V10.1 stable avec correction securité,bug sur csrf dans index
This commit is contained in:
Oleg Barykin committed
1 parent
e9d0010451
commit
21f34c64c9
11 files changed
+1136
-445
No files matched your search
+128
-88
@@ -1,7 +1,4 @@
|
||||
<?php
|
||||
ini_set('display_errors', '1');
|
||||
ini_set('display_startup_errors', '1');
|
||||
error_reporting(E_ALL);
|
||||
require_once __DIR__ . '/../public/includes/init_admin.php';
|
||||
|
||||
// FIX: cast pour comparaison stricte
|
||||
@@ -110,74 +107,110 @@
|
||||
</div>
|
||||
</button>
|
||||
|
||||
<ul class="dropdown-menu-custom menu-panel" id="menu" style="display:none; min-width:220px;">
|
||||
<li onclick="window.open('https://staging.uslugi.fr/matomo/index.php','_blank')">
|
||||
<?php echo h($translations['admin_analytic'] ?? 'Analytics') ?>
|
||||
</li>
|
||||
<ul class="dropdown-menu-custom menu-panel" id="menu" aria-hidden="true">
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('add_video')) ?>'">
|
||||
<?php echo h($translations['add_video'] ?? 'Ajouter une vidéo') ?>
|
||||
</li>
|
||||
<li class="has-submenu">
|
||||
<button type="button" class="submenu-toggle" aria-expanded="false">
|
||||
<?php echo h($translations['menu_stats'] ?? 'Statistiques & suivi') ?>
|
||||
<span class="submenu-arrow">▾</span>
|
||||
</button>
|
||||
<ul class="submenu" hidden>
|
||||
<li onclick="window.open('https://staging.uslugi.fr/matomo/index.php','_blank')">
|
||||
<?php echo h($translations['admin_analytic'] ?? 'Analytics') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('logs')) ?>'">
|
||||
<?php echo h($translations['afficher_logs'] ?? 'Logs') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('audit')) ?>'">
|
||||
<?php echo h($translations['audit'] ?? 'Audit') ?>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('new_inscrits')) ?>'">
|
||||
<?php echo h($translations['les_inscrits'] ?? 'Les Inscrits') ?>
|
||||
</li>
|
||||
<li class="has-submenu">
|
||||
<button type="button" class="submenu-toggle" aria-expanded="false">
|
||||
<?php echo h($translations['menu_users'] ?? 'Utilisateurs') ?>
|
||||
<span class="submenu-arrow">▾</span>
|
||||
</button>
|
||||
<ul class="submenu" hidden>
|
||||
<li onclick="location.href='<?php echo h(admin_url('new_inscrits')) ?>'">
|
||||
<?php echo h($translations['les_inscrits'] ?? 'Les inscrits') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('gerer_praticiens')) ?>'">
|
||||
<?php echo h($translations['gerer_praticiens'] ?? 'Gérer praticiens') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('connecter_en_admin')) ?>'">
|
||||
<?php echo h($translations['connecter_en_admin'] ?? 'Войти от имени пользователя') ?>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('mail_praticiens')) ?>'">
|
||||
<?php echo h($translations['mail_praticiens'] ?? 'Рассылка практикующим') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('mailing_client')) ?>'">
|
||||
<?php echo h($translations['mail_clients'] ?? 'Рассылка клиентам') ?>
|
||||
</li>
|
||||
<li class="has-submenu">
|
||||
<button type="button" class="submenu-toggle" aria-expanded="false">
|
||||
<?php echo h($translations['menu_communication'] ?? 'Communication') ?>
|
||||
<span class="submenu-arrow">▾</span>
|
||||
</button>
|
||||
<ul class="submenu" hidden>
|
||||
<li onclick="location.href='<?php echo h(admin_url('mail_praticiens')) ?>'">
|
||||
<?php echo h($translations['mail_praticiens'] ?? 'Рассылка практикующим') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('mailing_client')) ?>'">
|
||||
<?php echo h($translations['mail_clients'] ?? 'Рассылка клиентам') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('afficher_messages')) ?>'">
|
||||
<?php echo h($translations['afficher_messages'] ?? 'Afficher Messages') ?>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('connecter_en_admin')) ?>'">
|
||||
<?php echo h($translations['connecter_en_admin'] ?? 'Войти от имени пользователя') ?>
|
||||
</li>
|
||||
<li class="has-submenu">
|
||||
<button type="button" class="submenu-toggle" aria-expanded="false">
|
||||
<?php echo h($translations['menu_content'] ?? 'Contenu') ?>
|
||||
<span class="submenu-arrow">▾</span>
|
||||
</button>
|
||||
<ul class="submenu" hidden>
|
||||
<li onclick="location.href='<?php echo h(admin_url('add_video')) ?>'">
|
||||
<?php echo h($translations['add_video'] ?? 'Ajouter une vidéo') ?>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('gerer_praticiens')) ?>'">
|
||||
<?php echo h($translations['gerer_praticiens'] ?? 'Gérer praticiens') ?>
|
||||
</li>
|
||||
<li class="has-submenu">
|
||||
<button type="button" class="submenu-toggle" aria-expanded="false">
|
||||
<?php echo h($translations['menu_maintenance'] ?? 'Maintenance') ?>
|
||||
<span class="submenu-arrow">▾</span>
|
||||
</button>
|
||||
<ul class="submenu" hidden>
|
||||
<li onclick="location.href='<?php echo h(admin_url('cleanup_inscriptions')) ?>'">
|
||||
<?php echo h($translations['supp_inscr'] ?? 'Supp. inscriptions') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('clean_uploads')) ?>'">
|
||||
<?php echo h($translations['supp_uploads'] ?? 'Supp. uploads') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('purge_conversations')) ?>'">
|
||||
<?php echo h($translations['purger_messages'] ?? 'Supp. messages') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('purger_mess_upload')) ?>'">
|
||||
<?php echo h($translations['purger_mess_upload'] ?? 'Supp. Upload') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('cleanup_rdv')) ?>'">
|
||||
<?php echo h($translations['cleanup_rdv'] ?? 'Cleanup RDV') ?>
|
||||
</li>
|
||||
<li onclick="location.href='<?php echo h(admin_url('backup_db')) ?>'">
|
||||
<?php echo h($translations['backup_db'] ?? 'Backup DB') ?>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('cleanup_inscriptions')) ?>'">
|
||||
<?php echo h($translations['supp_inscr'] ?? 'Supp. inscriptions') ?>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('clean_uploads')) ?>'">
|
||||
<?php echo h($translations['supp_uploads'] ?? 'Supp. uploads') ?>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('purge_conversations')) ?>'">
|
||||
<?php echo h($translations['purger_messages'] ?? 'Supp. messages') ?>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('purger_mess_upload')) ?>'">
|
||||
<?php echo h($translations['purger_mess_upload'] ?? 'Supp. Upload') ?>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('logs')) ?>'">
|
||||
<?php echo h($translations['afficher_logs'] ?? 'Logs') ?>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('audit')) ?>'">
|
||||
<?php echo h($translations['audit'] ?? 'Audit') ?>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('backup_db')) ?>'">
|
||||
<?php echo h($translations['backup_db'] ?? 'Backup DB') ?>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('cleanup_rdv')) ?>'">
|
||||
<?php echo h($translations['cleanup_rdv'] ?? 'Cleanup RDV') ?>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='<?php echo h(admin_url('afficher_messages')) ?>'">
|
||||
<?php echo h($translations['afficher_messages'] ?? 'Afficher Messages') ?>
|
||||
</li>
|
||||
|
||||
<li onclick="location.href='/public/deconnexion.php'" class="text-danger">
|
||||
<?php echo h($translations['menu_deconnexion'] ?? 'Déconnexion') ?>
|
||||
</li>
|
||||
</ul>
|
||||
<li class="menu-item-form">
|
||||
<form method="POST" action="/public/deconnexion.php" class="menu-logout-form">
|
||||
<input type="hidden" name="csrf_token" value="<?php echo htmlspecialchars(ensure_csrf_token(), ENT_QUOTES, 'UTF-8') ?>">
|
||||
<button type="submit" class="menu-logout-btn">
|
||||
<?php echo htmlspecialchars($translations['menu_deconnexion'] ?? 'Déconnexion') ?>
|
||||
</button>
|
||||
</form>
|
||||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
</nav>
|
||||
</div>
|
||||
@@ -197,7 +230,37 @@
|
||||
?>
|
||||
</div>
|
||||
</div>
|
||||
<script>
|
||||
document.addEventListener('DOMContentLoaded', function () {
|
||||
const toggles = document.querySelectorAll('.submenu-toggle');
|
||||
|
||||
toggles.forEach(toggle => {
|
||||
toggle.addEventListener('click', function (e) {
|
||||
e.stopPropagation();
|
||||
|
||||
const parent = this.closest('.has-submenu');
|
||||
const submenu = parent.querySelector('.submenu');
|
||||
const isOpen = parent.classList.contains('open');
|
||||
|
||||
// ferme les autres
|
||||
document.querySelectorAll('.has-submenu.open').forEach(item => {
|
||||
if (item !== parent) {
|
||||
item.classList.remove('open');
|
||||
const sub = item.querySelector('.submenu');
|
||||
const btn = item.querySelector('.submenu-toggle');
|
||||
if (sub) sub.hidden = true;
|
||||
if (btn) btn.setAttribute('aria-expanded', 'false');
|
||||
}
|
||||
});
|
||||
|
||||
// toggle courant
|
||||
parent.classList.toggle('open', !isOpen);
|
||||
submenu.hidden = isOpen;
|
||||
this.setAttribute('aria-expanded', isOpen ? 'false' : 'true');
|
||||
});
|
||||
});
|
||||
});
|
||||
</script>
|
||||
<script>
|
||||
function toggleMenu() {
|
||||
const menu = document.getElementById('menu');
|
||||
@@ -226,29 +289,6 @@
|
||||
if (e.key === 'Escape') closeMenu();
|
||||
});
|
||||
|
||||
document.addEventListener('click', function(e) {
|
||||
const btn = e.target.closest('.submenu-toggle');
|
||||
if (!btn) return;
|
||||
|
||||
const submenuId = btn.getAttribute('aria-controls');
|
||||
const submenu = document.getElementById(submenuId);
|
||||
if (!submenu) return;
|
||||
|
||||
const isOpen = btn.getAttribute('aria-expanded') === 'true';
|
||||
btn.setAttribute('aria-expanded', String(!isOpen));
|
||||
submenu.hidden = isOpen;
|
||||
e.stopPropagation();
|
||||
});
|
||||
|
||||
function closeSubmenus() {
|
||||
document
|
||||
.querySelectorAll('.submenu-toggle[aria-expanded="true"]')
|
||||
.forEach(btn => {
|
||||
btn.setAttribute('aria-expanded', 'false');
|
||||
const sub = document.getElementById(btn.getAttribute('aria-controls'));
|
||||
if (sub) sub.hidden = true;
|
||||
});
|
||||
}
|
||||
</script>
|
||||
|
||||
<script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/js/bootstrap.bundle.min.js"></script>
|
||||
|
||||
Reference in new issue
Block a user