mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-06 11:09:18 +02:00
467aced734
Phase 1: Consolidate shared infrastructure - Create shared/ directory for common code - Consolidate Database.php from front-backend and formulaire into unified shared/Database.php - Smart path detection for test.db vs posterg.db - Secure search with wildcard escaping and input validation - Support both singleton and direct instantiation patterns - Full CRUD methods for admin functionality - Move RateLimit.php to shared/ (30 requests/min) - Update all require paths across apps to use shared/ Phase 2: Reorganize directory structure - Rename front-backend/ → apps/public/ - Rename formulaire/ → apps/admin/ - Rename db/ → database/ - Update all file paths for new structure - Create root .gitignore excluding databases, cache, logs Implement secure search feature - Add apps/public/search.php with full-text search across theses - Search filters: query, year, orientation, AP program, keywords - Security features: - SQL injection prevention (prepared statements) - Wildcard injection prevention (escape % and _) - Input validation (max 200 chars, year range 1900-2100) - Rate limiting (30 req/min per IP) - Pagination limited to 100 results/page - XSS protection (htmlspecialchars on output) Add comprehensive test suite - Create apps/public/tests/ with proper structure - tests/Integration/SearchTest.php - 12 search scenarios - tests/Security/SecurityTest.php - vulnerability testing - tests/Unit/RateLimitTest.php - rate limit behavior - Create database/fixtures/CreateTestDatabase.php - Add apps/public/run-tests.php test runner - All tests passing (4/4 suites) Update deployment configuration - Rename justfile 'sync' recipe to 'deploy' - Create deploy group with separate deploy-public and deploy-admin - Add test-deploy recipe for test database - Exclude *.db, tests/, cache/, *.md from production deploy - Deploy shared/ to both public and admin locations Stats: +4482 insertions, -654 deletions across 72 files
302 lines
12 KiB
PHP
302 lines
12 KiB
PHP
<?php
|
|
// Start session and generate CSRF token
|
|
session_start();
|
|
if (empty($_SESSION["csrf_token"])) {
|
|
$_SESSION["csrf_token"] = bin2hex(random_bytes(32));
|
|
}
|
|
|
|
// Load database helper
|
|
require_once __DIR__ . '/../../shared/Database.php';
|
|
|
|
try {
|
|
$db = new Database();
|
|
$orientations = $db->getAllOrientations();
|
|
$apPrograms = $db->getAllAPPrograms();
|
|
$finalityTypes = $db->getAllFinalityTypes();
|
|
$languages = $db->getAllLanguages();
|
|
$formatTypes = $db->getAllFormatTypes();
|
|
} catch (Exception $e) {
|
|
error_log("Failed to load form data: " . $e->getMessage());
|
|
die(
|
|
"Erreur lors du chargement du formulaire. Veuillez réessayer plus tard."
|
|
);
|
|
}
|
|
|
|
// Get error message and preserved form data from session (if redirected back from error)
|
|
$error = isset($_SESSION["form_error"]) ? $_SESSION["form_error"] : null;
|
|
$formData = isset($_SESSION["form_data"]) ? $_SESSION["form_data"] : [];
|
|
|
|
// Clear session data after retrieving
|
|
unset($_SESSION["form_error"]);
|
|
unset($_SESSION["form_data"]);
|
|
|
|
// Helper function to get old form value
|
|
function old($key, $default = "")
|
|
{
|
|
global $formData;
|
|
return isset($formData[$key])
|
|
? htmlspecialchars($formData[$key])
|
|
: $default;
|
|
}
|
|
|
|
// Helper function to check if value was previously selected
|
|
function wasSelected($key, $value)
|
|
{
|
|
global $formData;
|
|
if (!isset($formData[$key])) {
|
|
return false;
|
|
}
|
|
if (is_array($formData[$key])) {
|
|
return in_array($value, $formData[$key]);
|
|
}
|
|
return $formData[$key] == $value;
|
|
}
|
|
?>
|
|
<!DOCTYPE html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<meta http-equiv="X-UA-Compatible" content="IE=edge">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>Formulaire</title>
|
|
<link rel="stylesheet" href="assets/normalize.css">
|
|
<link rel="stylesheet" href="https://raw.githack.com/waldyrious/downstyler/master/downstyler.css" />
|
|
<!-- <link rel="stylesheet" href="assets/simple.css"> -->
|
|
<!--<link rel="stylesheet" href="assets/posterg.css"> -->
|
|
<link rel="shortcut icon" href="assets/icon.svg" type="image/svg">
|
|
</head>
|
|
<body>
|
|
<header>
|
|
<h1>Formulaire Posterg</h1>
|
|
<nav style="margin-top: 1rem;">
|
|
<a href="list.php" style="font-size: 0.9em;">📋 Liste des TFE</a> |
|
|
<a href="import.php" style="font-size: 0.9em;">📥 Importer CSV</a>
|
|
</nav>
|
|
</header>
|
|
|
|
<main>
|
|
<?php if ($error): ?>
|
|
<div class="error-message" style="background: #fee; border: 2px solid #c00; padding: 1rem; margin-bottom: 1rem; border-radius: 4px; color: #c00;">
|
|
<strong>⚠️ Erreur:</strong> <?php echo htmlspecialchars($error); ?>
|
|
</div>
|
|
<?php endif; ?>
|
|
|
|
<form action="formulaire.php" method="post" enctype="multipart/form-data">
|
|
<!-- CSRF Protection -->
|
|
<input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars(
|
|
$_SESSION["csrf_token"],
|
|
); ?>">
|
|
|
|
<h2>Informations de base</h2>
|
|
|
|
<fieldset>
|
|
<label for="auteurice">Nom/Prénom/Pseudo *</label>
|
|
<input type="text" id="auteurice" name="auteurice" placeholder="Nom de l'auteur·ice" value="<?php echo old(
|
|
"auteurice",
|
|
); ?>" required>
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label for="mail">Contact (email, site web, insta, ...)</label>
|
|
<input type="text" id="mail" name="mail" placeholder="votre.email@example.com ou @instagram" value="<?php echo old(
|
|
"mail",
|
|
); ?>">
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label for="année">Année diplômante *</label>
|
|
<input type="number" id="année" name="année" min="2000" max="<?php echo date(
|
|
"Y",
|
|
) + 1; ?>" placeholder="<?php echo date(
|
|
"Y",
|
|
); ?>" value="<?php echo old("année"); ?>" required>
|
|
</fieldset>
|
|
|
|
<h2>Informations académiques</h2>
|
|
|
|
|
|
<fieldset>
|
|
<label for="orientation">Orientation principale *</label>
|
|
<select id="orientation" name="orientation" required>
|
|
<option value="">-- Sélectionner une orientation --</option>
|
|
<?php foreach ($orientations as $orientation): ?>
|
|
<option value="<?php echo htmlspecialchars(
|
|
$orientation["id"],
|
|
); ?>" <?php echo wasSelected(
|
|
"orientation",
|
|
$orientation["id"],
|
|
)
|
|
? "selected"
|
|
: ""; ?>>
|
|
<?php echo htmlspecialchars(
|
|
$orientation["name"],
|
|
); ?>
|
|
</option>
|
|
<?php endforeach; ?>
|
|
</select>
|
|
|
|
<fieldset>
|
|
<label for="ap">Atelier Pratique (AP) *</label>
|
|
<select id="ap" name="ap" required>
|
|
<option value="">-- Sélectionner un AP --</option>
|
|
<?php foreach ($apPrograms as $ap): ?>
|
|
<option value="<?php echo htmlspecialchars(
|
|
$ap["id"],
|
|
); ?>" <?php echo wasSelected("ap", $ap["id"])
|
|
? "selected"
|
|
: ""; ?>>
|
|
<?php echo htmlspecialchars($ap["name"]); ?>
|
|
<?php if (
|
|
$ap["code"]
|
|
): ?> (<?php echo htmlspecialchars(
|
|
$ap["code"],
|
|
); ?>)<?php endif; ?>
|
|
</option>
|
|
<?php endforeach; ?>
|
|
</select>
|
|
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label for="finality">Finalité du master *</label>
|
|
<select id="finality" name="finality" required>
|
|
<option value="">-- Sélectionner une finalité --</option>
|
|
<?php foreach ($finalityTypes as $finality): ?>
|
|
<option value="<?php echo htmlspecialchars(
|
|
$finality["id"],
|
|
); ?>" <?php echo wasSelected(
|
|
"finality",
|
|
$finality["id"],
|
|
)
|
|
? "selected"
|
|
: ""; ?>>
|
|
<?php echo htmlspecialchars($finality["name"]); ?>
|
|
</option>
|
|
<?php endforeach; ?>
|
|
</select>
|
|
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label for="promoteurice">Promoteur·ice(s)</label>
|
|
<input type="text" id="promoteurice" name="promoteurice" placeholder="Nom du/de la promoteur·ice (si plusieurs, séparer par des virgules)" value="<?php echo old(
|
|
"promoteurice",
|
|
); ?>">
|
|
|
|
</fieldset>
|
|
|
|
<h2>À propos du TFE</h2>
|
|
|
|
|
|
<fieldset>
|
|
<label for="titre">Titre du mémoire *</label>
|
|
<input type="text" id="titre" name="titre" placeholder="Titre de votre TFE" value="<?php echo old(
|
|
"titre",
|
|
); ?>" required>
|
|
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label for="subtitle">Sous-titre (si applicable)</label>
|
|
<input type="text" id="subtitle" name="subtitle" placeholder="Sous-titre de votre TFE" value="<?php echo old(
|
|
"subtitle",
|
|
); ?>">
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label for="synopsis">Synopsis (environ 200 mots) *</label>
|
|
<textarea id="synopsis" name="synopsis" rows="8" placeholder="Décrivez votre TFE en quelques paragraphes..." required><?php echo old(
|
|
"synopsis",
|
|
); ?></textarea>
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label for="problématique">Problématique</label>
|
|
<textarea id="problématique" name="problématique" rows="4" placeholder="La problématique principale de votre mémoire..."><?php echo old(
|
|
"problématique",
|
|
); ?></textarea>
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label>Langue(s) du TFE * (sélection multiple possible)</label>
|
|
<?php foreach ($languages as $language): ?>
|
|
<label class="checkbox-label">
|
|
<input type="checkbox" name="languages[]" value="<?php echo htmlspecialchars(
|
|
$language["id"],
|
|
); ?>" <?php echo wasSelected(
|
|
"languages",
|
|
$language["id"],
|
|
)
|
|
? "checked"
|
|
: ""; ?>>
|
|
<?php echo htmlspecialchars($language["name"]); ?>
|
|
</label>
|
|
<?php endforeach; ?>
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label>Format(s) (sélection multiple possible)</label>
|
|
<?php foreach ($formatTypes as $format): ?>
|
|
<label class="checkbox-label">
|
|
<input type="checkbox" name="formats[]" value="<?php echo htmlspecialchars(
|
|
$format["id"],
|
|
); ?>" <?php echo wasSelected(
|
|
"formats",
|
|
$format["id"],
|
|
)
|
|
? "checked"
|
|
: ""; ?>>
|
|
<?php echo htmlspecialchars($format["name"]); ?>
|
|
</label>
|
|
<?php endforeach; ?>
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label for="tag">Mots-clés (max 10, séparés par des virgules)</label>
|
|
<input type="text" id="tag" name="tag" placeholder="typographie, photographie, outils libre, post-colonial..." value="<?php echo old(
|
|
"tag",
|
|
); ?>">
|
|
<small>Séparez les mots-clés par des virgules. Maximum 10 mots-clés.</small>
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label for="duration_info">Durée/Taille (si applicable)</label>
|
|
<input type="text" id="duration_info" name="duration_info" placeholder="Ex: 68 minutes, 128 pages, 78 pages + 15 minutes" value="<?php echo old(
|
|
"duration_info",
|
|
); ?>">
|
|
<small>Indiquez la durée (en minutes) ou le nombre de pages de votre TFE.</small>
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label for="lien">Lien vers un site web ou ressource en ligne</label>
|
|
<input type="url" id="lien" name="lien" placeholder="https://monmemoire.erg.be/..." value="<?php echo old(
|
|
"lien",
|
|
); ?>">
|
|
</fieldset>
|
|
|
|
<h2>Fichiers</h2>
|
|
|
|
<fieldset>
|
|
<label for="couverture">Importer une image de couverture</label>
|
|
<small>Formats acceptés : JPG, PNG. Taille max : 10MB.</small>
|
|
<input type="file" id="couverture" name="couverture" accept="image/jpeg,image/png">
|
|
</fieldset>
|
|
|
|
<fieldset>
|
|
<label for="files">Importer le TFE et les fichiers annexes</label>
|
|
<small>Formats acceptés : PDF, JPG, PNG, MP4, ZIP. Taille max par fichier : 50MB.</small>
|
|
<small>Si vous voulez importer un dossier, créez une archive ZIP.</small>
|
|
<input type="file" id="files" name="files[]" multiple accept=".pdf,.jpg,.jpeg,.png,.mp4,.zip">
|
|
</fieldset>
|
|
|
|
<br>
|
|
<input type="submit" name="go" value="Soumettre mon TFE">
|
|
</form>
|
|
</main>
|
|
|
|
<footer>
|
|
<p>Formulaire fait avec ❤ en PHP et <a href="https://github.com/kevquirk/simple.css">SimpleCSS</a>.</p>
|
|
</footer>
|
|
</body>
|
|
</html>
|