mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-06 19:19:19 +02:00
27e1b6828d
Requirements: - parametres.php toggle: 'restricted_files_enabled' enables/disables the feature - Public TFE page: when enabled + access_type=Interne, hides files, shows French restriction message + access request form (metadata/synopsis still visible) - ERG emails (@erg.school / @erg.be): auto-approve, send 24h access link immediately - External emails: show justification textarea, create pending request, notify admin - Admin panel /admin/file-access.php: approve/reject requests with optional notes, sends access email on approval (linked from admin nav with pending count badge) Security: - One-time 24h email tokens (used_at + is_valid=0 on first click) - Token redeemed via POST /validate-access (GET shows confirmation page only) - Long-lived 30-day browser session in file_access_sessions table - Cookie: HttpOnly + Secure + SameSite=Strict - CSRF on all mutations, rate limiting on request submission - Audit trail: IP, UA, event, timestamp in file_access_audit Bug fixes: - admin/file-access.php: $vars never extract()ed → page was blank - Template had self-contained head/footer includes (double-include) - Admin approval URL used $requestId instead of $request['thesis_id'] - App::boot() now starts session so CSRF token works on public pages - Dispatcher routes /validate-access and /request-access through front controller
340 lines
16 KiB
PHP
340 lines
16 KiB
PHP
<main class="tfe-main" id="main-content">
|
||
<article class="tfe-layout">
|
||
|
||
<!-- LEFT: info — article header -->
|
||
<header class="tfe-left">
|
||
<!-- Author above title -->
|
||
<p class="tfe-author"><?= htmlspecialchars($data['authors'] ?? 'Auteur inconnu') ?></p>
|
||
|
||
<h1 class="tfe-title">
|
||
<?= htmlspecialchars($data['title']) ?>
|
||
<?php if (!empty($data['subtitle'])): ?>
|
||
– <?= htmlspecialchars($data['subtitle']) ?>
|
||
<?php endif; ?>
|
||
</h1>
|
||
|
||
<dl>
|
||
<?php if (!empty($data['orientation'])): ?>
|
||
<div>
|
||
<dt>Orientation :</dt>
|
||
<dd><a href="/repertoire?or[]=<?= urlencode($data['orientation']) ?>"><?= htmlspecialchars($data['orientation']) ?></a></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($data['ap_program'])): ?>
|
||
<div>
|
||
<dt>Atelier pluridisciplinaire :</dt>
|
||
<dd><a href="/repertoire?ap[]=<?= urlencode($data['ap_program']) ?>"><?= htmlspecialchars($data['ap_program']) ?></a></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($data['year'])): ?>
|
||
<div>
|
||
<dt>Date :</dt>
|
||
<dd><a href="/repertoire?fy[]=<?= urlencode($data['year']) ?>"><?= htmlspecialchars($data['year']) ?></a></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($data['languages'])): ?>
|
||
<div>
|
||
<dt>Langue :</dt>
|
||
<dd><?php
|
||
$langs = array_map('trim', explode(',', $data['languages']));
|
||
$langLinks = array_map(fn($l) => '<a href="/search?query=' . urlencode($l) . '">' . htmlspecialchars($l) . '</a>', $langs);
|
||
echo implode(', ', $langLinks);
|
||
?></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($data['formats'])): ?>
|
||
<div>
|
||
<dt>Format :</dt>
|
||
<dd><?php
|
||
$fmts = array_map('trim', explode(',', $data['formats']));
|
||
$fmtLinks = array_map(fn($f) => '<a href="/search?query=' . urlencode($f) . '">' . htmlspecialchars($f) . '</a>', $fmts);
|
||
echo implode(', ', $fmtLinks);
|
||
?></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($data['file_size_info'])): ?>
|
||
<div>
|
||
<dt>Durée :</dt>
|
||
<dd><?= htmlspecialchars($data['file_size_info']) ?></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($data['keywords'])): ?>
|
||
<div>
|
||
<dt>Mots-clés :</dt>
|
||
<dd><?php
|
||
$kws = array_map('trim', explode(',', $data['keywords']));
|
||
$kwLinks = array_map(fn($k) => '<a href="/repertoire?kw[]=' . urlencode($k) . '">' . htmlspecialchars($k) . '</a>', $kws);
|
||
echo implode(', ', $kwLinks);
|
||
?></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($promoteursInternes)): ?>
|
||
<div>
|
||
<dt>Promoteur·ice interne :</dt>
|
||
<dd><?php
|
||
$links = array_map(fn($n) => '<a href="/search?query=' . urlencode($n) . '">' . htmlspecialchars($n) . '</a>', $promoteursInternes);
|
||
echo implode(', ', $links);
|
||
?></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($promoteursExternes)): ?>
|
||
<div>
|
||
<dt>Promoteur·ice externe :</dt>
|
||
<dd><?php
|
||
$links = array_map(fn($n) => '<a href="/search?query=' . urlencode($n) . '">' . htmlspecialchars($n) . '</a>', $promoteursExternes);
|
||
echo implode(', ', $links);
|
||
?></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($juryPresidents)): ?>
|
||
<div>
|
||
<dt>Président·e du jury :</dt>
|
||
<dd><?php
|
||
$links = array_map(fn($n) => '<a href="/search?query=' . urlencode($n) . '">' . htmlspecialchars($n) . '</a>', $juryPresidents);
|
||
echo implode(', ', $links);
|
||
?></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($juryLecteurs)): ?>
|
||
<div>
|
||
<dt>Lecteur·ices :</dt>
|
||
<dd><?php
|
||
$links = array_map(fn($n) => '<a href="/search?query=' . urlencode($n) . '">' . htmlspecialchars($n) . '</a>', $juryLecteurs);
|
||
echo implode(', ', $links);
|
||
?></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($data['access_type'])): ?>
|
||
<div>
|
||
<dt>Accès :</dt>
|
||
<dd><?= htmlspecialchars($data['access_type']) ?></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($data['license_type'])): ?>
|
||
<div>
|
||
<dt>Licence :</dt>
|
||
<dd><?= htmlspecialchars($data['license_type']) ?></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($data['context_note'])): ?>
|
||
<div class="tfe-meta-note">
|
||
<dt>Note :</dt>
|
||
<dd class="tfe-note-value"><?= nl2br(htmlspecialchars($data['context_note'])) ?></dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($data['author_email']) && !empty($data['author_show_contact'])): ?>
|
||
<div>
|
||
<dt>Contact :</dt>
|
||
<dd>
|
||
<?php
|
||
$_contact = $data['author_email'];
|
||
$_isUrl = filter_var($_contact, FILTER_VALIDATE_URL) !== false;
|
||
$_isEmail = !$_isUrl && str_contains($_contact, '@');
|
||
if ($_isUrl):
|
||
?>
|
||
<a href="<?= htmlspecialchars($_contact) ?>" target="_blank" rel="noopener">
|
||
<?= htmlspecialchars(preg_replace('#^https?://#i', '', rtrim($_contact, '/'))) ?>
|
||
<span class="sr-only">(ouvre dans un nouvel onglet)</span>
|
||
</a>
|
||
<?php elseif ($_isEmail): ?>
|
||
<a href="mailto:<?= htmlspecialchars($_contact) ?>"><?= htmlspecialchars($_contact) ?></a>
|
||
<?php else: ?>
|
||
<?= htmlspecialchars($_contact) ?>
|
||
<?php endif; ?>
|
||
</dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
|
||
<?php if (!empty($data['baiu_link'])): ?>
|
||
<?php
|
||
$_baiuHref = htmlspecialchars($data['baiu_link']);
|
||
$_baiuLabel = preg_replace('#^https?://#i', '', rtrim($data['baiu_link'], '/'));
|
||
?>
|
||
<div>
|
||
<dt>Lien :</dt>
|
||
<dd>
|
||
<a href="<?= $_baiuHref ?>" target="_blank" rel="noopener">
|
||
<?= htmlspecialchars($_baiuLabel) ?>
|
||
<span class="sr-only">(ouvre dans un nouvel onglet)</span>
|
||
</a>
|
||
|
||
</dd>
|
||
</div>
|
||
<?php endif; ?>
|
||
</dl>
|
||
|
||
<?php if (!empty($data['synopsis'])): ?>
|
||
<p class="tfe-synopsis-text">
|
||
<?= nl2br(htmlspecialchars($data['synopsis'])) ?>
|
||
</p>
|
||
<?php endif; ?>
|
||
</header>
|
||
|
||
<!-- RIGHT: media — supplementary aside -->
|
||
<aside class="tfe-right">
|
||
<?php
|
||
$_videoIndex = 0;
|
||
?>
|
||
<?php if ($isInterdit): ?>
|
||
<p class="tfe-restricted">
|
||
Ce TFE n'est pas disponible en ligne.
|
||
</p>
|
||
<?php elseif ($shouldHideFiles): ?>
|
||
<div class="tfe-restricted-access">
|
||
<p class="tfe-restricted-message">
|
||
<strong>Accès restreint</strong><br>
|
||
Les fichiers attachés à ce TFE sont réservés aux utilisateurs autorisés.
|
||
</p>
|
||
|
||
<form id="access-request-form" class="tfe-access-request-form"
|
||
data-thesis-id="<?= $thesisId ?>">
|
||
<input type="hidden" name="csrf_token"
|
||
value="<?= htmlspecialchars($_SESSION['csrf_token'] ?? '') ?>">
|
||
|
||
<div class="form-group">
|
||
<label for="access-email">Votre adresse email :</label>
|
||
<input type="email"
|
||
id="access-email"
|
||
name="email"
|
||
required
|
||
placeholder="votre@email.com">
|
||
</div>
|
||
|
||
<div id="justification-container" class="form-group" style="display: none;">
|
||
<label for="access-justification">Pourquoi souhaitez-vous accéder à ce TFE ?</label>
|
||
<textarea id="access-justification"
|
||
name="justification"
|
||
rows="4"
|
||
placeholder="Décrivez brièvement votre motivation (recherche, collaboration, etc.)"></textarea>
|
||
</div>
|
||
|
||
<button type="submit" class="tfe-btn-request-access">
|
||
Demander l'accès
|
||
</button>
|
||
|
||
<div id="access-request-message" class="tfe-access-message" style="display: none;"></div>
|
||
</form>
|
||
</div>
|
||
|
||
<script>
|
||
(function() {
|
||
const form = document.getElementById('access-request-form');
|
||
const emailInput = document.getElementById('access-email');
|
||
const justificationContainer = document.getElementById('justification-container');
|
||
const justificationInput = document.getElementById('access-justification');
|
||
const messageDiv = document.getElementById('access-request-message');
|
||
|
||
// Show/hide justification based on email domain
|
||
emailInput.addEventListener('input', function() {
|
||
const email = this.value.trim().toLowerCase();
|
||
const isErg = email.endsWith('@erg.school') || email.endsWith('@erg.be');
|
||
justificationContainer.style.display = isErg ? 'none' : 'block';
|
||
justificationInput.required = !isErg;
|
||
});
|
||
|
||
// Form submission
|
||
form.addEventListener('submit', function(e) {
|
||
e.preventDefault();
|
||
|
||
const submitBtn = form.querySelector('button[type="submit"]');
|
||
submitBtn.disabled = true;
|
||
submitBtn.textContent = 'Envoi en cours...';
|
||
messageDiv.style.display = 'none';
|
||
|
||
const formData = new FormData(form);
|
||
formData.append('thesis_id', '<?= $thesisId ?>');
|
||
|
||
fetch('/request-access.php', {
|
||
method: 'POST',
|
||
body: formData
|
||
})
|
||
.then(response => response.json())
|
||
.then(data => {
|
||
submitBtn.disabled = false;
|
||
submitBtn.textContent = 'Demander l\'accès';
|
||
|
||
messageDiv.style.display = 'block';
|
||
if (data.success) {
|
||
messageDiv.className = 'tfe-access-message tfe-access-success';
|
||
messageDiv.textContent = data.message;
|
||
form.reset();
|
||
} else {
|
||
messageDiv.className = 'tfe-access-message tfe-access-error';
|
||
messageDiv.textContent = data.message || 'Une erreur est survenue. Veuillez réessayer.';
|
||
}
|
||
})
|
||
.catch(error => {
|
||
submitBtn.disabled = false;
|
||
submitBtn.textContent = 'Demander l\'accès';
|
||
messageDiv.style.display = 'block';
|
||
messageDiv.className = 'tfe-access-message tfe-access-error';
|
||
messageDiv.textContent = 'Erreur de connexion. Veuillez réessayer.';
|
||
});
|
||
});
|
||
})();
|
||
</script>
|
||
<?php elseif (!empty($data['files'])): ?>
|
||
<?php foreach ($data['files'] as $file): ?>
|
||
<?php
|
||
$ext = strtolower(pathinfo($file['file_path'], PATHINFO_EXTENSION));
|
||
if ($ext === 'vtt') continue;
|
||
?>
|
||
<figure>
|
||
<?php if ($ext === 'pdf'): ?>
|
||
<embed src="/media?path=<?= urlencode($file['file_path']) ?>"
|
||
type="application/pdf" width="100%" height="700px">
|
||
<p class="tfe-pdf-fallback">
|
||
<a href="/media?path=<?= urlencode($file['file_path']) ?>&download=1">
|
||
Télécharger le PDF
|
||
</a>
|
||
</p>
|
||
<?php elseif (in_array($ext, ['jpg','jpeg','png','gif','bmp','webp'])): ?>
|
||
<img src="/media?path=<?= urlencode($file['file_path']) ?>"
|
||
alt="<?= htmlspecialchars(
|
||
!empty($file['description'])
|
||
? $file['description']
|
||
: ($data['title'] . ' — ' . ($data['authors'] ?? ''))
|
||
) ?>">
|
||
<?php elseif ($ext === 'mp4'): ?>
|
||
<?php
|
||
$_vttPath = $captionFiles[$_videoIndex] ?? null;
|
||
$_videoIndex++;
|
||
?>
|
||
<video width="100%" controls>
|
||
<source src="/media?path=<?= urlencode($file['file_path']) ?>" type="video/mp4">
|
||
<?php if ($_vttPath): ?>
|
||
<track kind="captions"
|
||
src="/media?path=<?= urlencode($_vttPath) ?>"
|
||
srclang="fr"
|
||
label="Sous-titres"
|
||
default>
|
||
<?php endif; ?>
|
||
</video>
|
||
<?php endif; ?>
|
||
<?php if (!empty($file['description'])): ?>
|
||
<figcaption><?= htmlspecialchars($file['description']) ?></figcaption>
|
||
<?php endif; ?>
|
||
</figure>
|
||
<?php endforeach; ?>
|
||
<?php else: ?>
|
||
<p class="tfe-no-files">Aucun fichier disponible pour ce TFE.</p>
|
||
<?php endif; ?>
|
||
</aside>
|
||
|
||
</article>
|
||
</main>
|