PostERG/xamxam
1
0
Fork 0
mirror of https://codeberg.org/PostERG/xamxam.git synced 2026-09-25 01:53:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

migrate file-access tokens onto shared OneTimeToken model (hash-at-rest)

Browse Source
This commit is contained in:
Pontoporeia
2026-08-24 11:36:02 +02:00
parent 3f1dcf5d43
commit d7184e4447
6 changed files with 122 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/public/validate-access.php
+1 -14
View File
@@ -72,20 +72,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
// Minimal pre-check: does the token exist and look valid?
// (Full redemption + one-time mark only happens on POST)
$db = Database::getInstance();
$check = $db->getPDO()->prepare(
"SELECT fat.expires_at, fr.thesis_id
FROM file_access_tokens fat
JOIN file_access_requests fr ON fat.request_id = fr.id
WHERE fat.token = ?
AND fat.is_valid = 1
AND fat.used_at IS NULL
AND fat.expires_at > CURRENT_TIMESTAMP
AND fr.status = 'approved'
AND fr.thesis_id = ?
LIMIT 1"
);
$check->execute([$token, $thesisId]);
$valid = $check->fetch();
$valid = $db->isAccessTokenValid($token, $thesisId);
if (!$valid) {
renderError(403, 'Lien d\'accès invalide ou expiré',