From d341312192695da5890c2ad77c4a95849e8697a1 Mon Sep 17 00:00:00 2001
From: NOrtmann1 <ortmann.niklas@yahoo.de>
Date: Sat, 18 Jul 2026 15:47:25 +0200
Subject: [PATCH] Update index-controller.php

---
 php/controller/index-controller.php | 31 +++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/php/controller/index-controller.php b/php/controller/index-controller.php
index 62a2de0..8842024 100644
--- a/php/controller/index-controller.php
+++ b/php/controller/index-controller.php
@@ -1,3 +1,34 @@
 <?php
+$pfad = $_GET["pfad"] ?? "home";
 
+// Allowlist für Content
+$erlaubte_content_seiten = [
+    "accessibility", "confirm-password", "confirm-register", "createArticle",
+    "datenschutz", "home", "impressum", "login", "nutzungsbedingungen",
+    "password-forgotten", "profile", "register", "search-results",
+    "show-mail", "showArticle", "showCategory", "updateArticle"
+];
+
+// Allowlist für Controller
+$erlaubte_controller = [
+    "confirm-password", "confirm-register", "createArticle", "deleteAccount",
+    "deleteArticle", "home", "index", "like", "login", "logout",
+    "password-forgotten", "profile", "profileArticles", "register",
+    "search-results", "showArticle", "showCategory", "updateArticle"
+];
+
+// Validierung der Content-Seite
+if (!in_array($pfad, $erlaubte_content_seiten)) {
+    $pfad = "404";
+}
+
+// Automatisch den passenden Controller laden, falls erlaubt
+if ($pfad !== "404" && in_array($pfad, $erlaubte_controller)) {
+    include_once "php/controller/" . $pfad . "-controller.php";
+
+    // Nach Logout oder Account-Löschung das Skript sofort beenden
+    if ($pfad === "logout" || $pfad === "deleteAccount") {
+        exit();
+    }
+}
 ?>