7 lines
530 B
PHP
7 lines
530 B
PHP
<?php
|
|
$path = rawurldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH));
|
|
if (preg_match('~(?:^|/)(?:\.\w+|dev)(?:/|$)|\.(?:sql(?:\.gz|\.zip)?|log|sh)$|^/dashboard/(?:tools|migrations)/|^/dashboard/bootstrap\.php$~i', $path) || strpos($path, '\\') !== false || strpos($path, "\0") !== false) { http_response_code(404); exit('Not found'); }
|
|
$root=realpath(__DIR__.'/..'); $file=realpath($root.$path);
|
|
if ($file && $file !== $root && strpos($file,$root.DIRECTORY_SEPARATOR)!==0) { http_response_code(404); exit; }
|
|
return false;
|