cvs: docweb /www redirect.php

colder		Tue Dec  5 17:50:20 2006 UTC

  Modified files:              
    /docweb/www	redirect.php 
  Log:
  Cleans the path parsing
  Require a valid mime type
  
http://cvs.php.net/viewvc.cgi/docweb/www/redirect.php?r1=1.9&r2=1.10&diff_format=u
Index: docweb/www/redirect.php
diff -u docweb/www/redirect.php:1.9 docweb/www/redirect.php:1.10
--- docweb/www/redirect.php:1.9	Sun Jul 31 13:57:02 2005
+++ docweb/www/redirect.php	Tue Dec  5 17:50:20 2006
@@ -15,7 +15,7 @@
 +----------------------------------------------------------------------+
 | Authors:          Sean Coates <[email protected]>                         |
 +----------------------------------------------------------------------+
-$Id: redirect.php,v 1.9 2005/07/31 13:57:02 vincent Exp $
+$Id: redirect.php,v 1.10 2006/12/05 17:50:20 colder Exp $
 */
 
 require_once('../include/lib_proj_lang.inc.php');
@@ -42,17 +42,19 @@
     $filename = preg_replace('/\?.*$/', '', $part);
 
     // remove webroot-escape attempts
-    $filename = str_replace(array('..', '//'), array('', '/'), $filename);
+    $filename = str_replace('..', '', $filename);
     
-    // fake DirectoryIndex
-    if (substr($filename, -1) == '/' || $filename == '') {
-        $filename .= 'index.php';
-    }
+    // remove obsolete slashes
+    $filename = preg_replace('#/{2,}#', '/', $filename);
+    
+    // strip ending slashes
+    $filename = rtrim($filename, '/');
 
-    $filename = "./$filename";
+    $filename = './'.$filename;
 
-    if (is_dir($filename))
-        return "$filename/index.php";
+    if (is_dir($filename)) {
+        return $filename.'/index.php';
+    }
 
     return $filename;
 }
@@ -103,24 +105,31 @@
     // If it's a PHP file include it, otherwise pass it through
     if (substr($uri, -4) == '.php') {
         require($uri);
+        return;
     } else {
-        // get the file mime type
+        // the file can't be a directory nor a php file
+        // Validate the mime type
+        $mime = false;
         foreach ($mime_types as $ext => $type) {
-            if (substr($uri, -strlen(ext)) == $ext) {
+            
+            if (substr($uri, -strlen($ext)) == $ext) {
                 $mime = $type;
                 break;
             }
-        }
 
-        header("Content-Type: $mime");
-        readfile($uri);
+        }
+        if ($mime !== false) {
+            header("Content-Type: $mime");
+            readfile($uri);
+            return;
+        } 
     }
-} else {
-  // no resource found:
-  header($_SERVER['SERVER_PROTOCOL']." 404 Not Found");
-  $_SERVER["REDIRECT_STATUS"] = '404';
-  $uri = '/';
-  require('error.php');
 }
+// script has not exited yet, an error must have occured, display 404.
+// no resource found:
+header($_SERVER['SERVER_PROTOCOL']." 404 Not Found");
+$_SERVER["REDIRECT_STATUS"] = '404';
+$uri = '/';
+require('error.php');
 
 ?>