Init Git Prod Mars 2026

includes/tracking.php

@@ -0,0 +1,26 @@
+<?php
+// Charge les scripts de tracking uniquement pour des pages HTML vues en GET.
+// → Pas d’injection sur API/AJAX/assets/callbacks.
+if (PHP_SAPI === 'cli') return;
+
+$uri     = $_SERVER['REQUEST_URI']        ?? '';
+$accept  = $_SERVER['HTTP_ACCEPT']        ?? '';
+$method  = $_SERVER['REQUEST_METHOD']     ?? 'GET';
+$xrw     = $_SERVER['HTTP_X_REQUESTED_WITH'] ?? '';
+
+$isGet      = strcasecmp($method, 'GET') === 0;
+$wantsHtml  = (stripos($accept, 'text/html') !== false) || ($accept === '');
+$wantsJson  = stripos($accept, 'application/json') !== false;
+
+$isAjax   = strcasecmp($xrw, 'XMLHttpRequest') === 0;
+$isApi    = preg_match('~/(api/|messages/api/|webhook|callback|notify)~i', $uri);
+$isAsset  = preg_match('~\.(css|js|map|png|jpe?g|gif|svg|webp|ico|json|xml|txt|pdf|woff2?|ttf|eot|mp4|webm)(\?|$)~i', $uri);
+$isMatomo = stripos($uri, '/matomo/') !== false;
+$isRdv    = preg_match('~/(valider_rdv\.php|confirmer_rdv\.php|rdv/)~i', $uri);
+
+if ($isGet && $wantsHtml && !$wantsJson && !$isAjax && !$isApi && !$isAsset && !$isMatomo && !$isRdv) {
+  // 100% externe (pas d’inline) → compatible CSP 'self' + domaines autorisés
+  echo '<script src="/js/tracking.js" defer></script>';
+  // Pixel noscript Matomo (ok même sans JS)
+  echo '<noscript><p><img src="https://staging.uslugi.fr/matomo/matomo.php?idsite=1&amp;rec=1" style="border:0" alt=""></p></noscript>';
+}