From f56ba7e3c8c09e3b2d6edee2e897ea17b1a908c2 Mon Sep 17 00:00:00 2001
From: Florian Sylvain <floriansylvainpro@gmail.com>
Date: Fri, 24 Sep 2021 22:37:00 +0200
Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F=20Improved=20and=20fixed?=
 =?UTF-8?q?=20security=20issues=20by=20adding=20.env=20file=20for=20DB=20c?=
 =?UTF-8?q?onnection=20and=20loading=20class.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .gitignore                     |  1 +
 ProjetProgWeb/class/conf.php   | 10 +++-----
 ProjetProgWeb/class/dotEnv.php | 46 ++++++++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+), 6 deletions(-)
 create mode 100644 .gitignore
 create mode 100644 ProjetProgWeb/class/dotEnv.php

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..3f2acdf
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+/ProjetProgWeb/env.php
diff --git a/ProjetProgWeb/class/conf.php b/ProjetProgWeb/class/conf.php
index 0e7448a..d6ad5da 100644
--- a/ProjetProgWeb/class/conf.php
+++ b/ProjetProgWeb/class/conf.php
@@ -1,15 +1,13 @@
 <?php
 
+require_once('dotEnv.php');
+(new DotEnv(__DIR__ . '/../.env'))->load();
+
 class conf
 {
     private pdo $pdo;
 
-    public function __construct()
-    {
-        $this->pdo = new PDO('mysql:host=localhost;dbname=projet_prog_web', 'root', 'root');
-    }
-
     public function getPDO() : pdo {
-        return $this->pdo;
+        return new PDO('mysql:host=localhost;dbname=' . getenv('DBNAME'), getenv('USERNAME'), getenv('PASSWORD'));
     }
 }
\ No newline at end of file
diff --git a/ProjetProgWeb/class/dotEnv.php b/ProjetProgWeb/class/dotEnv.php
new file mode 100644
index 0000000..073bb38
--- /dev/null
+++ b/ProjetProgWeb/class/dotEnv.php
@@ -0,0 +1,46 @@
+<?php
+
+// Since I don't know atm if I am allowed to use external libs like dotenv, I used this piece of code to load .env file.
+// Link : https://dev.to/fadymr/php-create-your-own-php-dotenv-3k2i
+// Author : F.R Michel
+class dotEnv
+{
+    /**
+     * The directory where the .env file can be located.
+     * @var string
+     */
+    protected string $path;
+
+    public function __construct(string $path)
+    {
+        if(!file_exists($path)) {
+            throw new \InvalidArgumentException(sprintf('%s does not exist', $path));
+        }
+        $this->path = $path;
+    }
+
+    public function load() :void
+    {
+        if (!is_readable($this->path)) {
+            throw new \RuntimeException(sprintf('%s file is not readable', $this->path));
+        }
+
+        $lines = file($this->path, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
+        foreach ($lines as $line) {
+
+            if (strpos(trim($line), '#') === 0) {
+                continue;
+            }
+
+            list($name, $value) = explode('=', $line, 2);
+            $name = trim($name);
+            $value = trim($value);
+
+            if (!array_key_exists($name, $_SERVER) && !array_key_exists($name, $_ENV)) {
+                putenv(sprintf('%s=%s', $name, $value));
+                $_ENV[$name] = $value;
+                $_SERVER[$name] = $value;
+            }
+        }
+    }
+}
\ No newline at end of file