diff --git a/route.php b/route.php index 31e9a3c..3142a28 100644 --- a/route.php +++ b/route.php @@ -63,10 +63,8 @@ class route { // Calculate the root in relative $request = $this->requestURL (); - $root = dirname ($_SERVER["SCRIPT_NAME"]); - $requestdir = substr ($request, 1+strlen ($root)); $this->baseURL = str_repeat ("../", - substr_count ($requestdir, "/")). + substr_count ($request, "/")). $this->baseURL; if ($this->baseURL === "") $this->baseURL = "./"; @@ -121,7 +119,7 @@ class route $url .= "//".$_SERVER["SERVER_NAME"].$port; } if (isset ($_SERVER["REQUEST_URI"])) - $url .= $_SERVER["REQUEST_URI"]; + $url .= substr ($_SERVER["REQUEST_URI"], 1+strlen (dirname ($_SERVER["SCRIPT_NAME"]))); return $url; } @@ -155,7 +153,7 @@ class route // Allow to redirect from POST to GET, but not GET to GET (can loop) if ($destURL === $requestURL && $_SERVER["REQUEST_METHOD"] === "GET") throw new Exception ("Redirect to myself", 508); - if (substr ($destURL, 0, strlen ($baseURL)) !== $baseURL) + if (substr_count ("../", $baseURL) > 1+ substr_count ("/", $destURL)) throw new Exception ("Can't redirect outside this site (Base $baseURL)", 405); @@ -314,7 +312,7 @@ file_put_contents ("/tmp/csrf.log", date ("Y-m-d H:i:s")." DELETE route->map ($r public function map ($route, $function) { $url = substr ($this->requestURL (), strlen ($this->baseURLmodule ())); - $url = substr ($this->requestURL (), 1+ strlen (dirname ($_SERVER["SCRIPT_NAME"]))); + $url = $this->requestURL (); if ($this->debug) echo "$url "; if ($url === $route)