From 4f0ecdba5e9034848383522e320ea6d4c178e57d Mon Sep 17 00:00:00 2001
From: Debian <debian@ctf-Q>
Date: Sat, 10 Jan 2026 11:18:38 +0000
Subject: [PATCH] Initial DevWeb commit (no secrets, no runtime data)

---
 README.md           | 0
 flag.php            | 2 +-
 includes/config.php | 9 +++++++--
 3 files changed, 8 insertions(+), 3 deletions(-)
 create mode 100644 README.md

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..e69de29
diff --git a/flag.php b/flag.php
index 4d41514..27f0af4 100644
--- a/flag.php
+++ b/flag.php
@@ -9,6 +9,6 @@ if (!isset($_SESSION['admin'])) {
 require 'includes/header.php';
 ?>
 <h1>FLAG</h1>
-<p><?= FLAG ?></p>
+<p><?= htmlspecialchars(FLAG, ENT_QUOTES, 'UTF-8') ?></p>
 <?php
 require 'includes/footer.php';
diff --git a/includes/config.php b/includes/config.php
index cdf044d..79ce6ca 100644
--- a/includes/config.php
+++ b/includes/config.php
@@ -2,14 +2,19 @@
 session_start();
 
 define('ADMIN_USER', 'fredemonetise');
-define('ADMIN_PASS', 'k2AhX[?5KX0z9J*BtP[!!2sa53Y');
+define('ADMIN_PASS', getenv('DEVWEB_ADMIN_PASS'));
 
 if (ADMIN_PASS === false || ADMIN_PASS === '') {
   error_log('[DEVWEB] ADMIN_PASS manquant');
   die('Configuration serveur invalide');
 }
 
-define('FLAG', '{CTFM1:0=126XBVQnuhi0O°o-x.bM][ZB1GP=&GRYc5Q}');
+define('FLAG', getenv('DEVWEB_FLAG'));
+
+if (FLAG === false || FLAG === '') {
+  error_log('[DEVWEB] FLAG manquant');
+  die('Configuration serveur invalide');
+}
 
 $db = new PDO('sqlite:' . __DIR__ . '/../db/forum.sqlite');
 $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);