mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-06-25 16:19:19 +02:00
d5fee1acfb
- Replace fetch(redirect:manual) with XMLHttpRequest in file-upload-queue.js. The previous fetch-based redirect detection was broken because opaque redirects hide the Location header. XHR's responseURL reliably exposes the final URL after server-side redirects. - Add console.log tracing at every decision point in submit interception: entry, hasFiles check, enctype check, double-submit guard, XHR status, redirect detection, error fallback. - Add error_log entry-point logging to all 16 admin action files plus the partage/index.php submission handler and password gate. Each logs: request method, content type/length, POST keys, file counts, and queue-specific file counts where applicable. - Add double-submit guard (_xamxamActiveSubmit) to prevent duplicate XHR sends when the native submit handler fires after interception.
99 lines
3.8 KiB
PHP
99 lines
3.8 KiB
PHP
<?php
|
|
/**
|
|
* Student-access link actions (create, toggle, set_password, archive).
|
|
*/
|
|
require_once __DIR__ . '/../../../bootstrap.php';
|
|
require_once __DIR__ . '/../../../src/AdminAuth.php';
|
|
require_once __DIR__ . '/../../../src/ShareLink.php';
|
|
require_once __DIR__ . '/../../../src/AdminLogger.php';
|
|
|
|
error_log('[acces-etudiante.php] ENTRY | method=' . $_SERVER['REQUEST_METHOD'] . ' | action=' . ($_POST['action'] ?? 'none') . ' | post_keys=' . implode(',', array_keys($_POST)));
|
|
|
|
App::adminGuard();
|
|
|
|
if ($_SERVER['REQUEST_METHOD'] !== 'POST'
|
|
|| !isset($_POST['csrf_token'], $_SESSION['csrf_token'])
|
|
|| !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
|
|
http_response_code(403);
|
|
exit('CSRF token invalide.');
|
|
}
|
|
|
|
$action = $_POST['action'] ?? '';
|
|
$id = isset($_POST['id']) ? intval($_POST['id']) : 0;
|
|
$shareLink = ShareLink::make();
|
|
$logger = AdminLogger::make();
|
|
|
|
switch ($action) {
|
|
case 'create':
|
|
$name = !empty($_POST['name']) ? trim($_POST['name']) : null;
|
|
$password = !empty($_POST['password']) ? trim($_POST['password']) : null;
|
|
$expiresRaw = !empty($_POST['expires_at']) ? trim($_POST['expires_at']) : null;
|
|
$expiresAt = null;
|
|
if ($expiresRaw) {
|
|
$expiresAt = date('Y-m-d H:i:s', strtotime($expiresRaw));
|
|
if ($expiresAt <= date('Y-m-d H:i:s')) {
|
|
App::redirect('/admin/acces.php', error: "La date d'expiration doit être dans le futur.");
|
|
}
|
|
}
|
|
$objetRaw = $_POST['objet_restriction'] ?? ['tfe'];
|
|
$validObjet = ['tfe', 'thèse', 'frart'];
|
|
$selected = is_array($objetRaw) ? array_intersect($objetRaw, $validObjet) : [];
|
|
$objetRestriction = !empty($selected) ? implode(',', $selected) : 'tfe';
|
|
$link = $shareLink->create(1, $password, $expiresAt, $objetRestriction, $name);
|
|
$logger->logLinkCreate(
|
|
$link['slug'] ?? '',
|
|
$password !== null,
|
|
$expiresAt,
|
|
$objetRestriction
|
|
);
|
|
App::redirect('/admin/acces.php', success: 'Lien d\'accès créé.');
|
|
break;
|
|
|
|
case 'toggle':
|
|
if ($id > 0) {
|
|
$nowActive = $shareLink->toggleActive($id);
|
|
$logger->logLinkToggle($id, $nowActive);
|
|
App::redirect('/admin/acces.php', success: 'Statut du lien modifié.');
|
|
} else {
|
|
App::redirect('/admin/acces.php', error: 'Lien introuvable.');
|
|
}
|
|
break;
|
|
|
|
case 'set_password':
|
|
if ($id > 0) {
|
|
$password = isset($_POST['password']) && $_POST['password'] !== '' ? trim($_POST['password']) : null;
|
|
$shareLink->setPassword($id, $password);
|
|
$logger->logLinkPasswordChange($id, $password === null);
|
|
App::redirect('/admin/acces.php', success: 'Mot de passe mis à jour.');
|
|
} else {
|
|
App::redirect('/admin/acces.php', error: 'Lien introuvable.');
|
|
}
|
|
break;
|
|
|
|
case 'archive':
|
|
if ($id > 0) {
|
|
$shareLink->archive($id);
|
|
$logger->logLinkArchive($id);
|
|
App::redirect('/admin/acces.php', success: 'Lien archivé.');
|
|
} else {
|
|
App::redirect('/admin/acces.php', error: 'Lien introuvable.');
|
|
}
|
|
break;
|
|
|
|
case 'update':
|
|
if ($id > 0) {
|
|
$name = isset($_POST['name']) ? trim($_POST['name']) : null;
|
|
$password = isset($_POST['password']) ? trim($_POST['password']) : null;
|
|
$expiresRaw = isset($_POST['expires_at']) ? trim($_POST['expires_at']) : null;
|
|
$shareLink->update($id, $name, $password, $expiresRaw);
|
|
App::redirect('/admin/acces.php', success: 'Lien mis à jour.');
|
|
} else {
|
|
App::redirect('/admin/acces.php', error: 'Lien introuvable.');
|
|
}
|
|
break;
|
|
|
|
default:
|
|
App::redirect('/admin/acces.php', error: 'Action inconnue.');
|
|
break;
|
|
}
|