oleg/maria_uslugi
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Version stable, aprelic, connexion CFRS et autres corrections

Browse Source
This commit is contained in:
Oleg Barykin committed 2026-04-17 20:18:11 +02:00
1 parent 865de8a976
commit e9d0010451
62 files changed
+17483 -7256
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

validation.php
+25 -62
View File
@@ -75,10 +75,6 @@ function ui_exit(string $title, string $message, int $status = 400, string $type
// 1) Token présent & valide
// =====================
$rawToken = trim((string) ($_GET['token'] ?? ''));
$rawAL = trim((string) ($_GET['al'] ?? ''));
if ($rawAL !== '' && ! preg_match('/^[A-Fa-f0-9]{64}$/', $rawAL)) {
$rawAL = ''; // on ignore si format suspect
}
if ($rawToken === '') {
ui_exit(
@@ -157,12 +153,14 @@ if ($now > $expireAt) {
// =====================
try {
$stmt = $pdo->prepare("
UPDATE compte
SET email_valide = 1,
token_validation = NULL,
token_validation_expire = NULL
WHERE id = :id
");
UPDATE compte
SET email_valide = 1,
token_validation = NULL,
token_validation_expire = NULL,
token_autologin = NULL,
token_autologin_expire = NULL
WHERE id = :id
");
$stmt->execute(['id' => $compte['id']]);
} catch (Throwable $e) {
error_log('Validation email - UPDATE échouée: ' . $e->getMessage());
@@ -175,63 +173,28 @@ try {
$translations['retour_acceuil'] ?? 'Retour à l’accueil'
);
}
// =====================
// 4bis) Auto-login (si al fourni et valide)
// 4bis) Auto-login direct après validation
// =====================
if ($rawAL !== '') {
// On recharge le compte pour lire token_autologin + expire (plus propre)
$stmt = $pdo->prepare("SELECT id, role, reference_id, token_autologin, token_autologin_expire
FROM compte
WHERE id = :id
LIMIT 1");
$stmt->execute(['id' => (int) $compte['id']]);
$c = $stmt->fetch(PDO::FETCH_ASSOC);
session_regenerate_id(true);
$_SESSION['compte_id'] = (int) $compte['id'];
$_SESSION['role'] = (string) $compte['role'];
$_SESSION['reference_id'] = (int) $compte['reference_id'];
if ($c && ! empty($c['token_autologin']) && hash_equals((string) $c['token_autologin'], $rawAL)) {
// Expiration (obligatoire)
$expOk = false;
if (! empty($c['token_autologin_expire'])) {
try {
$exp = new DateTime((string) $c['token_autologin_expire']);
$expOk = (new DateTime()) <= $exp;
} catch (Throwable $e) {
$expOk = false;
}
}
if ($expOk) {
// One-time : on invalide le token autologin
$pdo->prepare("UPDATE compte
SET token_autologin = NULL, token_autologin_expire = NULL
WHERE id = :id")
->execute(['id' => (int) $c['id']]);
// Connexion session (même logique pour client/praticien)
session_regenerate_id(true);
$_SESSION['compte_id'] = (int) $c['id']; // <-- IMPORTANT (secure.php l'exige)
$_SESSION['role'] = (string) $c['role'];
$_SESSION['reference_id'] = (int) $c['reference_id'];
if ($_SESSION['role'] === 'client') {
$_SESSION['client_id'] = (int) $c['reference_id'];
header('Location: /public/client/informations.php');
exit;
}
if ($_SESSION['role'] === 'praticien') {
$_SESSION['praticien_id'] = (int) $c['reference_id'];
header('Location: /public/praticien/informations.php');
exit;
}
// fallback si role inconnu
header('Location: /connexion.php');
exit;
}
}
if ($_SESSION['role'] === 'client') {
$_SESSION['client_id'] = (int) $compte['reference_id'];
header('Location: /public/client/informations.php');
exit;
}
if ($_SESSION['role'] === 'praticien') {
$_SESSION['praticien_id'] = (int) $compte['reference_id'];
header('Location: /public/praticien/informations.php');
exit;
}
header('Location: /connexion.php');
exit;
// =====================
// 5) Écran final (succès)
// =====================