29 lines
1.3 KiB
PHP
29 lines
1.3 KiB
PHP
<?php
|
||
// Charge les scripts de tracking uniquement pour des pages HTML vues en GET.
|
||
// → Pas d’injection sur API/AJAX/assets/callbacks.
|
||
if (PHP_SAPI === 'cli') {
|
||
return;
|
||
}
|
||
|
||
$uri = $_SERVER['REQUEST_URI'] ?? '';
|
||
$accept = $_SERVER['HTTP_ACCEPT'] ?? '';
|
||
$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
|
||
$xrw = $_SERVER['HTTP_X_REQUESTED_WITH'] ?? '';
|
||
|
||
$isGet = strcasecmp($method, 'GET') === 0;
|
||
$wantsHtml = (stripos($accept, 'text/html') !== false) || ($accept === '');
|
||
$wantsJson = stripos($accept, 'application/json') !== false;
|
||
|
||
$isAjax = strcasecmp($xrw, 'XMLHttpRequest') === 0;
|
||
$isApi = preg_match('~/(api/|messages/api/|webhook|callback|notify)~i', $uri);
|
||
$isAsset = preg_match('~\.(css|js|map|png|jpe?g|gif|svg|webp|ico|json|xml|txt|pdf|woff2?|ttf|eot|mp4|webm)(\?|$)~i', $uri);
|
||
$isMatomo = stripos($uri, '/matomo/') !== false;
|
||
$isRdv = preg_match('~/(valider_rdv\.php|confirmer_rdv\.php|rdv/)~i', $uri);
|
||
|
||
if ($isGet && $wantsHtml && ! $wantsJson && ! $isAjax && ! $isApi && ! $isAsset && ! $isMatomo && ! $isRdv) {
|
||
// 100% externe (pas d’inline) → compatible CSP 'self' + domaines autorisés
|
||
echo '<script src="/js/tracking.js" defer></script>';
|
||
// Pixel noscript Matomo (ok même sans JS)
|
||
//echo '<noscript><p><img src="https://staging.uslugi.fr/matomo/matomo.php?idsite=1&rec=1" style="border:0" alt=""></p></noscript>';
|
||
}
|