From 5c726f91b2414bdca4e1686c919c6c7ae911ce02 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20FAMIBELLE-PRONZOLA?= <c.pronzola@tuta.io>
Date: Sun, 26 Jul 2026 19:55:18 +0400
Subject: [PATCH] fix(server): exclude /ajax/ from .php redirect to preserve
 POST

---
 conf/.htaccess.sample  | 2 ++
 conf/nginx.conf.sample | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/conf/.htaccess.sample b/conf/.htaccess.sample
index 46b1bb9..a228ecc 100644
--- a/conf/.htaccess.sample
+++ b/conf/.htaccess.sample
@@ -40,7 +40,9 @@ RewriteCond %{REQUEST_FILENAME} !-f
 RewriteRule ^([^\.]+)$ $1.php [NC,L]
 
 # Rediriger les URLs avec .php vers les URLs sans extension
+# Sauf /ajax/ : un 301 transformerait le POST en GET et ferait perdre le token CSRF.
 RewriteCond %{THE_REQUEST} /([^.]+)\.php [NC]
+RewriteCond %{REQUEST_URI} !^/ajax/ [NC]
 RewriteRule ^ /%1 [NC,L,R=301]
 
 # Pour accéder à page.php via /page
diff --git a/conf/nginx.conf.sample b/conf/nginx.conf.sample
index d92edbc..53e218f 100644
--- a/conf/nginx.conf.sample
+++ b/conf/nginx.conf.sample
@@ -69,6 +69,11 @@ server {
     # @rewrite ou directive index), on sert le PHP. Cela évite la boucle
     # infinie /index → /index.php → /index → …
     location ~ \.php$ {
+        # Ne pas rediriger les endpoints AJAX : un 301 transformerait le POST
+        # en GET et ferait perdre le token CSRF.
+        if ($request_uri ~ "^/ajax/") {
+            break;
+        }
         if ($request_uri ~ "^(/[^?]+)\.php") {
             return 301 $1$is_args$args;
         }