Invalid site URL format.
'; echo 'Use: /site/username/filename.php
'; exit; } $username = $matches[1]; $filePath = $matches[2] ?? '/index.php'; // Default to index.php if only directory requested if (substr($filePath, -1) === '/') { $filePath .= 'index.php'; } // Sanitise — prevent directory traversal $filePath = '/' . implode('/', array_filter(array_map(function($part) { return ($part === '..' || $part === '.') ? '' : $part; }, explode('/', $filePath)))); // Check user exists $db = new PDO('sqlite:/data/db/platform.sqlite'); $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); $stmt = $db->prepare('SELECT id FROM users WHERE username = ?'); $stmt->execute([$username]); if (!$stmt->fetch()) { http_response_code(404); echo 'No site found for user: ' . htmlspecialchars($username) . '
'; exit; } $htdocs = "/data/sites/{$username}/htdocs"; $fullPath = $htdocs . $filePath; if (!file_exists($fullPath)) { http_response_code(404); echo 'File not found: ' . htmlspecialchars($filePath) . '
'; exit; } // ── Serve static files directly ─────────────────────────────────────────────── $ext = strtolower(pathinfo($fullPath, PATHINFO_EXTENSION)); $mimeTypes = [ 'html' => 'text/html', 'htm' => 'text/html', 'css' => 'text/css', 'js' => 'application/javascript', 'json' => 'application/json', 'png' => 'image/png', 'jpg' => 'image/jpeg', 'jpeg' => 'image/jpeg', 'gif' => 'image/gif', 'webp' => 'image/webp', 'svg' => 'image/svg+xml', 'ico' => 'image/x-icon', 'txt' => 'text/plain', 'pdf' => 'application/pdf', 'woff' => 'font/woff', 'woff2'=> 'font/woff2', ]; if ($ext !== 'php') { $mime = $mimeTypes[$ext] ?? 'application/octet-stream'; header("Content-Type: {$mime}"); readfile($fullPath); exit; } // ── Execute PHP files ───────────────────────────────────────────────────────── // Set environment so the included PHP file feels like it was requested directly $_SERVER['DOCUMENT_ROOT'] = $htdocs; $_SERVER['SCRIPT_FILENAME'] = $fullPath; $_SERVER['SCRIPT_NAME'] = $filePath; $_SERVER['PHP_SELF'] = $filePath; // Change working directory so relative includes work chdir($htdocs); // Buffer and include the PHP file ob_start(); include $fullPath; $output = ob_get_clean(); echo $output;