oleg/maria_uslugi
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Derniere version de site au 4/10/2026

Browse Source
This commit is contained in:
Oleg Barykin committed 2026-10-04 14:50:04 +02:00
1 parent 21f34c64c9
commit dbb8e299a0
35 files changed
+8697 -1242
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

includes/tracking.php
+15 -13
View File
@@ -1,16 +1,18 @@
<?php
// Charge les scripts de tracking uniquement pour des pages HTML vues en GET.
// → Pas d’injection sur API/AJAX/assets/callbacks.
if (PHP_SAPI === 'cli') return;
if (PHP_SAPI === 'cli') {
return;
}
$uri = $_SERVER['REQUEST_URI'] ?? '';
$accept = $_SERVER['HTTP_ACCEPT'] ?? '';
$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
$xrw = $_SERVER['HTTP_X_REQUESTED_WITH'] ?? '';
$uri = $_SERVER['REQUEST_URI'] ?? '';
$accept = $_SERVER['HTTP_ACCEPT'] ?? '';
$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
$xrw = $_SERVER['HTTP_X_REQUESTED_WITH'] ?? '';
$isGet = strcasecmp($method, 'GET') === 0;
$wantsHtml = (stripos($accept, 'text/html') !== false) || ($accept === '');
$wantsJson = stripos($accept, 'application/json') !== false;
$isGet = strcasecmp($method, 'GET') === 0;
$wantsHtml = (stripos($accept, 'text/html') !== false) || ($accept === '');
$wantsJson = stripos($accept, 'application/json') !== false;
$isAjax = strcasecmp($xrw, 'XMLHttpRequest') === 0;
$isApi = preg_match('~/(api/|messages/api/|webhook|callback|notify)~i', $uri);
@@ -18,9 +20,9 @@ $isAsset = preg_match('~\.(css|js|map|png|jpe?g|gif|svg|webp|ico|json|xml|txt|p
$isMatomo = stripos($uri, '/matomo/') !== false;
$isRdv = preg_match('~/(valider_rdv\.php|confirmer_rdv\.php|rdv/)~i', $uri);
if ($isGet && $wantsHtml && !$wantsJson && !$isAjax && !$isApi && !$isAsset && !$isMatomo && !$isRdv) {
// 100% externe (pas d’inline) → compatible CSP 'self' + domaines autorisés
echo '<script src="/js/tracking.js" defer></script>';
// Pixel noscript Matomo (ok même sans JS)
echo '<noscript><p><img src="https://staging.uslugi.fr/matomo/matomo.php?idsite=1&amp;rec=1" style="border:0" alt=""></p></noscript>';
if ($isGet && $wantsHtml && ! $wantsJson && ! $isAjax && ! $isApi && ! $isAsset && ! $isMatomo && ! $isRdv) {
// 100% externe (pas d’inline) → compatible CSP 'self' + domaines autorisés
echo '<script src="/js/tracking.js" defer></script>';
// Pixel noscript Matomo (ok même sans JS)
//echo '<noscript><p><img src="https://staging.uslugi.fr/matomo/matomo.php?idsite=1&amp;rec=1" style="border:0" alt=""></p></noscript>';
}