mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-07 03:29:19 +02:00
27e1b6828d
Requirements: - parametres.php toggle: 'restricted_files_enabled' enables/disables the feature - Public TFE page: when enabled + access_type=Interne, hides files, shows French restriction message + access request form (metadata/synopsis still visible) - ERG emails (@erg.school / @erg.be): auto-approve, send 24h access link immediately - External emails: show justification textarea, create pending request, notify admin - Admin panel /admin/file-access.php: approve/reject requests with optional notes, sends access email on approval (linked from admin nav with pending count badge) Security: - One-time 24h email tokens (used_at + is_valid=0 on first click) - Token redeemed via POST /validate-access (GET shows confirmation page only) - Long-lived 30-day browser session in file_access_sessions table - Cookie: HttpOnly + Secure + SameSite=Strict - CSRF on all mutations, rate limiting on request submission - Audit trail: IP, UA, event, timestamp in file_access_audit Bug fixes: - admin/file-access.php: $vars never extract()ed → page was blank - Template had self-contained head/footer includes (double-include) - Admin approval URL used $requestId instead of $request['thesis_id'] - App::boot() now starts session so CSRF token works on public pages - Dispatcher routes /validate-access and /request-access through front controller
58 lines
2.0 KiB
PHP
58 lines
2.0 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../../bootstrap.php';
|
|
require_once __DIR__ . '/../../../src/AdminAuth.php';
|
|
AdminAuth::requireLogin();
|
|
|
|
if (!isset($_POST['csrf_token'], $_SESSION['csrf_token'])
|
|
|| !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
|
|
App::flash('error', "Erreur de sécurité : token invalide.");
|
|
header('Location: /admin/parametres.php');
|
|
exit;
|
|
}
|
|
|
|
require_once APP_ROOT . '/src/Database.php';
|
|
require_once APP_ROOT . '/src/SmtpRelay.php';
|
|
$db = new Database();
|
|
|
|
$section = $_POST['section'] ?? '';
|
|
|
|
if ($section === 'formulaire') {
|
|
$allowed = [
|
|
'access_type_libre_enabled',
|
|
'access_type_interne_enabled',
|
|
'access_type_interdit_enabled',
|
|
'restricted_files_enabled'
|
|
];
|
|
foreach ($allowed as $key) {
|
|
$value = isset($_POST[$key]) ? '1' : '0';
|
|
$db->setSetting($key, $value);
|
|
}
|
|
App::flash('success', "Paramètres du formulaire mis à jour.");
|
|
} elseif ($section === 'objet_types') {
|
|
$db->setSetting('objet_these_enabled', isset($_POST['objet_these_enabled']) ? '1' : '0');
|
|
$db->setSetting('objet_frart_enabled', isset($_POST['objet_frart_enabled']) ? '1' : '0');
|
|
App::flash('success', "Types de travaux mis à jour.");
|
|
} elseif ($section === 'smtp') {
|
|
$smtpData = [
|
|
'host' => $_POST['smtp_host'] ?? '',
|
|
'port' => $_POST['smtp_port'] ?? 587,
|
|
'encryption' => $_POST['smtp_encryption'] ?? 'tls',
|
|
'username' => $_POST['smtp_username'] ?? '',
|
|
'from_email' => $_POST['smtp_from_email'] ?? '',
|
|
'from_name' => $_POST['smtp_from_name'] ?? 'Post-ERG',
|
|
];
|
|
// Only update password when user actually typed something.
|
|
$pwd = $_POST['smtp_password'] ?? '';
|
|
if ($pwd !== '') {
|
|
$smtpData['password'] = $pwd;
|
|
}
|
|
SmtpRelay::updateSettings($db, $smtpData);
|
|
App::flash('success', "Paramètres SMTP mis à jour.");
|
|
} else {
|
|
App::flash('error', "Section inconnue.");
|
|
}
|
|
|
|
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
|
|
header('Location: /admin/parametres.php');
|
|
exit;
|