mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-09-25 01:53:03 +02:00
Add admin-only route to open Interdit thesis files from backoffice:
- reliable tab title /favicon wrapper, - Content-Disposition filename, - admin media route hardened to thesis-file prefixes only (defense-in-depth)
This commit is contained in:
Pontoporeia
@@ -17,6 +17,8 @@ the XAMXAM TFE database.
|
||||
| `contenus-edit.php` | Edit a content page |
|
||||
| `acces.php` | Share-link management |
|
||||
| `file-access.php` | Restricted-file access requests |
|
||||
| `media.php` | Admin file viewer — opens files of 'Interdit' (access_type_id=3) theses; session-gated (`AdminAuth::requireLogin`), delegates to `MediaController::handle(adminBypass: true)` |
|
||||
| `media-viewer.php` | HTML wrapper that opens a thesis file with a reliable tab title (original file name); embeds the file via `media.php` in a full-viewport iframe |
|
||||
| `account.php` | Admin account / password |
|
||||
| `login.php` | Login (session) |
|
||||
| `import.php` | Redirects to `/admin/` (CSV import is inline in `index.php`) |
|
||||
|
||||
@@ -0,0 +1,74 @@
|
||||
<?php
|
||||
/**
|
||||
* Admin media viewer — a minimal HTML wrapper that reliably sets a useful
|
||||
* browser tab title when opening thesis files (incl. 'Interdit') from the
|
||||
* backoffice.
|
||||
*
|
||||
* Why a wrapper?
|
||||
* - PDFs served directly show the URL ("media.php") as the tab title because
|
||||
* most don't embed a /Title metadata and Chrome/Firefox's PDF viewer ignores
|
||||
* Content-Disposition: filename for the tab. A wrapper <title> always wins.
|
||||
* - The actual bytes stream through /admin/media.php (the server validated
|
||||
* inlined below), preserving the existing security checks (path whitelist,
|
||||
* realpath() jail, MIME allow-list, Interdit bypass gated by admin session).
|
||||
*
|
||||
* Security:
|
||||
* - Auth-gated by AdminAuth::requireLogin().
|
||||
* - Path is validated against thesis-file prefixes before it is passed on.
|
||||
* - The embedded iframe is same-origin (/admin/media.php); admin CSP permits
|
||||
* frame-src 'self'. noindex/nofollow and no-referrer keep it private.
|
||||
*
|
||||
* Usage: /admin/media-viewer.php?path=tfe/2025/2025-001/rapport.pdf
|
||||
*/
|
||||
require_once __DIR__ . '/../../bootstrap.php';
|
||||
require_once __DIR__ . '/../../src/AdminAuth.php';
|
||||
|
||||
AdminAuth::requireLogin();
|
||||
|
||||
require_once APP_ROOT . '/src/Database.php';
|
||||
require_once APP_ROOT . '/src/ErrorHandler.php';
|
||||
|
||||
$path = trim((string)($_GET['path'] ?? ''));
|
||||
|
||||
// Only thesis-file paths are ever served; reject anything else early.
|
||||
if (!preg_match('#^(theses|documents|tfe|these|frart)/[^?&]{1,255}$#', $path)) {
|
||||
http_response_code(400);
|
||||
echo 'Chemin invalide.';
|
||||
exit;
|
||||
}
|
||||
|
||||
$displayName = 'Document';
|
||||
try {
|
||||
$mediaDb = Database::getInstance();
|
||||
$displayName = $mediaDb->getFileDisplayName($path) ?? basename($path);
|
||||
} catch (\Throwable $e) {
|
||||
ErrorHandler::log('media_viewer_display', $e, ['path' => $path]);
|
||||
}
|
||||
if ($displayName === '') {
|
||||
$displayName = 'Document';
|
||||
}
|
||||
|
||||
$src = '/admin/media.php?path=' . urlencode($path);
|
||||
$title = htmlspecialchars($displayName);
|
||||
$srcAttr = htmlspecialchars($src);
|
||||
?>
|
||||
<!DOCTYPE html>
|
||||
<html lang="fr">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<meta name="robots" content="noindex, nofollow">
|
||||
<meta name="referrer" content="no-referrer">
|
||||
<link rel="icon" type="image/png" sizes="32x32" href="/assets/favicon/favicon-32x32.png">
|
||||
<link rel="icon" type="image/png" sizes="16x16" href="/assets/favicon/favicon-16x16.png">
|
||||
<link rel="shortcut icon" href="/assets/favicon/favicon.ico">
|
||||
<title><?= $title ?> – XAMXAM</title>
|
||||
<style>
|
||||
html, body { margin: 0; height: 100%; background: #525659; }
|
||||
iframe { display: block; width: 100%; height: 100%; border: 0; background: #525659; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<iframe src="<?= $srcAttr ?>" title="<?= $title ?>" allow="autoplay; fullscreen"></iframe>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,24 @@
|
||||
<?php
|
||||
/**
|
||||
* Dedicated admin file viewer — lets a backoffice user open files whose owning
|
||||
* thesis is marked 'Interdit' (access_type_id=3).
|
||||
*
|
||||
* Security:
|
||||
* - Auth-gated by AdminAuth::requireLogin() → only an authenticated admin
|
||||
* session (cookie scoped to /admin) can reach the handler below.
|
||||
* - Delegates to MediaController::handle(adminBypass: true), which bypasses
|
||||
* ONLY the Interdit visibility gate. The strict path-whitelist, realpath()
|
||||
* storage jail and MIME allow-list remain fully enforced, so an admin
|
||||
* cannot read arbitrary files on the server.
|
||||
*
|
||||
* Usage: /admin/media.php?path=tfe/2025/2025-001/rapport.pdf
|
||||
*/
|
||||
require_once __DIR__ . '/../../bootstrap.php';
|
||||
require_once __DIR__ . '/../../src/AdminAuth.php';
|
||||
|
||||
AdminAuth::requireLogin();
|
||||
|
||||
require_once APP_ROOT . '/src/Controllers/MediaController.php';
|
||||
|
||||
$controller = new MediaController();
|
||||
$controller->handle(adminBypass: true);
|
||||
@@ -12,14 +12,40 @@
|
||||
* - realpath() jail: resolved path must stay inside STORAGE_ROOT
|
||||
* - MIME type verified against an allow-list before serving
|
||||
* - Access-type gate for thesis files (blocks 'Interdit' access_type_id=3)
|
||||
* - Content-Disposition filename is sanitised (no CR/LF/quotes / non-ASCII
|
||||
* fallback) to prevent header injection; original uploaded name is used
|
||||
* for the browser tab title.
|
||||
*
|
||||
* Admin bypass:
|
||||
* The backoffice may open files whose owning thesis is 'Interdit' via a
|
||||
* DEDICATED admin route (/admin/media.php) that is gated by
|
||||
* AdminAuth::requireLogin() BEFORE this method is reached. The bypass is
|
||||
* passed in as `$adminBypass = true` and only relaxes the single Interdit
|
||||
* visibility gate above — path whitelist, realpath() jail and MIME checks
|
||||
* are all still enforced.
|
||||
*/
|
||||
class MediaController
|
||||
{
|
||||
/** Thesis-file path prefixes (legacy + new layouts). */
|
||||
private const THESIS_FILE_PREFIX = '#^(theses|documents|tfe|these|frart)/#';
|
||||
|
||||
/**
|
||||
* Whether a requested path targets a thesis file (vs. any other storage file).
|
||||
*/
|
||||
public static function isThesisFilePath(string $requestedPath): bool
|
||||
{
|
||||
return (bool) preg_match(self::THESIS_FILE_PREFIX, $requestedPath);
|
||||
}
|
||||
|
||||
/**
|
||||
* Handle a media request. Reads $_GET['path'], validates, and streams the file.
|
||||
* Sends appropriate headers and exit() — no return value.
|
||||
*
|
||||
* @param bool $adminBypass When true, the 'Interdit' (access_type_id=3)
|
||||
* visibility gate is skipped. MUST only be set after the caller has
|
||||
* confirmed an authenticated admin session (AdminAuth::requireLogin()).
|
||||
*/
|
||||
public function handle(): void
|
||||
public function handle(bool $adminBypass = false): void
|
||||
{
|
||||
$requestedPath = $_GET['path'] ?? '';
|
||||
|
||||
@@ -51,19 +77,29 @@ class MediaController
|
||||
}
|
||||
|
||||
// 3. Visibility gate for thesis files (legacy theses/ and documents/, new tfe/these/frart/ paths)
|
||||
if (preg_match('#^(theses|documents|tfe|these|frart)/#', $requestedPath)) {
|
||||
if (self::isThesisFilePath($requestedPath)) {
|
||||
require_once APP_ROOT . '/src/Database.php';
|
||||
require_once APP_ROOT . '/src/ErrorHandler.php';
|
||||
try {
|
||||
$mediaDb = Database::getInstance();
|
||||
$accessTypeId = $mediaDb->getFileVisibility($requestedPath);
|
||||
if ($accessTypeId !== null && $accessTypeId === 3) {
|
||||
// Interdit (access_type_id=3) is blocked for the public route
|
||||
// unless the request already passed the admin auth gate.
|
||||
if (!$adminBypass && $accessTypeId !== null && $accessTypeId === 3) {
|
||||
http_response_code(403);
|
||||
exit;
|
||||
}
|
||||
} catch (\Throwable $e) {
|
||||
ErrorHandler::log('media_visibility', $e, ['path' => $requestedPath]);
|
||||
}
|
||||
} elseif ($adminBypass) {
|
||||
// Defence-in-depth: the admin bypass (Interdit files) is intended for
|
||||
// thesis files only. If an admin request does not target one of the
|
||||
// thesis file prefixes, it can only address non-thesis storage paths
|
||||
// (schema, db, tmp, backups…). Deny those outright rather than rely
|
||||
// solely on the MIME allow-list to protect them.
|
||||
http_response_code(403);
|
||||
exit;
|
||||
}
|
||||
|
||||
// 4. Verify MIME type
|
||||
@@ -108,6 +144,25 @@ class MediaController
|
||||
exit;
|
||||
}
|
||||
|
||||
// Resolve a human-facing display name for the tab title / download name.
|
||||
// Prefer the original uploaded name (thesis_files.file_name); fall back to
|
||||
// the basename of the requested path. Strip anything that could break the
|
||||
// Content-Disposition header (CR/LF, quotes, control chars).
|
||||
$displayName = null;
|
||||
if (self::isThesisFilePath($requestedPath)) {
|
||||
require_once APP_ROOT . '/src/Database.php';
|
||||
require_once APP_ROOT . '/src/ErrorHandler.php';
|
||||
try {
|
||||
$mediaDb = Database::getInstance();
|
||||
$displayName = $mediaDb->getFileDisplayName($requestedPath);
|
||||
} catch (\Throwable $e) {
|
||||
ErrorHandler::log('media_display_name', $e, ['path' => $requestedPath]);
|
||||
}
|
||||
}
|
||||
if ($displayName === null || $displayName === '') {
|
||||
$displayName = basename($requestedPath);
|
||||
}
|
||||
|
||||
// 5. Send response headers
|
||||
header('Content-Type: ' . $mimeType);
|
||||
header('Content-Length: ' . (int) filesize($realFull));
|
||||
@@ -118,20 +173,22 @@ class MediaController
|
||||
header('Cache-Control: public, max-age=86400');
|
||||
} elseif (in_array($ext, ['jpg','jpeg','png','gif','webp'], true)) {
|
||||
header('Cache-Control: public, max-age=604800');
|
||||
header('Content-Disposition: inline');
|
||||
$this->sendInlineContentDisposition($displayName);
|
||||
} elseif ($ext === 'pdf') {
|
||||
header('Cache-Control: public, max-age=86400');
|
||||
header('Content-Disposition: inline');
|
||||
$this->sendInlineContentDisposition($displayName);
|
||||
} elseif (in_array($ext, ['mp4','webm','ogv','mov'], true)) {
|
||||
// Video: no cache-control range requests should work
|
||||
header('Accept-Ranges: bytes');
|
||||
$this->sendInlineContentDisposition($displayName);
|
||||
header('Cache-Control: public, max-age=86400');
|
||||
} elseif (in_array($ext, ['mp3','ogg','oga','wav','flac','aac','m4a'], true)) {
|
||||
header('Accept-Ranges: bytes');
|
||||
$this->sendInlineContentDisposition($displayName);
|
||||
header('Cache-Control: public, max-age=86400');
|
||||
} else {
|
||||
// Unknown / other: serve inline, no download
|
||||
header('Content-Disposition: inline');
|
||||
$this->sendInlineContentDisposition($displayName);
|
||||
header('Cache-Control: public, max-age=86400');
|
||||
}
|
||||
|
||||
@@ -143,6 +200,36 @@ class MediaController
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Send a Content-Disposition: inline header carrying a useful tab title.
|
||||
*
|
||||
* Browsers use the filename in the tab title when a binary file is shown
|
||||
* inline (PDF/image/video). We provide the original uploaded name, encoded
|
||||
* safely:
|
||||
* - `filename` — ASCII-only fallback (RFC 2183)
|
||||
* - `filename*=` — UTF-8 encoded form for accented / international
|
||||
* names (RFC 6266)
|
||||
*
|
||||
* @param string $filename Raw display name (UTF-8).
|
||||
*/
|
||||
private function sendInlineContentDisposition(string $filename): void
|
||||
{
|
||||
// ASCII fallback: keep only printable ASCII, then drop quotes/backslashes.
|
||||
$ascii = preg_replace('/[^\x20-\x7E]/', '', $filename);
|
||||
if ($ascii === null) {
|
||||
$ascii = '';
|
||||
}
|
||||
$ascii = str_replace(['"', '\\'], '', $ascii);
|
||||
if ($ascii === '') {
|
||||
$ascii = 'file';
|
||||
}
|
||||
|
||||
header(
|
||||
'Content-Disposition: inline; filename="' . addcslashes($ascii, '"\\') . '"'
|
||||
. "; filename*=UTF-8''" . rawurlencode($filename)
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Stream a file with HTTP Range support (required for HTML5 audio/video seeking).
|
||||
*/
|
||||
|
||||
@@ -2087,6 +2087,26 @@ class Database
|
||||
return ($val !== false) ? (int)$val : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return the human-facing display name (thesis_files.file_name) for a file
|
||||
* path, or null when the path does not belong to a stored thesis file.
|
||||
*
|
||||
* file_name preserves the original filename the submitter uploaded, which
|
||||
* is nicer than the sanitised on-disk path when the browser uses it as a
|
||||
* tab title / download name (e.g. via Content-Disposition).
|
||||
*/
|
||||
public function getFileDisplayName(string $filePath): ?string
|
||||
{
|
||||
$stmt = $this->pdo->prepare('
|
||||
SELECT tf.file_name FROM thesis_files tf
|
||||
WHERE tf.file_path = ?
|
||||
LIMIT 1
|
||||
');
|
||||
$stmt->execute([$filePath]);
|
||||
$val = $stmt->fetchColumn();
|
||||
return ($val !== false && $val !== '') ? (string)$val : null;
|
||||
}
|
||||
|
||||
/**
|
||||
* Return total number of rows in the theses table (for system status display).
|
||||
*/
|
||||
|
||||
@@ -243,7 +243,14 @@
|
||||
} elseif ($isExternal) {
|
||||
$mediaUrl = htmlspecialchars($filePath);
|
||||
} else {
|
||||
$mediaUrl = '/media?path=' . urlencode($filePath);
|
||||
// Interdit (access_type_id=3): the public /media route returns
|
||||
// 403 for these. Open them via the dedicated admin viewer
|
||||
// (/admin/media-viewer.php), served under /admin so the
|
||||
// administrator's session cookie is sent and the tab title
|
||||
// shows the file name.
|
||||
$_isForbidden = ((int)($thesis['access_type_id'] ?? 0) === 3);
|
||||
$mediaUrl = ($_isForbidden ? '/admin/media-viewer.php' : '/media')
|
||||
. '?path=' . urlencode($filePath);
|
||||
}
|
||||
|
||||
$typeIcon = match (true) {
|
||||
|
||||
Reference in New Issue
Block a user