mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-06 11:09:18 +02:00
8e864fc624
- Database: add deleteThesisFile() and handleCoverUpload() methods - ThesisEditController::load(): expose currentFiles + currentCover to view - ThesisEditController::save(): handle couverture upload/removal, per-file deletion (delete_files[]), and new thesis file uploads - edit.php template: new Fichiers fieldset with cover preview+remove, existing files list with delete checkboxes, new file upload input (mirrors add.php / partage.php)
72 lines
3.9 KiB
Markdown
72 lines
3.9 KiB
Markdown
# TFE Access Restriction Feature
|
|
|
|
## Admin Edit Form — File Management
|
|
- [x] Add cover image upload/preview/remove to edit.php
|
|
- [x] Add existing thesis files listing with per-file delete checkboxes
|
|
- [x] Add new thesis files upload field (PDF, JPG, PNG, MP4, ZIP, VTT)
|
|
- [x] Add `deleteThesisFile()` and `handleCoverUpload()` to Database.php
|
|
- [x] Update `ThesisEditController::save()` to handle cover, file deletion, new uploads
|
|
- [x] Update `ThesisEditController::load()` to expose `currentFiles` + `currentCover`
|
|
|
|
|
|
## Overview
|
|
Add access restriction for TFE attached files based on user email domain, with admin validation workflow.
|
|
|
|
## Implementation Plan
|
|
|
|
### 1. Database Changes
|
|
- [x] Add `restricted_files_enabled` setting to site_settings table
|
|
- [x] Create `file_access_requests` table
|
|
- id, thesis_id, email, justification, status (pending/approved/rejected), admin_notes, created_at, approved_at, approved_by_admin_id
|
|
- [x] Create `file_access_tokens` table (short-lived, one-time email links, 24h)
|
|
- id, request_id, token (unique), expires_at, used_at (one-time mark)
|
|
- [x] Create `file_access_sessions` table (long-lived browser sessions, 30 days)
|
|
- id, request_id, session_token, expires_at, is_valid
|
|
- [x] Create `file_access_audit` table (IP, UA, timestamp on redemption)
|
|
|
|
### 2. Configuration
|
|
- [x] Add `restricted_files_enabled` checkbox in parametres.php (Formulaire section)
|
|
- [x] Update settings.php action handler to persist the setting
|
|
|
|
### 3. Public TFE View (tfe.php) - Restricted Access UI
|
|
- [x] TfeController checks restricted flag + access_type_id=2 + cookie session
|
|
- [x] French text: "Accès restreint — Les fichiers attachés à ce TFE sont réservés aux utilisateurs autorisés."
|
|
- [x] Request form: email input + conditional justification textarea (non-ERG only)
|
|
- [x] JS: shows/hides justification textarea based on email domain (@erg.school / @erg.be)
|
|
- [x] Form submits via fetch POST to /request-access.php with CSRF token
|
|
- [x] Metadata, title, authors, synopsis all remain visible regardless of restriction
|
|
|
|
### 4. Email Flow
|
|
- [x] @erg.school / @erg.be → auto-approve, generate 24h one-time token, send email immediately
|
|
- [x] External email → create pending request, notify admin by email
|
|
- [x] Admin approves → generate 24h token, send email to requester
|
|
- [x] Email contains link to GET /validate-access (confirmation page) → POST to redeem
|
|
|
|
### 5. Secure Token Redemption
|
|
- [x] One-time email token (24h, marked used_at on first click, is_valid=0)
|
|
- [x] GET /validate-access → shows confirmation page (no side effects)
|
|
- [x] POST /validate-access → redeems token (CSRF required), creates browser session cookie
|
|
- [x] Cookie: HttpOnly; Secure; SameSite=Strict; 30 days
|
|
- [x] Session stored in file_access_sessions (separate from one-time email token)
|
|
- [x] TfeController checks file_access_sessions via hasValidCookieAccess()
|
|
- [x] Audit trail: IP, User-Agent, timestamp in file_access_audit on every redemption attempt
|
|
|
|
### 6. Admin Panel - Access Requests Management
|
|
- [x] Admin page: /admin/file-access.php (linked from admin nav with pending badge)
|
|
- [x] List pending/approved/rejected requests with tab filters and pagination
|
|
- [x] Approve dialog (with optional note) → sends 24h access email
|
|
- [x] Reject dialog (with optional note)
|
|
- [x] Bug fix: $vars was never extract()ed — page was blank
|
|
- [x] Bug fix: template included head.php/header.php/footer.php itself (double-include)
|
|
- [x] Bug fix: admin approval URL used $requestId instead of $request['thesis_id']
|
|
|
|
### 7. Security
|
|
- [x] One-time use tokens (used_at + is_valid=0)
|
|
- [x] POST-based redemption (token in hidden form field, not URL action)
|
|
- [x] 256-bit random tokens, rate limiting on request submission (3/10min per IP)
|
|
- [x] HttpOnly cookie + SameSite=Strict
|
|
- [x] CSRF on all mutations
|
|
- [x] Audit trail (IP, UA, event, timestamp)
|
|
- [x] Short-lived email links (24h), long-lived browser sessions (30 days)
|
|
- [x] App::boot() starts session for all public requests (CSRF token available everywhere)
|