X-Git-Url: http://git.shiar.nl/minimedit.git/blobdiff_plain/19cde41f182998a36cdac76d530881aaea24c719..05c560470887c86a30c82360d7be5caf0de1baa4:/page.php diff --git a/page.php b/page.php index 5d79cf6..30f0e3c 100644 --- a/page.php +++ b/page.php @@ -2,31 +2,99 @@ error_reporting(E_ALL); ini_set('display_errors', TRUE); -$Args = ''; -$Page = preg_replace('/\?.*/', '', $_SERVER['REQUEST_URI']); -$Page = urldecode(trim($Page, '/')) ?: 'index'; -while (TRUE) { - if (file_exists("$Page/index.html")) { - $Page .= '/index'; - break; +define('DOCROOT', getcwd()); +set_include_path(implode(PATH_SEPARATOR, [ DOCROOT, __DIR__ ])); + +include_once 'error.inc.php'; + +# setup requested page + +$request = preg_replace('/\?.*/', '', @$_SERVER['PATH_INFO'] ?: $_SERVER['REQUEST_URI']); +$request = urldecode(trim($request, '/')) ?: 'index'; + +$staticpage = "$request.html"; +if (file_exists($staticpage)) { + if (is_link($staticpage)) { + $target = preg_replace('/\.html$/', '', readlink($staticpage)); + abort($target, '307 Shorthand'); } - if (file_exists("$Page.html")) { - break; +} +elseif (file_exists("$request/index.html")) { + $staticpage = "$request/index.html"; +} + +require_once('article.inc.php'); +$Page = new ArchiveArticle($staticpage); + +if (@$_SERVER['HTTP_ACCEPT'] === 'text/plain') { + $Page->api = TRUE; +} + +# user login and control + +include_once 'auth.inc.php'; // sets global $User + +if ($Page->restricted) { + # access restriction + if (!$User->login) { + $target = urlencode($Page->link); + abort("/login?goto=$target", '303 Eerst inloggen'); } - if (file_exists("$Page.php")) { - # unformatted script override - require "$Page.php"; - break; + elseif ($check = file_get_contents("{$Page->restricted}/.private") + and !$User->admin(trim($check))) { + http_response_code(403); + $Page->raw('403.inc.html'); } +} - $up = strrpos($Page, '/'); - if ($up === FALSE) { +# prepare page contents + +header(sprintf('Content-Security-Policy: %s', implode('; ', [ + "default-src 'self' 'unsafe-inline' http://cdn.ckeditor.com", # some overrides remain + "img-src 'self' data: blob: http://cdn.ckeditor.com", # inline svg (in css) + "base-uri 'self'", # only local pages + "frame-ancestors 'none'", # prevent malicious embedding +]))); +header('Referrer-Policy: no-referrer-when-downgrade'); + +$Page->place += [ + 'user' => $User->login ?: '', + 'url' => htmlspecialchars($_SERVER['REQUEST_URI']), +]; + +if ($Page->editable = $User->admin("edit {$Page->link}")) { + include_once 'edit/head.inc.php'; +} + +if (isset($Page->raw) +and @$_SERVER['HTTP_ACCEPT'] !== 'application/xml') { + $Page->raw = '