X-Git-Url: http://git.shiar.nl/minimedit.git/blobdiff_plain/1ed6d72f061c2bc619f4e69cd0fa8f458a1e1206..772961fd4e9be46ad340cad1e55ee5f28cc5b968:/page.php diff --git a/page.php b/page.php index 50e098a..a469a9d 100644 --- a/page.php +++ b/page.php @@ -8,6 +8,38 @@ function abort($body, $status = NULL) { exit; } +function placeholder_include($name, $params = []) +{ + $path = stream_resolve_include_path("widget/$name.php"); + if (!file_exists($path)) { + return ''.$name.' ontbreekt'; + } + + ob_start(); + $Page = clone $GLOBALS['Page']; + $Page->handler = $Page->handler . $Page->path; // .= with explicit getter + $Page->path = ''; + $Place = $GLOBALS['Place']; + foreach ($params as $param) { + if ($set = strpos($param, '=')) { + $Place[ substr($param, 0, $set) ] = substr($param, $set + 1); + } + elseif (!empty($param)) { + $Page->path .= '/'.$param; + } + } + $Page->link .= $Page->path; + try { + include "widget/$name.php"; + return ob_get_clean(); + } + catch (Exception $e) { + return sprintf('%s', + "fout in $name: {$e->getMessage()}" + ); + } +} + function getoutput($blocks = []) { $doc = ob_get_clean(); @@ -22,35 +54,23 @@ function getoutput($blocks = []) } } + # keep either login or logout parts depending on user level + global $User; + $hideclass = $User && property_exists($User, 'login') && $User->login ? 'logout' : 'login'; + $doc = preg_replace('{\s*<([a-z]+) class="'.$hideclass.'">.*?}s', '', $doc); + return preg_replace_callback( - '< \[\[ ([^] ]+) ([^]]*) \]\] >x', + '{ \[\[ ([^] ]+) ([^]]*) \]\] }x', function ($sub) use ($blocks) { list ($placeholder, $name, $params) = $sub; - if (isset($blocks[$name])) { - $html = $blocks[$name]; - } - elseif (file_exists("$name.php")) { - ob_start(); - $Page = $GLOBALS['Page']; - $Args = $GLOBALS['Args']; - foreach (explode(' ', $params) as $param) { - if ($set = strpos($param, '=')) { - $_GET[ substr($param, 0, $set) ] = substr($param, $set + 1); - } - elseif (!empty($param)) { - $Args .= '/'.$param; - } - } - include "$name.php"; - $html = ob_get_clean(); - } - else { - $html = ''.$name.' ontbreekt'; + $html = $blocks[$name] ?? + placeholder_include($name, explode(' ', $params)); + if (empty($html) or $html[0] != '<') { + $html = "$html"; } - return sprintf('%s', - is_numeric($name) ? '' : $placeholder, # edit replacement - preg_replace('{}', '', $html) # contents - ); + $attr = sprintf(' data-dyn="%s"', is_numeric($name) ? '' : $name.$params); + # contents with identifier in first tag + return preg_replace( '/(?=>)/', $attr, $html, 1); }, $doc ); @@ -58,15 +78,22 @@ function getoutput($blocks = []) # custom error handling -define('DOCROOT', getcwd().'/'); +define('DOCROOT', getcwd()); +set_include_path(implode(PATH_SEPARATOR, [ DOCROOT, __DIR__ ])); function fail($error) { + global $User, $Page; http_response_code(500); + if (!isset($Page)) { + require_once('article.inc.php'); + $Page = new ArchiveArticle(NULL); + $Page->title = 'Fout'; + } include_once 'page.inc.php'; ob_start(); - require_once DOCROOT.'500.html'; - print getoutput(['debug' => $error]); + require '500.inc.html'; + print getoutput(['debug' => htmlspecialchars($error)]); } set_exception_handler('fail'); @@ -92,76 +119,91 @@ error_reporting(error_reporting() & ~E_FATAL); # user login and control -include_once 'auth.inc.php'; +include_once 'auth.inc.php'; // sets global $User $Edit = isset($_GET['edit']); -# distinguish subpage Args from topmost Page script - -$Args = ''; -$Page = preg_replace('/\?.*/', '', @$_SERVER['PATH_INFO'] ?: $_SERVER['REQUEST_URI']); -$Page = urldecode(trim($Page, '/')) ?: 'index'; -while (TRUE) { - if (file_exists("$Page/.private")) { - # access restriction - if (empty($User)) { - http_response_code(303); - $target = urlencode($_SERVER['REQUEST_URI']); - header("Location: /login?goto=$target"); - exit; - } - $PageAccess = $Page; - } +# setup requested page - if (file_exists("$Page/index.php")) { - break; - } +$request = preg_replace('/\?.*/', '', @$_SERVER['PATH_INFO'] ?: $_SERVER['REQUEST_URI']); +$request = urldecode(trim($request, '/')) ?: 'index'; - $up = strrpos($Page, '/'); - $Args = substr($Page, $up) . $Args; - $Page = substr($Page, 0, $up); - if ($up === FALSE) { - break; +$staticpage = "$request.html"; +if (file_exists($staticpage)) { + if (is_link($staticpage)) { + $target = preg_replace('/\.html$/', '', readlink($staticpage)); + header("HTTP/1.1 302 Shorthand"); + header("Location: $target"); + exit; } } +elseif (file_exists("$request/index.html")) { + $staticpage = "$request/index.html"; +} -# load static contents - -ob_start(); # page body -ob_start(); # inner html -print '
'."\n\n"; +require_once('article.inc.php'); +$Page = new ArchiveArticle($staticpage); -$found = FALSE; -if (file_exists("$Page$Args.html")) { - $found = include "./$Page$Args.html"; -} -elseif (file_exists("$Page$Args/index.html")) { - $found = include "./$Page$Args/index.html"; -} -elseif (!empty($User['admin'])) { - $found = include (file_exists("$Page/template.html") ? "$Page/template.html" : './template.html'); +if ($Page->restricted) { + # access restriction + if (!$User->login) { + http_response_code(303); + $target = urlencode($Page->link); + header("Location: /login?goto=$target"); + exit; + } } -print "
\n\n"; +# prepare page contents -# execute dynamic code +header(sprintf('Content-Security-Policy: %s', implode('; ', [ + "default-src 'self' 'unsafe-inline' http://cdn.ckeditor.com", # some overrides remain + "img-src 'self' data: http://cdn.ckeditor.com", # inline svg (in css) + "base-uri 'self'", # only local pages + "frame-ancestors 'none'", # prevent malicious embedding +]))); -$Place = []; +ob_start(); # page body +$Place = [ + 'user' => $User->login ?: '', + 'url' => htmlspecialchars($_SERVER['REQUEST_URI']), +]; -if ($Page) { - $found |= require "./$Page/index.php"; +if (!isset($Page->raw) and $User->admin("edit {$Page->link}")) { + # open bottom template as initial contents + $template = 'template.inc.html'; + if ($Page->handler and file_exists("{$Page->handler}/$template")) { + $template = "{$Page->handler}/$template"; + } + $Page->raw($template); + $Page->meta['article:published_time'] = date('Y-m-d h:i:s O'); + $Page->meta['article:author'] = '/' . $User->dir; } -$Place += [ - 'user' => empty($User) ? '' : $User['name'], - 'url' => htmlspecialchars($_SERVER['REQUEST_URI']), -]; +if (isset($Page->raw)) { + if ($User->admin("edit {$Page->link}")) { + # restore meta tags in static contents for editing + foreach (array_reverse($Page->meta) as $metaprop => $val) { + $Page->raw = sprintf( + ''."\n", + $metaprop, $val + ) . $Page->raw; + } + } + $Page->raw = '
'."\n\n".$Page->raw."
\n\n"; +} -# global html +# output dynamic and/or static html -if (!$found) { - # no resulting output - http_response_code(404); - @require "./404.html"; +if (!$Page->handler or require("./{$Page->handler}/index.php")) { + # static contents + if (isset($Page->raw)) { + print $Page->raw; + } + else { + # no resulting output + http_response_code(404); + @require '404.inc.html'; + } } include_once 'page.inc.php';