35 lines
1.1 KiB
PHP
35 lines
1.1 KiB
PHP
<?php
|
|
$pfad = $_GET["pfad"] ?? "home";
|
|
|
|
// Allowlist für Content
|
|
$erlaubte_content_seiten = [
|
|
"accessibility", "confirm-password", "confirm-register", "createArticle",
|
|
"datenschutz", "home", "impressum", "login", "nutzungsbedingungen",
|
|
"password-forgotten", "profile", "register", "search-results",
|
|
"show-mail", "showArticle", "showCategory", "updateArticle"
|
|
];
|
|
|
|
// Allowlist für Controller
|
|
$erlaubte_controller = [
|
|
"confirm-password", "confirm-register", "createArticle", "deleteAccount",
|
|
"deleteArticle", "home", "index", "like", "login", "logout",
|
|
"password-forgotten", "profile", "profileArticles", "register",
|
|
"search-results", "showArticle", "showCategory", "updateArticle"
|
|
];
|
|
|
|
// Validierung der Content-Seite
|
|
if (!in_array($pfad, $erlaubte_content_seiten)) {
|
|
$pfad = "404";
|
|
}
|
|
|
|
// Automatisch den passenden Controller laden, falls erlaubt
|
|
if ($pfad !== "404" && in_array($pfad, $erlaubte_controller)) {
|
|
include_once "../php/controller/" . $pfad . "-controller.php";
|
|
|
|
// Nach Logout oder Account-Löschung das Skript sofort beenden
|
|
if ($pfad === "logout" || $pfad === "deleteAccount") {
|
|
exit();
|
|
}
|
|
}
|
|
?>
|