|
4 | 4 | * PHPPgAdmin v6.0.0-RC1 |
5 | 5 | */ |
6 | 6 |
|
7 | | -require_once __DIR__ . '/src/lib.inc.php'; |
| 7 | +require_once __DIR__.'/src/lib.inc.php'; |
8 | 8 |
|
9 | 9 | // This section is made to be able to parse requests coming from PHP Builtin webserver |
10 | 10 | if (PHP_SAPI === 'cli-server') { |
11 | | - //include_once __DIR__ . '/src/cli.router.php'; |
12 | 11 | $will_redirect = false; |
13 | | - $req_uri = isset($_SERVER['PHP_SELF']) ? $_SERVER['PHP_SELF'] : $_SERVER['REQUEST_URI']; |
14 | | - $first10chars = substr($req_uri, 0, 10); |
15 | | - if ($first10chars === '/index.php') { |
| 12 | + // @todo is PHP_SELF is not set, chances are REQUEST_URI won't either |
| 13 | + $req_uri = isset($_SERVER['PHP_SELF']) ? $_SERVER['PHP_SELF'] : $_SERVER['REQUEST_URI']; |
| 14 | + if (substr($req_uri, 0, 10) === '/index.php') { |
16 | 15 | $will_redirect = true; |
17 | 16 | $req_uri = substr($req_uri, 10); |
18 | 17 | } |
19 | 18 | $filePath = realpath(ltrim($req_uri, '/')); |
20 | | - $new_location = 'Location: http://' . $_SERVER['HTTP_HOST'] . $req_uri; |
21 | | - |
22 | | - if ($filePath && is_readable($filePath)) { |
23 | | - // 1. check that file is not outside of this directory for security |
24 | | - // 2. check for circular reference to router.php |
25 | | - // 3. don't serve dotfiles |
26 | | - |
27 | | - if (strpos($filePath, BASE_PATH . DIRECTORY_SEPARATOR) === 0 && |
28 | | - $filePath != BASE_PATH . DIRECTORY_SEPARATOR . 'index.php' && |
29 | | - substr(basename($filePath), 0, 1) != '.' |
30 | | - ) { |
31 | | - if (strtolower(substr($filePath, -4)) == '.php') { |
32 | | - // php file; serve through interpreter |
33 | | - include $filePath; |
34 | | - |
35 | | - return; |
36 | | - } |
37 | | - if ($will_redirect) { |
38 | | - header($new_location, true, 301); |
39 | | - |
40 | | - return; |
41 | | - } |
42 | | - // asset file; serve from filesystem |
43 | | - return false; |
| 19 | + $new_location = 'Location: http://'.$_SERVER['HTTP_HOST'].$req_uri; |
| 20 | + |
| 21 | + if ($filePath && // 1. check that filepath is set |
| 22 | + is_readable($filePath) && // 2. and references a readable file/folder |
| 23 | + strpos($filePath, BASE_PATH.DIRECTORY_SEPARATOR) === 0 && // 3. And is inside this folder |
| 24 | + $filePath != BASE_PATH.DIRECTORY_SEPARATOR.'index.php' && // 4. discard circular references to index.php |
| 25 | + substr(basename($filePath), 0, 1) != '.' // 5. don't serve dotfiles |
| 26 | + ) { |
| 27 | + if (strtolower(substr($filePath, -4)) == '.php') { |
| 28 | + // php file; serve through interpreter |
| 29 | + include $filePath; |
| 30 | + |
| 31 | + return; |
44 | 32 | } |
| 33 | + if ($will_redirect) { |
| 34 | + header($new_location, true, 301); |
| 35 | + |
| 36 | + return; |
| 37 | + } |
| 38 | + // asset file; serve from filesystem |
| 39 | + return false; |
45 | 40 | } |
46 | 41 | } |
47 | 42 |
|
|
53 | 48 | /* @scrutinizer ignore-unused */ |
54 | 49 | $args |
55 | 50 | ) { |
56 | | - |
57 | 51 | return $response |
58 | 52 | ->withHeader('Content-type', 'application/json') |
59 | 53 | ->withJson(['version' => $this->version]); |
|
73 | 67 | $loginShared = $request->getParsedBodyParam('loginShared'); |
74 | 68 | $loginServer = $request->getParsedBodyParam('loginServer'); |
75 | 69 | $loginUsername = $request->getParsedBodyParam('loginUsername'); |
76 | | - $loginPassword = $request->getParsedBodyParam('loginPassword_' . md5($loginServer)); |
| 70 | + $loginPassword = $request->getParsedBodyParam('loginPassword_'.md5($loginServer)); |
77 | 71 |
|
78 | 72 | // If login action is set, then set session variables |
79 | 73 | if ((bool) $loginServer && (bool) $loginUsername && $loginPassword !== null) { |
|
146 | 140 | $safe_subjects = ($subject === 'servers' || $subject === 'intro' || $subject === 'browser'); |
147 | 141 |
|
148 | 142 | if ($this->misc->getServerId() === null && !$safe_subjects) { |
149 | | - return $response->withStatus(302)->withHeader('Location', SUBFOLDER . '/src/views/servers'); |
| 143 | + return $response->withStatus(302)->withHeader('Location', SUBFOLDER.'/src/views/servers'); |
150 | 144 | } |
151 | 145 |
|
152 | 146 | if (!isset($_server_info['username']) && $subject !== 'login' && !$safe_subjects) { |
153 | | - $destinationurl = SUBFOLDER . '/src/views/login?server=' . $this->misc->getServerId(); |
| 147 | + $destinationurl = SUBFOLDER.'/src/views/login?server='.$this->misc->getServerId(); |
154 | 148 |
|
155 | 149 | return $response->withStatus(302)->withHeader('Location', $destinationurl); |
156 | 150 | } |
157 | 151 |
|
158 | | - $className = '\PHPPgAdmin\Controller\\' . ucfirst($subject) . 'Controller'; |
| 152 | + $className = '\PHPPgAdmin\Controller\\'.ucfirst($subject).'Controller'; |
159 | 153 | $controller = new $className($this); |
160 | 154 |
|
161 | 155 | return $controller->render(); |
|
184 | 178 | $subject = 'servers'; |
185 | 179 | } |
186 | 180 |
|
187 | | - return maybeRenderIframes($this, $response, $subject, $query_string); |
| 181 | + return $this->utils->maybeRenderIframes($response, $subject, $query_string); |
188 | 182 | }); |
189 | 183 |
|
190 | 184 | $app->get('/', function ( |
|
199 | 193 |
|
200 | 194 | $query_string = $request->getUri()->getQuery(); |
201 | 195 |
|
202 | | - return maybeRenderIframes($this, $response, $subject, $query_string); |
| 196 | + return $this->utils->maybeRenderIframes($response, $subject, $query_string); |
203 | 197 | }); |
204 | 198 |
|
205 | 199 | $app->get('[/{path:.*}]', function ($request, $response, $args) { |
206 | | - $filepath = \BASE_PATH . '/' . $args['path']; |
| 200 | + $filepath = \BASE_PATH.'/'.$args['path']; |
207 | 201 | $query_string = $request->getUri()->getQuery(); |
208 | 202 |
|
209 | 203 | $this->utils->dump($query_string, $filepath); |
|
0 commit comments