[[warn]]
'; - if ($offset = strpos($doc, '')) { - $doc = substr_replace($doc, "\n\n".$warn, $offset + 5, 0); - } - else { - $doc = $warn . "\n\n" . $doc; - } - } - - # keep either login or logout parts depending on user level - global $User; - $hideclass = $User && property_exists($User, 'login') && $User->login ? 'logout' : 'login'; - $doc = preg_replace('{\s*<([a-z]+) class="'.$hideclass.'">.*?}s', '', $doc); - - return preg_replace_callback( - '{ \[\[ ([^] ]+) ([^]]*) \]\] }x', - function ($sub) use ($blocks) { - list ($placeholder, $name, $params) = $sub; - $html = $blocks[$name] ?? - placeholder_include($name, explode(' ', $params)); - if (empty($html) or $html[0] != '<') { - $html = "$html"; - } - $attr = sprintf(' data-dyn="%s"', is_numeric($name) ? '' : $name.$params); - # contents with identifier in first tag - return preg_replace( '/(?=>)/', $attr, $html, 1); - }, - $doc - ); -} - -# custom error handling - define('DOCROOT', getcwd()); set_include_path(implode(PATH_SEPARATOR, [ DOCROOT, __DIR__ ])); -function fail($error) -{ - global $User, $Page, $Args; - http_response_code(500); - if (!isset($Article)) { - require_once('article.inc.php'); - $Article = new ArchiveArticle(NULL); - $Article->title = 'Fout'; - } - include_once 'page.inc.php'; - ob_start(); - require '500.inc.html'; - print getoutput(['debug' => htmlspecialchars($error)]); -} - -set_exception_handler('fail'); - -define('E_FATAL', E_ERROR | E_CORE_ERROR | E_COMPILE_ERROR | E_USER_ERROR); - -set_error_handler(function ($level, $error, $file, $line) { - if ($level & E_FATAL) { - fail($error); - return; - } - return FALSE; -}); - -register_shutdown_function(function () { - # display failure page for fatal exceptions - $error = error_get_last(); - if (!($error['type'] & E_FATAL)) return; - fail("Fatal: $error[message] in $error[file]:$error[line]"); -}); - -error_reporting(error_reporting() & ~E_FATAL); - -# user login and control - -include_once 'auth.inc.php'; // sets global $User -$Edit = isset($_GET['edit']); +include_once 'error.inc.php'; # setup requested page -$Args = ''; -$Page = preg_replace('/\?.*/', '', @$_SERVER['PATH_INFO'] ?: $_SERVER['REQUEST_URI']); -$Page = urldecode(trim($Page, '/')) ?: 'index'; +$request = preg_replace('/\?.*/', '', @$_SERVER['PATH_INFO'] ?: $_SERVER['REQUEST_URI']); +$request = urldecode(trim($request, '/')) ?: 'index'; -$staticpage = "$Page.html"; +$staticpage = "$request.html"; if (file_exists($staticpage)) { if (is_link($staticpage)) { $target = preg_replace('/\.html$/', '', readlink($staticpage)); - header("HTTP/1.1 302 Shorthand"); - header("Location: $target"); - exit; + abort($target, '307 Shorthand'); } } -elseif (file_exists("$Page/index.html")) { - $staticpage = "$Page/index.html"; +elseif (file_exists("$request/index.html")) { + $staticpage = "$request/index.html"; } require_once('article.inc.php'); -$Article = new ArchiveArticle($staticpage); +$Page = new ArchiveArticle($staticpage); + +if (@$_SERVER['HTTP_ACCEPT'] === 'text/plain') { + $Page->api = TRUE; +} + +# user login and control -$Page = $Article->handler; -$Args = $Article->path; +include_once 'auth.inc.php'; // sets global $User -if ($PageAccess = $Article->restricted) { +if ($Page->restricted) { # access restriction if (!$User->login) { - http_response_code(303); - $target = urlencode($Article->link); - header("Location: /login?goto=$target"); - exit; + $target = urlencode($Page->link); + abort("/login?goto=$target", '303 Eerst inloggen'); + } + elseif ($check = file_get_contents("{$Page->restricted}/.private") + and !$User->admin(trim($check))) { + http_response_code(403); + $Page->raw('403.inc.html'); } } @@ -159,48 +51,50 @@ if ($PageAccess = $Article->restricted) { header(sprintf('Content-Security-Policy: %s', implode('; ', [ "default-src 'self' 'unsafe-inline' http://cdn.ckeditor.com", # some overrides remain - "img-src 'self' data: http://cdn.ckeditor.com", # inline svg (in css) + "img-src 'self' data: blob: http://cdn.ckeditor.com", # inline svg (in css) "base-uri 'self'", # only local pages "frame-ancestors 'none'", # prevent malicious embedding ]))); +header('Referrer-Policy: no-referrer-when-downgrade'); -ob_start(); # page body -$Place = [ +$Page->place += [ 'user' => $User->login ?: '', 'url' => htmlspecialchars($_SERVER['REQUEST_URI']), ]; -if (!isset($Article->raw) and $User->admin("edit {$Article->link}")) { - # open template as initial contents - $Article->raw(file_exists("$Page/template.inc.html") ? "$Page/template.inc.html" : 'template.inc.html'); +if ($Page->editable = $User->admin("edit {$Page->link}")) { + include_once 'edit/head.inc.php'; } -if (isset($Article->raw)) { - if ($User->admin("edit $Page$Args")) { - # restore meta tags in static contents for editing - foreach (array_reverse($Article->meta) as $metaprop => $val) { - $Article->raw = sprintf( - ''."\n", - $metaprop, $val - ) . $Article->raw; - } - } - $Article->raw = '