mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-06-25 16:19:19 +02:00
6f7a02244f
Extract shared filepond logic into src/FilepondHandler.php class. Admin filepond endpoints delegate to the handler after AdminAuth check. New partage filepond endpoints at /partage/actions/filepond/ verify share_active session flag + CSRF token, no admin auth required. JS reads filepond-base meta tag to determine endpoint path: - Admin pages: /admin/actions/filepond (via head.php isAdmin check) - Partage form: /partage/actions/filepond (explicit meta) partage/index.php sets share_active = true on form render, cleans up on successful submit. Partage process endpoint rate-limited to 30/5min per session. No nginx changes needed — /partage/ location already handles PHP without auth_basic.
30 lines
1.2 KiB
PHP
30 lines
1.2 KiB
PHP
<?php
|
|
/**
|
|
* FilePond process endpoint — receives one file per request (admin).
|
|
*
|
|
* POST /admin/actions/filepond/process.php
|
|
* Headers: X-CSRF-Token
|
|
* Fields: file (multipart), queue_type (string)
|
|
*
|
|
* Returns plain text file_id on success (200), or error message on failure (4xx).
|
|
*/
|
|
|
|
require_once __DIR__ . '/../../../../bootstrap.php';
|
|
require_once __DIR__ . '/../../../../src/AdminAuth.php';
|
|
require_once __DIR__ . '/../../../../src/FilepondHandler.php';
|
|
|
|
// ── Auth (admin only) ────────────────────────────────────────────────────
|
|
AdminAuth::requireLogin();
|
|
|
|
// ── CSRF via header ──────────────────────────────────────────────────────
|
|
$csrfHeader = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
|
|
if (!isset($_SESSION['csrf_token'])
|
|
|| !hash_equals($_SESSION['csrf_token'], $csrfHeader)) {
|
|
error_log('[filepond:admin:process] CSRF FAIL');
|
|
http_response_code(403);
|
|
die('Token CSRF invalide.');
|
|
}
|
|
|
|
$handler = new FilepondHandler('[filepond:admin]');
|
|
$handler->handleProcess();
|