'
. htmlspecialchars($translations['non_autorise'] ?? 'Accès refusé.', ENT_QUOTES, 'UTF-8')
. '
';
return;
}
try { $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); } catch (Throwable) {}
$e = static fn($s) => htmlspecialchars((string)$s, ENT_QUOTES, 'UTF-8');
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
$CSRF = $_SESSION['csrf_token'];
$msg = null;
if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'reauth') {
if (!hash_equals($CSRF, $_POST['csrf'] ?? '')) {
$msg = $translations['reauth_csrf_invalid'] ?? 'Token CSRF invalide.';
} else {
$password = (string)($_POST['password'] ?? '');
$uid = (int)($_SESSION['compte_id'] ?? $_SESSION['user_id'] ?? 0);
// fallback email
if ($uid <= 0 && !empty($_SESSION['email'])) {
$st = $pdo->prepare("SELECT id FROM compte WHERE email = ? LIMIT 1");
$st->execute([(string)$_SESSION['email']]);
$uid = (int)$st->fetchColumn();
}
$ok = false;
if ($uid > 0) {
$st = $pdo->prepare("SELECT mot_de_passe FROM compte WHERE id = ? AND role = 'admin' LIMIT 1");
$st->execute([$uid]);
$hash = $st->fetchColumn();
if ($hash && password_verify($password, $hash)) {
$ok = true;
if (password_needs_rehash($hash, PASSWORD_DEFAULT)) {
$new = password_hash($password, PASSWORD_DEFAULT);
$up = $pdo->prepare("UPDATE compte SET mot_de_passe = ? WHERE id = ?");
$up->execute([$new, $uid]);
}
}
}
if ($ok) {
$_SESSION['admin_reauth_at'] = time();
$redir = $_GET['redir'] ?? 'index.php?page=maintenance';
header('Location: '.$redir);
exit;
} else {
$msg = $translations['reauth_invalid_password'] ?? 'Неверный пароль.';
}
}
}
?>