From 7d617fbd3b11f20c7f3f0efa7e76b19da87ffb16 Mon Sep 17 00:00:00 2001
From: Nick White <git@njw.me.uk>
Date: Thu, 10 Sep 2009 21:42:47 +0100
Subject: Improve handling so symbolic links are no longer needed

---
 index.php | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

(limited to 'index.php')

diff --git a/index.php b/index.php
index 867b6d5..e0741d2 100644
--- a/index.php
+++ b/index.php
@@ -16,9 +16,32 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+$contentpath = $_SERVER['DOCUMENT_ROOT'] . "/text/" . $_SERVER['REQUEST_URI'];
+
+if ( is_dir($contentpath) == TRUE )
+	$contentpath .= 'index.php';
+
+/* Sanitise */
+if (preg_match ( '/\.\./', $contentpath )  || /* don't go up the filesystem */
+	preg_match ( '/[\'\"]/', $contentpath )|| /* string terminators */
+	preg_match ( '/\\\0/', $contentpath ) )   /* null bytes */
+
+{
+	header('HTTP/1.0 500 Internal Error');
+	echo "<h1>Error</h1>";
+	exit (0);
+}
+
+if ( ! is_file($contentpath) )
+{
+	header('HTTP/1.0 404 Not Found');
+	echo "<h1>Not Found</h1>";
+	exit (0);
+}
+
 include($_SERVER['DOCUMENT_ROOT'] . "/includes/header.php");
 
-include($_SERVER['DOCUMENT_ROOT'] . "/text/" . $_SERVER['PHP_SELF']);
+include($contentpath);
 
 xhtml_header($title);
 
-- 
cgit v1.2.3