From 50f9b29cc21f5adef555d3cf21940124ceadb0eb Mon Sep 17 00:00:00 2001
From: Mischa POSLAWSKY <perl@shiar.org>
Date: Fri, 4 Dec 2020 01:30:17 +0100
Subject: [PATCH] page: ignore output buffer in article render

Operate on object property [raw] only.

Stops preliminary output (such as in nieuws code) being injected inside the
html body, probably something to restore later for improved behaviour of
errors and broken code.
---
 article.inc.php   |  2 +-
 nieuws/index.php  |  2 +-
 page.inc.php      |  6 +-----
 page.php          | 18 +++++++++++-------
 widget/nieuws.php |  1 +
 widget/page.php   |  2 --
 6 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/article.inc.php b/article.inc.php
index cff69ff..47a08a7 100644
--- a/article.inc.php
+++ b/article.inc.php
@@ -207,7 +207,7 @@ class ArchiveArticle
 
 	function render()
 	{
-		$doc = ob_get_clean();
+		$doc = $this->raw;
 
 		if (!empty($this->place['warn'])) {
 			$warn = '<p class="warn">[[warn]]</p>';
diff --git a/nieuws/index.php b/nieuws/index.php
index f6e63a4..33b61fb 100644
--- a/nieuws/index.php
+++ b/nieuws/index.php
@@ -3,7 +3,7 @@ $replyform = $Page->handler == 'melding' && $User->login;
 @list ($year, $page) = explode('/', trim($Page->path, '/'));
 
 if ($User->admin("edit {$Page->handler}")) {
-	print '<script src="/nieuws/edit.js"></script>'."\n";
+	$Page->raw = '<script src="/nieuws/edit.js"></script>'."\n" . $Page->raw;
 }
 
 if ($page and !is_numeric($page)) {
diff --git a/page.inc.php b/page.inc.php
index afaa970..8eba91b 100644
--- a/page.inc.php
+++ b/page.inc.php
@@ -1,12 +1,8 @@
 <?php
-$body = $Page->render();
-
 include_once 'head.inc.php';
 
 print "<header>\n";
-ob_start();
 $menu = new ArchiveArticle('menu.inc.html');
-print $menu->raw;
 ob_start();
 if ($User and property_exists($User, 'login') and $User->login) {
 	print '<div class="login"><p>';
@@ -41,7 +37,7 @@ $nav = preg_replace_callback('{<a href="([^"]+)">(.*?)</a>}', function ($m) {
 print $nav;
 print "</header>\n\n";
 
-print $body;
+print $Page->render();
 
 register_shutdown_function(function () {
 	print '<footer>';
diff --git a/page.php b/page.php
index 5eefadb..8d2d01c 100644
--- a/page.php
+++ b/page.php
@@ -23,9 +23,11 @@ function fail($error)
 		$Page->title = 'Fout';
 	}
 	include_once 'page.inc.php';
+
 	ob_start();
 	require '500.inc.html';
 	$Page->place['debug'] = htmlspecialchars($error);
+	$Page->raw = ob_get_clean();
 	print $Page->render();
 }
 
@@ -95,7 +97,6 @@ header(sprintf('Content-Security-Policy: %s', implode('; ', [
 	"frame-ancestors 'none'", # prevent malicious embedding
 ])));
 
-ob_start(); # page body
 $Page->place += [
 	'user'  => $User->login ?: '',
 	'url'   => htmlspecialchars($_SERVER['REQUEST_URI']),
@@ -127,15 +128,18 @@ if (isset($Page->raw)) {
 
 # output dynamic and/or static html
 
-if (!$Page->handler or require("./{$Page->handler}/index.php")) {
-	# static contents
-	if (isset($Page->raw)) {
-		print $Page->raw;
-	}
-	else {
+ob_start();
+if ($Page->handler and !require("./{$Page->handler}/index.php")) {
+	# replace contents by code output on false return
+	$Page->raw = ob_get_clean();
+}
+else {
+	# keep article contents
+	if (!isset($Page->raw)) {
 		# no resulting output
 		http_response_code(404);
 		@require '404.inc.html';
+		$Page->raw = ob_get_clean();
 	}
 }
 
diff --git a/widget/nieuws.php b/widget/nieuws.php
index 7185036..9cf427c 100644
--- a/widget/nieuws.php
+++ b/widget/nieuws.php
@@ -74,4 +74,5 @@ if (@$Page->place['view'] === 'toc') {
 }
 ob_start();
 shownews($articles, @$Page->place['n'] ?: 5);
+$Page->raw = ob_get_clean();
 print $Page->render();
diff --git a/widget/page.php b/widget/page.php
index 7304739..37c31fa 100644
--- a/widget/page.php
+++ b/widget/page.php
@@ -1,5 +1,3 @@
 <?php
 $article = new ArchiveArticle(".{$Page->path}.html");
-ob_start();
-print $article->raw;
 print $article->render();
-- 
2.30.0