Added doc

src/Controllers/PostController.php

@@ -9,6 +9,9 @@ use Psr\Http\Message\ServerRequestInterface as Request;
 use Slim\Views\Twig;
 use App\Repositories\PostRepositoryMedoo as PostRepository;
 
+/**
+ * Contrôleur pour les posts.
+ */
 class PostController
 {
     private Twig $view;
@@ -20,18 +23,40 @@ class PostController
         $this->repo  = $repo;
     }
 
+    /**
+     * Affiche la page d'accueil avec la liste des posts.
+     *
+     * @param Request  $req
+     * @param Response $res
+     * @return Response
+     */
     public function index(Request $req, Response $res): Response
     {
         $posts = $this->repo->allDesc();
         return $this->view->render($res, 'pages/home.twig', ['posts' => $posts]);
     }
 
+    /**
+     * Affiche la page d'administration.
+     *
+     * @param Request  $req
+     * @param Response $res
+     * @return Response
+     */
     public function admin(Request $req, Response $res): Response
     {
         $posts = $this->repo->allDesc();
         return $this->view->render($res, 'pages/admin.twig', ['posts' => $posts]);
     }
 
+    /**
+     * Formulaire de création / édition.
+     *
+     * @param Request $req
+     * @param Response $res
+     * @param array   $args
+     * @return Response
+     */
     public function form(Request $req, Response $res, array $args): Response
     {
         $id = (int)($args['id'] ?? 0);
@@ -40,23 +65,74 @@ class PostController
         return $this->view->render($res, 'pages/post_form.twig', ['post' => $post, 'action' => $action]);
     }
 
+    /**
+     * Crée un nouvel article.
+     *
+     * @param Request  $req
+     * @param Response $res
+     * @return Response
+     */
     public function create(Request $req, Response $res): Response
     {
-        $data = $req->getParsedBody();
+        $data = $this->sanitize($req->getParsedBody());
         $this->repo->create($data);
         return $res->withHeader('Location', '/admin')->withStatus(302);
     }
 
+    /**
+     * Met à jour un article existant.
+     *
+     * @param Request $req
+     * @param Response $res
+     * @param array   $args
+     * @return Response
+     */
     public function update(Request $req, Response $res, array $args): Response
     {
         $id = (int)$args['id'];
-        $this->repo->update($id, $req->getParsedBody());
+        $data = $this->sanitize($req->getParsedBody());
+        $this->repo->update($id, $data);
         return $res->withHeader('Location', '/admin')->withStatus(302);
     }
 
+    /**
+     * Supprime un article.
+     *
+     * @param Request $req
+     * @param Response $res
+     * @param array   $args
+     * @return Response
+     */
     public function delete(Request $req, Response $res, array $args): Response
     {
         $this->repo->delete((int)$args['id']);
         return $res->withHeader('Location', '/admin')->withStatus(302);
     }
+
+    /**
+     * Sanitize minimal des données entrantes :
+     * - cast string
+     * - trim
+     * - limiter la longueur raisonnablement (pour éviter insertion énorme)
+     *
+     * @param mixed $input
+     * @return array{title:string,content:string}
+     */
+    private function sanitize($input): array
+    {
+        $title = isset($input['title']) ? (string)$input['title'] : '';
+        $content = isset($input['content']) ? (string)$input['content'] : '';
+
+        $title = trim($title);
+        $content = trim($content);
+
+        // Limites raisonnables (adaptables)
+        $title = mb_substr($title, 0, 255);
+        $content = mb_substr($content, 0, 65535);
+
+        return [
+            'title' => $title,
+            'content' => $content,
+        ];
+    }
 }

src/Repositories/PostRepositoryMedoo.php

@@ -25,7 +25,13 @@ class PostRepositoryMedoo
     public function allDesc(): array
     {
         $rows = $this->db->select('post', ['id', 'title', 'content'], ['ORDER' => ['id' => 'DESC']]);
-        return is_array($rows) ? $rows : [];
+        return is_array($rows) ? array_map(function ($r) {
+            return [
+                'id' => (int)($r['id'] ?? 0),
+                'title' => (string)($r['title'] ?? ''),
+                'content' => (string)($r['content'] ?? ''),
+            ];
+        }, $rows) : [];
     }
 
     /**
@@ -46,6 +52,10 @@ class PostRepositoryMedoo
         ];
     }
 
+    /**
+     * @param array{title:string,content:string} $data
+     * @return int Inserted id
+     */
     public function create(array $data): int
     {
         $this->db->insert('post', [
@@ -55,6 +65,11 @@ class PostRepositoryMedoo
         return (int)$this->db->id();
     }
 
+    /**
+     * @param int $id
+     * @param array{title:string,content:string} $data
+     * @return void
+     */
     public function update(int $id, array $data): void
     {
         $this->db->update('post', [
@@ -63,6 +78,10 @@ class PostRepositoryMedoo
         ], ['id' => $id]);
     }
 
+    /**
+     * @param int $id
+     * @return void
+     */
     public function delete(int $id): void
     {
         $this->db->delete('post', ['id' => $id]);

src/Routes/web.php

@@ -7,6 +7,11 @@ use Slim\Views\Twig;
 use App\Repositories\PostRepositoryMedoo;
 use App\Controllers\PostController;
 
+/**
+ * @param App $app
+ * @param array{view:Twig, postRepository:PostRepositoryMedoo} $container
+ * @return void
+ */
 return function (App $app, array $container): void {
     /** @var Twig $view */
     $view = $container['view'];