mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-06 11:09:18 +02:00
Items resolved: - #3 (HIGH): Move file uploads outside webroot to STORAGE_ROOT (/var/www/posterg/storage). Uploads were previously stored in public/admin/actions/data/ which is web-accessible. - #4 (HIGH): Align file paths and add media.php controller. DB paths are now storage-relative (theses/YEAR/ID/file, covers/file). New public/media.php serves files with path-traversal jail, MIME allow-list, and proper caching headers. memoire.php and search.php updated to use /media.php?path=. Also fixed: cover images were never recorded in thesis_files (broken INSERT). - #5 (HIGH): RateLimit::getClientIdentifier() now uses REMOTE_ADDR only. HTTP_X_FORWARDED_FOR and HTTP_CLIENT_IP are attacker-controlled headers that allowed unlimited rate-limit bypass by rotating spoofed IPs. - #6 (HIGH): Port public/admin/.htaccess security rules to nginx/posterg.conf. Apache .htaccess directives are silently ignored by nginx; none were active. CSP added to /admin/ location block, .log file denial added globally, autoindex off made explicit. Documented in nginx/HTACCESS_TO_NGINX.md. Supporting changes: - config/bootstrap.php: add STORAGE_ROOT constant - nginx/SECURITY_HEADERS.md: updated to reflect admin CSP and pending public CSP - docs/TODO.SECURITY.md: items #3-6 moved to resolved; priority order updated
154 lines
6.5 KiB
PHP
154 lines
6.5 KiB
PHP
<?php
|
|
// Bootstrap application
|
|
require_once __DIR__ . '/../config/bootstrap.php';
|
|
|
|
// Load required libraries and classes
|
|
require_once APP_ROOT . '/lib/Database.php';
|
|
|
|
// Check if an id parameter is provided in the URL
|
|
if (isset($_GET['id'])) {
|
|
$thesisId = intval($_GET['id']);
|
|
try {
|
|
$db = Database::getInstance();
|
|
$data = $db->getThesisById($thesisId);
|
|
|
|
if (!$data) {
|
|
// Thesis not found or not published
|
|
header('Location: index.php');
|
|
exit;
|
|
}
|
|
} catch (Exception $e) {
|
|
error_log("Error loading thesis: " . $e->getMessage());
|
|
header('Location: index.php');
|
|
exit;
|
|
}
|
|
} else {
|
|
// Redirect to the index page if no id parameter is provided
|
|
header('Location: index.php');
|
|
exit;
|
|
}
|
|
|
|
// Include the header template
|
|
include APP_ROOT . '/includes/header.php'; ?>
|
|
<main>
|
|
<div class="item">
|
|
<div class="card-content">
|
|
<!-- Display the title and author from the database -->
|
|
<h1 class="title">
|
|
<?= htmlspecialchars($data['title']); ?>
|
|
<?php if (!empty($data['subtitle'])): ?>
|
|
<br><small><?= htmlspecialchars($data['subtitle']); ?></small>
|
|
<?php endif; ?>
|
|
</h1>
|
|
<h2 class="subtitle">par
|
|
<?= htmlspecialchars($data['authors'] ?? 'Auteur inconnu'); ?>
|
|
</h2>
|
|
|
|
<h3 class="subtitle"></h3>
|
|
<div class="columns">
|
|
<div class="column is-half ">
|
|
<?php if (!empty($data['orientation']) || !empty($data['ap_program'])): ?>
|
|
<h3 class="subtitle">
|
|
<?php if (!empty($data['orientation'])): ?>
|
|
<?= htmlspecialchars($data['orientation']); ?>
|
|
<?php endif; ?>
|
|
<?php if (!empty($data['orientation']) && !empty($data['ap_program'])): ?>
|
|
et
|
|
<?php endif; ?>
|
|
<?php if (!empty($data['ap_program'])): ?>
|
|
<?= htmlspecialchars($data['ap_program']); ?>
|
|
<?php endif; ?>
|
|
</h3>
|
|
<?php endif; ?>
|
|
<p class="block tag subtitle is-6">
|
|
<?= htmlspecialchars($data['year']); ?>
|
|
</p>
|
|
<?php if (!empty($data['finality_type'])): ?>
|
|
<p class="block">
|
|
<strong>Finalité:</strong> <?= htmlspecialchars($data['finality_type']); ?>
|
|
</p>
|
|
<?php endif; ?>
|
|
</div>
|
|
|
|
<div class="column">
|
|
<?php if (!empty($data['context_note'])): ?>
|
|
<p class="block">
|
|
<em><?= htmlspecialchars($data['context_note']); ?></em>
|
|
</p>
|
|
<?php endif; ?>
|
|
|
|
<?php if (!empty($data['supervisors'])): ?>
|
|
<p class="block">
|
|
<strong>Promoteur.ice.s:</strong>
|
|
<?= htmlspecialchars($data['supervisors']); ?>
|
|
</p>
|
|
<?php endif; ?>
|
|
|
|
<?php if (!empty($data['languages'])): ?>
|
|
<p class="block">
|
|
<strong>Langue(s):</strong>
|
|
<?= htmlspecialchars($data['languages']); ?>
|
|
</p>
|
|
<?php endif; ?>
|
|
|
|
<?php if (!empty($data['formats'])): ?>
|
|
<p class="block">
|
|
<strong>Format(s):</strong>
|
|
<?= htmlspecialchars($data['formats']); ?>
|
|
</p>
|
|
<?php endif; ?>
|
|
|
|
<?php if (!empty($data['keywords'])): ?>
|
|
<p class="block">
|
|
<strong>Mots-clés:</strong>
|
|
<?= htmlspecialchars($data['keywords']); ?>
|
|
</p>
|
|
<?php endif; ?>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
<div class="box">
|
|
<?php if (!empty($data['synopsis'])): ?>
|
|
<?= nl2br(htmlspecialchars($data['synopsis'])); ?>
|
|
<?php endif; ?>
|
|
</div>
|
|
</div>
|
|
|
|
<div class="column is-two-third">
|
|
<div class="content">
|
|
<!-- Check if there are any files in the database -->
|
|
<?php if (isset($data['files']) && count($data['files']) > 0): ?>
|
|
<!-- Loop through the files and display them based on their file type -->
|
|
<?php foreach ($data['files'] as $file): ?>
|
|
<?php $ext = strtolower(pathinfo($file['file_path'], PATHINFO_EXTENSION)); ?>
|
|
<div class="block">
|
|
<?php if ($ext === 'pdf'): ?>
|
|
<!-- Display PDF files using the embed element -->
|
|
<embed src="/media.php?path=<?= urlencode($file['file_path']); ?>" type="application/pdf" width="100%" height="600px" />
|
|
<?php elseif (in_array($ext, ['jpg', 'jpeg', 'png', 'gif', 'bmp'])): ?>
|
|
<!-- Display image files using the img element -->
|
|
<figure>
|
|
<img src="/media.php?path=<?= urlencode($file['file_path']); ?>" alt="<?= htmlspecialchars($file['file_name']); ?>">
|
|
</figure>
|
|
<?php elseif ($ext === 'mp4'): ?>
|
|
<!-- Display MP4 video files using the video element -->
|
|
<video width="100%" height="auto" controls>
|
|
<source src="/media.php?path=<?= urlencode($file['file_path']); ?>" type="video/mp4">
|
|
Your browser does not support the video tag.
|
|
</video>
|
|
<?php endif; ?>
|
|
<?php if (!empty($file['description'])): ?>
|
|
<p class="help"><?= htmlspecialchars($file['description']); ?></p>
|
|
<?php endif; ?>
|
|
</div>
|
|
|
|
<?php endforeach; ?>
|
|
<?php else: ?>
|
|
<p class="notification is-warning">Aucun fichier disponible pour ce mémoire.</p>
|
|
<?php endif; ?>
|
|
</div>
|
|
</main>
|
|
|
|
<!-- Include the footer template -->
|
|
<?php include APP_ROOT . '/includes/footer.php'; ?>
|