app/router.php

@@ -98,8 +98,6 @@ if (str_ends_with($ctx->requestPath, 'feed.xml')) {
             // Render full content for each item
             foreach ($items as &$item) {
                 $item['content'] = '';
-                $itemMetadata = loadMetadata($item['dirPath']);
-                getPluginManager()->loadPagePlugins($itemMetadata);
                 $contentFiles = findAllContentFiles($item['dirPath']);
                 foreach ($contentFiles as $file) {
                     $item['content'] .= renderContentFile($file, $ctx);

app/static.php

@@ -1,39 +1,29 @@
 <?php
+// test
 // Serve static files from /app directory
 $requestUri = $_SERVER['REQUEST_URI'];
 $file = preg_replace('#^/app/#', '', parse_url($requestUri, PHP_URL_PATH));
+$file = str_replace(['../', '..\\'], '', $file); // Prevent directory traversal
 
-// Map request paths to allowed base directories
+// Map request paths to actual file paths
-$customBasePath = dirname(__DIR__) . '/custom/';
+$basePath = __DIR__ . '/';
-$appBasePath = __DIR__ . '/default/';
+$customBasePath = dirname(__DIR__) . '/';
 
 if (str_starts_with($file, 'styles/')) {
-    $allowedBase = realpath($customBasePath . 'styles');
+    $filePath = $customBasePath . 'custom/' . $file;
-    $filePath = $customBasePath . $file;
 } elseif (str_starts_with($file, 'fonts/')) {
-    $allowedBase = realpath($customBasePath . 'fonts');
+    $filePath = $customBasePath . 'custom/' . $file;
-    $filePath = $customBasePath . $file;
 } elseif (str_starts_with($file, 'assets/')) {
-    $allowedBase = realpath($customBasePath . 'assets');
+    $filePath = $customBasePath . 'custom/' . $file;
-    $filePath = $customBasePath . $file;
 } elseif (str_starts_with($file, 'default-styles/')) {
-    $allowedBase = realpath($appBasePath . 'styles');
+    $filePath = $basePath . 'default/' . substr($file, 15); // Remove 'default-styles/' prefix
-    $filePath = $appBasePath . 'styles/' . substr($file, 15);
 } else {
     http_response_code(404);
     exit;
 }
 
-// Resolve real path and verify it's within the allowed directory
+// Check if file exists and is readable
-$realPath = realpath($filePath);
+if (!file_exists($filePath) || !is_readable($filePath)) {
-if ($realPath === false || $allowedBase === false || !str_starts_with($realPath, $allowedBase . '/')) {
-    http_response_code(404);
-    exit;
-}
-$filePath = $realPath;
-
-// Check if file is readable
-if (!is_readable($filePath)) {
     http_response_code(404);
     exit;
 }