PostERG/xamxam
1
0
Fork 0
mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-05-06 19:19:19 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add Paramètres page: consolidate maintenance + account settings

Browse Source
This commit is contained in:
Pontoporeia
2026-04-08 15:06:51 +02:00
parent ba135f0cb5
commit 603af07b68
8 changed files with 262 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
public/admin/actions/account.php
View File

@@ -23,15 +23,18 @@ $action = $_POST['action'] ?? 'change_password';
// ── Remove credentials ────────────────────────────────────────────────────────
if ($action === 'remove_credentials') {
$backUrl = $_POST['redirect'] ?? '/admin/parametres.php';
if (!preg_match('#^/admin/#', $backUrl)) { $backUrl = '/admin/parametres.php'; }
if (!$hasPassword) {
App::flash('error', 'Aucun fichier de mot de passe à supprimer.');
header('Location: /admin/account.php');
header('Location: ' . $backUrl);
exit;
}
if (!is_writable($credentialsFile) && !is_writable(dirname($credentialsFile))) {
App::flash('error', 'Le fichier de configuration n\'est pas accessible en écriture.');
header('Location: /admin/account.php');
header('Location: ' . $backUrl);
exit;
}
@@ -42,7 +45,7 @@ if ($action === 'remove_credentials') {
exit;
} else {
App::flash('error', 'Impossible de supprimer le fichier de configuration.');
header('Location: /admin/account.php');
header('Location: ' . $backUrl);
exit;
}
}
@@ -50,11 +53,14 @@ if ($action === 'remove_credentials') {
// ── Change / set password ─────────────────────────────────────────────────────
// 1. If a password is already set, verify the current one.
$backUrl = $_POST['redirect'] ?? '/admin/parametres.php';
if (!preg_match('#^/admin/#', $backUrl)) { $backUrl = '/admin/parametres.php'; }
if ($hasPassword) {
$currentPassword = $_POST['current_password'] ?? '';
if (!AdminAuth::login($currentPassword)) {
App::flash('error', 'Mot de passe actuel incorrect.');
header('Location: /admin/account.php');
header('Location: ' . $backUrl);
exit;
}
}
@@ -65,13 +71,13 @@ $confirmPassword = $_POST['confirm_password'] ?? '';
if (strlen($newPassword) < 12) {
App::flash('error', 'Le nouveau mot de passe doit contenir au moins 12 caractères.');
header('Location: /admin/account.php');
header('Location: ' . $backUrl);
exit;
}
if ($newPassword !== $confirmPassword) {
App::flash('error', 'Les mots de passe ne correspondent pas.');
header('Location: /admin/account.php');
header('Location: ' . $backUrl);
exit;
}
@@ -79,7 +85,7 @@ if ($newPassword !== $confirmPassword) {
$hash = password_hash($newPassword, PASSWORD_BCRYPT, ['cost' => 12]);
if ($hash === false) {
App::flash('error', 'Erreur lors du hachage du mot de passe.');
header('Location: /admin/account.php');
header('Location: ' . $backUrl);
exit;
}
@@ -100,13 +106,13 @@ $tmpFile = $credentialsFile . '.tmp.' . bin2hex(random_bytes(6));
if (file_put_contents($tmpFile, $configContent, LOCK_EX) === false) {
@unlink($tmpFile);
App::flash('error', 'Impossible d\'écrire le fichier de configuration. Vérifiez les permissions sur config/.');
header('Location: /admin/account.php');
header('Location: ' . $backUrl);
exit;
}
if (!rename($tmpFile, $credentialsFile)) {
@unlink($tmpFile);
App::flash('error', 'Impossible de mettre à jour le fichier de configuration.');
header('Location: /admin/account.php');
header('Location: ' . $backUrl);
exit;
}
@@ -118,5 +124,5 @@ App::flash('success', $hasPassword
? 'Mot de passe mis à jour avec succès.'
: 'Mot de passe défini avec succès. L\'authentification PHP est maintenant active.');
header('Location: /admin/account.php');
header('Location: ' . $backUrl);
exit;

7
public/admin/actions/maintenance.php
View File

@@ -24,5 +24,10 @@ if ($action === 'enable_maintenance') {
App::flash('error', "Action inconnue.");
}
header('Location: /admin/');
$redirect = isset($_POST['redirect']) ? $_POST['redirect'] : '/admin/';
// Allow only internal admin redirects for safety
if (!preg_match('#^/admin/#', $redirect)) {
$redirect = '/admin/';
}
header('Location: ' . $redirect);
exit();