PostERG/xamxam
1
0
Fork 0
mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-09-25 01:53:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

Add admin-only route to open Interdit thesis files from backoffice:

Browse Source 
- reliable tab title /favicon wrapper,
- Content-Disposition filename,
- admin media route hardened to thesis-file prefixes only (defense-in-depth)
This commit is contained in:
Pontoporeia
2026-09-18 16:26:36 +02:00
parent e518163c5b
commit 6e1fc6a781
9 changed files with 404 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/templates/admin/recapitulatif.php
+8 -1
View File
@@ -243,7 +243,14 @@
} elseif ($isExternal) {
$mediaUrl = htmlspecialchars($filePath);
} else {
$mediaUrl = '/media?path=' . urlencode($filePath);
// Interdit (access_type_id=3): the public /media route returns
// 403 for these. Open them via the dedicated admin viewer
// (/admin/media-viewer.php), served under /admin so the
// administrator's session cookie is sent and the tab title
// shows the file name.
$_isForbidden = ((int)($thesis['access_type_id'] ?? 0) === 3);
$mediaUrl = ($_isForbidden ? '/admin/media-viewer.php' : '/media')
. '?path=' . urlencode($filePath);
}
$typeIcon = match (true) {