This commit is contained in:
Esteban
2026-07-03 02:02:13 +02:00
parent 88c10ee5b0
commit a19c5c8381
42 changed files with 578 additions and 129 deletions
+6 -4
View File
@@ -6,10 +6,12 @@
require_once('../functions/databaseConnection.php');
// Liste blanche des types autorisés : empêche toute injection de nom de table
// (le PDF est stocké dans une table associée depuis la migration Juillet 2026 (6),
// pour ne plus jamais charger son contenu binaire lors des listes de projets/xp/écoles)
$tables = [
'projet' => 'projects',
'experience' => 'experiences',
'ecole' => 'schools',
'projet' => ['pdf' => 'project_pdfs', 'colonne' => 'project_id'],
'experience' => ['pdf' => 'experience_pdfs', 'colonne' => 'experience_id'],
'ecole' => ['pdf' => 'school_pdfs', 'colonne' => 'school_id'],
];
$type = $_GET['type'] ?? '';
@@ -21,7 +23,7 @@ if (!isset($tables[$type]) || !is_numeric($id)) {
}
try {
$stmt = $dbh->prepare('SELECT pdf_data, pdf_filename FROM `' . $tables[$type] . '` WHERE id = :id');
$stmt = $dbh->prepare('SELECT pdf_data, pdf_filename FROM `' . $tables[$type]['pdf'] . '` WHERE `' . $tables[$type]['colonne'] . '` = :id');
$stmt->bindValue(':id', (int) $id, PDO::PARAM_INT);
$stmt->execute();
$row = $stmt->fetch(PDO::FETCH_ASSOC);