<?php
 $_SERVER['HTTP_MOD_REWRITE'] = 'On'; $uri = urldecode(parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH)); if ($uri !== '/' && is_file(__DIR__ . $uri)) { return false; } if (preg_match('#^/storage/(images|cache)/(.+)$#', $uri, $m)) { $file = dirname(__DIR__) . '/storage/' . $m[1] . '/' . $m[2]; if (is_file($file)) { $ext = strtolower(pathinfo($file, PATHINFO_EXTENSION)); $mime = ['png'=>'image/png','jpg'=>'image/jpeg','jpeg'=>'image/jpeg', 'gif'=>'image/gif','webp'=>'image/webp','svg'=>'image/svg+xml', 'ico'=>'image/x-icon'][$ext] ?? 'application/octet-stream'; header('Content-Type: ' . $mime); header('Cache-Control: public, max-age=86400'); readfile($file); return true; } http_response_code(404); return true; } $blocked = ['core', 'registry', 'build', 'tools', 'docs', 'site']; foreach ($blocked as $b) { if (preg_match('#^/' . $b . '(/|$)#', $uri)) { http_response_code(403); echo '403 Forbidden'; return true; } } if (preg_match('#^/storage/#', $uri) && !preg_match('#^/storage/(images|cache)/#', $uri)) { http_response_code(403); echo '403 Forbidden'; return true; } if (preg_match('#^/admin(/[^?]*)?#', $uri, $m)) { $sub = trim($m[1] ?? '/', '/'); $phpFile = $sub ?: 'index.php'; if (!str_contains($phpFile, '.')) $phpFile .= '.php'; $fullPath = dirname(__DIR__) . '/core/admin/' . $phpFile; if (!is_file($fullPath)) $fullPath = dirname(__DIR__) . '/core/admin/index.php'; $_SERVER['SCRIPT_NAME'] = '/admin/' . basename($fullPath); $_SERVER['PHP_SELF'] = '/admin/' . basename($fullPath); chdir(dirname(__DIR__) . '/core/admin'); require $fullPath; return true; } $_SERVER['SCRIPT_NAME'] = '/index.php'; $_SERVER['PHP_SELF'] = '/index.php'; require __DIR__ . '/index.php'; return true; 