'
. htmlspecialchars($translations['non_autorise'] ?? 'Доступ запрещён.', ENT_QUOTES, 'UTF-8')
. '
';
return;
}
$mustReauth = function(int $ttl=600){
$t=(int)($_SESSION['admin_reauth_at']??0);
return ($t===0||(time()-$t)>$ttl);
};
if ($mustReauth()){
$qs=http_build_query(['page'=>'reauth','redir'=>($_SERVER['REQUEST_URI']??'index.php?page=maintenance')]);
header('Location:?'.$qs);
exit;
}
// -- PDO si absent
if (!isset($pdo)) { require_once '../../includes/db.php'; }
// CSRF
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
$CSRF = $_SESSION['csrf_token'];
// helpers
function e($s){ return htmlspecialchars((string)$s, ENT_QUOTES, 'UTF-8'); }
$flash = ['type'=>null,'msg'=>null];
// ---- Обработка POST ----
$action = $_POST['do'] ?? null;
try {
if ($action === 'update_main') {
if (!hash_equals($_SESSION['csrf_token'] ?? '', $_POST['csrf'] ?? '')) throw new Exception('CSRF');
$pid = (int)($_POST['id'] ?? 0);
$url = trim($_POST['video'] ?? '');
$stmt = $pdo->prepare("UPDATE praticien SET video = :video WHERE id = :id");
$stmt->execute(['video' => ($url !== '' ? $url : null), 'id' => $pid]);
$flash = ['type'=>'success','msg'=>($translations['admin_video_flash_main_saved'] ?? 'Основное видео сохранено.')];
$_GET['id'] = $pid;
}
if ($action === 'add_extra') {
if (!hash_equals($_SESSION['csrf_token'] ?? '', $_POST['csrf'] ?? '')) throw new Exception('CSRF');
$pid = (int)($_POST['id'] ?? 0);
$url = trim($_POST['url'] ?? '');
$title = trim($_POST['title'] ?? '');
$ordre = (int)($_POST['ordre'] ?? 0);
if ($url === '') throw new Exception($translations['admin_video_err_url_required'] ?? 'Укажите URL');
$stmt = $pdo->prepare("INSERT INTO praticien_video (praticien_id, url, title, ordre) VALUES (?,?,?,?)");
$stmt->execute([$pid, $url, ($title !== '' ? $title : null), $ordre]);
$flash = ['type'=>'success','msg'=>($translations['admin_video_flash_added'] ?? 'Видео добавлено.')];
$_GET['id'] = $pid;
}
if ($action === 'update_extra') {
if (!hash_equals($_SESSION['csrf_token'] ?? '', $_POST['csrf'] ?? '')) throw new Exception('CSRF');
$pid = (int)($_POST['pid'] ?? 0);
$vid = (int)($_POST['vid'] ?? 0);
$url = trim($_POST['url'] ?? '');
$title = trim($_POST['title'] ?? '');
$ordre = (int)($_POST['ordre'] ?? 0);
if ($vid <= 0 || $url === '') throw new Exception($translations['admin_video_err_check_fields'] ?? 'Проверьте поля');
$stmt = $pdo->prepare("UPDATE praticien_video SET url=?, title=?, ordre=? WHERE id=?");
$stmt->execute([$url, ($title !== '' ? $title : null), $ordre, $vid]);
$flash = ['type'=>'success','msg'=>($translations['admin_video_flash_updated'] ?? 'Видео обновлено.')];
$_GET['id'] = $pid;
}
if ($action === 'delete_extra') {
if (!hash_equals($_SESSION['csrf_token'] ?? '', $_POST['csrf'] ?? '')) throw new Exception('CSRF');
$pid = (int)($_POST['pid'] ?? 0);
$vid = (int)($_POST['vid'] ?? 0);
if ($vid <= 0) throw new Exception($translations['admin_video_err_unknown_id'] ?? 'Неизвестный ID');
$stmt = $pdo->prepare("DELETE FROM praticien_video WHERE id=?");
$stmt->execute([$vid]);
$flash = ['type'=>'success','msg'=>($translations['admin_video_flash_deleted'] ?? 'Видео удалено.')];
$_GET['id'] = $pid;
}
} catch (Exception $ex) {
$flash = ['type'=>'danger','msg'=>($translations['err_prefixe'] ?? 'Ошибка: ') . $ex->getMessage()];
}
// ---- РЕЖИМ A: список всех практиков ----
if (empty($_GET['id'])) {
$rows = $pdo->query("
SELECT id, titre, nom, prenom, specialite, photo, video
FROM praticien
ORDER BY nom ASC, prenom ASC
")->fetchAll(PDO::FETCH_ASSOC);
?>
prepare("SELECT id, titre, nom, prenom, specialite, photo, video FROM praticien WHERE id=?");
$st->execute([$pid]);
$praticien = $st->fetch(PDO::FETCH_ASSOC);
if (!$praticien) {
echo '';
return;
}
$extras = $pdo->prepare("SELECT id, url, title, ordre, created_at FROM praticien_video WHERE praticien_id=? ORDER BY ordre ASC, id DESC");
$extras->execute([$pid]);
$videos = $extras->fetchAll(PDO::FETCH_ASSOC);
$name = trim($praticien['prenom'].' '.$praticien['nom']);
$photo = !empty($praticien['photo']) ? '/public/uploads/'.e($praticien['photo']) : '/public/uploads/img/user_placeholder.png';
?>