cvs: docweb /www redirect.php

colder Tue Dec 5 17:50:20 2006 UTC Modified files: /docweb/www redirect.php Log: Cleans the path parsing Require a valid mime type http://cvs.php.net/viewvc.cgi/docweb/www/redirect.php?r1=1.9&r2=1.10&diff_format=u Index: docweb/www/redirect.php diff -u docweb/www/redirect.php:1.9 docweb/www/redirect.php:1.10 --- docweb/www/redirect.php:1.9 Sun Jul 31 13:57:02 2005 +++ docweb/www/redirect.php Tue Dec 5 17:50:20 2006 @@ -15,7 +15,7 @@ +----------------------------------------------------------------------+ | Authors: Sean Coates <sean@php.net> | +----------------------------------------------------------------------+ -$Id: redirect.php,v 1.9 2005/07/31 13:57:02 vincent Exp $ +$Id: redirect.php,v 1.10 2006/12/05 17:50:20 colder Exp $ */ require_once('../include/lib_proj_lang.inc.php'); @@ -42,17 +42,19 @@ $filename = preg_replace('/\?.*$/', '', $part); // remove webroot-escape attempts - $filename = str_replace(array('..', '//'), array('', '/'), $filename); + $filename = str_replace('..', '', $filename); - // fake DirectoryIndex - if (substr($filename, -1) == '/' || $filename == '') { - $filename .= 'index.php'; - } + // remove obsolete slashes + $filename = preg_replace('#/{2,}#', '/', $filename); + + // strip ending slashes + $filename = rtrim($filename, '/'); - $filename = "./$filename"; + $filename = './'.$filename; - if (is_dir($filename)) - return "$filename/index.php"; + if (is_dir($filename)) { + return $filename.'/index.php'; + } return $filename; } @@ -103,24 +105,31 @@ // If it's a PHP file include it, otherwise pass it through if (substr($uri, -4) == '.php') { require($uri); + return; } else { - // get the file mime type + // the file can't be a directory nor a php file + // Validate the mime type + $mime = false; foreach ($mime_types as $ext => $type) { - if (substr($uri, -strlen(ext)) == $ext) { + + if (substr($uri, -strlen($ext)) == $ext) { $mime = $type; break; } - } - header("Content-Type: $mime"); - readfile($uri); + } + if ($mime !== false) { + header("Content-Type: $mime"); + readfile($uri); + return; + } } -} else { - // no resource found: - header($_SERVER['SERVER_PROTOCOL']." 404 Not Found"); - $_SERVER["REDIRECT_STATUS"] = '404'; - $uri = '/'; - require('error.php'); } +// script has not exited yet, an error must have occured, display 404. +// no resource found: +header($_SERVER['SERVER_PROTOCOL']." 404 Not Found"); +$_SERVER["REDIRECT_STATUS"] = '404'; +$uri = '/'; +require('error.php'); ?>