X-Git-Url: http://git.shiar.nl/minimedit.git/blobdiff_plain/2884a2a2fd31342c4c2e37b569b2b89a0949995e..HEAD:/page.php diff --git a/page.php b/page.php index 932e729..30f0e3c 100644 --- a/page.php +++ b/page.php @@ -2,208 +2,99 @@ error_reporting(E_ALL); ini_set('display_errors', TRUE); -function abort($body, $status = NULL) { - if ($status) header("HTTP/1.1 $status"); - print "$body\n"; - exit; -} - -function placeholder_include($name, $params = []) -{ - $path = stream_resolve_include_path("widget/$name.php"); - if (!file_exists($path)) { - return ''.$name.' ontbreekt'; - } - - ob_start(); - $Page = $GLOBALS['Page'] . $GLOBALS['Args']; - $Args = ''; - $Place = $GLOBALS['Place']; - foreach ($params as $param) { - if ($set = strpos($param, '=')) { - $Place[ substr($param, 0, $set) ] = substr($param, $set + 1); - } - elseif (!empty($param)) { - $Args .= '/'.$param; - } - } - try { - include "widget/$name.php"; - return ob_get_clean(); - } - catch (Exception $e) { - return sprintf('%s', - "fout in $name: {$e->getMessage()}" - ); - } -} - -function getoutput($blocks = []) -{ - $doc = ob_get_clean(); - - if (!empty($blocks['warn'])) { - $warn = '

[[warn]]

'; - if ($offset = strpos($doc, '')) { - $doc = substr_replace($doc, "\n\n".$warn, $offset + 5, 0); - } - else { - $doc = $warn . "\n\n" . $doc; - } - } - - # keep either login or logout parts depending on user level - global $User; - $hideclass = empty($User) ? 'login' : 'logout'; - $doc = preg_replace('{\s*<(p|li|span) class="'.$hideclass.'">.*?}s', '', $doc); - - return preg_replace_callback( - '{ (?%s', - is_numeric($name) ? '' : $placeholder, # edit replacement - preg_replace('{}', '', $html) # contents - ); - }, - $doc - ); -} - -# custom error handling - define('DOCROOT', getcwd()); set_include_path(implode(PATH_SEPARATOR, [ DOCROOT, __DIR__ ])); -function fail($error) -{ - http_response_code(500); - if (!isset($Article)) { - $Article = new ArchiveArticle(NULL); - $Article->title = 'Fout'; - } - include_once 'page.inc.php'; - ob_start(); - require_once '500.inc.html'; - print getoutput(['debug' => $error]); -} +include_once 'error.inc.php'; -set_exception_handler('fail'); +# setup requested page -define('E_FATAL', E_ERROR | E_CORE_ERROR | E_COMPILE_ERROR | E_USER_ERROR); +$request = preg_replace('/\?.*/', '', @$_SERVER['PATH_INFO'] ?: $_SERVER['REQUEST_URI']); +$request = urldecode(trim($request, '/')) ?: 'index'; -set_error_handler(function ($level, $error, $file, $line) { - if ($level & E_FATAL) { - fail($error); - return; +$staticpage = "$request.html"; +if (file_exists($staticpage)) { + if (is_link($staticpage)) { + $target = preg_replace('/\.html$/', '', readlink($staticpage)); + abort($target, '307 Shorthand'); } - return FALSE; -}); +} +elseif (file_exists("$request/index.html")) { + $staticpage = "$request/index.html"; +} -register_shutdown_function(function () { - # display failure page for fatal exceptions - $error = error_get_last(); - if (!($error['type'] & E_FATAL)) return; - fail("Fatal: $error[message] in $error[file]:$error[line]"); -}); +require_once('article.inc.php'); +$Page = new ArchiveArticle($staticpage); -error_reporting(error_reporting() & ~E_FATAL); +if (@$_SERVER['HTTP_ACCEPT'] === 'text/plain') { + $Page->api = TRUE; +} # user login and control -$User = NULL; -include_once 'auth.inc.php'; -$Edit = isset($_GET['edit']); - -# distinguish subpage Args from topmost Page script - -$Args = ''; -$Page = preg_replace('/\?.*/', '', @$_SERVER['PATH_INFO'] ?: $_SERVER['REQUEST_URI']); -$Page = urldecode(trim($Page, '/')) ?: 'index'; -while (TRUE) { - if (file_exists("$Page/.private")) { - # access restriction - if (empty($User)) { - http_response_code(303); - $target = urlencode($_SERVER['REQUEST_URI']); - header("Location: /login?goto=$target"); - exit; - } - $PageAccess = $Page; - } +include_once 'auth.inc.php'; // sets global $User - if (file_exists("$Page/index.php")) { - break; +if ($Page->restricted) { + # access restriction + if (!$User->login) { + $target = urlencode($Page->link); + abort("/login?goto=$target", '303 Eerst inloggen'); } - - $up = strrpos($Page, '/'); - $Args = substr($Page, $up) . $Args; - $Page = substr($Page, 0, $up); - if ($up === FALSE) { - break; + elseif ($check = file_get_contents("{$Page->restricted}/.private") + and !$User->admin(trim($check))) { + http_response_code(403); + $Page->raw('403.inc.html'); } } -$staticpage = NULL; -if (file_exists("$Page$Args.html")) { - $staticpage = "$Page$Args.html"; - if (is_link($staticpage)) { - $target = preg_replace('/\.html$/', '', readlink($staticpage)); - header("HTTP/1.1 302 Shorthand"); - header("Location: $target"); - exit; - } -} -elseif (file_exists("$Page$Args/index.html")) { - $staticpage = "$Page$Args/index.html"; -} -elseif ($User and $User->admin("edit $Page$Args")) { - $staticpage = (file_exists("$Page/template.inc.html") ? "$Page/template.inc.html" : 'template.inc.html'); -} - # prepare page contents -require_once('article.inc.php'); -$Article = new ArchiveArticle($staticpage); +header(sprintf('Content-Security-Policy: %s', implode('; ', [ + "default-src 'self' 'unsafe-inline' http://cdn.ckeditor.com", # some overrides remain + "img-src 'self' data: blob: http://cdn.ckeditor.com", # inline svg (in css) + "base-uri 'self'", # only local pages + "frame-ancestors 'none'", # prevent malicious embedding +]))); +header('Referrer-Policy: no-referrer-when-downgrade'); -ob_start(); # page body -$Place = [ - 'user' => $User ? $User->login : '', +$Page->place += [ + 'user' => $User->login ?: '', 'url' => htmlspecialchars($_SERVER['REQUEST_URI']), ]; -if (isset($Article->raw)) { - if ($User and $User->admin("edit $Page$Args")) { - # restore meta tags in static contents for editing - foreach (array_reverse($Article->meta) as $metaprop => $val) { - $Article->raw = sprintf( - ''."\n", - $metaprop, $val - ) . $Article->raw; - } - } - $Article->raw = '
'."\n\n".$Article->raw."
\n\n"; +if ($Page->editable = $User->admin("edit {$Page->link}")) { + include_once 'edit/head.inc.php'; +} + +if (isset($Page->raw) +and @$_SERVER['HTTP_ACCEPT'] !== 'application/xml') { + $Page->raw = '
'."\n\n".$Page->raw."
\n\n"; } # output dynamic and/or static html -if (!$Page or require("./$Page/index.php")) { - # static contents - if (isset($Article->raw)) { - print $Article->raw; - } - else { +include_once 'format.inc.php'; + +ob_start(); +if ($Page->handler and !$Page->index($Page->api)) { + # replace contents by code output on false return + $Page->raw = ob_get_clean(); +} +else { + # keep article contents + if (!isset($Page->body)) { # no resulting output http_response_code(404); @require '404.inc.html'; + $Page->raw = ob_get_clean() . $Page->raw; } } -include_once 'page.inc.php'; +if (@$_SERVER['HTTP_ACCEPT'] === 'application/xml') { + header('Access-Control-Allow-Origin: *'); +} +elseif (!$Page->api) { + include_once 'page.inc.php'; +} +print $Page->render();