Init Git Prod Mars 2026

2026-03-05 10:25:39 +01:00
commit d81efe93b1
@@ -0,0 +1,175 @@
+<?php
+declare(strict_types=1);
+
+// Interdit l’accès direct au fichier (pas de HTML ici)
+if (isset($_SERVER['SCRIPT_FILENAME']) && realpath(__FILE__) === realpath($_SERVER['SCRIPT_FILENAME'])) {
+    http_response_code(403);
+    exit('Forbidden');
+}
+
+/** Est-ce que l'utilisateur est connecté ? */
+function is_logged_in(): bool {
+    return isset($_SESSION['compte_id'], $_SESSION['reference_id'])
+        && $_SESSION['compte_id'] !== ''
+        && $_SESSION['reference_id'] !== '';
+}
+
+/** Timeout inactivité (2h) */
+function enforce_session_timeout(int $maxIdleSeconds = 7200): void {
+    $now = time();
+    $last = (int)($_SESSION['last_activity'] ?? 0);
+
+    if ($last > 0 && ($now - $last) > $maxIdleSeconds) {
+        logout_and_redirect_to_login($_SERVER['REQUEST_URI'] ?? '/');
+    }
+    $_SESSION['last_activity'] = $now;
+}
+
+/** Anti open-redirect : n’autorise que les chemins internes commençant par '/' */
+function next_safe(?string $u): ?string {
+    if (!$u) return null;
+    if (!preg_match('#^/[^\\r\\n]*$#', $u)) return null;
+    if (strpos($u, '//') === 0) return null;
+    return $u;
+}
+
+function redirect_forbidden(?string $requestUri = null): void {
+    $u = $requestUri ?: ($_SERVER['REQUEST_URI'] ?? '/');
+    $u = next_safe($u) ?? '/';
+    header('Location: /403.php?next=' . rawurlencode($u), true, 303);
+    exit;
+}
+
+function redirect_to_login_with_next(?string $requestUri = null): void {
+    $u = $requestUri ?: ($_SERVER['REQUEST_URI'] ?? '/');
+    $u = next_safe($u) ?? '/';
+    $_SESSION['redirect_to'] = $u;
+    header('Location: /connexion.php?next=' . rawurlencode($u), true, 303);
+    exit;
+}
+
+function logout_and_redirect_to_login(?string $requestUri = null): void {
+    $_SESSION = [];
+    if (session_status() === PHP_SESSION_ACTIVE) {
+        $params = session_get_cookie_params();
+        setcookie(
+            session_name(),
+            '',
+            time() - 42000,
+            $params['path'] ?? '/',
+            $params['domain'] ?? '',
+            (bool)($params['secure'] ?? false),
+            (bool)($params['httponly'] ?? true)
+        );
+    }
+    if (session_status() === PHP_SESSION_ACTIVE) {
+        session_destroy();
+    }
+    redirect_to_login_with_next($requestUri ?? ($_SERVER['REQUEST_URI'] ?? '/'));
+}
+
+/**
+ * 🔒 Re-check rôle depuis DB (optionnel) + hydrate $_SESSION['role'] si absent.
+ * Retourne le rôle (string) ou '' si introuvable.
+ */
+function refresh_role_from_db(PDO $pdo): string {
+    $compteId = (int)($_SESSION['compte_id'] ?? 0);
+    if ($compteId <= 0) return '';
+
+    $stmt = $pdo->prepare("SELECT role FROM compte WHERE id=? LIMIT 1");
+    $stmt->execute([$compteId]);
+    $role = (string)($stmt->fetchColumn() ?: '');
+    if ($role !== '') {
+        $_SESSION['role'] = $role;
+    }
+    return strtolower($role);
+}
+
+/**
+ * ✅ À appeler en haut des pages protégées.
+ * - $allowedRoles = null => tous rôles
+ * - options:
+ *   - 'pdo' => PDO (pour re-check DB si demandé)
+ *   - 'recheck_db_role' => true/false
+ *   - 'admin_strict_reference' => int|null (ex: 88888888)
+ */
+function require_login_or_redirect(?array $allowedRoles = null, array $options = []): void {
+    if (!is_logged_in()) {
+        redirect_to_login_with_next($_SERVER['REQUEST_URI'] ?? '/');
+    }
+
+    enforce_session_timeout(7200);
+
+    $pdo = $options['pdo'] ?? ($GLOBALS['pdo'] ?? null);
+    $recheck = (bool)($options['recheck_db_role'] ?? false);
+
+    // Rôle: session d'abord, DB si demandé (ou si role manquant)
+    $userRole = strtolower((string)($_SESSION['role'] ?? ''));
+    if (($userRole === '' || $recheck) && ($pdo instanceof PDO)) {
+        $userRole = refresh_role_from_db($pdo);
+    }
+
+    if ($allowedRoles) {
+        $allowed = array_map(static fn($r) => strtolower((string)$r), $allowedRoles);
+
+        if (!in_array($userRole, $allowed, true)) {
+            redirect_forbidden($_SERVER['REQUEST_URI'] ?? '/');
+        }
+
+        // 🔥 Renfort admin optionnel : role + reference_id
+        if (in_array('admin', $allowed, true)) {
+            $strictRef = $options['admin_strict_reference'] ?? null;
+            if ($strictRef !== null) {
+                $refId = (int)($_SESSION['reference_id'] ?? 0);
+                if ($refId !== (int)$strictRef) {
+                    redirect_forbidden($_SERVER['REQUEST_URI'] ?? '/');
+                }
+            }
+        }
+    }
+}
+
+/* =========================
+   Admin helpers (CSRF + logs)
+   ========================= */
+
+/** Token CSRF session */
+function ensure_csrf_token(): string {
+    if (empty($_SESSION['csrf_token'])) {
+        $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
+    }
+    return (string)$_SESSION['csrf_token'];
+}
+
+/** Exige POST + CSRF (supporte aussi header X-CSRF-Token si tu veux fetch/AJAX) */
+function require_post_csrf(): void {
+    if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'POST') {
+        http_response_code(405);
+        exit('Méthode non autorisée');
+    }
+
+    $token = $_POST['csrf_token'] ?? '';
+    if ($token === '' && !empty($_SERVER['HTTP_X_CSRF_TOKEN'])) {
+        $token = (string)$_SERVER['HTTP_X_CSRF_TOKEN'];
+    }
+
+    if ($token === '' || !hash_equals((string)($_SESSION['csrf_token'] ?? ''), (string)$token)) {
+        http_response_code(419);
+        exit('CSRF invalide');
+    }
+}
+
+/** Log admin minimal */
+function log_admin_action(PDO $pdo, int $userId, string $action, string $details = ''): void {
+    // limite simple pour éviter d'exploser la table
+    if (strlen($details) > 2000) $details = substr($details, 0, 2000);
+
+    $pdo->prepare(
+        "INSERT INTO admin_actions_log (user_id, action, details, ip) VALUES (?,?,?,?)"
+    )->execute([
+        $userId,
+        $action,
+        $details,
+        $_SERVER['REMOTE_ADDR'] ?? ''
+    ]);
+}