PostERG/xamxam
1
0
Fork 0
mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-06-25 16:19:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix issues with nginx access to pages

Browse Source 
- fix: 403 on /language-autre-fragment.php — add explicit nginx location block

  The nginx catch-all  blocked direct access
  to all PHP files except /index.php and files inside /admin/.

  language-autre-fragment.php lives at the public root and is POSTed to by
  HTMX from both the admin edit form and the partage form. Added an explicit
   fastcgi block so it is executed
  rather than denied.

- fix: replace .php-suffixed public URLs blocked by nginx catch-all

  Audit of all client-facing PHP URL references against nginx routing:

  - fetch('/request-access.php') in tfe.php -> '/request-access'
    (clean URL already routed by Dispatcher)
  - /media.php?path= in form.php (x2) and admin/recapitulatif.php -> /media?path=
    (nginx only has location = /media, no location for /media.php)

  All these .php-suffixed URLs hit the nginx catch-all
    location ~ \.php$ { deny all; }
  which takes precedence over location / { try_files ... } for regex matches.
This commit is contained in:
Pontoporeia
2026-05-08 11:30:02 +02:00
parent 6ba13e00ea
commit 5735ccbc38
8 changed files with 77 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
app/public/admin/language-autre-fragment.php Normal file
View File

@@ -0,0 +1,17 @@
<?php
/**
* language-autre-fragment.php (admin)
*
* HTMX fragment: returns the "Autre(s) langue(s)" input row.
* Called from the shared form partial when a language checkbox changes.
*
* Expected POST:
* languages[] — selected language IDs (may be absent)
* language_autre — current free-text value (for repopulation)
*/
require_once __DIR__ . '/../../bootstrap.php';
require_once __DIR__ . '/../../src/AdminAuth.php';
AdminAuth::requireLogin();
require_once APP_ROOT . '/public/partage/language-autre-fragment.php';

46
app/public/language-autre-fragment.php
View File

@@ -1,46 +0,0 @@
<?php
/**
* language-autre-fragment.php
*
* HTMX fragment: returns the "Autre(s) langue(s)" input row when no standard
* language checkbox is checked, or an empty hidden placeholder when at least
* one is checked.
*
* Expected POST:
* languages[] — selected language IDs (may be absent)
* language_autre — current free-text value (for repopulation)
*/
require_once __DIR__ . '/../bootstrap.php';
$selectedIds = isset($_POST['languages']) && is_array($_POST['languages'])
? $_POST['languages']
: [];
$currentValue = htmlspecialchars(trim($_POST['language_autre'] ?? ''));
$anyChecked = !empty($selectedIds);
?>
<div id="language-autre-row">
<?php if (!$anyChecked): ?>
<div>
<label for="language_autre">Autre(s) langue(s) : <span class="asterisk">*</span></label>
<div>
<input type="text"
id="language_autre"
name="language_autre"
value="<?= $currentValue ?>"
required>
<small>Si votre TFE contient une langue absente de la liste, précisez-la ici.</small>
</div>
</div>
<?php else: ?>
<div>
<label for="language_autre">Autre(s) langue(s) :</label>
<div>
<input type="text"
id="language_autre"
name="language_autre"
value="<?= $currentValue ?>">
<small>Si votre TFE contient une langue absente de la liste, précisez-la ici.</small>
</div>
</div>
<?php endif; ?>
</div>

7
app/public/partage/index.php
View File

@@ -21,6 +21,13 @@ $parts = explode('/', $path);
$slug = $parts[0] ?? '';
$action = $parts[1] ?? '';
// Special route: /partage/language-autre-fragment (HTMX fragment, no auth needed)
if ($slug === 'language-autre-fragment' && $_SERVER['REQUEST_METHOD'] === 'POST') {
App::boot();
require_once __DIR__ . '/language-autre-fragment.php';
exit;
}
// Special route: /partage/format-website-fragment (HTMX fragment, no auth needed)
if ($slug === 'format-website-fragment' && $_SERVER['REQUEST_METHOD'] === 'POST') {
App::boot();

36
app/public/partage/language-autre-fragment.php Normal file
View File

@@ -0,0 +1,36 @@
<?php
/**
* language-autre-fragment.php
*
* Shared HTMX fragment include: returns the "Autre(s) langue(s)" input row
* when no standard language checkbox is checked, or the plain (non-required)
* variant when at least one is checked.
*
* Included by:
* - /admin/language-autre-fragment.php (AdminAuth gated)
* - partage/index.php special route (public, session already booted)
*
* Expected POST:
* languages[] — selected language IDs (may be absent)
* language_autre — current free-text value (for repopulation)
*/
$selectedIds = isset($_POST['languages']) && is_array($_POST['languages'])
? $_POST['languages']
: [];
$currentValue = htmlspecialchars(trim($_POST['language_autre'] ?? ''));
$anyChecked = !empty($selectedIds);
?>
<div id="language-autre-row">
<div>
<label for="language_autre">Autre(s) langue(s) :<?= !$anyChecked ? ' <span class="asterisk">*</span>' : '' ?></label>
<div>
<input type="text"
id="language_autre"
name="language_autre"
value="<?= $currentValue ?>"
<?= !$anyChecked ? 'required' : '' ?>>
<small>Si votre TFE contient une langue absente de la liste, précisez-la ici.</small>
</div>
</div>
</div>