From 19bb105303ec511d0ff1d045aafe0545423e0f74 Mon Sep 17 00:00:00 2001
From: Ruben <post@rubensolvang.no>
Date: Thu, 2 Oct 2025 17:19:15 +0200
Subject: [PATCH] Fix static file path handling for security

Use REQUEST_URI and parse_url to properly handle paths Prevent directory
traversal with stricter sanitization
---
 app/static.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/static.php b/app/static.php
index 3f2f5e7..81afd9e 100644
--- a/app/static.php
+++ b/app/static.php
@@ -1,6 +1,7 @@
 <?php
 // Serve static files from /app directory
-$file = $_GET['file'] ?? '';
+$requestUri = $_SERVER['REQUEST_URI'];
+$file = preg_replace('#^/app/#', '', parse_url($requestUri, PHP_URL_PATH));
 $file = str_replace(['../', '..\\'], '', $file); // Prevent directory traversal
 
 // Map request paths to actual file paths