From 4dadfb8863df6c07267d7acc90a9bffc1783a8e4 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sat, 18 Jul 2026 15:47:23 +0200 Subject: [PATCH 01/10] Update index.php --- index.php | 128 +++++++++++++++++------------------------------------- 1 file changed, 40 insertions(+), 88 deletions(-) diff --git a/index.php b/index.php index c9a5cfb..e5dbec3 100644 --- a/index.php +++ b/index.php @@ -2,99 +2,51 @@ if (session_status() === PHP_SESSION_NONE) { session_start(); } -ob_start(); -include_once("php/controller/index.php"); -$pfad = $_GET["pfad"] ?? "home"; +include_once("php/controller/index-controller.php"); -/* - Controller für Aktionen werden vor der HTML-Ausgabe geladen, - damit Weiterleitungen mit header() funktionieren. -*/ -if ($pfad === "login") { - include_once "php/controller/login-controller.php"; -} - -if ($pfad === "register") { - include_once "php/controller/register-controller.php"; -} -if ($pfad === "password-forgotten") { -include_once "php/controller/password-forgotten-controller.php"; -} - -if ($pfad === "confirm-register") { - include_once "php/controller/confirm-register-controller.php"; -} - -if ($pfad === "confirm-password") { - include_once "php/controller/confirm-password-controller.php"; -} - -if ($pfad === "logout") { - include_once "php/controller/logout-controller.php"; - exit(); -} - -if ($pfad === "deleteAccount") { - include_once "php/controller/deleteAccount-controller.php"; - exit(); -} ?> + + + + + + + + - - - + + + + + + + + + - - - - - - + + + + + - - - - - - - - - - - - - - - - - EduForge - - - - - - - - + EduForge + + \ No newline at end of file +include_once 'includes/navbar.php'; + +// Dynamischer Inhalt (Absolut sicher durch die obige Prüfung) +if (isset($pfad) && $pfad !== "404" && file_exists('content/' . $pfad . '.php')) { + include_once 'content/' . $pfad . '.php'; +} else { + include_once 'content/404.php'; +} + +include_once 'includes/footer.php'; +?> + + + -- 2.47.3 From d341312192695da5890c2ad77c4a95849e8697a1 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sat, 18 Jul 2026 15:47:25 +0200 Subject: [PATCH 02/10] Update index-controller.php --- php/controller/index-controller.php | 31 +++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/php/controller/index-controller.php b/php/controller/index-controller.php index 62a2de0..8842024 100644 --- a/php/controller/index-controller.php +++ b/php/controller/index-controller.php @@ -1,3 +1,34 @@ -- 2.47.3 From fee5a701dffe46a78e9d45eabecc0d6186fe5c9f Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sat, 18 Jul 2026 15:50:07 +0200 Subject: [PATCH 03/10] Update index-controller.php --- php/controller/index-controller.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/php/controller/index-controller.php b/php/controller/index-controller.php index 8842024..e51b1ee 100644 --- a/php/controller/index-controller.php +++ b/php/controller/index-controller.php @@ -24,7 +24,7 @@ if (!in_array($pfad, $erlaubte_content_seiten)) { // Automatisch den passenden Controller laden, falls erlaubt if ($pfad !== "404" && in_array($pfad, $erlaubte_controller)) { - include_once "php/controller/" . $pfad . "-controller.php"; + include_once "../php/controller/" . $pfad . "-controller.php"; // Nach Logout oder Account-Löschung das Skript sofort beenden if ($pfad === "logout" || $pfad === "deleteAccount") { -- 2.47.3 From 3f9c048493c0d8cc333115e447753e5125373e1b Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sat, 18 Jul 2026 15:53:31 +0200 Subject: [PATCH 04/10] Update index.php --- index.php | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/index.php b/index.php index e5dbec3..a55aa39 100644 --- a/index.php +++ b/index.php @@ -2,9 +2,7 @@ if (session_status() === PHP_SESSION_NONE) { session_start(); } - -include_once("php/controller/index-controller.php"); - +include_once "php/controller/index-controller.php"; ?> @@ -38,7 +36,7 @@ include_once("php/controller/index-controller.php"); Date: Sat, 18 Jul 2026 15:53:33 +0200 Subject: [PATCH 05/10] Update index-controller.php --- php/controller/index-controller.php | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/php/controller/index-controller.php b/php/controller/index-controller.php index e51b1ee..0f22ebb 100644 --- a/php/controller/index-controller.php +++ b/php/controller/index-controller.php @@ -1,7 +1,8 @@ + +// Content-Validierung: Wenn der Pfad nicht erlaubt ist, dann 404 +if (!in_array($pfad, $erlaubte_content_seiten)) { + $pfad = "404"; +} -- 2.47.3 From 423941e7ed34ce9cd6332de74f78df0a19a06eca Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sat, 18 Jul 2026 16:06:35 +0200 Subject: [PATCH 06/10] Update index-controller.php --- php/controller/index-controller.php | 41 ++++++++++++++++------------- 1 file changed, 22 insertions(+), 19 deletions(-) diff --git a/php/controller/index-controller.php b/php/controller/index-controller.php index 0f22ebb..853c015 100644 --- a/php/controller/index-controller.php +++ b/php/controller/index-controller.php @@ -2,7 +2,7 @@ // Standardpfad $pfad = $_GET["pfad"] ?? "home"; -// Allowlists +// Allowlist für alle gültigen Content-Seiten $erlaubte_content_seiten = [ "accessibility", "confirm-password", "confirm-register", "createArticle", "datenschutz", "home", "impressum", "login", "nutzungsbedingungen", @@ -10,24 +10,27 @@ $erlaubte_content_seiten = [ "show-mail", "showArticle", "showCategory", "updateArticle" ]; -$erlaubte_controller = [ - "confirm-password", "confirm-register", "createArticle", "deleteAccount", - "deleteArticle", "home", "index", "like", "login", "logout", - "password-forgotten", "profile", "profileArticles", "register", - "search-results", "showArticle", "showCategory", "updateArticle" -]; - -// Controller laden -if (in_array($pfad, $erlaubte_controller)) { - include_once "php/controller/" . $pfad . "-controller.php"; - - // Sofortiger Abbruch bei zerstörenden Aktionen - if ($pfad === "logout" || $pfad === "deleteAccount") { - exit(); - } -} - -// Content-Validierung: Wenn der Pfad nicht erlaubt ist, dann 404 +// Content-Validierung if (!in_array($pfad, $erlaubte_content_seiten)) { $pfad = "404"; } + +// Controller laden +if ($pfad === "login") { + include_once "php/controller/login-controller.php"; +} elseif ($pfad === "register") { + include_once "php/controller/register-controller.php"; +} elseif ($pfad === "password-forgotten") { + include_once "php/controller/password-forgotten-controller.php"; +} elseif ($pfad === "confirm-register") { + include_once "php/controller/confirm-register-controller.php"; +} elseif ($pfad === "confirm-password") { + include_once "php/controller/confirm-password-controller.php"; +} elseif ($pfad === "logout") { + include_once "php/controller/logout-controller.php"; + exit(); +} elseif ($pfad === "deleteAccount") { + include_once "php/controller/deleteAccount-controller.php"; + exit(); +} + -- 2.47.3 From 101a2a247b13e7162de5355f332f655a05e05f68 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sat, 18 Jul 2026 16:08:05 +0200 Subject: [PATCH 07/10] Update index-controller.php --- php/controller/index-controller.php | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/php/controller/index-controller.php b/php/controller/index-controller.php index 853c015..acca836 100644 --- a/php/controller/index-controller.php +++ b/php/controller/index-controller.php @@ -18,18 +18,24 @@ if (!in_array($pfad, $erlaubte_content_seiten)) { // Controller laden if ($pfad === "login") { include_once "php/controller/login-controller.php"; -} elseif ($pfad === "register") { +} +if ($pfad === "register") { include_once "php/controller/register-controller.php"; -} elseif ($pfad === "password-forgotten") { +} +if ($pfad === "password-forgotten") { include_once "php/controller/password-forgotten-controller.php"; -} elseif ($pfad === "confirm-register") { +} +if ($pfad === "confirm-register") { include_once "php/controller/confirm-register-controller.php"; -} elseif ($pfad === "confirm-password") { +} +if ($pfad === "confirm-password") { include_once "php/controller/confirm-password-controller.php"; -} elseif ($pfad === "logout") { +} +if ($pfad === "logout") { include_once "php/controller/logout-controller.php"; exit(); -} elseif ($pfad === "deleteAccount") { +} +if ($pfad === "deleteAccount") { include_once "php/controller/deleteAccount-controller.php"; exit(); } -- 2.47.3 From f61c548b9e75a157899585999c2f86530e186a78 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sat, 18 Jul 2026 16:11:53 +0200 Subject: [PATCH 08/10] Update index.php --- index.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/index.php b/index.php index a55aa39..ac03d7b 100644 --- a/index.php +++ b/index.php @@ -37,7 +37,7 @@ include_once "php/controller/index-controller.php"; include_once 'includes/navbar.php'; // Dynamischer Inhalt (Nutzt das geprüfte $pfad aus dem Index-Controller) -if (isset($pfad) && $pfad !== "404" && file_exists('content/' . $pfad . '.php')) { +if ($pfad !== "404" && file_exists('content/' . $pfad . '.php')) { include_once 'content/' . $pfad . '.php'; } else { include_once 'content/404.php'; -- 2.47.3 From d3435d4cdeb8b19b260614c7ab3dabdebcb33c67 Mon Sep 17 00:00:00 2001 From: NOrtmann1 Date: Sat, 18 Jul 2026 16:14:09 +0200 Subject: [PATCH 09/10] Update index.php --- index.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/index.php b/index.php index ac03d7b..f2dda6c 100644 --- a/index.php +++ b/index.php @@ -36,8 +36,8 @@ include_once "php/controller/index-controller.php"; Date: Sat, 18 Jul 2026 16:19:48 +0200 Subject: [PATCH 10/10] Update index-controller.php --- php/controller/index-controller.php | 49 +++++++++++++---------------- 1 file changed, 21 insertions(+), 28 deletions(-) diff --git a/php/controller/index-controller.php b/php/controller/index-controller.php index acca836..7d598f7 100644 --- a/php/controller/index-controller.php +++ b/php/controller/index-controller.php @@ -2,7 +2,27 @@ // Standardpfad $pfad = $_GET["pfad"] ?? "home"; -// Allowlist für alle gültigen Content-Seiten +if ($pfad === "logout") { + include_once "php/controller/logout-controller.php"; + exit(); +} elseif ($pfad === "deleteAccount") { + include_once "php/controller/deleteAccount-controller.php"; + exit(); +} + +if ($pfad === "login") { + include_once "php/controller/login-controller.php"; +} elseif ($pfad === "register") { + include_once "php/controller/register-controller.php"; +} elseif ($pfad === "password-forgotten") { + include_once "php/controller/password-forgotten-controller.php"; +} elseif ($pfad === "confirm-register") { + include_once "php/controller/confirm-register-controller.php"; +} elseif ($pfad === "confirm-password") { + include_once "php/controller/confirm-password-controller.php"; +} + +// Whitelist $erlaubte_content_seiten = [ "accessibility", "confirm-password", "confirm-register", "createArticle", "datenschutz", "home", "impressum", "login", "nutzungsbedingungen", @@ -10,33 +30,6 @@ $erlaubte_content_seiten = [ "show-mail", "showArticle", "showCategory", "updateArticle" ]; -// Content-Validierung if (!in_array($pfad, $erlaubte_content_seiten)) { $pfad = "404"; } - -// Controller laden -if ($pfad === "login") { - include_once "php/controller/login-controller.php"; -} -if ($pfad === "register") { - include_once "php/controller/register-controller.php"; -} -if ($pfad === "password-forgotten") { - include_once "php/controller/password-forgotten-controller.php"; -} -if ($pfad === "confirm-register") { - include_once "php/controller/confirm-register-controller.php"; -} -if ($pfad === "confirm-password") { - include_once "php/controller/confirm-password-controller.php"; -} -if ($pfad === "logout") { - include_once "php/controller/logout-controller.php"; - exit(); -} -if ($pfad === "deleteAccount") { - include_once "php/controller/deleteAccount-controller.php"; - exit(); -} - -- 2.47.3