Clean URLs and security improvements
- Add .htaccess rewrite rules for clean URLs (/nl/page, /admin/route) - Add PHP dev server router with clean URL support - Update admin template asset paths to absolute for clean URL compat - All pentest fixes verified: CSRF on login, directory listing disabled, secure cookies, backup/sourcemap files removed, version disclosure off
This commit is contained in:
@@ -57,6 +57,48 @@ class CodePressCMS {
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Build a clean URL for a page
|
||||
*
|
||||
* @param string $page Page path (e.g., 'blog/leren/artikel')
|
||||
* @param string|null $lang Language code
|
||||
* @param array $params Additional query parameters
|
||||
* @return string Clean URL
|
||||
*/
|
||||
public function buildUrl($page = 'index', $lang = null, $params = []) {
|
||||
$lang = $lang ?: $this->currentLanguage;
|
||||
$url = '/' . $lang;
|
||||
if ($page && $page !== 'index') {
|
||||
$url .= '/' . $page;
|
||||
}
|
||||
if (!empty($params)) {
|
||||
$url .= '?' . http_build_query($params);
|
||||
}
|
||||
return $url;
|
||||
}
|
||||
|
||||
/**
|
||||
* Build a clean admin URL
|
||||
*
|
||||
* @param string $route Admin route
|
||||
* @param array $params Additional query parameters
|
||||
* @return string Clean admin URL
|
||||
*/
|
||||
public static function buildAdminUrl($route = '', $params = []) {
|
||||
$url = $route ? '/admin/' . $route : '/admin';
|
||||
if (!empty($params)) {
|
||||
$url .= '?' . http_build_query($params);
|
||||
}
|
||||
return $url;
|
||||
}
|
||||
|
||||
/**
|
||||
* Build URL string for template use (non-static, with current lang context)
|
||||
*/
|
||||
public function url($page = 'index', $extraParams = []) {
|
||||
return $this->buildUrl($page, $this->currentLanguage, $extraParams);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get current language from request or config
|
||||
*
|
||||
@@ -215,7 +257,7 @@ class CodePressCMS {
|
||||
'type' => 'file',
|
||||
'title' => $title,
|
||||
'path' => $pathWithoutExt,
|
||||
'url' => '?page=' . $pathWithoutExt . '&lang=' . $this->currentLanguage
|
||||
'url' => $this->buildUrl($pathWithoutExt)
|
||||
];
|
||||
}
|
||||
}
|
||||
@@ -262,7 +304,7 @@ class CodePressCMS {
|
||||
$this->searchResults[] = [
|
||||
'title' => $title,
|
||||
'path' => $relativePath,
|
||||
'url' => '?page=' . $relativePath . '&lang=' . $this->currentLanguage,
|
||||
'url' => $this->buildUrl($relativePath),
|
||||
'snippet' => $this->createSnippet($content, $query)
|
||||
];
|
||||
}
|
||||
@@ -297,8 +339,9 @@ class CodePressCMS {
|
||||
return $this->getSearchResults();
|
||||
}
|
||||
|
||||
// Check if guide is requested
|
||||
if (isset($_GET['guide'])) {
|
||||
// Check if guide is requested (either via ?guide or /guide clean URL)
|
||||
$pageCheck = $_GET['page'] ?? '';
|
||||
if (isset($_GET['guide']) || $pageCheck === 'guide') {
|
||||
return $this->getGuidePage();
|
||||
}
|
||||
|
||||
@@ -536,9 +579,9 @@ class CodePressCMS {
|
||||
// Auto-link page titles to existing content pages (but not in H1 tags)
|
||||
$body = $this->autoLinkPageTitles($body, $cleanName);
|
||||
|
||||
// Convert relative internal links to CMS format
|
||||
$body = preg_replace('/href="\/blog\/([^"]+)"/', 'href="?page=blog/$1"', $body);
|
||||
$body = preg_replace('/href="\/([^"]+)"/', 'href="?page=$1"', $body);
|
||||
// Convert relative internal links to clean URLs
|
||||
$body = preg_replace('/href="\/blog\/([^"]+)"/', 'href="/' . $this->currentLanguage . '/blog/$1"', $body);
|
||||
$body = preg_replace('/href="\/([^"]+)"/', 'href="/' . $this->currentLanguage . '/$1"', $body);
|
||||
|
||||
return [
|
||||
'title' => $title ?: $cleanName ?: 'Untitled',
|
||||
@@ -578,7 +621,7 @@ class CodePressCMS {
|
||||
return $text; // Don't link existing links, current page title, or H1 headings
|
||||
}
|
||||
|
||||
return '<a href="?page=' . $pagePath . '&lang=' . $this->currentLanguage . '" class="auto-link" title="' . $this->t('go_to') . ' ' . htmlspecialchars($pageTitle) . '">' . $text . '</a>';
|
||||
return '<a href="' . $this->buildUrl($pagePath) . '" class="auto-link" title="' . $this->t('go_to') . ' ' . htmlspecialchars($pageTitle) . '">' . $text . '</a>';
|
||||
};
|
||||
|
||||
$content = preg_replace_callback($pattern, $replacement, $content);
|
||||
@@ -916,7 +959,7 @@ private function getGuidePage() {
|
||||
$allItems[] = [
|
||||
'name' => ucfirst($item),
|
||||
'path' => $relativePath,
|
||||
'url' => '?page=' . $relativePath,
|
||||
'url' => $this->buildUrl($relativePath),
|
||||
'icon' => 'bi-folder',
|
||||
'type' => 'directory'
|
||||
];
|
||||
@@ -929,7 +972,7 @@ private function getGuidePage() {
|
||||
$allItems[] = [
|
||||
'name' => $fileTitle,
|
||||
'path' => $pathWithoutExt,
|
||||
'url' => '?page=' . $pathWithoutExt,
|
||||
'url' => $this->buildUrl($pathWithoutExt),
|
||||
'icon' => $icon,
|
||||
'type' => 'file'
|
||||
];
|
||||
@@ -1021,7 +1064,7 @@ private function getGuidePage() {
|
||||
'is_homepage' => (!isset($_GET['page']) || $_GET['page'] === $this->config['default_page']),
|
||||
'home_active_class' => (!isset($_GET['page']) || $_GET['page'] === $this->config['default_page']) ? 'active' : '',
|
||||
'is_guide_page' => isset($_GET['guide']),
|
||||
'lang_switch_url' => isset($_GET['guide']) ? '&guide' : '&page=' . $this->config['default_page'],
|
||||
'lang_switch_url' => '',
|
||||
'author_name' => $this->config['author']['name'] ?? 'CodePress Developer',
|
||||
'author_website' => $this->config['author']['website'] ?? '#',
|
||||
'author_git' => 'https://git.noorlander.info/E.Noorlander',
|
||||
@@ -1133,13 +1176,14 @@ private function getGuidePage() {
|
||||
$sidebarToggle = '<li class="breadcrumb-item sidebar-toggle-item"><button type="button" class="sidebar-toggle-btn" onclick="toggleSidebar()" title="Toggle Sidebar" aria-label="Toggle Sidebar" aria-expanded="true"><i class="bi bi-layout-sidebar-inset"></i></button></li>';
|
||||
|
||||
if (isset($_GET['search'])) {
|
||||
return '<nav aria-label="breadcrumb"><ol class="breadcrumb">' . $sidebarToggle . '<li class="breadcrumb-item"><a href="?page=' . $this->config['default_page'] . '&lang=' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li><li class="breadcrumb-item"> > </li><li class="breadcrumb-item active">' . $this->t('search') . '</li></ol></nav>';
|
||||
return '<nav aria-label="breadcrumb"><ol class="breadcrumb">' . $sidebarToggle . '<li class="breadcrumb-item"><a href="/' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li><li class="breadcrumb-item"> > </li><li class="breadcrumb-item active">' . $this->t('search') . '</li></ol></nav>';
|
||||
}
|
||||
|
||||
$page = $_GET['page'] ?? $this->config['default_page'];
|
||||
$page = htmlspecialchars($page, ENT_QUOTES, 'UTF-8');
|
||||
$page = preg_replace('/\.[^.]+$/', '', $page);
|
||||
|
||||
// Convert page to clean URL format for breadcrumb
|
||||
if ($page === $this->config['default_page']) {
|
||||
return '<nav aria-label="breadcrumb"><ol class="breadcrumb">' . $sidebarToggle . '<li class="breadcrumb-item active"><i class="bi bi-house"></i></li></ol></nav>';
|
||||
}
|
||||
@@ -1148,7 +1192,7 @@ private function getGuidePage() {
|
||||
|
||||
// Start with sidebar toggle, then home icon linking to default page (root)
|
||||
$breadcrumb .= $sidebarToggle;
|
||||
$breadcrumb .= '<li class="breadcrumb-item"><a href="?page=' . $this->config['default_page'] . '&lang=' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li>';
|
||||
$breadcrumb .= '<li class="breadcrumb-item"><a href="/' . $this->currentLanguage . '"><i class="bi bi-house"></i></a></li>';
|
||||
|
||||
// Split page path and build breadcrumb items
|
||||
$parts = explode('/', $page);
|
||||
@@ -1164,7 +1208,7 @@ private function getGuidePage() {
|
||||
$breadcrumb .= '<li class="breadcrumb-item"> > </li><li class="breadcrumb-item active">' . $title . '</li>';
|
||||
} else {
|
||||
// Parent directory - clickable link with separator
|
||||
$breadcrumb .= '<li class="breadcrumb-item"> > </li><li class="breadcrumb-item"><a href="?page=' . $safePath . '&lang=' . $this->currentLanguage . '">' . $title . '</a></li>';
|
||||
$breadcrumb .= '<li class="breadcrumb-item"> > </li><li class="breadcrumb-item"><a href="/' . $this->currentLanguage . '/' . $safePath . '">' . $title . '</a></li>';
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
+38
-44
@@ -1,59 +1,53 @@
|
||||
<?php
|
||||
// Router file for PHP development server to handle security and static files
|
||||
// Router file for PHP development server - clean URL support + static file serving
|
||||
|
||||
$requestUri = $_SERVER['REQUEST_URI'];
|
||||
$parsedUrl = parse_url($requestUri);
|
||||
$path = $parsedUrl['path'];
|
||||
$path = $parsedUrl['path'] ?? '/';
|
||||
$path = rtrim($path, '/') ?: '/';
|
||||
$publicDir = __DIR__ . '/../public';
|
||||
|
||||
// Block direct access to content directory
|
||||
if (strpos($path, '/content/') === 0) {
|
||||
http_response_code(403);
|
||||
echo '<h1>403 - Forbidden</h1><p>Access denied.</p>';
|
||||
$mimeTypes = [
|
||||
'css' => 'text/css',
|
||||
'js' => 'application/javascript',
|
||||
'svg' => 'image/svg+xml',
|
||||
'png' => 'image/png',
|
||||
'jpg' => 'image/jpeg',
|
||||
'ico' => 'image/x-icon',
|
||||
'woff' => 'font/woff',
|
||||
'woff2' => 'font/woff2',
|
||||
'json' => 'application/json',
|
||||
];
|
||||
|
||||
// Serve static files from public/
|
||||
$filePath = $publicDir . $path;
|
||||
if (is_file($filePath)) {
|
||||
$ext = strtolower(pathinfo($filePath, PATHINFO_EXTENSION));
|
||||
if (isset($mimeTypes[$ext])) {
|
||||
header('Content-Type: ' . $mimeTypes[$ext]);
|
||||
}
|
||||
readfile($filePath);
|
||||
return true;
|
||||
}
|
||||
|
||||
// Block PHP execution in content directory
|
||||
if (preg_match('/\.php$/i', $path) && strpos($path, '/content/') !== false) {
|
||||
http_response_code(403);
|
||||
echo '<h1>403 - Forbidden</h1><p>PHP execution not allowed in content directory.</p>';
|
||||
// Admin routes: /admin/login → admin.php?route=login
|
||||
if (preg_match('#^/admin(?:/(.+))?$#', $path, $m)) {
|
||||
$_GET['route'] = $m[1] ?? 'dashboard';
|
||||
require $publicDir . '/admin.php';
|
||||
return true;
|
||||
}
|
||||
|
||||
// Block access to sensitive files
|
||||
$sensitiveFiles = ['.htaccess', 'config.php'];
|
||||
foreach ($sensitiveFiles as $file) {
|
||||
if (basename($path) === $file && dirname($path) === '/') {
|
||||
http_response_code(403);
|
||||
echo '<h1>403 - Forbidden</h1><p>Access denied.</p>';
|
||||
return true;
|
||||
// Language-prefixed routes: /nl/page/path → index.php?lang=nl&page=page/path
|
||||
if (preg_match('#^/(nl|en)(?:/(.+))?$#', $path, $m)) {
|
||||
$_GET['lang'] = $m[1];
|
||||
$_GET['page'] = $m[2] ?? 'index';
|
||||
if ($_GET['page'] === 'guide') {
|
||||
$_GET['guide'] = '1';
|
||||
}
|
||||
require $publicDir . '/index.php';
|
||||
return true;
|
||||
}
|
||||
|
||||
// Serve static files from engine/assets
|
||||
if (strpos($path, '/engine/') === 0) {
|
||||
$filePath = __DIR__ . $path;
|
||||
if (file_exists($filePath)) {
|
||||
// Set appropriate content type
|
||||
$extension = strtolower(pathinfo($filePath, PATHINFO_EXTENSION));
|
||||
$mimeTypes = [
|
||||
'css' => 'text/css',
|
||||
'js' => 'application/javascript',
|
||||
'svg' => 'image/svg+xml',
|
||||
'woff' => 'font/woff',
|
||||
'woff2' => 'font/woff2',
|
||||
'ttf' => 'font/ttf'
|
||||
];
|
||||
|
||||
if (isset($mimeTypes[$extension])) {
|
||||
header('Content-Type: ' . $mimeTypes[$extension]);
|
||||
}
|
||||
|
||||
// Serve the file
|
||||
readfile($filePath);
|
||||
return true;
|
||||
}
|
||||
}
|
||||
|
||||
// Route all other requests to index.php
|
||||
include __DIR__ . '/index.php';
|
||||
// Root or unknown → index.php
|
||||
require $publicDir . '/index.php';
|
||||
return true;
|
||||
@@ -19,7 +19,7 @@
|
||||
</div>
|
||||
<div class="site-info">
|
||||
<small class="text-muted">
|
||||
<a href="?guide&lang={{current_lang}}" class="footer-icon guide" title="{{t_guide}}">
|
||||
<a href="/{{current_lang}}/guide" class="footer-icon guide" title="{{t_guide}}">
|
||||
<i class="bi bi-book"></i>
|
||||
</a>
|
||||
<span class="ms-1">|</span>
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
<header id="site-header" class="navbar navbar-expand-lg navbar-dark" style="background-color: transparent;">
|
||||
<div class="container-fluid">
|
||||
<a class="navbar-brand" href="?page={{default_page}}&lang={{current_lang}}">
|
||||
<a class="navbar-brand" href="/{{current_lang}}">
|
||||
<img src="/assets/icon.svg" alt="CodePress Logo" width="32" height="32" class="me-2">
|
||||
{{site_title}}
|
||||
</a>
|
||||
@@ -27,7 +27,7 @@
|
||||
<ul class="dropdown-menu dropdown-menu-end" role="menu">
|
||||
{{#available_langs}}
|
||||
<li role="none">
|
||||
<a class="dropdown-item {{#is_current}}active{{/is_current}}" href="?lang={{code}}{{lang_switch_url}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
|
||||
<a class="dropdown-item {{#is_current}}active{{/is_current}}" href="/{{code}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
|
||||
{{native_name}}
|
||||
</a>
|
||||
</li>
|
||||
@@ -47,7 +47,7 @@
|
||||
<ul class="dropdown-menu dropdown-menu-end" role="menu">
|
||||
{{#available_langs}}
|
||||
<li role="none">
|
||||
<a class="dropdown-item {{#is_current}}active{{/is_current}}" href="?lang={{code}}{{lang_switch_url}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
|
||||
<a class="dropdown-item {{#is_current}}active{{/is_current}}" href="/{{code}}" role="menuitem" {{#is_current}}aria-current="true"{{/is_current}} lang="{{code}}">
|
||||
{{native_name}}
|
||||
</a>
|
||||
</li>
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
<div class="col">
|
||||
<ul class="nav nav-tabs flex-wrap" role="menubar">
|
||||
<li class="nav-item" role="none">
|
||||
<a class="nav-link {{home_active_class}}" href="?page={{homepage}}&lang={{current_lang}}" role="menuitem" aria-current="{{#is_homepage}}page{{/is_homepage}}">
|
||||
<a class="nav-link {{home_active_class}}" href="/{{current_lang}}" role="menuitem" aria-current="{{#is_homepage}}page{{/is_homepage}}">
|
||||
<i class="bi bi-house" aria-hidden="true"></i> {{homepage_title}}
|
||||
</a>
|
||||
</li>
|
||||
|
||||
Reference in New Issue
Block a user