73 lines
3.1 KiB
PHP
73 lines
3.1 KiB
PHP
<?php
|
|
require_once __DIR__ . '/env.php';
|
|
env_load(__DIR__ . '/../.env');
|
|
|
|
// The legacy CI4 front controller ran from the web root, so some ported view
|
|
// partials use root-relative paths (e.g. gallery's glob('uploads/gallery/...')).
|
|
// Pin the CWD to the project root so those keep resolving regardless of which
|
|
// script Apache invoked.
|
|
@chdir(dirname(__DIR__));
|
|
|
|
// ─── Bootstrap failure helper ────────────────────────────────────────────────
|
|
// Renders a generic 500 page. Never echoes exception details — they often
|
|
// contain the host:port, DB name, and (worst case) credentials. Real details
|
|
// land in logs/db_error.log; the page just says "something went wrong".
|
|
function _bootstrap_fail(string $logMsg): void {
|
|
@mkdir(__DIR__ . '/../logs', 0775, true);
|
|
@error_log('[' . date('c') . '] ' . $logMsg . "\n", 3, __DIR__ . '/../logs/db_error.log');
|
|
error_log('[fotografia bootstrap] ' . $logMsg);
|
|
http_response_code(500);
|
|
header('Content-Type: text/html; charset=utf-8');
|
|
$tpl = __DIR__ . '/../templates/error_500.php';
|
|
if (is_file($tpl)) {
|
|
require $tpl;
|
|
} else {
|
|
echo '<!doctype html><meta charset="utf-8"><title>Erro</title>'
|
|
. '<p style="font-family:sans-serif;text-align:center;margin:80px auto;">Algo correu mal. Tente novamente em instantes.</p>';
|
|
}
|
|
exit(1);
|
|
}
|
|
|
|
// Required env vars — fail loud if any is missing. Hard-coded fallback creds
|
|
// (especially `root` / `admin`) were a footgun: a missing .env would let the
|
|
// app boot with the wrong identity instead of refusing to start.
|
|
foreach (['DB_NAME', 'DB_USER'] as $req) {
|
|
if (getenv($req) === false || getenv($req) === '') {
|
|
_bootstrap_fail("required env var {$req} is not set");
|
|
}
|
|
}
|
|
if (getenv('DB_PASS') === false) {
|
|
_bootstrap_fail('required env var DB_PASS is not set (empty string is allowed)');
|
|
}
|
|
|
|
$host = env('DB_HOST', '127.0.0.1');
|
|
$port = (int) env('DB_PORT', 3306);
|
|
$db = env('DB_NAME');
|
|
$user = env('DB_USER');
|
|
$pass = env('DB_PASS');
|
|
|
|
$dsn = "mysql:host=$host;port=$port;dbname=$db;charset=utf8mb4";
|
|
|
|
try {
|
|
$pdo = new PDO($dsn, $user, $pass, [
|
|
PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
|
|
// Real server-side prepares (not driver emulation): a tighter defence
|
|
// against injection than emulated string-interpolation. Safe here — the
|
|
// codebase uses positional ? params (no reused :named, no bound LIMIT).
|
|
PDO::ATTR_EMULATE_PREPARES => false,
|
|
// Keep values coming back as strings, as the emulated driver did, so the
|
|
// type change from native prepares doesn't ripple through existing code.
|
|
PDO::ATTR_STRINGIFY_FETCHES => true,
|
|
]);
|
|
} catch (PDOException $e) {
|
|
_bootstrap_fail('PDO connect failed: ' . $e->getMessage());
|
|
}
|
|
|
|
// Distinct session cookie per app so installs that share a host (e.g.
|
|
// development.andmore.pt/id.andmore.pt/ and /fitme3070.pt/) don't overwrite
|
|
// each other's PHPSESSID. Must run before session_start().
|
|
if (session_status() === PHP_SESSION_NONE) {
|
|
session_name('FIT_SESS');
|
|
session_start();
|
|
}
|