Fallagassrini Bypass Shell

<?php
header('Content-Type: application/json; charset=utf-8');
session_start();

include("../configuration.php");
include("../includes/fonctions.php");

$token = trim($_POST['token'] ?? '');
$table = trim($_POST['table'] ?? 'heb');

if ($token === '' || !preg_match('/^[a-f0-9]{20,64}$/i', $token)) {
  echo json_encode(['ok'=>false,'error'=>'token invalide']);
  exit;
}

if (!in_array($table, ['heb','vis'], true)) {
  echo json_encode(['ok'=>false,'error'=>'table invalide']);
  exit;
}

/* 1) Essai téléchargement direct (champ photo) */
$res = telechargerPhotoDepuisTable($token, $table);

if (is_array($res) && ($res['statut'] ?? '') === 'ok' && !empty($res['url'])) {
  echo json_encode(['ok'=>true,'url'=>$res['url'], 'source'=>'direct']);
  exit;
}

/* 2) Fallback Google Places (place_id) */
$res2 = telechargerPhotoLieuGoogle($token, $table);

if (is_array($res2) && !empty($res2['ok']) && !empty($res2['url'])) {
  echo json_encode(['ok'=>true,'url'=>$res2['url'], 'source'=>'google']);
  exit;
}

/* 3) KO final => le front garde le placeholder */
$err = '';
if (is_array($res2) && !empty($res2['statut'])) $err = $res2['statut'];
elseif (is_array($res) && !empty($res['statut'])) $err = $res['statut'];
else $err = 'erreur';

echo json_encode(['ok'=>false,'error'=>$err, 'source'=>'none']);
exit;