From 5a83c2770d19062eb5a8b7a061fd558e48b043c1 Mon Sep 17 00:00:00 2001
From: Ruben <post@rubensolvang.no>
Date: Tue, 17 Mar 2026 10:54:52 +0100
Subject: [PATCH] Fix feed item rendering and strengthen static file path
 traversal protection

---
 app/router.php |  2 ++
 app/static.php | 32 +++++++++++++++++++++-----------
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/app/router.php b/app/router.php
index 5e2d72e..e3b4b77 100644
--- a/app/router.php
+++ b/app/router.php
@@ -78,6 +78,8 @@ if (str_ends_with($ctx->requestPath, 'feed.xml')) {
             // Render full content for each item
             foreach ($items as &$item) {
                 $item['content'] = '';
+                $itemMetadata = loadMetadata($item['dirPath']);
+                getPluginManager()->loadPagePlugins($itemMetadata);
                 $contentFiles = findAllContentFiles($item['dirPath']);
                 foreach ($contentFiles as $file) {
                     $item['content'] .= renderContentFile($file, $ctx);
diff --git a/app/static.php b/app/static.php
index 642fa2a..4b0d4c1 100644
--- a/app/static.php
+++ b/app/static.php
@@ -1,29 +1,39 @@
 <?php
-// test
 // Serve static files from /app directory
 $requestUri = $_SERVER['REQUEST_URI'];
 $file = preg_replace('#^/app/#', '', parse_url($requestUri, PHP_URL_PATH));
-$file = str_replace(['../', '..\\'], '', $file); // Prevent directory traversal
 
-// Map request paths to actual file paths
-$basePath = __DIR__ . '/';
-$customBasePath = dirname(__DIR__) . '/';
+// Map request paths to allowed base directories
+$customBasePath = dirname(__DIR__) . '/custom/';
+$appBasePath = __DIR__ . '/default/';
 
 if (str_starts_with($file, 'styles/')) {
-    $filePath = $customBasePath . 'custom/' . $file;
+    $allowedBase = realpath($customBasePath . 'styles');
+    $filePath = $customBasePath . $file;
 } elseif (str_starts_with($file, 'fonts/')) {
-    $filePath = $customBasePath . 'custom/' . $file;
+    $allowedBase = realpath($customBasePath . 'fonts');
+    $filePath = $customBasePath . $file;
 } elseif (str_starts_with($file, 'assets/')) {
-    $filePath = $customBasePath . 'custom/' . $file;
+    $allowedBase = realpath($customBasePath . 'assets');
+    $filePath = $customBasePath . $file;
 } elseif (str_starts_with($file, 'default-styles/')) {
-    $filePath = $basePath . 'default/' . substr($file, 15); // Remove 'default-styles/' prefix
+    $allowedBase = realpath($appBasePath . 'styles');
+    $filePath = $appBasePath . 'styles/' . substr($file, 15);
 } else {
     http_response_code(404);
     exit;
 }
 
-// Check if file exists and is readable
-if (!file_exists($filePath) || !is_readable($filePath)) {
+// Resolve real path and verify it's within the allowed directory
+$realPath = realpath($filePath);
+if ($realPath === false || $allowedBase === false || !str_starts_with($realPath, $allowedBase . '/')) {
+    http_response_code(404);
+    exit;
+}
+$filePath = $realPath;
+
+// Check if file is readable
+if (!is_readable($filePath)) {
     http_response_code(404);
     exit;
 }