Init Git Prod Mars 2026

admin/tools/backup_download.php

@@ -0,0 +1,14 @@
+<?php
+if (session_status() !== PHP_SESSION_ACTIVE) session_start();
+if (empty($_SESSION['role']) || !in_array('admin',(array)$_SESSION['role'],true)) { http_response_code(403); exit('Forbidden'); }
+if (empty($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_GET['csrf'] ?? '')) { http_response_code(400); exit('CSRF'); }
+
+$siteRoot=realpath(__DIR__.'/../../'); $dir=$siteRoot.'/backups/db';
+$f=basename($_GET['f'] ?? ''); $path=realpath($dir.'/'.$f);
+if(!$path || !str_starts_with($path, realpath($dir)) || !is_file($path)){ http_response_code(404); exit('Not found'); }
+
+while(ob_get_level()) ob_end_clean();
+header('Content-Type: application/octet-stream');
+header('Content-Disposition: attachment; filename="'.basename($path).'"');
+header('Content-Length: '.filesize($path));
+readfile($path); exit;