Algo correu mal. Tente novamente em instantes.
'; } exit(1); } // Required env vars — fail loud if any is missing. Hard-coded fallback creds // (especially `root` / `admin`) were a footgun: a missing .env would let the // app boot with the wrong identity instead of refusing to start. foreach (['DB_NAME', 'DB_USER'] as $req) { if (getenv($req) === false || getenv($req) === '') { _bootstrap_fail("required env var {$req} is not set"); } } if (getenv('DB_PASS') === false) { _bootstrap_fail('required env var DB_PASS is not set (empty string is allowed)'); } $host = env('DB_HOST', '127.0.0.1'); $port = (int) env('DB_PORT', 3306); $db = env('DB_NAME'); $user = env('DB_USER'); $pass = env('DB_PASS'); $dsn = "mysql:host=$host;port=$port;dbname=$db;charset=utf8mb4"; try { $pdo = new PDO($dsn, $user, $pass, [ PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION, // Real server-side prepares (not driver emulation): a tighter defence // against injection than emulated string-interpolation. Safe here — the // codebase uses positional ? params (no reused :named, no bound LIMIT). PDO::ATTR_EMULATE_PREPARES => false, // Keep values coming back as strings, as the emulated driver did, so the // type change from native prepares doesn't ripple through existing code. PDO::ATTR_STRINGIFY_FETCHES => true, ]); } catch (PDOException $e) { _bootstrap_fail('PDO connect failed: ' . $e->getMessage()); } // Distinct session cookie per app so installs that share a host (e.g. // development.andmore.pt/id.andmore.pt/ and /fitme3070.pt/) don't overwrite // each other's PHPSESSID. Must run before session_start(). // // Cookie e modo estrito definidos aqui, no código, para valerem em qualquer // servidor: antes o cookie saía só com path=/ (sem Secure, HttpOnly nem // SameSite) e o PHP aceitava IDs de sessão inventados pelo cliente. if (session_status() === PHP_SESSION_NONE) { ini_set('session.use_strict_mode', '1'); ini_set('session.use_only_cookies', '1'); ini_set('session.cookie_httponly', '1'); ini_set('session.cookie_samesite', 'Lax'); if (request_is_https()) ini_set('session.cookie_secure', '1'); session_name('FIT_SESS'); session_start(); }