<?php
// +-------------------------------------------------+
// © 2002-2004 PMB Services / www.sigb.net pmb@sigb.net et contributeurs (voir www.sigb.net)
// +-------------------------------------------------+
// $Id: emergency_upload.php,v 1.8.8.1 2026/03/17 13:47:13 qvarin Exp $

//Restauration d'urgence
session_start();
@set_time_limit(1200);

require_once './messages_env_ract.inc.php';
require_once '../lib/api.inc.php';
require_once '../lib/database_parser.class.php';
require_once '../lib/upload_file.class.php';

$databaseParser = new DatabaseParser();
$databases = $databaseParser->parse(file_get_contents('../../../includes/db_param.inc.php'));

$database = $_POST['database'] ?? null;
$secret_database = $_POST['secret_database'] ?? null;

if (empty($databases[$database]) || !is_string($database)) {
    http_response_code(403);
    abort_critical(mb_convert_encoding($msg['sauv_misc_ract_invalid_database'], 'UTF-8', 'ISO-8859-1'));
    exit();
}

if (empty(trim($databases[$database][DatabaseParser::DATABASE_SECRET]))) {
    http_response_code(403);
    abort_critical(mb_convert_encoding($msg['sauv_misc_ract_emergency_disable'], 'UTF-8', 'ISO-8859-1'));
    exit();
}

$salt = hex2bin(random_bytes(36));
if (
    empty($secret_database) ||
    !is_string($secret_database) ||
    // Ici, on utilise un hash_equals pour eviter une attaque de type "Timing attack on hash comparison"
    // Merci de ne pas mettre de "==" ou de "===" à la place
    !hash_equals(
        hash_hmac('sha256', $databases[$database][DatabaseParser::DATABASE_SECRET], $salt),
        hash_hmac('sha256', $secret_database, $salt)
    )
) {
    http_response_code(403);
    abort_critical(mb_convert_encoding($msg['sauv_misc_ract_emergency_invalid_secret'], 'UTF-8', 'ISO-8859-1'));
    exit();
}

try {
    $uploadFile = new UploadFile('archive_file');

    $infos = read_infos($uploadFile->getTmpName());
    if (!empty($infos['error'])) {
        @unlink($uploadFile->getTmpName());
        abort_critical(mb_convert_encoding($msg['sauv_misc_ract_no_sauv'], 'UTF-8', 'ISO-8859-1'));
        exit();
    }

    if ($infos['Compress'] && $infos['compress_type'] !== 'internal') {
        @unlink($uploadFile->getTmpName());
        abort_critical(mb_convert_encoding($msg['sauv_misc_ract_invalid_compress'], 'UTF-8', 'ISO-8859-1'));
        exit();
    }

    $uploadFile->generateFilename('emergency_upload_');
    if (!$uploadFile->copy('../../backup/backups/')) {
        @unlink($uploadFile->getTmpName());
        abort_critical(mb_convert_encoding($msg['sauv_misc_ract_backups_dir_not_writeable'], 'UTF-8', 'ISO-8859-1'));
        exit();
    }

    $_SESSION['emergency'] = [
        'critical' => true,
        'database' => $database,
        'filename' => $uploadFile->filename,
        'original_name' => $uploadFile->getName(),
    ];

} catch (\InvalidArgumentException $e) {
    http_response_code(400);
    abort_critical(mb_convert_encoding($msg['sauv_misc_ract_no_sauv'], 'UTF-8', 'ISO-8859-1'));
    exit();
}


?>
<script>
    document.location = "../restaure.php";
</script>