streaper2/afrov2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

correction faille de securité
All checks were successful
Build and Push App / build (push) Successful in 5m50s
Details

Browse Source
This commit is contained in:
streaper2
2026-05-01 21:48:00 +02:00
parent 9c003d1b7d
commit f450f8ee03
10 changed files with 78 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
app/annuaire/[id]/page.tsx
View File

@@ -77,7 +77,9 @@ const BusinessDetailPage = () => {
// 2. Try API (Database)
try {
const res = await fetch(`/api/businesses/${id}`);
const res = await fetch(`/api/businesses/${id}`, {
headers: user ? { 'x-user-id': user.id } : {}
});
if (res.ok) {
const data = await res.json();
setBusiness(data);
@@ -104,7 +106,10 @@ const BusinessDetailPage = () => {
}
// Also increment views count in DB (Legacy support)
fetch(`/api/businesses/${id}/view`, { method: 'POST' }).catch(console.error);
fetch(`/api/businesses/${id}/view`, {
method: 'POST',
headers: user ? { 'x-user-id': user.id } : {}
}).catch(console.error);
} else {
setBusiness(null);
}
@@ -135,7 +140,9 @@ const BusinessDetailPage = () => {
// 5. Fetch all ratings
try {
setLoadingRatings(true);
const ratingsRes = await fetch(`/api/businesses/${id}/ratings`);
const ratingsRes = await fetch(`/api/businesses/${id}/ratings`, {
headers: user ? { 'x-user-id': user.id } : {}
});
if (ratingsRes.ok) {
const ratingsData = await ratingsRes.json();
setRatings(ratingsData);

11
app/annuaire/page.tsx
View File

@@ -7,8 +7,10 @@ import { Search, Loader2 } from 'lucide-react';
import { Business, Country } from '../../types';
import BusinessCard from '../../components/BusinessCard';
import AnnuaireHero from '../../components/AnnuaireHero';
import { useUser } from '../../components/UserProvider';
const AnnuairePageContent = () => {
const { user } = useUser();
const [businesses, setBusinesses] = useState<Business[]>([]);
const [featuredBusiness, setFeaturedBusiness] = useState<Business | null>(null);
const [countries, setCountries] = useState<Country[]>([]);
@@ -41,7 +43,10 @@ const AnnuairePageContent = () => {
const fetchHeadliner = async () => {
try {
// Disable caching to ensure we get fresh data and more variety
const res = await fetch('/api/businesses?featured=true', { cache: 'no-store' });
const res = await fetch('/api/businesses?featured=true', {
cache: 'no-store',
headers: user ? { 'x-user-id': user.id } : {}
});
const data = await res.json();
if (Array.isArray(data) && data.length > 0) {
// Truly random selection from the pool of featured businesses
@@ -65,7 +70,9 @@ const AnnuairePageContent = () => {
if (filterCountry !== 'All') params.append('countryId', filterCountry);
if (searchQuery) params.append('q', searchQuery);
const res = await fetch(`/api/businesses?${params.toString()}`);
const res = await fetch(`/api/businesses?${params.toString()}`, {
headers: user ? { 'x-user-id': user.id } : {}
});
const data = await res.json();
if (Array.isArray(data)) {
setBusinesses(data);

17
app/api/businesses/[id]/route.ts
View File

@@ -1,15 +1,20 @@
import { NextRequest, NextResponse } from 'next/server'
import prisma from '@/lib/prisma'
import { USER_SAFE_SELECT } from '@/lib/auth-utils'
import { USER_SAFE_SELECT, getAuthUser } from '@/lib/auth-utils'
type Params = { params: Promise<{ id: string }> }
// GET /api/businesses/[id]
export async function GET(
_request: NextRequest,
request: NextRequest,
context: { params: Promise<{ id: string }> }
): Promise<Response> {
try {
const user = await getAuthUser(request)
if (!user) {
return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
}
const { id } = await context.params
const business = await prisma.business.findFirst({
where: {
@@ -26,7 +31,13 @@ export async function GET(
},
})
if (!business) return NextResponse.json({ error: 'Non trouvé' }, { status: 404 })
return NextResponse.json(business)
// Mask technical IDs
const { id: bizId, ownerId, ...rest } = business
return NextResponse.json({
...rest,
id: business.slug || bizId
})
} catch (error) {
console.error('GET /api/businesses/[id] error:', error)
return NextResponse.json({ error: 'Erreur serveur' }, { status: 500 })

21
app/api/businesses/route.ts
View File

@@ -1,10 +1,15 @@
import { NextRequest, NextResponse } from 'next/server'
import prisma from '@/lib/prisma'
import { USER_SAFE_SELECT } from '@/lib/auth-utils'
import { USER_SAFE_SELECT, getAuthUser } from '@/lib/auth-utils'
// GET /api/businesses — List all businesses (Mock + DB)
export async function GET(request: NextRequest) {
try {
const user = await getAuthUser(request)
if (!user) {
return NextResponse.json({ error: 'Authentification requise' }, { status: 401 })
}
const { searchParams } = new URL(request.url)
const category = searchParams.get('category')
const q = searchParams.get('q')?.toLowerCase()
@@ -52,8 +57,18 @@ export async function GET(request: NextRequest) {
orderBy: { createdAt: 'desc' },
})
// 2. Return DB results
return NextResponse.json(dbBusinesses)
// 2. Map results to mask technical IDs
const safeBusinesses = dbBusinesses.map(biz => {
const { id, ownerId, ...rest } = biz
return {
...rest,
// Return slug as the primary identifier if available,
// otherwise return a masked version or keep it but it's now "safe"
id: biz.slug || id
}
})
return NextResponse.json(safeBusinesses)
} catch (error) {
console.error('GET /api/businesses error:', error)
return NextResponse.json({ error: 'Erreur serveur' }, { status: 500 })

21
app/api/favorites/route.ts
View File

@@ -43,12 +43,29 @@ export async function POST(request: NextRequest) {
return NextResponse.json({ error: 'businessId requis' }, { status: 400 });
}
// Resolve business ID (in case slug was passed)
const business = await prisma.business.findFirst({
where: {
OR: [
{ id: businessId },
{ slug: businessId }
]
},
select: { id: true }
});
if (!business) {
return NextResponse.json({ error: 'Entreprise non trouvée' }, { status: 404 });
}
const actualBusinessId = business.id;
// Check if already favorited
const existing = await prisma.favorite.findUnique({
where: {
userId_businessId: {
userId,
businessId
businessId: actualBusinessId
}
}
});
@@ -64,7 +81,7 @@ export async function POST(request: NextRequest) {
await prisma.favorite.create({
data: {
userId,
businessId
businessId: actualBusinessId
}
});
return NextResponse.json({ favorited: true });

2
app/forgot-password/page.tsx
View File

@@ -72,7 +72,7 @@ const ForgotPasswordPage = () => {
</div>
</div>
) : (
<form className="mt-8 space-y-6" onSubmit={handleSubmit}>
<form className="mt-8 space-y-6" onSubmit={handleSubmit} method="POST">
<input type="hidden" name="csrf_token" value={csrfToken} />
{error && (
<div className="bg-red-50 border-l-4 border-red-500 p-4 rounded text-red-700 text-sm">

2
app/login/page.tsx
View File

@@ -145,7 +145,7 @@ const LoginPage = () => {
</div>
)}
<form className="space-y-6" onSubmit={handleSubmit}>
<form className="space-y-6" onSubmit={handleSubmit} method="POST">
<input type="hidden" name="csrf_token" value={csrfToken} />
<div className="rounded-md shadow-sm -space-y-px">
<div>

6
app/page.tsx
View File

@@ -11,7 +11,7 @@ import { useUser } from '../components/UserProvider';
const HomePage = () => {
const router = useRouter();
const { settings } = useUser();
const { user, settings } = useUser();
const [searchTerm, setSearchTerm] = useState('');
const [featuredBusinesses, setFeaturedBusinesses] = useState<Business[]>([]);
const [posts, setPosts] = useState<BlogPost[]>([]);
@@ -22,7 +22,9 @@ const HomePage = () => {
useEffect(() => {
const fetchFeatured = async () => {
try {
const res = await fetch('/api/businesses?featured=true');
const res = await fetch('/api/businesses?featured=true', {
headers: user ? { 'x-user-id': user.id } : {}
});
const data = await res.json();
if (Array.isArray(data)) {
setFeaturedBusinesses(data.slice(0, 4)); // Show top 4

2
app/register/page.tsx
View File

@@ -98,7 +98,7 @@ const RegisterPage = () => {
<p className="text-gray-600">Redirection vers la page de connexion...</p>
</div>
) : (
<form className="space-y-6" onSubmit={handleSubmit}>
<form className="space-y-6" onSubmit={handleSubmit} method="POST">
<input type="hidden" name="csrf_token" value={csrfToken} />
{error && (
<div className="bg-red-50 border-l-4 border-red-500 p-4 rounded-r-lg flex items-center gap-3 text-red-700 animate-in slide-in-from-top-2 duration-300">

2
app/reset-password/page.tsx
View File

@@ -95,7 +95,7 @@ const ResetPasswordForm = () => {
<p className="mt-2">Redirection vers la page de connexion...</p>
</div>
) : (
<form className="mt-8 space-y-6" onSubmit={handleSubmit}>
<form className="mt-8 space-y-6" onSubmit={handleSubmit} method="POST">
<input type="hidden" name="csrf_token" value={csrfToken} />
{error && (
<div className="bg-red-50 border-l-4 border-red-500 p-4 rounded text-red-700 text-sm">