mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-09-25 09:53:08 +02:00
Pontoporeia
6e1fc6a781
- reliable tab title /favicon wrapper, - Content-Disposition filename, - admin media route hardened to thesis-file prefixes only (defense-in-depth)
25 lines
930 B
PHP
25 lines
930 B
PHP
<?php
|
|
/**
|
|
* Dedicated admin file viewer — lets a backoffice user open files whose owning
|
|
* thesis is marked 'Interdit' (access_type_id=3).
|
|
*
|
|
* Security:
|
|
* - Auth-gated by AdminAuth::requireLogin() → only an authenticated admin
|
|
* session (cookie scoped to /admin) can reach the handler below.
|
|
* - Delegates to MediaController::handle(adminBypass: true), which bypasses
|
|
* ONLY the Interdit visibility gate. The strict path-whitelist, realpath()
|
|
* storage jail and MIME allow-list remain fully enforced, so an admin
|
|
* cannot read arbitrary files on the server.
|
|
*
|
|
* Usage: /admin/media.php?path=tfe/2025/2025-001/rapport.pdf
|
|
*/
|
|
require_once __DIR__ . '/../../bootstrap.php';
|
|
require_once __DIR__ . '/../../src/AdminAuth.php';
|
|
|
|
AdminAuth::requireLogin();
|
|
|
|
require_once APP_ROOT . '/src/Controllers/MediaController.php';
|
|
|
|
$controller = new MediaController();
|
|
$controller->handle(adminBypass: true);
|