File manager - Edit - /home/webapp69.cm.in.th/u69319090028/Shop/app/Controllers/HomeController.php
Back
<?php /** * HomeController * Dynamic Marketplace Landing page and language switcher */ require_once __DIR__ . '/../Core/Controller.php'; require_once __DIR__ . '/../Services/ProductService.php'; require_once __DIR__ . '/../Helpers/Language.php'; require_once __DIR__ . '/../Helpers/Url.php'; class HomeController extends Controller { private ProductService $productService; public function __construct() { $this->productService = new ProductService(); } public function index(): void { $data = $this->productService->getHomepageData(); $this->render('home/index', array_merge($data, [ 'pageTitle' => 'CARGOO - Online Shopping Marketplace', ]), 'main'); } public function setLanguage(?string $lang = null): void { $locale = $lang ?? $_GET['lang'] ?? 'th'; // Strictly validate allowed locales $config = []; if (file_exists(__DIR__ . '/../../config/app.php')) { $config = require __DIR__ . '/../../config/app.php'; } $supported = $config['supported_locales'] ?? ['th', 'en']; $default = $config['default_locale'] ?? 'th'; if (!in_array($locale, $supported, true)) { $locale = $default; } Language::setLocale($locale); // Safe return URL calculation $targetUrl = $_GET['return'] ?? $_GET['redirect'] ?? $_SERVER['HTTP_REFERER'] ?? Url::to('/'); $safeUrl = $this->sanitizeRedirectUrl($targetUrl); header("Location: " . $safeUrl); exit; } /** * Sanitize redirect target URL against Open Redirect, CRLF, loops, and dangerous protocols */ public function sanitizeRedirectUrl(string $url): string { $url = trim($url); if ($url === '') { return Url::to('/'); } // Prevent CRLF injection if (preg_match('/[\r\n]/', $url)) { return Url::to('/'); } // Prevent protocol-relative URLs (e.g. //evil.com or \\evil.com) if (str_starts_with($url, '//') || str_starts_with($url, '\\\\')) { return Url::to('/'); } // Prevent dangerous pseudo-protocols if (preg_match('/^(javascript|data|vbscript):/i', $url)) { return Url::to('/'); } $parsed = parse_url($url); if ($parsed === false) { return Url::to('/'); } $appConfig = []; if (file_exists(__DIR__ . '/../../config/app.php')) { $appConfig = require __DIR__ . '/../../config/app.php'; } $appUrl = rtrim($appConfig['app_url'] ?? 'http://localhost/CARGOO', '/'); $basePath = rtrim($appConfig['base_path'] ?? '/CARGOO', '/'); $parsedApp = parse_url($appUrl); // If absolute URL host is provided, ensure it matches current app host or server host if (isset($parsed['host'])) { $allowedHosts = array_filter([ $parsedApp['host'] ?? null, $_SERVER['HTTP_HOST'] ?? null, $_SERVER['SERVER_NAME'] ?? null, 'localhost', '127.0.0.1' ]); $matched = false; foreach ($allowedHosts as $allowed) { $allowedWithoutPort = explode(':', $allowed)[0]; $hostWithoutPort = explode(':', $parsed['host'])[0]; if (strcasecmp($hostWithoutPort, $allowedWithoutPort) === 0) { $matched = true; break; } } if (!$matched) { return Url::to('/'); } } $path = $parsed['path'] ?? '/'; // Prevent redirecting to language switcher endpoints themselves (prevent infinite loop) $cleanPath = '/' . trim($path, '/'); if ($basePath !== '' && str_starts_with($cleanPath, $basePath)) { $routePath = substr($cleanPath, strlen($basePath)); } else { $routePath = $cleanPath; } $routePath = '/' . trim($routePath, '/'); if (preg_match('#^/(language|set-language|lang)(/|$)#i', $routePath)) { return Url::to('/'); } // Build sanitized URL preserving query string & fragment $queryString = isset($parsed['query']) ? '?' . $parsed['query'] : ''; $fragment = isset($parsed['fragment']) ? '#' . $parsed['fragment'] : ''; if (isset($parsed['scheme']) && isset($parsed['host'])) { $port = isset($parsed['port']) ? ':' . $parsed['port'] : ''; return $parsed['scheme'] . '://' . $parsed['host'] . $port . $path . $queryString . $fragment; } if ($basePath !== '' && !str_starts_with($path, $basePath)) { return Url::to($path) . $queryString . $fragment; } return $path . $queryString . $fragment; } }
| ver. 1.4 |
Github
|
.
| PHP 7.4.33 | Generation time: 0.23 |
proxy
|
phpinfo
|
Settings