oleg/maria_uslugi
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

V10.1 stable avec correction securité,bug sur csrf dans index

Browse Source
This commit is contained in:
Oleg Barykin committed 2026-05-27 13:54:59 +02:00
1 parent e9d0010451
commit 21f34c64c9
11 files changed
+1136 -445
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

includes/avatar_initiales.php
+69 -47
View File
@@ -7,65 +7,87 @@
/* =========================
Helpers
========================= */
function is_logged_in(): bool {
$role = (string)($_SESSION['role'] ?? ($_SESSION['user_type'] ?? ''));
if (!empty($_SESSION['reference_id']) && $role !== '') return true;
if (!empty($_SESSION['user_id'])) return true;
if (!empty($_SESSION['client_id'])) return true;
if (!empty($_SESSION['praticien_id'])) return true;
return false;
function is_header_logged_in(): bool
{
$role = (string) ($_SESSION['role'] ?? ($_SESSION['user_type'] ?? ''));
if (! empty($_SESSION['reference_id']) && $role !== '') {
return true;
}
if (! empty($_SESSION['user_id'])) {
return true;
}
if (! empty($_SESSION['client_id'])) {
return true;
}
if (! empty($_SESSION['praticien_id'])) {
return true;
}
return false;
}
/**
* Inclut /public/includes/header.php sans DOCTYPE/HTML/HEAD/BODY et sans recharger bootstrap/css.
*/
function include_header_clean(string $absPath): void {
global $translations, $lang;
ob_start();
include $absPath;
$buf = ob_get_clean() ?: '';
function include_header_clean(string $absPath): void
{
global $translations, $lang;
require_once APP_HTDOCS . '/public/includes/securite.php';
ob_start();
include $absPath; // /public/includes/header.php
$buf = ob_get_clean() ?: '';
$buf = preg_replace('~<!doctype\s+html[^>]*>~i', '', $buf);
$buf = preg_replace('~</?html\b[^>]*>~i', '', $buf);
$buf = preg_replace('~<head\b[^>]*>.*?</head>~is', '', $buf);
$buf = preg_replace('~</?body\b[^>]*>~i', '', $buf);
// 0) DOCTYPE + <html>…</html>
$buf = preg_replace('~<!doctype\s+html[^>]*>~i', '', $buf);
$buf = preg_replace('~</?html\b[^>]*>~i', '', $buf);
// éviter d’écraser la home
$buf = preg_replace('~<link[^>]+href="[^"]*(bootstrap[^"]*\.css|mobil_style\.css|site_style\.css|fonts\.googleapis)[^"]*"[^>]*>~i', '', $buf);
$buf = preg_replace('~<script[^>]+src="[^"]*bootstrap[^"]*bundle[^"]*\.js[^"]*"[^>]*>\s*</script>~i', '', $buf);
// 1) retirer <head>…</head> et <body> ouverts/fermés
$buf = preg_replace('~<head\b[^>]*>.*?</head>~is', '', $buf);
$buf = preg_replace('~</?body\b[^>]*>~i', '', $buf);
echo $buf;
// 2) retirer les <link> CSS “globaux” pour éviter d’écraser la home
$buf = preg_replace('~<link[^>]+href="[^"]*(bootstrap[^"]*\.css|mobil_style\.css|site_style\.css|fonts\.googleapis)[^"]*"[^>]*>~i', '', $buf);
// 3) retirer le <script> Bootstrap CDN (on le charge déjà en bas de la page)
$buf = preg_replace('~<script[^>]+src="[^"]*bootstrap[^"]*bundle[^"]*\.js[^"]*"[^>]*>\s*</script>~i', '', $buf);
echo $buf; // garde <header> + tes scripts inline utiles
}
function prepare_secure_header_context(): void {
$pdo = $GLOBALS['pdo'] ?? null;
if (!($pdo instanceof PDO)) return;
function prepare_secure_header_context(): void
{
$pdo = $GLOBALS['pdo'] ?? null;
if (! ($pdo instanceof PDO)) {
return;
}
$role = strtolower((string)($_SESSION['role'] ?? ''));
$refId = (int)($_SESSION['reference_id'] ?? 0);
$role = strtolower((string) ($_SESSION['role'] ?? ''));
$refId = (int) ($_SESSION['reference_id'] ?? 0);
// Initiales client/praticien
if ($refId > 0 && ($role === 'client' || $role === 'praticien')) {
try {
$table = ($role === 'client') ? 'client' : 'praticien';
$st = $pdo->prepare("SELECT nom, prenom FROM {$table} WHERE id = ? LIMIT 1");
$st->execute([$refId]);
$u = $st->fetch(PDO::FETCH_ASSOC) ?: [];
$nom = trim((string)($u['nom'] ?? ''));
$prenom = trim((string)($u['prenom'] ?? ''));
$ini = mb_strtoupper(
mb_substr($prenom, 0, 1, 'UTF-8') . mb_substr($nom, 0, 1, 'UTF-8'),
'UTF-8'
);
$GLOBALS['initiales'] = $ini !== '' ? $ini : 'U';
} catch (Throwable $e) {
$GLOBALS['initiales'] = 'U';
// Initiales client/praticien
if ($refId > 0 && ($role === 'client' || $role === 'praticien')) {
try {
$table = ($role === 'client') ? 'client' : 'praticien';
$st = $pdo->prepare("SELECT nom, prenom FROM {$table} WHERE id = ? LIMIT 1");
$st->execute([$refId]);
$u = $st->fetch(PDO::FETCH_ASSOC) ?: [];
$nom = trim((string) ($u['nom'] ?? ''));
$prenom = trim((string) ($u['prenom'] ?? ''));
$ini = mb_strtoupper(
mb_substr($prenom, 0, 1, 'UTF-8') . mb_substr($nom, 0, 1, 'UTF-8'),
'UTF-8'
);
$GLOBALS['initiales'] = $ini !== '' ? $ini : 'U';
} catch (Throwable $e) {
$GLOBALS['initiales'] = 'U';
}
}
}
}
// Si connecté -> préparer le contexte header sécurisé (sans redirection)
$logged = is_logged_in();
if ($logged) prepare_secure_header_context();
$logged = is_header_logged_in();
if ($logged) {
prepare_secure_header_context();
}