V10.1 stable avec correction securité,bug sur csrf dans index
This commit is contained in:
Oleg Barykin committed
1 parent
e9d0010451
commit
21f34c64c9
11 files changed
+1136
-445
No files matched your search
+181
-14
@@ -7,38 +7,174 @@
|
||||
:root {
|
||||
--header: #f1f1f1;
|
||||
}
|
||||
/* ==== VISUEL COMMUN POUR TOUS LES MENUS ==== */
|
||||
.menu-panel {
|
||||
background: #fff;
|
||||
border: 1px solid rgba(0, 0, 0, 0.1);
|
||||
border-radius: 12px;
|
||||
box-shadow: 0 8px 20px rgba(0, 0, 0, 0.08);
|
||||
min-width: 230px;
|
||||
padding: 8px 0;
|
||||
}
|
||||
|
||||
/* Items menu principal */
|
||||
.menu-panel > li,
|
||||
.menu-panel .dropdown-item {
|
||||
font-size: 16px;
|
||||
line-height: 1.25;
|
||||
white-space: nowrap;
|
||||
cursor: pointer;
|
||||
transition: background 0.2s ease;
|
||||
}
|
||||
|
||||
/* séparateurs entre blocs du menu principal */
|
||||
.menu-panel > li + li,
|
||||
.menu-panel .dropdown-item + .dropdown-item {
|
||||
border-top: 1px solid #f1f1f1;
|
||||
}
|
||||
|
||||
.menu-panel > li:hover,
|
||||
.menu-panel .dropdown-item:hover {
|
||||
background: #f8f9fa;
|
||||
}
|
||||
|
||||
.menu-panel a {
|
||||
color: inherit;
|
||||
text-decoration: none;
|
||||
display: block;
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
/* ==== MENU CUSTOM ==== */
|
||||
.menu-wrap {
|
||||
position: relative;
|
||||
display: inline-block;
|
||||
}
|
||||
|
||||
.dropdown-menu-custom {
|
||||
position: absolute;
|
||||
top: calc(100% + 8px);
|
||||
right: 0;
|
||||
background: #fff;
|
||||
border: 1px solid #dee2e6;
|
||||
border-radius: 8px;
|
||||
list-style: none;
|
||||
padding: 0;
|
||||
margin: 0;
|
||||
width: 230px;
|
||||
box-shadow: 0 8px 20px rgba(0, 0, 0, 0.08);
|
||||
display: none;
|
||||
z-index: 1100;
|
||||
}
|
||||
.dropdown-menu-custom li {
|
||||
|
||||
.dropdown-menu-custom.is-open {
|
||||
display: block;
|
||||
}
|
||||
|
||||
/* ==== Sous-menu interne ==== */
|
||||
.has-submenu {
|
||||
background: #fff;
|
||||
}
|
||||
|
||||
.has-submenu .submenu-toggle {
|
||||
width: 100%;
|
||||
text-align: left;
|
||||
background: none;
|
||||
border: 0;
|
||||
padding: 12px 18px;
|
||||
border-bottom: 1px solid #f1f1f1;
|
||||
font-size: 16px;
|
||||
line-height: 1.25;
|
||||
font-weight: 400;
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: space-between;
|
||||
cursor: pointer;
|
||||
font-size: 15px;
|
||||
transition: background 0.2s ease;
|
||||
}
|
||||
.dropdown-menu-custom li:last-child {
|
||||
border-bottom: none;
|
||||
}
|
||||
.dropdown-menu-custom li:hover {
|
||||
|
||||
.has-submenu .submenu-toggle:hover {
|
||||
background: #f8f9fa;
|
||||
}
|
||||
|
||||
.submenu-arrow {
|
||||
font-size: 14px;
|
||||
opacity: 0.7;
|
||||
transition: transform 0.2s ease;
|
||||
}
|
||||
|
||||
.has-submenu.open .submenu-arrow {
|
||||
transform: rotate(180deg);
|
||||
}
|
||||
|
||||
.submenu {
|
||||
list-style: none;
|
||||
margin: 0;
|
||||
padding: 0 0 8px 0;
|
||||
background: #fff;
|
||||
}
|
||||
|
||||
.submenu > li {
|
||||
padding: 10px 18px 10px 32px;
|
||||
font-size: 15px;
|
||||
line-height: 1.25;
|
||||
cursor: pointer;
|
||||
transition: background 0.2s ease;
|
||||
white-space: nowrap;
|
||||
}
|
||||
|
||||
.submenu > li:hover {
|
||||
background: #f8f9fa;
|
||||
}
|
||||
|
||||
.submenu > li + li {
|
||||
border-top: 1px solid #f7f7f7;
|
||||
}
|
||||
|
||||
.submenu[hidden] {
|
||||
display: none;
|
||||
}
|
||||
|
||||
/* bouton logout */
|
||||
.menu-item-form {
|
||||
padding: 0;
|
||||
}
|
||||
|
||||
.menu-logout-form {
|
||||
margin: 0;
|
||||
}
|
||||
|
||||
.menu-logout-btn {
|
||||
width: 100%;
|
||||
text-align: left;
|
||||
background: none;
|
||||
border: 0;
|
||||
padding: 12px 18px;
|
||||
font-size: 16px;
|
||||
line-height: 1.25;
|
||||
cursor: pointer;
|
||||
}
|
||||
|
||||
.menu-logout-btn:hover {
|
||||
background: #f8f9fa;
|
||||
}
|
||||
|
||||
/* sécurité overflow */
|
||||
.site-header,
|
||||
.header-actions,
|
||||
.menu-wrap,
|
||||
.dropdown {
|
||||
overflow: visible;
|
||||
}
|
||||
|
||||
/* bouton avatar */
|
||||
#btnMenu {
|
||||
background: none;
|
||||
border: none;
|
||||
padding: 0;
|
||||
cursor: pointer;
|
||||
-webkit-tap-highlight-color: transparent;
|
||||
padding-left: 10px;
|
||||
}
|
||||
|
||||
#btnMenu:focus,
|
||||
#btnMenu:active {
|
||||
outline: none;
|
||||
box-shadow: none;
|
||||
}
|
||||
|
||||
/* ======================== Mobile-first (≤ 956px) ======================== */
|
||||
@media (max-width: 956px) {
|
||||
/* Garde-fous */
|
||||
@@ -398,3 +534,34 @@
|
||||
background: #38378b; /* bleu foncé */
|
||||
color: #fff;
|
||||
}
|
||||
|
||||
.menu-item-form {
|
||||
padding: 0 !important;
|
||||
list-style: none;
|
||||
}
|
||||
|
||||
.menu-logout-form {
|
||||
margin: 0;
|
||||
width: 100%;
|
||||
}
|
||||
|
||||
.menu-logout-btn {
|
||||
all: unset;
|
||||
box-sizing: border-box;
|
||||
display: block;
|
||||
width: 100%;
|
||||
padding: 12px 16px;
|
||||
cursor: pointer;
|
||||
font: inherit;
|
||||
color: inherit;
|
||||
text-align: left;
|
||||
}
|
||||
|
||||
.menu-logout-btn:hover {
|
||||
background: #f3f4f6;
|
||||
}
|
||||
|
||||
.menu-logout-btn:focus-visible {
|
||||
outline: 2px solid #94a3b8;
|
||||
outline-offset: -2px;
|
||||
}
|
||||
@@ -7,65 +7,87 @@
|
||||
/* =========================
|
||||
Helpers
|
||||
========================= */
|
||||
function is_logged_in(): bool {
|
||||
$role = (string)($_SESSION['role'] ?? ($_SESSION['user_type'] ?? ''));
|
||||
if (!empty($_SESSION['reference_id']) && $role !== '') return true;
|
||||
if (!empty($_SESSION['user_id'])) return true;
|
||||
if (!empty($_SESSION['client_id'])) return true;
|
||||
if (!empty($_SESSION['praticien_id'])) return true;
|
||||
return false;
|
||||
function is_header_logged_in(): bool
|
||||
{
|
||||
$role = (string) ($_SESSION['role'] ?? ($_SESSION['user_type'] ?? ''));
|
||||
if (! empty($_SESSION['reference_id']) && $role !== '') {
|
||||
return true;
|
||||
}
|
||||
|
||||
if (! empty($_SESSION['user_id'])) {
|
||||
return true;
|
||||
}
|
||||
|
||||
if (! empty($_SESSION['client_id'])) {
|
||||
return true;
|
||||
}
|
||||
|
||||
if (! empty($_SESSION['praticien_id'])) {
|
||||
return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
/**
|
||||
* Inclut /public/includes/header.php sans DOCTYPE/HTML/HEAD/BODY et sans recharger bootstrap/css.
|
||||
*/
|
||||
function include_header_clean(string $absPath): void {
|
||||
global $translations, $lang;
|
||||
ob_start();
|
||||
include $absPath;
|
||||
$buf = ob_get_clean() ?: '';
|
||||
function include_header_clean(string $absPath): void
|
||||
{
|
||||
global $translations, $lang;
|
||||
require_once APP_HTDOCS . '/public/includes/securite.php';
|
||||
ob_start();
|
||||
include $absPath; // /public/includes/header.php
|
||||
$buf = ob_get_clean() ?: '';
|
||||
|
||||
$buf = preg_replace('~<!doctype\s+html[^>]*>~i', '', $buf);
|
||||
$buf = preg_replace('~</?html\b[^>]*>~i', '', $buf);
|
||||
$buf = preg_replace('~<head\b[^>]*>.*?</head>~is', '', $buf);
|
||||
$buf = preg_replace('~</?body\b[^>]*>~i', '', $buf);
|
||||
// 0) DOCTYPE + <html>…</html>
|
||||
$buf = preg_replace('~<!doctype\s+html[^>]*>~i', '', $buf);
|
||||
$buf = preg_replace('~</?html\b[^>]*>~i', '', $buf);
|
||||
|
||||
// éviter d’écraser la home
|
||||
$buf = preg_replace('~<link[^>]+href="[^"]*(bootstrap[^"]*\.css|mobil_style\.css|site_style\.css|fonts\.googleapis)[^"]*"[^>]*>~i', '', $buf);
|
||||
$buf = preg_replace('~<script[^>]+src="[^"]*bootstrap[^"]*bundle[^"]*\.js[^"]*"[^>]*>\s*</script>~i', '', $buf);
|
||||
// 1) retirer <head>…</head> et <body> ouverts/fermés
|
||||
$buf = preg_replace('~<head\b[^>]*>.*?</head>~is', '', $buf);
|
||||
$buf = preg_replace('~</?body\b[^>]*>~i', '', $buf);
|
||||
|
||||
echo $buf;
|
||||
// 2) retirer les <link> CSS “globaux” pour éviter d’écraser la home
|
||||
$buf = preg_replace('~<link[^>]+href="[^"]*(bootstrap[^"]*\.css|mobil_style\.css|site_style\.css|fonts\.googleapis)[^"]*"[^>]*>~i', '', $buf);
|
||||
|
||||
// 3) retirer le <script> Bootstrap CDN (on le charge déjà en bas de la page)
|
||||
$buf = preg_replace('~<script[^>]+src="[^"]*bootstrap[^"]*bundle[^"]*\.js[^"]*"[^>]*>\s*</script>~i', '', $buf);
|
||||
|
||||
echo $buf; // garde <header> + tes scripts inline utiles
|
||||
}
|
||||
function prepare_secure_header_context(): void {
|
||||
$pdo = $GLOBALS['pdo'] ?? null;
|
||||
if (!($pdo instanceof PDO)) return;
|
||||
function prepare_secure_header_context(): void
|
||||
{
|
||||
$pdo = $GLOBALS['pdo'] ?? null;
|
||||
if (! ($pdo instanceof PDO)) {
|
||||
return;
|
||||
}
|
||||
|
||||
$role = strtolower((string)($_SESSION['role'] ?? ''));
|
||||
$refId = (int)($_SESSION['reference_id'] ?? 0);
|
||||
$role = strtolower((string) ($_SESSION['role'] ?? ''));
|
||||
$refId = (int) ($_SESSION['reference_id'] ?? 0);
|
||||
|
||||
|
||||
|
||||
// Initiales client/praticien
|
||||
if ($refId > 0 && ($role === 'client' || $role === 'praticien')) {
|
||||
try {
|
||||
$table = ($role === 'client') ? 'client' : 'praticien';
|
||||
$st = $pdo->prepare("SELECT nom, prenom FROM {$table} WHERE id = ? LIMIT 1");
|
||||
$st->execute([$refId]);
|
||||
$u = $st->fetch(PDO::FETCH_ASSOC) ?: [];
|
||||
$nom = trim((string)($u['nom'] ?? ''));
|
||||
$prenom = trim((string)($u['prenom'] ?? ''));
|
||||
$ini = mb_strtoupper(
|
||||
mb_substr($prenom, 0, 1, 'UTF-8') . mb_substr($nom, 0, 1, 'UTF-8'),
|
||||
'UTF-8'
|
||||
);
|
||||
$GLOBALS['initiales'] = $ini !== '' ? $ini : 'U';
|
||||
} catch (Throwable $e) {
|
||||
$GLOBALS['initiales'] = 'U';
|
||||
// Initiales client/praticien
|
||||
if ($refId > 0 && ($role === 'client' || $role === 'praticien')) {
|
||||
try {
|
||||
$table = ($role === 'client') ? 'client' : 'praticien';
|
||||
$st = $pdo->prepare("SELECT nom, prenom FROM {$table} WHERE id = ? LIMIT 1");
|
||||
$st->execute([$refId]);
|
||||
$u = $st->fetch(PDO::FETCH_ASSOC) ?: [];
|
||||
$nom = trim((string) ($u['nom'] ?? ''));
|
||||
$prenom = trim((string) ($u['prenom'] ?? ''));
|
||||
$ini = mb_strtoupper(
|
||||
mb_substr($prenom, 0, 1, 'UTF-8') . mb_substr($nom, 0, 1, 'UTF-8'),
|
||||
'UTF-8'
|
||||
);
|
||||
$GLOBALS['initiales'] = $ini !== '' ? $ini : 'U';
|
||||
} catch (Throwable $e) {
|
||||
$GLOBALS['initiales'] = 'U';
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// Si connecté -> préparer le contexte header sécurisé (sans redirection)
|
||||
$logged = is_logged_in();
|
||||
if ($logged) prepare_secure_header_context();
|
||||
|
||||
$logged = is_header_logged_in();
|
||||
if ($logged) {
|
||||
prepare_secure_header_context();
|
||||
}
|
||||
Reference in new issue
Block a user