mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-06-25 16:19:19 +02:00
5735ccbc38
- fix: 403 on /language-autre-fragment.php — add explicit nginx location block
The nginx catch-all blocked direct access
to all PHP files except /index.php and files inside /admin/.
language-autre-fragment.php lives at the public root and is POSTed to by
HTMX from both the admin edit form and the partage form. Added an explicit
fastcgi block so it is executed
rather than denied.
- fix: replace .php-suffixed public URLs blocked by nginx catch-all
Audit of all client-facing PHP URL references against nginx routing:
- fetch('/request-access.php') in tfe.php -> '/request-access'
(clean URL already routed by Dispatcher)
- /media.php?path= in form.php (x2) and admin/recapitulatif.php -> /media?path=
(nginx only has location = /media, no location for /media.php)
All these .php-suffixed URLs hit the nginx catch-all
location ~ \.php$ { deny all; }
which takes precedence over location / { try_files ... } for regex matches.
53 lines
3.8 KiB
Markdown
53 lines
3.8 KiB
Markdown
# XAMXAM TODO
|
||
|
||
## Completed
|
||
|
||
- [x] TDD analysis + new test suites
|
||
- [x] **Bug fixed**: `SearchController::handleSearch()` — `$coverMap` undefined variable + never populated for search results
|
||
- [x] `ShareLinkTest` (13 tests) — `generateSlug`, all `validateLink` branches, `verifyPassword`, `incrementUsage`, `objet_restriction`
|
||
- [x] `PureLogicTest` (31 tests) — `TfeController` helpers (meta, OG image, jury split, captions), `ThesisCreateController` helpers (autofocus, detectFileType, authorSlug), `ThesisEditController::buildFileSizeInfo`, `ExportController` CSV column consistency, `SearchController` coverMap regression
|
||
- [x] Private helpers promoted to `protected` in `TfeController`, `ThesisCreateController`, `ThesisEditController` to enable subclass-based testing without reflection
|
||
|
||
- [x] Form save audit + TDD
|
||
- [x] `createThesis()` missing `duration_pages`/`duration_minutes` columns — fixed
|
||
- [x] `ThesisCreateController` not passing raw page/minute values to `createThesis()` — fixed (`durationPages`, `durationMinutes` extracted and passed)
|
||
- [x] `FormSaveTest.php` — 14 red-green tests covering create+edit round-trips for all fields
|
||
|
||
- [x] Language form improvements
|
||
- [x] Add Néerlandais as default language option (schema + migration 017)
|
||
- [x] `language_autre` conditionally required via HTMX fragment (replaced custom JS)
|
||
- [x] `language_autre` saved via `getOrCreateLanguage()` in both create and edit controllers
|
||
- [x] `formData['languages']` wired in edit.php so checkboxes are pre-checked
|
||
- [x] `duration_pages`/`duration_minutes` saved in `updateThesis()` and read back in `getThesisRawFields()`
|
||
- [x] `beforeunload-guard` applied to add and partage forms too
|
||
|
||
- [x] Audit + fix direct PHP URL references blocked by nginx catch-all `deny all`
|
||
- [x] `/request-access.php` fetch in `tfe.php` → `/request-access`
|
||
- [x] `/media.php?path=` in `form.php` (×2) and `admin/recapitulatif.php` → `/media?path=`
|
||
|
||
- [x] Fix 403 on `/language-autre-fragment.php` from `edit.php`
|
||
- [x] Root cause: standalone root-level PHP file blocked by nginx catch-all `deny all`
|
||
- [x] Moved logic to `partage/language-autre-fragment.php` (shared include)
|
||
- [x] Added route `/partage/language-autre-fragment` in `partage/index.php`
|
||
- [x] Added `admin/language-autre-fragment.php` (AdminAuth gated, includes shared logic)
|
||
- [x] `form.php` picks URL based on `$mode` (`partage` vs admin)
|
||
- [x] Deleted `public/language-autre-fragment.php`; nginx unchanged
|
||
|
||
- [x] Merge banner images into cover images
|
||
- [x] Migration 016: copy `storage/banners/*` → `storage/covers/`, insert `thesis_files` cover records, clear `banner_path`, remove banners dir
|
||
- [x] Remove banner fieldset from edit form (`form.php`)
|
||
- [x] Remove banner fieldset from student submission form (`fieldset-files.php`: rename to couverture)
|
||
- [x] Update `ThesisEditController::save()` — remove banner upload/removal logic
|
||
- [x] Update `ThesisCreateController::submit()` — remove `handleBannerUpload` call
|
||
- [x] Update `Database::handleCoverUpload()` — add webp support, raise limit to 20 MB
|
||
- [x] Remove `Database::setBannerPath()`, `handleBannerUpload()`, `getThesisBannerPath()`
|
||
- [x] Update `Database::deleteThesis()` / `bulkDeleteTheses()` — remove banner file cleanup
|
||
- [x] `HomeController`: batch-load covers for all items, remove banner_path fallback
|
||
- [x] `SearchController::handleSearch()`: batch-load covers, pass `$coverMap` to view
|
||
- [x] `SearchController::handleStudentPreview()`: load covers, pass `$coverMap` to partial
|
||
- [x] `TfeController::resolveOgImage()`: use cover file_type instead of banner_path
|
||
- [x] `home.php`: use only `$coverMap` (no banner_path fallback)
|
||
- [x] `search.php`: show cover thumbnail on result cards
|
||
- [x] `student-preview.php`: use `$coverMap` instead of `banner_path`
|
||
- [x] Migration applied and file moved to `applied/`
|