php, add key.svg icon button in Actions to copy password to clipboard, reorder actions (URL/password/edit/toggle/archive), switch URL icon to link-simple.svg
-- [x] Fix CC2r: removed hidden seeds (were stale/overriding user input), render initial licence-choice from \$formData; Interne want_license unchecked clears CC2r+licence, switching from other modes preserves values; CC2r independent toggle; licence dropdown has no-licence placeholder
-- [x] Dans le formulaire admin, le contact privé ne se sauvegarde pas.
-- [x] Remove "Rendre le contact visible publiquement sur la fiche du TFE" from admin add/edit forms
-- [x] Auto-show contact on public TFE page when contact_visible is filled (no checkbox needed)
-- [x] Fix file size limits: align all layers (JS/FilepondHandler/ThesisFileHandler/validate-fragment) — video/audio 5 GB, default 500 MB, PDF 100 MB; fix JS fileValidateSizeFilter gate bug that rejected AV files >1 GB despite 8 GB per-ext cap
-- [x] Fix: deleting contact groups in apropos form not persisted (no change event after DOM removal, autosave never triggered)
-- [x] Improve h1, h2, h3 size difference in base.css heading scale
-- [x] Rework TFE page desktop layout: two columns 35vw/1fr, left = author/title/meta/synopsis, right = files, media 100% width; columns scroll independently, content fits 100vw; no bottom padding on main; add &scrollbar=0 to PDF iframe URLs
-- [x] 'Promoteur·ice ULB' remplacé par 'Promoteur·ice université' (changement juste l'étiquette)
-- [x] PDF viewer: fix page navigation buttons (prev/next) — build toolbar after canvases exist & query canvases fresh in scroll handler
-- [x] PDF viewer: render pages smaller by default (0.85× scale)
-- [x] PDF viewer: add dark transparent violet background behind pages when expanded
-- [x] pdf-viewer: expand to fill right column (not whole page), center pages, freeze column on expand
-- [x] pdf-viewer: fix toolbar width (align-self:stretch), hide sibling file items when expanded
-- [x] Fix createThesis SQL: extra `?` placeholder in VALUES (27 values for 26 columns) + add integration tests
-- [x] CSV import/export: single source of truth (CSV_COLUMNS), add missing columns (duration, annexes, license_custom, contact_visible, objet, cc2r, exemplaires), fix XamxamInitFilePonds → window.n, generate import hint from headers
-- [x] Extend admin auth cookie lifetime from session-only to 1 week (604800s)
-- [x] Close TOC (licence/charte/apropos) and Filtres (search.php) <details> by default on mobile
-- [x] Wider heading scale (h1/h2/h3) for apropos/licence/charte pages: step-5 / step-3 / step-1
-- [x] Reduce heading sizes in content-page.css, use explicit clamp() values instead of step-system vars, tighter hierarchy
-- [x] Fix TOC: extractToc now captures h1/h2/h3 (was h1-only), templates render level classes, toc.css adds indentation per level
-- [x] Masquer le bloc "Durée" sur la page TFE quand aucune durée n'est encodée (ni pages ni minutes)
-- [x] Fix: locked_year cleared on edit — edit dialog didn't populate the field, so any edit cleared the locked academic year
-- [x] Fix repertoire Années column: sort reverse chronological (newest first) instead of ascending alpha
-- [x] TFE website embed: wrap iframe + button in overlay-style div with "Site web" pill badge on left corner, clearer link text
-- [x] Redirect internal metadata links on TFE page from /repertoire to /search (orientation, AP, finalité, year, keywords); add query= for search bar prefill; fix filter <details> visibility on desktop; add keyword to filterKeys badge; add hidden keyword input + visible chip to filter form so keyword filter survives form submission
-- [x] Fix Logger default level: production default was WARNING, but all facades (AppLogger, AdminLogger, Audit) write at INFO — causing submission/admin/audit logs to be silently discarded
-- [x] Add structured logging to PeerTube upload/delete: replace raw error_log() with Logger::get('app')->info() for successes and ErrorHandler::log() for failures in PeerTubeService, FilepondHandler, ThesisCreateController, ThesisFileHandler
-- [x] Fix word-break before punctuation in TFE titles/meta: override aggressive `word-break: break-word` from base.css with `word-break: normal` + `hyphens: auto` on .tfe-title, .tfe-author, .tfe-meta-item; replace spaces before colons in meta labels with `&nbsp;` (French typographic rule)

nginx/xamxam.conf

@@ -56,7 +56,7 @@ server {
 
     # Security headers
     add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload;" always;
-    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always;
+    add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always;
     add_header X-Frame-Options "DENY" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
@@ -145,7 +145,7 @@ server {
         # script-src needs 'unsafe-inline' for the OverType editor init block
         # and the live-reload poller (dev only). Admin is already auth-gated.
         # 'unsafe-eval' is required by htmx (uses Function() internally).
-        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always;
+        add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'none';" always;
 
         # Disable directory listing
         autoindex off;
@@ -190,7 +190,7 @@ server {
     # try_files triggers an internal redirect to location = /index.php, which
     # loses this CSP override and inherits the server-block frame-ancestors 'none'.
     location = /media {
-        add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';" always;
+        add_header Content-Security-Policy "default-src 'self'; frame-src 'self' https://videos.erg.be https://depnum.happyngreen.fr; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; object-src 'none'; frame-ancestors 'self';" always;
         # Direct fastcgi_pass to /index.php (no try_files) so add_header survives.
         # We can't use snippets/fastcgi-php.conf because its try_files
         # $fastcgi_script_name =404 would fail — $fastcgi_script_name is /media