cyla/admin.php

<?php
// debug :
ob_start();
ini_set('display_errors', 1);
error_reporting(E_ALL);

define('CYLA_CORE', true);
require_once 'core.php';

// Vérifions si des headers ont déjà été envoyés
if (headers_sent($filename, $linenum)) {
    exit("Headers already sent in $filename on line $linenum");
}

// Vérifier si l'utilisateur est connecté
if (!Cyla::isLoggedIn()) {
    header('Location: login.php');
    exit;
}

$error = $_GET['error'] ?? null;
$success = $_GET['success'] ?? null;

// Traitement du changement de mot de passe
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'change_password') {
    if (!isset($_POST['csrf_token']) || !Cyla::verifyCSRFToken($_POST['csrf_token'])) {
        $error = 'Token de sécurité invalide';
    } else {
        $current_password = $_POST['current_password'] ?? '';
        $new_password = $_POST['new_password'] ?? '';
        $confirm_password = $_POST['confirm_password'] ?? '';

        if (empty($current_password) || empty($new_password) || empty($confirm_password)) {
            $error = 'Tous les champs sont requis';
        } else if ($new_password !== $confirm_password) {
            $error = 'Les nouveaux mots de passe ne correspondent pas';
        } else {
            global $ADMIN_USERS;
            $username = $_SESSION['user'];
            $user = $ADMIN_USERS[$username];
            
            // Vérifier l'ancien mot de passe
            if (hash(HASH_ALGO, $current_password . $user['salt']) !== $user['password']) {
                $error = 'Mot de passe actuel incorrect';
            } else {
                // Mettre à jour le mot de passe
                $ADMIN_USERS[$username]['password'] = hash(HASH_ALGO, $new_password . $user['salt']);
                
                // Sauvegarder dans le fichier de configuration
                $config_content = file_get_contents('config.php');
                $config_content = preg_replace(
                    '/\'password\' => \'' . preg_quote($user['password'], '/') . '\'/',
                    '\'password\' => \'' . $ADMIN_USERS[$username]['password'] . '\'',
                    $config_content
                );
                file_put_contents('config.php', $config_content);
                
                $success = 'Mot de passe modifié avec succès';
            }
        }
    }
}

// Traitement de l'upload de fichier
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'upload') {
    if (!isset($_POST['csrf_token']) || !Cyla::verifyCSRFToken($_POST['csrf_token'])) {
        $error = 'Token de sécurité invalide';
    } else if (!isset($_FILES['file'])) {
        $error = 'Aucun fichier n\'a été envoyé';
    } else {
        $validation = Cyla::validateUpload($_FILES['file']);
        
        if (!$validation['valid']) {
            $error = $validation['error'];
        } else {
            $filename = Cyla::generateUniqueFilename($_FILES['file']['name']);
            $destination = UPLOAD_DIR . $filename;
            
            if (move_uploaded_file($_FILES['file']['tmp_name'], $destination)) {
                $success = 'Fichier uploadé avec succès';
            } else {
                $error = 'Erreur lors de l\'upload du fichier';
            }
        }
    }
}

// Liste des fichiers
$files = Cyla::listFiles();

// Contenu de la page
$pageTitle = 'Administration';
ob_start(); ?>

<div class="admin-container">
<div class="card">
        <h2>Téléversement de fichier</h2>
        
        <div class="upload-zone" id="uploadZone">
            <input type="file" id="fileInput" multiple class="file-input" name="files[]">
            <div class="upload-content">
                <div class="upload-icon">
                    <svg width="50" height="50" viewBox="0 0 24 24" fill="none" stroke="currentColor">
                        <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
                        <polyline points="17 8 12 3 7 8" />
                        <line x1="12" y1="3" x2="12" y2="15" />
                    </svg>
                </div>
                <p class="upload-text">
                    Glissez-déposez vos fichiers ici<br>
                    <span class="upload-text-sub">ou cliquez pour sélectionner</span>
                </p>
                <p class="upload-limit">
                    Taille maximale : 100 Mo<br>
                    Extensions : <?php echo implode(', ', ALLOWED_EXTENSIONS); ?>
                </p>
            </div>
        </div>

        <div id="fileList" class="file-list"></div>
    </div>

    <script>
        const uploadZone = document.getElementById('uploadZone');
        const fileInput = document.getElementById('fileInput');
        const fileList = document.getElementById('fileList');
        const maxFileSize = <?php echo MAX_FILE_SIZE; ?>;
        const allowedExtensions = <?php echo json_encode(ALLOWED_EXTENSIONS); ?>;

        // Gestion du drag & drop
        ['dragenter', 'dragover', 'dragleave', 'drop'].forEach(eventName => {
            uploadZone.addEventListener(eventName, preventDefaults, false);
            document.body.addEventListener(eventName, preventDefaults, false);
        });

        function preventDefaults(e) {
            e.preventDefault();
            e.stopPropagation();
        }

        ['dragenter', 'dragover'].forEach(eventName => {
            uploadZone.addEventListener(eventName, highlight, false);
        });

        ['dragleave', 'drop'].forEach(eventName => {
            uploadZone.addEventListener(eventName, unhighlight, false);
        });

        function highlight(e) {
            uploadZone.classList.add('upload-zone-active');
        }

        function unhighlight(e) {
            uploadZone.classList.remove('upload-zone-active');
        }

        // Gestion du drop
        uploadZone.addEventListener('drop', handleDrop, false);
        fileInput.addEventListener('change', handleFiles, false);
        uploadZone.addEventListener('click', () => fileInput.click());

        function handleDrop(e) {
            const dt = e.dataTransfer;
            const files = dt.files;
            handleFiles({ target: { files: files } });
        }

        function isValidFile(file) {
            const ext = file.name.split('.').pop().toLowerCase();
            if (!allowedExtensions.includes(ext)) {
                return { valid: false, error: `Extension .${ext} non autorisée` };
            }
            if (file.size > maxFileSize) {
                return { valid: false, error: 'Fichier trop volumineux (max 100 Mo)' };
            }
            return { valid: true };
        }

        function handleFiles(e) {
            const files = Array.from(e.target.files);
            
            // Vider la liste précédente
            fileList.innerHTML = '';
            
            files.forEach(file => {
                const validation = isValidFile(file);
                const fileElement = createFileElement(file, validation);
                fileList.appendChild(fileElement);
                
                if (validation.valid) {
                    uploadFile(file, fileElement);
                }
            });
        }

        function createFileElement(file, validation) {
            const div = document.createElement('div');
            div.className = 'file-item ' + (validation.valid ? '' : 'file-item-error');
            
            div.innerHTML = `
                <div class="file-item-content">
                    <div class="file-item-name">${file.name}</div>
                    <div class="file-item-size">${(file.size / 1024 / 1024).toFixed(2)} Mo</div>
                    ${validation.valid ? 
                        '<div class="file-item-progress"><div class="progress-bar"></div></div>' : 
                        `<div class="file-item-error-message">${validation.error}</div>`
                    }
                </div>
            `;
            
            return div;
        }

        async function uploadFile(file, element) {
            const formData = new FormData();
            formData.append('file', file);
            formData.append('csrf_token', '<?php echo Cyla::generateCSRFToken(); ?>');
            
            try {
                const response = await fetch('api.php', {
                    method: 'POST',
                    body: formData
                });

                if (!response.ok) {
                    throw new Error('Erreur lors de l\'upload');
                }

                const result = await response.json();
                
                if (result.success) {
                    element.classList.add('file-item-success');
                } else {
                    element.classList.add('file-item-error');
                }
            } catch (error) {
                element.classList.add('file-item-error');
                console.error('Error:', error);
            }
        }
    </script>

    <div class="card">
        <h2>Changer le mot de passe</h2>
        <form method="POST" class="password-form">
            <input type="hidden" name="csrf_token" value="<?php echo Cyla::generateCSRFToken(); ?>">
            <input type="hidden" name="action" value="change_password">
            
            <div class="form-group">
                <label for="current_password">Mot de passe actuel</label>
                <input type="password" id="current_password" name="current_password" required>
            </div>
            
            <div class="form-group">
                <label for="new_password">Nouveau mot de passe</label>
                <input type="password" id="new_password" name="new_password" required>
            </div>
            
            <div class="form-group">
                <label for="confirm_password">Confirmer le nouveau mot de passe</label>
                <input type="password" id="confirm_password" name="confirm_password" required>
            </div>
            
            <button type="submit" class="btn">Changer le mot de passe</button>
        </form>
    </div>

    <div class="card">
        <h2>Fichiers hébergés</h2>
        <?php if (empty($files)): ?>
            <p class="text-muted">Aucun fichier hébergé</p>
        <?php else: ?>
            <div class="file-list">
                <?php foreach ($files as $file): ?>
                    <div class="file-item">
                        <div class="file-preview">
                            <?php if ($file['preview_type'] === 'image'): ?>
                                <img src="fichiers/<?php echo Cyla::escape($file['name']); ?>" alt="<?php echo Cyla::escape($file['name']); ?>">
                            <?php else: ?>
                                <div class="preview-placeholder">
                                    <?php echo strtoupper($file['extension']); ?>
                                </div>
                            <?php endif; ?>
                        </div>
                        
                        <div class="file-info">
                            <p class="file-name"><?php echo Cyla::escape($file['name']); ?></p>
                            <p class="file-meta">
                                <?php echo Cyla::escape(round($file['size'] / 1024, 2)); ?> Ko
                                · <?php echo date('d/m/Y H:i', $file['uploaded']); ?>
                            </p>
                            <div class="file-actions">
                                <a href="share.php?file=<?php echo urlencode($file['name']); ?>" class="btn btn-secondary" target="_blank">Voir</a>
                                <button class="btn" onclick="copyShareLink('<?php echo SITE_URL; ?>share.php?file=<?php echo urlencode($file['name']); ?>')">Copier le lien</button>
                            </div>
                        </div>
                    </div>
                <?php endforeach; ?>
            </div>
        <?php endif; ?>
    </div>
</div>

<style>
/* Styles spécifiques à la page d'administration */
.admin-container {
    display: flex;
    flex-direction: column;
    gap: var(--spacing-lg);
}

.admin-container h2 {
    color: var(--color-primary);
    margin-bottom: var(--spacing-md);
}

.help-text {
    font-size: 0.9rem;
    color: var(--color-text-muted);
    margin-top: var(--spacing-xs);
}

.preview-placeholder {
    width: 100%;
    height: 100%;
    display: flex;
    align-items: center;
    justify-content: center;
    background-color: var(--color-bg);
    color: var(--color-text-muted);
    font-size: 2rem;
    font-weight: bold;
}

.file-name {
    font-weight: bold;
    word-break: break-all;
}

.file-meta {
    font-size: 0.9rem;
    color: var(--color-text-muted);
    margin: var(--spacing-xs) 0;
}

.file-actions {
    display: flex;
    gap: var(--spacing-sm);
    margin-top: var(--spacing-sm);
}
</style>

<script>
// Fonction pour copier le lien de partage
function copyShareLink(url) {
    navigator.clipboard.writeText(url).then(() => {
        alert('Lien copié dans le presse-papier');
    }).catch(err => {
        console.error('Erreur lors de la copie :', err);
        alert('Erreur lors de la copie du lien');
    });
}
</script>

<?php
$content = ob_get_clean();
require 'layout.php';
ob_end_flush();