mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-06-25 16:19:19 +02:00
d5fee1acfb
- Replace fetch(redirect:manual) with XMLHttpRequest in file-upload-queue.js. The previous fetch-based redirect detection was broken because opaque redirects hide the Location header. XHR's responseURL reliably exposes the final URL after server-side redirects. - Add console.log tracing at every decision point in submit interception: entry, hasFiles check, enctype check, double-submit guard, XHR status, redirect detection, error fallback. - Add error_log entry-point logging to all 16 admin action files plus the partage/index.php submission handler and password gate. Each logs: request method, content type/length, POST keys, file counts, and queue-specific file counts where applicable. - Add double-submit guard (_xamxamActiveSubmit) to prevent duplicate XHR sends when the native submit handler fires after interception.
63 lines
2.3 KiB
PHP
63 lines
2.3 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../../bootstrap.php';
|
|
require_once __DIR__ . '/../../../src/AdminAuth.php';
|
|
error_log('[visibility.php] ENTRY | method=' . $_SERVER['REQUEST_METHOD'] . ' | action=' . ($_POST['action'] ?? 'none') . ' | is_bulk=' . (!empty($_POST['bulk']) ? '1' : '0') . ' | post_keys=' . implode(',', array_keys($_POST)));
|
|
AdminAuth::requireLogin();
|
|
|
|
if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
|
|
|| !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
|
|
App::flash('error', "Erreur de sécurité : token invalide.");
|
|
header('Location: /admin/');
|
|
exit;
|
|
}
|
|
|
|
require_once __DIR__ . '/../../../src/Database.php';
|
|
require_once __DIR__ . '/../../../src/AdminLogger.php';
|
|
require_once __DIR__ . '/../../../src/ErrorHandler.php';
|
|
|
|
$action = $_POST['action'] ?? ''; // 'set_visibility'
|
|
$accessTypeId = filter_var($_POST['access_type_id'] ?? '', FILTER_VALIDATE_INT) ?: null;
|
|
$isBulk = !empty($_POST['bulk']);
|
|
|
|
$validAccess = [null, 1, 2, 3];
|
|
if (!in_array($accessTypeId, $validAccess, true)) {
|
|
App::flash('error', "Valeur de visibilité invalide.");
|
|
header('Location: /admin/');
|
|
exit;
|
|
}
|
|
|
|
try {
|
|
$db = new Database();
|
|
|
|
$logger = AdminLogger::make();
|
|
|
|
if ($isBulk) {
|
|
$ids = array_filter(array_map('intval', $_POST['selected_theses'] ?? []), fn($id) => $id > 0);
|
|
if (empty($ids)) {
|
|
App::flash('error', "Aucun TFE sélectionné.");
|
|
header('Location: /admin/');
|
|
exit;
|
|
}
|
|
$db->bulkSetVisibility($ids, $accessTypeId);
|
|
$logger->logVisibility($accessTypeId, array_values($ids));
|
|
App::flash('success', count($ids) . " TFE(s) mis à jour.");
|
|
} else {
|
|
$thesisId = filter_var($_POST['thesis_id'] ?? '', FILTER_VALIDATE_INT);
|
|
if (!$thesisId) {
|
|
App::flash('error', "ID invalide.");
|
|
header('Location: /admin/');
|
|
exit;
|
|
}
|
|
$db->setVisibility($thesisId, $accessTypeId);
|
|
$logger->logVisibility($accessTypeId, [$thesisId]);
|
|
App::flash('success', "Visibilité mise à jour.");
|
|
}
|
|
} catch (Exception $e) {
|
|
ErrorHandler::log('visibility', $e);
|
|
App::flash('error', 'Erreur : ' . ErrorHandler::userMessage($e));
|
|
}
|
|
|
|
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
|
|
header('Location: /admin/');
|
|
exit;
|