'
. e($translations['admin_access_denied'] ?? 'Доступ запрещён.')
. '
';
exit;
}
// Reauth (10 min)
$mustReauth = function (int $ttl = 600) {
$t = (int)($_SESSION['admin_reauth_at'] ?? 0);
return ($t === 0 || (time() - $t) > $ttl);
};
if ($mustReauth()) {
$qs = http_build_query(['page' => 'reauth', 'redir' => ($_SERVER['REQUEST_URI'] ?? 'index.php?page=maintenance')]);
header('Location:?' . $qs);
exit;
}
$pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
// CSRF
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
$CSRF = $_SESSION['csrf_token'];
// Récupération des comptes non validés depuis >6h
$sql = "SELECT * FROM compte WHERE email_valide = 0 AND TIMESTAMPDIFF(HOUR, cree_le, NOW()) > 6";
$stmt = $pdo->query($sql);
$comptes = $stmt->fetchAll(PDO::FETCH_ASSOC);
// Ajouter nom, prénom et âge du compte
foreach ($comptes as &$c) {
$nom = $prenom = ($translations['label_unknown'] ?? '(inconnu)');
if ($c['role'] === 'client') {
$stmt2 = $pdo->prepare("SELECT nom, prenom FROM client WHERE id = :id");
$stmt2->execute(['id' => $c['reference_id']]);
$info = $stmt2->fetch(PDO::FETCH_ASSOC);
if ($info) { $nom = $info['nom']; $prenom = $info['prenom']; }
} elseif ($c['role'] === 'praticien') {
$stmt2 = $pdo->prepare("SELECT nom, prenom FROM praticien WHERE id = :id");
$stmt2->execute(['id' => $c['reference_id']]);
$info = $stmt2->fetch(PDO::FETCH_ASSOC);
if ($info) { $nom = $info['nom']; $prenom = $info['prenom']; }
}
$c['nom'] = $nom;
$c['prenom'] = $prenom;
// Calculer la durée depuis création
$diff = time() - strtotime($c['cree_le']);
$heures = floor($diff / 3600);
$minutes = floor(($diff % 3600) / 60);
$c['age_humain'] = sprintf("%dh %02dmin", $heures, $minutes);
}
unset($c);
// --- Suppression sur POST ---
if ($_SERVER['REQUEST_METHOD'] === 'POST'
&& isset($_POST['csrf_token'])
&& hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])
&& !empty($_POST['ids'])) {
$idsToDelete = array_map('intval', $_POST['ids']);
$deleted = 0;
foreach ($comptes as $compte) {
if (!in_array($compte['id'], $idsToDelete, true)) continue;
$id = $compte['id'];
$role = $compte['role'];
$ref_id = $compte['reference_id'];
// Supprimer fiche associée
if ($role === 'client') {
$pdo->prepare("DELETE FROM client WHERE id = :id")->execute(['id' => $ref_id]);
} elseif ($role === 'praticien') {
$pdo->prepare("DELETE FROM praticien WHERE id = :id")->execute(['id' => $ref_id]);
}
// Supprimer le compte
$pdo->prepare("DELETE FROM compte WHERE id = :id")->execute(['id' => $id]);
$deleted++;
}
$msgTpl = ($translations['flash_unverified_deleted'] ?? '✅ {N} compte(s) non validé(s) supprimé(s).');
$msg = str_replace('{N}', (string)$deleted, $msgTpl);
echo ''
. e($msg)
. '
';
exit;
}
?>