<?php /* * Copyright (C) 2009 Nick White * * This program is free software: you can redistribute it and/or modify * it under the terms of the GNU Affero General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Affero General Public License for more details. * * You should have received a copy of the GNU Affero General Public License * along with this program. If not, see <http://www.gnu.org/licenses/>. */ $contentpath = $_SERVER['DOCUMENT_ROOT'] . "/text/" . $_SERVER['REQUEST_URI']; if ( is_dir($contentpath) == TRUE ) $contentpath .= 'index.php'; /* Sanitise */ if (preg_match ( '/\.\./', $contentpath ) || /* don't go up the filesystem */ preg_match ( '/[\'\"]/', $contentpath )|| /* string terminators */ preg_match ( '/\\\0/', $contentpath ) ) /* null bytes */ { header('HTTP/1.0 500 Internal Error'); echo "<h1>Error</h1>"; exit (0); } if ( ! is_file($contentpath) ) { header('HTTP/1.0 404 Not Found'); echo "<h1>Not Found</h1>"; exit (0); } include($_SERVER['DOCUMENT_ROOT'] . "/includes/header.php"); include($contentpath); xhtml_header($title); print($body); include($_SERVER['DOCUMENT_ROOT'] . "/includes/footer.php"); page_footer($contentpath); ?>