From 2d4f609562d7252d7e715042d73161c8b4079233 Mon Sep 17 00:00:00 2001
From: Kyllian Auguste <tezcat.auguste@gmail.com>
Date: Mon, 18 May 2026 00:37:51 +0200
Subject: [PATCH] fix path for cybersecurity issues

fix path in admin.php & add to config.php mdp to connect to panel admin ( config.php is not commited )
---
 www/admin.php | 12 +++++++-----
 www/api.php   |  2 +-
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/www/admin.php b/www/admin.php
index 24c0146..2970901 100755
--- a/www/admin.php
+++ b/www/admin.php
@@ -2,9 +2,11 @@
 /* --- SESSION & AUTHENTICATION --- */
 session_start();
 
+$config = require_once './config.php';
+
 $error = '';
 if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'login') {
-    if ($_POST['username'] === 'admin' && $_POST['password'] === 'admin') {
+    if ($_POST['username'] === $config['admin_user'] && $_POST['password'] === $config['admin_pass']) {
         $_SESSION['admin_logged_in'] = true;
         header('Location: admin.php');
         exit;
@@ -20,10 +22,10 @@ if (isset($_GET['logout'])) {
 }
 
 /* --- DATABASE CONFIGURATION --- */
-$host = 'mysql-openplanetsmaps.alwaysdata.net';
-$dbname = 'openplanetsmaps_bdd';
-$db_user = 'openplanetsmaps_root';
-$db_pass = 'ka041006';
+$host = $config['host'];
+$dbname = $config['dbname'];
+$db_user = $config['username'];
+$db_pass = $config['password'];
 
 $message = '';
 /* --- FORM PROCESSING & DB INSERTION --- */
diff --git a/www/api.php b/www/api.php
index 040bff4..8d1704d 100755
--- a/www/api.php
+++ b/www/api.php
@@ -2,7 +2,7 @@
 header('Content-Type: application/json');
 
 /* --- CONFIGURATION & SETUP --- */
-$config = require_once __DIR__ . '/config.php';
+$config = require_once 'config.php';
 $host = $config['host'];
 $dbname = $config['dbname'];
 $username = $config['username'];