mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-05-07 03:29:19 +02:00
8613f71112
- lib/AdminAuth.php: new class with requireLogin(), login(), logout(), isAuthenticated(); starts session with hardened cookie params (HttpOnly, SameSite=Strict, Secure, Path=/admin) — also resolves item #8 (session cookie hardening) - requireLogin() auto-authenticates from nginx Basic Auth credentials ($_SERVER['PHP_AUTH_PW']) so the user only sees one browser prompt; falls back to /admin/login.php if the proxy is absent/misconfigured - config/admin_credentials.php: gitignored credential store; define ADMIN_PASSWORD_HASH with a bcrypt hash to enable PHP auth - config/admin_credentials.example.php: template for the above - config/bootstrap.php: auto-loads admin_credentials.php if present - .gitignore: exclude config/admin_credentials.php - public/admin/login.php: fallback login form (shown only when nginx Basic Auth is bypassed / proxy absent) - public/admin/logout.php: session destruction + redirect to login - All 7 admin PHP files: replace session_start() with AdminAuth::requireLogin() (defence-in-depth behind nginx Basic Auth) - public/admin/inc/head.php: Déconnexion button when ADMIN_PASSWORD_HASH is defined - nginx/PHP_AUTH_LAYER.md: documents dual-auth architecture, UX flow, and setup instructions - docs/TODO.SECURITY.md: items #2 and #8 moved to Resolved; priority order updated (all CRITICAL done)
101 lines
3.1 KiB
PHP
101 lines
3.1 KiB
PHP
<?php
|
|
// Bootstrap application
|
|
require_once __DIR__ . "/../../config/bootstrap.php";
|
|
require_once __DIR__ . '/../../lib/AdminAuth.php';
|
|
|
|
/**
|
|
* Handle publish/unpublish actions for theses
|
|
*/
|
|
// PHP-level auth guard (defence-in-depth behind nginx Basic Auth)
|
|
AdminAuth::requireLogin();
|
|
|
|
require_once __DIR__ . '/../../lib/Database.php';
|
|
|
|
// Verify CSRF token
|
|
if (!isset($_POST['csrf_token']) || !isset($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
|
|
$_SESSION['error'] = "Erreur de sécurité : token invalide.";
|
|
header('Location: ../index.php');
|
|
exit;
|
|
}
|
|
|
|
$action = isset($_POST['action']) ? $_POST['action'] : '';
|
|
$isBulk = isset($_POST['bulk']) && $_POST['bulk'] == '1';
|
|
|
|
if (!in_array($action, ['publish', 'unpublish'])) {
|
|
$_SESSION['error'] = "Action invalide.";
|
|
header('Location: ../index.php');
|
|
exit;
|
|
}
|
|
|
|
try {
|
|
$db = new Database();
|
|
$pdo = $db->getPDO();
|
|
|
|
$isPublished = ($action === 'publish') ? 1 : 0;
|
|
|
|
if ($isBulk) {
|
|
// Handle bulk action
|
|
$thesisIds = isset($_POST['selected_theses']) ? $_POST['selected_theses'] : [];
|
|
|
|
if (empty($thesisIds)) {
|
|
$_SESSION['error'] = "Aucun TFE sélectionné.";
|
|
header('Location: ../index.php');
|
|
exit;
|
|
}
|
|
|
|
// Validate all IDs are integers
|
|
$thesisIds = array_map('intval', $thesisIds);
|
|
$thesisIds = array_filter($thesisIds, fn($id) => $id > 0);
|
|
|
|
if (empty($thesisIds)) {
|
|
$_SESSION['error'] = "IDs invalides.";
|
|
header('Location: ../index.php');
|
|
exit;
|
|
}
|
|
|
|
// Prepare placeholders for IN clause
|
|
$placeholders = str_repeat('?,', count($thesisIds) - 1) . '?';
|
|
$sql = "UPDATE theses SET is_published = ?, updated_at = CURRENT_TIMESTAMP WHERE id IN ($placeholders)";
|
|
|
|
$stmt = $pdo->prepare($sql);
|
|
$params = array_merge([$isPublished], $thesisIds);
|
|
$stmt->execute($params);
|
|
|
|
$count = count($thesisIds);
|
|
if ($action === 'publish') {
|
|
$_SESSION['success'] = "$count TFE(s) publié(s) avec succès!";
|
|
} else {
|
|
$_SESSION['success'] = "$count TFE(s) retiré(s) de la publication.";
|
|
}
|
|
|
|
} else {
|
|
// Handle single action
|
|
$thesisId = isset($_POST['thesis_id']) ? intval($_POST['thesis_id']) : 0;
|
|
|
|
if ($thesisId <= 0) {
|
|
$_SESSION['error'] = "ID invalide.";
|
|
header('Location: ../index.php');
|
|
exit;
|
|
}
|
|
|
|
$stmt = $pdo->prepare("UPDATE theses SET is_published = ?, updated_at = CURRENT_TIMESTAMP WHERE id = ?");
|
|
$stmt->execute([$isPublished, $thesisId]);
|
|
|
|
if ($action === 'publish') {
|
|
$_SESSION['success'] = "TFE publié avec succès!";
|
|
} else {
|
|
$_SESSION['success'] = "TFE retiré de la publication.";
|
|
}
|
|
}
|
|
|
|
} catch (Exception $e) {
|
|
error_log("Publish error: " . $e->getMessage());
|
|
$_SESSION['error'] = "Erreur lors de la modification: " . $e->getMessage();
|
|
}
|
|
|
|
// Regenerate CSRF token
|
|
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
|
|
|
|
header('Location: ../index.php');
|
|
exit;
|