mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-11-09 11:10:08 +01:00
Pontoporeia
554fc57455
The passive scan flagged 3x MEDIUM 'PHPSESSID missing Secure' and an
admin-login cookie missing HttpOnly. Root cause was not the cookie code
but scheme detection: every call site read $_SERVER['HTTPS'] directly,
which is unset when TLS is terminated in front of PHP-FPM, so the Secure
flag was silently dropped.
Add RequestUtil::isSecure()/baseUrl() as the single scheme detector:
1. $_SERVER['HTTPS'] (direct TLS)
2. X-Forwarded-Proto — only from a loopback/private peer, so a remote
client cannot spoof it
3. SERVER_PORT == 443
Replace all 8 inline $_SERVER['HTTPS'] idioms (App, AdminAuth, 4x filepond
endpoints, validate-access, admin/acces, SystemController self-ping).
nginx: forward the scheme to php-fpm in all 4 fastcgi blocks
(fastcgi_param HTTPS $https + X-Forwarded-Proto $scheme) and uncomment
server_tokens off. Config validated with nginx -t (real config, alpine
container).
AdminAuth: logout() now clears the session cookie with the same
path/domain/secure/httponly/samesite it was set with, instead of the
legacy positional setcookie() that dropped SameSite.
Tests (+24, 340 total):
- RequestUtilTest: scheme detection incl. proxy trust boundaries
- SessionCookieTest: logout emits a hardened deletion cookie
- PeerTubeIntegrationTest: PeerTube keeps using its absolute instance_url
and is unaffected by scheme changes (Guzzle MockHandler)
- NginxConfigTest: pins HTTPS forwarding, HSTS includeSubDomains,
server_tokens off
PeerTube uses an absolute instance_url from the DB and never derives URLs
from the request, so the integration is unchanged — the regression tests
lock that invariant in.
Admin Panel Structure
This directory and app/templates/admin/ contain the admin panel for managing
the XAMXAM TFE database.
Entry points (app/public/admin/)
| File | Purpose |
|---|---|
index.php |
List all theses (main page; hosts the inline CSV import + tabs for list/trash) |
add.php |
Add new thesis form |
edit.php |
Existing thesis form |
recapitulatif.php |
Post-submission recap |
cleanup.php |
Cleanup page (Corbeille — restore/delete trashed files) |
system.php |
System dashboard (logs, SMTP/PeerTube status) |
contenus.php |
Editable content (pages, contacts) |
contenus-edit.php |
Edit a content page |
acces.php |
Share-link management |
file-access.php |
Restricted-file access requests |
media.php |
Admin file viewer — opens files of 'Interdit' (access_type_id=3) theses; session-gated (AdminAuth::requireLogin), delegates to MediaController::handle(adminBypass: true) |
media-viewer.php |
HTML wrapper that opens a thesis file with a reliable tab title (original file name); embeds the file via media.php in a full-viewport iframe |
account.php |
Admin account / password |
session-keepalive.php |
Lightweight 204/401 liveness ping that refreshes admin_last_activity while an open admin page is being actively used (see docs/security.md) |
login.php |
Login (session) |
import.php |
Redirects to /admin/ (CSV import is inline in index.php) |
status.php, markdown-cheatsheet-fragment.php, *fragment.php |
HTMX fragments / helpers |
Backend actions (app/public/admin/actions/)
Process forms and redirect (no HTML output):
formulaire.php— thesis create submission (ThesisCreateController::submit())edit.php— thesis edit submission (ThesisEditController::save())export-csv.php,export-db.php,export-files.php— seedocs/export.mdfilepond/— FilePond async upload endpoints- many others:
publish,delete,corbeille(trash),draft,visibility,tag,language,form-help*,page,apropos,smtp-test,peertube-*,maintenance,settings,account,access-request,acces-etudiante,cleanup-*
Templates
View templates live under app/templates/admin/ (not in public/):
app/templates/admin/*.php— page layoutsapp/templates/admin/partials/— shared fragments (toasts, dialogs, toc, …)
The public/partage and form partials live in app/templates/partials/ and
app/templates/partage/.
Auth
- PHP session auth (
src/AdminAuth.php) viaAdminAuth::requireLogin()is the only authentication layer. The old nginxauth_basiclayer has been removed — seedocs/security.mdandnginx/docs/PHP_AUTH_LAYER.md. - All forms include a CSRF token from
$_SESSION['csrf_token']. - Inputs use PDO prepared statements; uploads validated and stored outside the
webroot (
app/storage/).
Bootstrap / routing
Entry pages bootstrap the app and set up the environment:
require_once __DIR__ . '/../../bootstrap.php'; // defines APP_ROOT, autoload, config
require_once APP_ROOT . '/src/AdminAuth.php';
AdminAuth::requireLogin();
APP_ROOT is the app/ directory. Database access is via
app/src/Database.php; form logic lives in app/src/Controllers/ and
app/src/Form/.
URL structure
/admin/— list theses (index.php)/admin/add.php— add thesis/admin/edit.php?id=N— edit thesis/admin/cleanup.php,/admin/system.php,/admin/acces.php, etc./admin/actions/…— backend processors
Development guide
Add a page: create app/templates/admin/yourpage.php, add a thin
app/public/admin/yourpage.php entry that bootstraps + requires the template,
and add navigation in app/templates/admin/partials/admin-toc.php.
Add an action: create app/public/admin/actions/youraction.php that
bootstraps, requires login, verifies the CSRF token, performs the work, and
redirects back to the referring admin page.
See docs/development.md for the general workflow (dev server, builds,
tests, linting).