From 35415429e596da769e84315e692bb7e1ca57cde3 Mon Sep 17 00:00:00 2001 From: andre Date: Fri, 25 Sep 2026 12:25:40 +0100 Subject: [PATCH] =?UTF-8?q?fix(platform-tools):=20renomeia=20$user=20em=20?= =?UTF-8?q?config/db.php=20para=20n=C3=A3o=20colidir=20com=20o=20router?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit O router (platform.php) requer config/db.php e as páginas partilhadas no mesmo âmbito plano, sem função a separar — o $user = env('DB_USER') (a string do utilizador da BD) ficava visível mais tarde em includes/header.php, que só substitui $user quando está vazio ($user ?? current_user() ?? …). O utilizador de sessão nunca entrava, e $user['role'] rebentava com TypeError "Cannot access offset of type string on string" em todas as páginas de sistema (Backups, Auditoria, Actualizações, IP bans, Origem das visitas) — só a Geo escapava por não usar esse layout. Confirmado em logs/php_errors.jsonl em produção. Co-Authored-By: Claude Sonnet 5 --- config/db.php | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/config/db.php b/config/db.php index 176b605..7776411 100644 --- a/config/db.php +++ b/config/db.php @@ -40,16 +40,19 @@ if (getenv('DB_PASS') === false) { _bootstrap_fail('required env var DB_PASS is not set (empty string is allowed)'); } -$host = env('DB_HOST', '127.0.0.1'); -$port = (int) env('DB_PORT', 3306); -$db = env('DB_NAME'); -$user = env('DB_USER'); -$pass = env('DB_PASS'); +$host = env('DB_HOST', '127.0.0.1'); +$port = (int) env('DB_PORT', 3306); +$db = env('DB_NAME'); +// Not $user: that name leaks into the router's flat include scope (router.php +// requires this file at top level, no function wrapper) and would shadow the +// real logged-in user array that includes/header.php expects. +$dbUser = env('DB_USER'); +$pass = env('DB_PASS'); $dsn = "mysql:host=$host;port=$port;dbname=$db;charset=utf8mb4"; try { - $pdo = new PDO($dsn, $user, $pass, [ + $pdo = new PDO($dsn, $dbUser, $pass, [ PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, // Real server-side prepares (not driver emulation): a tighter defence // against injection than emulated string-interpolation. Safe here — the