Update index-controller.php

Update index.php
2026-07-18 15:53:33 +02:00 · 2026-07-18 15:53:31 +02:00 · 2026-07-18 15:50:07 +02:00 · 2026-07-18 15:47:25 +02:00 · 2026-07-18 15:47:23 +02:00
2 changed files with 71 additions and 91 deletions
@@ -2,53 +2,11 @@
 if (session_status() === PHP_SESSION_NONE) {
    session_start();
 }
-ob_start();
-include_once("php/controller/index.php");
-
-$pfad = $_GET["pfad"] ?? "home";
-
-/*
-    Controller für Aktionen werden vor der HTML-Ausgabe geladen,
-    damit Weiterleitungen mit header() funktionieren.
-*/
-if ($pfad === "login") {
-    include_once "php/controller/login-controller.php";
-}
-
-if ($pfad === "register") {
-    include_once "php/controller/register-controller.php";
-}
-if ($pfad === "password-forgotten") {
-include_once "php/controller/password-forgotten-controller.php";
-}
-
-if ($pfad === "confirm-register") {
-    include_once "php/controller/confirm-register-controller.php";
-}
-
-if ($pfad === "confirm-password") {
-    include_once "php/controller/confirm-password-controller.php";
-}
-
-if ($pfad === "logout") {
-    include_once "php/controller/logout-controller.php";
-    exit();
-}
-
-if ($pfad === "deleteAccount") {
-    include_once "php/controller/deleteAccount-controller.php";
-    exit();
-}
+include_once "php/controller/index-controller.php";
 ?>
-
-    <!--
-        Seite: Index der Lernplattform
-        Funktion: Webseitengerüst, Anzeigen von Content
-    -->
-    <!DOCTYPE html>
-    <html lang="de">
-
-    <head>
+<!DOCTYPE html>
+<html lang="de">
+<head>
    <meta charset="utf-8">
    <meta name="description" content="EduForge">
    <meta name="author" content="Niklas Ortmann">
@@ -72,29 +30,21 @@ if ($pfad === "deleteAccount") {
    <script src="js/filter.js" async></script>

    <title>EduForge</title>
-    </head>
-
-    <body>
-
-    <?php
-    include_once 'includes/navbar.php';
-
-    /*
-        Dynamischer Inhalt:
-        Je nach pfad-Parameter wird die passende Datei aus content geladen.
-    */
-    if (file_exists('content/' . $pfad . '.php')) {
-        include_once 'content/' . $pfad . '.php';
-    } else {
-        include_once 'content/404.php';
-    }
-
-    include_once 'includes/footer.php';
-    ?>
-
-    </body>
-    </html>
+</head>
+<body>

 <?php
-ob_end_flush();
+include_once 'includes/navbar.php';
+
+// Dynamischer Inhalt (Nutzt das geprüfte $pfad aus dem Index-Controller)
+if (isset($pfad) && $pfad !== "404" && file_exists('content/' . $pfad . '.php')) {
+    include_once 'content/' . $pfad . '.php';
+} else {
+    include_once 'content/404.php';
+}
+
+include_once 'includes/footer.php';
 ?>
+
+</body>
+</html>
@@ -1,3 +1,33 @@
 <?php
+// Standardpfad
+$pfad = $_GET["pfad"] ?? "home";

-?>
+// Allowlists
+$erlaubte_content_seiten = [
+    "accessibility", "confirm-password", "confirm-register", "createArticle",
+    "datenschutz", "home", "impressum", "login", "nutzungsbedingungen",
+    "password-forgotten", "profile", "register", "search-results",
+    "show-mail", "showArticle", "showCategory", "updateArticle"
+];
+
+$erlaubte_controller = [
+    "confirm-password", "confirm-register", "createArticle", "deleteAccount",
+    "deleteArticle", "home", "index", "like", "login", "logout",
+    "password-forgotten", "profile", "profileArticles", "register",
+    "search-results", "showArticle", "showCategory", "updateArticle"
+];
+
+// Controller laden
+if (in_array($pfad, $erlaubte_controller)) {
+    include_once "php/controller/" . $pfad . "-controller.php";
+
+    // Sofortiger Abbruch bei zerstörenden Aktionen
+    if ($pfad === "logout" || $pfad === "deleteAccount") {
+        exit();
+    }
+}
+
+// Content-Validierung: Wenn der Pfad nicht erlaubt ist, dann 404
+if (!in_array($pfad, $erlaubte_content_seiten)) {
+    $pfad = "404";
+}
Author	SHA1	Message	Date
niklas.ortmann	a8e76c782d	Update index-controller.php	2026-07-18 15:53:33 +02:00
niklas.ortmann	3f9c048493	Update index.php	2026-07-18 15:53:31 +02:00
niklas.ortmann	fee5a701df	Update index-controller.php	2026-07-18 15:50:07 +02:00
niklas.ortmann	d341312192	Update index-controller.php	2026-07-18 15:47:25 +02:00
niklas.ortmann	4dadfb8863	Update index.php	2026-07-18 15:47:23 +02:00