From fe703f5f8f07fa12d12b3b3f00046474a86894b7 Mon Sep 17 00:00:00 2001
From: jessy-david-dev <ultralionfr@gmail.com>
Date: Mon, 13 Apr 2026 00:04:44 +0200
Subject: [PATCH] security: block devtools and context menu when search is
 disabled

---
 lib/useSearchAllowed.ts | 34 +++++++++++++++++++++++++++-------
 1 file changed, 27 insertions(+), 7 deletions(-)

diff --git a/lib/useSearchAllowed.ts b/lib/useSearchAllowed.ts
index 7895af5..5816347 100644
--- a/lib/useSearchAllowed.ts
+++ b/lib/useSearchAllowed.ts
@@ -24,19 +24,39 @@ export function useSearchAllowed() {
   return { allowed, toggle };
 }
 
-// Pour le mode multi : blocage Ctrl+F basé sur room.searchAllowed (vérité côté serveur)
+// Pour le mode multi : blocage Ctrl+F + DevTools basé sur room.searchAllowed (vérité côté serveur)
 export function useCtrlFBlock(allowed: boolean) {
   useEffect(() => {
+    if (allowed) return;
+
     function handleKeyDown(e: KeyboardEvent) {
-      if ((e.ctrlKey || e.metaKey) && e.key === "f") {
-        if (!allowed) {
-          e.preventDefault();
-          e.stopPropagation();
-        }
+      const ctrl = e.ctrlKey || e.metaKey;
+      // Ctrl+F (recherche)
+      if (ctrl && e.key === "f") {
+        e.preventDefault();
+        e.stopPropagation();
+        return;
+      }
+      // Raccourcis DevTools : F12, Ctrl+Shift+I, Ctrl+Shift+J, Ctrl+Shift+C, Ctrl+U
+      if (
+        e.key === "F12" ||
+        (ctrl && e.shiftKey && (e.key === "I" || e.key === "i" || e.key === "J" || e.key === "j" || e.key === "C" || e.key === "c")) ||
+        (ctrl && (e.key === "U" || e.key === "u"))
+      ) {
+        e.preventDefault();
+        e.stopPropagation();
       }
     }
+
+    function handleContextMenu(e: MouseEvent) {
+      e.preventDefault();
+    }
+
     window.addEventListener("keydown", handleKeyDown, { capture: true });
-    return () =>
+    window.addEventListener("contextmenu", handleContextMenu, { capture: true });
+    return () => {
       window.removeEventListener("keydown", handleKeyDown, { capture: true });
+      window.removeEventListener("contextmenu", handleContextMenu, { capture: true });
+    };
   }, [allowed]);
 }