xamxam/admin/edit.php

<?php
// Edit thesis page
session_start();

// Generate CSRF token
if (empty($_SESSION['csrf_token'])) {
    $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}

require_once __DIR__ . '/../lib/Database.php';

$thesisId = isset($_GET['id']) ? intval($_GET['id']) : 0;
$error = null;
$success = null;

if ($thesisId <= 0) {
    die("ID invalide");
}

try {
    $db = new Database();
    $pdo = $db->getPDO();

    // Handle form submission
    if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['csrf_token'])) {
        // Verify CSRF token
        if (!hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
            throw new Exception("Erreur de sécurité : token invalide.");
        }

        try {
            $db->beginTransaction();

            // Update thesis basic info
            $stmt = $pdo->prepare("
                UPDATE theses SET
                    title = ?,
                    subtitle = ?,
                    year = ?,
                    orientation_id = ?,
                    ap_program_id = ?,
                    finality_id = ?,
                    synopsis = ?,
                    file_size_info = ?,
                    baiu_link = ?,
                    is_published = ?,
                    updated_at = CURRENT_TIMESTAMP
                WHERE id = ?
            ");

            $stmt->execute([
                trim($_POST['titre']),
                !empty($_POST['subtitle']) ? trim($_POST['subtitle']) : null,
                intval($_POST['année']),
                intval($_POST['orientation']),
                intval($_POST['ap']),
                intval($_POST['finality']),
                trim($_POST['synopsis']),
                !empty($_POST['duration_info']) ? trim($_POST['duration_info']) : null,
                !empty($_POST['lien']) ? trim($_POST['lien']) : null,
                isset($_POST['is_published']) ? 1 : 0,
                $thesisId
            ]);

            // Update authors
            $pdo->prepare("DELETE FROM thesis_authors WHERE thesis_id = ?")->execute([$thesisId]);
            $authorsRaw = trim($_POST['auteurice'] ?? '');
            if (!empty($authorsRaw)) {
                $authors = array_map('trim', explode(',', $authorsRaw));
                foreach ($authors as $index => $authorName) {
                    if (!empty($authorName)) {
                        $authorId = $db->findOrCreateAuthor($authorName, $index === 0 ? ($_POST['mail'] ?? null) : null);
                        $stmt = $pdo->prepare("INSERT INTO thesis_authors (thesis_id, author_id, author_order) VALUES (?, ?, ?)");
                        $stmt->execute([$thesisId, $authorId, $index + 1]);
                    }
                }
            }

            // Update supervisors
            $pdo->prepare("DELETE FROM thesis_supervisors WHERE thesis_id = ?")->execute([$thesisId]);
            $supervisorsRaw = trim($_POST['promoteurice'] ?? '');
            if (!empty($supervisorsRaw)) {
                $supervisors = array_map('trim', explode(',', $supervisorsRaw));
                foreach ($supervisors as $index => $supervisorName) {
                    if (!empty($supervisorName)) {
                        $supervisorId = $db->findOrCreateSupervisor($supervisorName);
                        $stmt = $pdo->prepare("INSERT INTO thesis_supervisors (thesis_id, supervisor_id, supervisor_order) VALUES (?, ?, ?)");
                        $stmt->execute([$thesisId, $supervisorId, $index + 1]);
                    }
                }
            }

            // Update languages
            $pdo->prepare("DELETE FROM thesis_languages WHERE thesis_id = ?")->execute([$thesisId]);
            if (isset($_POST['languages']) && is_array($_POST['languages'])) {
                foreach ($_POST['languages'] as $languageId) {
                    $stmt = $pdo->prepare("INSERT INTO thesis_languages (thesis_id, language_id) VALUES (?, ?)");
                    $stmt->execute([$thesisId, intval($languageId)]);
                }
            }

            // Update formats
            $pdo->prepare("DELETE FROM thesis_formats WHERE thesis_id = ?")->execute([$thesisId]);
            if (isset($_POST['formats']) && is_array($_POST['formats'])) {
                foreach ($_POST['formats'] as $formatId) {
                    $stmt = $pdo->prepare("INSERT INTO thesis_formats (thesis_id, format_id) VALUES (?, ?)");
                    $stmt->execute([$thesisId, intval($formatId)]);
                }
            }

            // Update keywords
            $pdo->prepare("DELETE FROM thesis_keywords WHERE thesis_id = ?")->execute([$thesisId]);
            $keywordsRaw = trim($_POST['tag'] ?? '');
            if (!empty($keywordsRaw)) {
                $keywords = array_map('trim', explode(',', $keywordsRaw));
                $keywords = array_slice($keywords, 0, 10); // Max 10
                foreach ($keywords as $keyword) {
                    if (!empty($keyword)) {
                        $keywordId = $db->findOrCreateKeyword($keyword);
                        if ($keywordId) {
                            $stmt = $pdo->prepare("INSERT INTO thesis_keywords (thesis_id, keyword_id) VALUES (?, ?)");
                            $stmt->execute([$thesisId, $keywordId]);
                        }
                    }
                }
            }

            $db->commit();
            $success = "TFE mis à jour avec succès!";

            // Regenerate CSRF token
            $_SESSION['csrf_token'] = bin2hex(random_bytes(32));

        } catch (Exception $e) {
            $db->rollback();
            $error = $e->getMessage();
            error_log("Edit error: " . $e->getMessage());
        }
    }

    // Load thesis data
    $thesis = $db->getThesis($thesisId);

    if (!$thesis) {
        die("TFE non trouvé");
    }

    // Load current relationships
    $stmt = $pdo->prepare("SELECT language_id FROM thesis_languages WHERE thesis_id = ?");
    $stmt->execute([$thesisId]);
    $currentLanguages = $stmt->fetchAll(PDO::FETCH_COLUMN);

    $stmt = $pdo->prepare("SELECT format_id FROM thesis_formats WHERE thesis_id = ?");
    $stmt->execute([$thesisId]);
    $currentFormats = $stmt->fetchAll(PDO::FETCH_COLUMN);

    // Load reference data
    $orientations = $db->getAllOrientations();
    $apPrograms = $db->getAllAPPrograms();
    $finalityTypes = $db->getAllFinalityTypes();
    $languages = $db->getAllLanguages();
    $formatTypes = $db->getAllFormatTypes();

} catch (Exception $e) {
    error_log("Error loading edit page: " . $e->getMessage());
    die("Erreur lors du chargement: " . $e->getMessage());
}
?>
<!DOCTYPE html>
<html lang="fr">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Éditer TFE - <?php echo htmlspecialchars($thesis['title']); ?></title>
    <link rel="stylesheet" href="assets/normalize.css">
    <link rel="stylesheet" href="https://raw.githack.com/waldyrious/downstyler/master/downstyler.css" />
    <link rel="shortcut icon" href="assets/icon.svg" type="image/svg">
</head>
<body>
    <header>
        <h1>Éditer TFE</h1>
        <nav>
            <a href="list.php">← Liste</a> |
            <a href="thanks.php?id=<?php echo $thesisId; ?>">Voir</a>
        </nav>
    </header>

    <main>
        <?php if ($error): ?>
            <div style="background: #fee; border: 2px solid #c00; padding: 1rem; margin-bottom: 1rem; border-radius: 4px; color: #c00;">
                <strong>⚠️ Erreur:</strong> <?php echo htmlspecialchars($error); ?>
            </div>
        <?php endif; ?>

        <?php if ($success): ?>
            <div style="background: #efe; border: 2px solid #0a0; padding: 1rem; margin-bottom: 1rem; border-radius: 4px; color: #0a0;">
                <strong>✓ <?php echo htmlspecialchars($success); ?></strong>
            </div>
        <?php endif; ?>

        <form method="post" action="edit.php?id=<?php echo $thesisId; ?>">
            <input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars($_SESSION['csrf_token']); ?>">

            <h2>Informations de base</h2>

            <fieldset>
                <label for="auteurice">Nom/Prénom/Pseudo *</label>
                <input type="text" id="auteurice" name="auteurice" value="<?php echo htmlspecialchars($thesis['authors']); ?>" required>
                <small>Si plusieurs, séparer par des virgules</small>
            </fieldset>

            <fieldset>
                <label for="mail">Contact</label>
                <input type="text" id="mail" name="mail" value="">
            </fieldset>

            <fieldset>
                <label for="année">Année *</label>
                <input type="number" id="année" name="année" value="<?php echo $thesis['year']; ?>" required>
            </fieldset>

            <h2>Informations académiques</h2>

            <fieldset>
                <label for="orientation">Orientation *</label>
                <select id="orientation" name="orientation" required>
                    <?php foreach ($orientations as $orientation): ?>
                        <option value="<?php echo $orientation['id']; ?>" <?php echo ($thesis['orientation'] == $orientation['name']) ? 'selected' : ''; ?>>
                            <?php echo htmlspecialchars($orientation['name']); ?>
                        </option>
                    <?php endforeach; ?>
                </select>
            </fieldset>

            <fieldset>
                <label for="ap">Atelier Pratique *</label>
                <select id="ap" name="ap" required>
                    <?php foreach ($apPrograms as $ap): ?>
                        <option value="<?php echo $ap['id']; ?>" <?php echo ($thesis['ap_program'] == $ap['name']) ? 'selected' : ''; ?>>
                            <?php echo htmlspecialchars($ap['name']); ?>
                        </option>
                    <?php endforeach; ?>
                </select>
            </fieldset>

            <fieldset>
                <label for="finality">Finalité *</label>
                <select id="finality" name="finality" required>
                    <?php foreach ($finalityTypes as $finality): ?>
                        <option value="<?php echo $finality['id']; ?>" <?php echo ($thesis['finality_type'] == $finality['name']) ? 'selected' : ''; ?>>
                            <?php echo htmlspecialchars($finality['name']); ?>
                        </option>
                    <?php endforeach; ?>
                </select>
            </fieldset>

            <fieldset>
                <label for="promoteurice">Promoteur·ice(s)</label>
                <input type="text" id="promoteurice" name="promoteurice" value="<?php echo htmlspecialchars($thesis['supervisors'] ?? ''); ?>">
                <small>Si plusieurs, séparer par des virgules</small>
            </fieldset>

            <h2>À propos du TFE</h2>

            <fieldset>
                <label for="titre">Titre *</label>
                <input type="text" id="titre" name="titre" value="<?php echo htmlspecialchars($thesis['title']); ?>" required>
            </fieldset>

            <fieldset>
                <label for="subtitle">Sous-titre</label>
                <input type="text" id="subtitle" name="subtitle" value="<?php echo htmlspecialchars($thesis['subtitle'] ?? ''); ?>">
            </fieldset>

            <fieldset>
                <label for="synopsis">Synopsis *</label>
                <textarea id="synopsis" name="synopsis" rows="8" required><?php echo htmlspecialchars($thesis['synopsis'] ?? ''); ?></textarea>
            </fieldset>

            <fieldset>
                <label>Langue(s) *</label>
                <?php foreach ($languages as $language): ?>
                    <label class="checkbox-label">
                        <input type="checkbox" name="languages[]" value="<?php echo $language['id']; ?>" <?php echo in_array($language['id'], $currentLanguages) ? 'checked' : ''; ?>>
                        <?php echo htmlspecialchars($language['name']); ?>
                    </label>
                <?php endforeach; ?>
            </fieldset>

            <fieldset>
                <label>Format(s)</label>
                <?php foreach ($formatTypes as $format): ?>
                    <label class="checkbox-label">
                        <input type="checkbox" name="formats[]" value="<?php echo $format['id']; ?>" <?php echo in_array($format['id'], $currentFormats) ? 'checked' : ''; ?>>
                        <?php echo htmlspecialchars($format['name']); ?>
                    </label>
                <?php endforeach; ?>
            </fieldset>

            <fieldset>
                <label for="tag">Mots-clés (max 10)</label>
                <input type="text" id="tag" name="tag" value="<?php echo htmlspecialchars($thesis['keywords'] ?? ''); ?>">
                <small>Séparer par des virgules</small>
            </fieldset>

            <fieldset>
                <label for="duration_info">Durée/Taille</label>
                <input type="text" id="duration_info" name="duration_info" value="<?php echo htmlspecialchars($thesis['file_size_info'] ?? ''); ?>">
            </fieldset>

            <fieldset>
                <label for="lien">Lien externe</label>
                <input type="url" id="lien" name="lien" value="<?php echo htmlspecialchars($thesis['baiu_link'] ?? ''); ?>">
            </fieldset>

            <h2>Publication</h2>

            <fieldset>
                <label style="display: flex; align-items: center; gap: 0.5rem;">
                    <input type="checkbox" name="is_published" value="1" <?php echo $thesis['is_published'] ? 'checked' : ''; ?>>
                    <span>Publier ce TFE sur le site public</span>
                </label>
                <small>Si coché, ce TFE sera visible sur le site public. Sinon, il restera en attente.</small>
            </fieldset>

            <button type="submit">Enregistrer les modifications</button>
            <a href="thanks.php?id=<?php echo $thesisId; ?>">Annuler</a>
        </form>
    </main>

    <footer>
        <p>Édition TFE #<?php echo $thesisId; ?></p>
    </footer>
</body>
</html>