@@ -43,7 +43,7 @@ DEBUG($go);

 if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go.php")) or (! is_file("modules/$go.php"))) {

     die("illegal command");

 }

-list($module, $page) = explode('/', $go, 2);

+[$module, $page] = explode('/', $go, 2);

 $page = str_replace('/', '-', $page);

 if (! in_array($module, config('modules'))) {

     die("inactive module");

@@ -38,6 +38,8 @@ if (substr($go, strlen($go) - 4) == '.php') {

 DEBUG($go);

+// Can throw invalid open_basedir warnings,

+// see https://bugs.php.net/52065

 if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go.php")) or (! is_file("modules/$go.php"))) {

     die("illegal command");

 }

@@ -22,7 +22,7 @@ require_once("inc/theme.php");

 set_exception_handler('handle_exception');

-if (!isset($_GET['go'])) {

+if (!isset($_GET['go']) || !is_string($_GET['go'])) {

     die("No command");

 }

 $go = $_GET['go'];

@@ -22,8 +22,9 @@ require_once("inc/theme.php");

 set_exception_handler('handle_exception');

-if (!isset($_GET['go']))

+if (!isset($_GET['go'])) {

     die("No command");

+}

 $go = $_GET['go'];

 /*

@@ -22,6 +22,8 @@ require_once("inc/theme.php");

 set_exception_handler('handle_exception');

+if (!isset($_GET['go']))

+    die("No command");

 $go = $_GET['go'];

 /*

@@ -20,6 +20,7 @@ require_once('inc/debug.php');

 require_once("inc/base.php");

 require_once("inc/theme.php");

+set_exception_handler('handle_exception');

 $go = $_GET['go'];

@@ -9,7 +9,7 @@ Written 2008-2018 by schokokeks.org Hosting, namely

 To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.

-You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 

+You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see

 https://creativecommons.org/publicdomain/zero/1.0/

 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

@@ -28,21 +28,19 @@ $go = $_GET['go'];

 */

 // filenames can end with .php

-if ( substr( $go, strlen( $go ) - 4 ) == '.php' ) {

-  $go = substr( $go, 0, strlen($go) - 4);

+if (substr($go, strlen($go) - 4) == '.php') {

+    $go = substr($go, 0, strlen($go) - 4);

 }

 DEBUG($go);

-if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go.php")) or (! is_file("modules/$go.php")))

-{

-  die("illegal command");

+if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go.php")) or (! is_file("modules/$go.php"))) {

+    die("illegal command");

 }

 list($module, $page) = explode('/', $go, 2);

 $page = str_replace('/', '-', $page);

-if (! in_array($module, config('modules')))

-{

-  die("inactive module");

+if (! in_array($module, config('modules'))) {

+    die("inactive module");

 }

@@ -64,7 +62,7 @@ $output = "";

 $html_header = "";

 require_once("inc/base.php");

 /* setup module include path */

-ini_set('include_path',ini_get('include_path').':./modules/'.$module.'/include:');

+ini_set('include_path', ini_get('include_path').':./modules/'.$module.'/include:');

 /* Look where we are (but let the module override) */

 $section = str_replace("/", "_", $go);

@@ -72,12 +70,9 @@ $section = str_replace("/", "_", $go);

 /* Let the module work */

 include("modules/".$go.".php");

-if ($output)

-{

-  if (!isset($title)) {

-    $title = '';

-  }

-  show_page($module, $page);

+if ($output) {

+    if (!isset($title)) {

+        $title = '';

+    }

+    show_page($module, $page);

 }

-

-?>

@@ -3,7 +3,7 @@

 This file belongs to the Webinterface of schokokeks.org Hosting.

 Please see https://source.schokokeks.org for the newest source files.

-Written 2008-2014 by schokokeks.org Hosting, namely

+Written 2008-2018 by schokokeks.org Hosting, namely

   Bernd Wurst <bernd@schokokeks.org>

   Hanno Böck <hanno@schokokeks.org>

@@ -1,7 +1,7 @@

 <?php

 /*

 This file belongs to the Webinterface of schokokeks.org Hosting.

-Please see http://source.schokokeks.org for the newest source files.

+Please see https://source.schokokeks.org for the newest source files.

 Written 2008-2014 by schokokeks.org Hosting, namely

   Bernd Wurst <bernd@schokokeks.org>

@@ -10,7 +10,7 @@ Written 2008-2014 by schokokeks.org Hosting, namely

 To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.

 You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 

-http://creativecommons.org/publicdomain/zero/1.0/

+https://creativecommons.org/publicdomain/zero/1.0/

 Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

 */

@@ -3,7 +3,7 @@

 This file belongs to the Webinterface of schokokeks.org Hosting.

 Please see http://source.schokokeks.org for the newest source files.

-Written 2008-2013 by schokokeks.org Hosting, namely

+Written 2008-2014 by schokokeks.org Hosting, namely

   Bernd Wurst <bernd@schokokeks.org>

   Hanno Böck <hanno@schokokeks.org>

@@ -17,7 +17,6 @@ Nevertheless, in case you use a significant part of this code, we ask (but not r

 require_once('config.php');

 require_once('inc/debug.php');

-require_once('inc/db_connect.php');

 require_once("inc/base.php");

 require_once("inc/theme.php");

@@ -3,7 +3,7 @@

 This file belongs to the Webinterface of schokokeks.org Hosting.

 Please see http://source.schokokeks.org for the newest source files.

-Written 2008-2012 by schokokeks.org Hosting, namely

+Written 2008-2013 by schokokeks.org Hosting, namely

   Bernd Wurst <bernd@schokokeks.org>

   Hanno Böck <hanno@schokokeks.org>

@@ -1,4 +1,19 @@

 <?php

+/*

+This file belongs to the Webinterface of schokokeks.org Hosting.

+Please see http://source.schokokeks.org for the newest source files.

+

+Written 2008-2012 by schokokeks.org Hosting, namely

+  Bernd Wurst <bernd@schokokeks.org>

+  Hanno Böck <hanno@schokokeks.org>

+

+To the extent possible under law, the author(s) have dedicated all copyright and related and neighboring rights to this software to the public domain worldwide. This software is distributed without any warranty.

+

+You should have received a copy of the CC0 Public Domain Dedication along with this software. If not, see 

+http://creativecommons.org/publicdomain/zero/1.0/

+

+Nevertheless, in case you use a significant part of this code, we ask (but not require, see the license) that you keep the authors' names in place and return your changes to the public. We would be especially happy if you tell us what you're going to do with this code.

+*/

 require_once('config.php');

 require_once('inc/debug.php');

@@ -4,6 +4,7 @@ require_once('config.php');

 require_once('inc/debug.php');

 require_once('inc/db_connect.php');

 require_once("inc/base.php");

+require_once("inc/theme.php");

 $go = $_GET['go'];

@@ -23,11 +24,11 @@ if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists

 {

   die("illegal command");

 }

-$tmp = explode('/', $go, 2);

-$module = $tmp[0];

+list($module, $page) = explode('/', $go, 2);

+$page = str_replace('/', '-', $page);

 if (! in_array($module, config('modules')))

 {

-  die("illegal command");

+  die("inactive module");

 }

@@ -57,12 +58,12 @@ $section = str_replace("/", "_", $go);

 /* Let the module work */

 include("modules/".$go.".php");

-//$title = '';

 if ($output)

 {

-  include('inc/top.php');

-  print $output;

-  include('inc/bottom.php');

+  if (!isset($title)) {

+    $title = '';

+  }

+  show_page($module, $page);

 }

 ?>

@@ -57,11 +57,12 @@ $section = str_replace("/", "_", $go);

 /* Let the module work */

 include("modules/".$go.".php");

-$title = '';

-

-include('inc/top.php');

-print $output;

-include('inc/bottom.php');

-

+//$title = '';

+if ($output)

+{

+  include('inc/top.php');

+  print $output;

+  include('inc/bottom.php');

+}

 ?>

@@ -5,18 +5,6 @@ require_once('inc/debug.php');

 require_once('inc/db_connect.php');

 require_once("inc/base.php");

-/*

- read configuration from database

-*/

-

-$options = db_query( "SELECT `key`, value FROM misc.config" );

-

-while( $object = mysql_fetch_assoc( $options ) ) {

-//	echo "1";

-//	echo $object['key'];

-	$config[$object['key']]=$object['value'];

-}

-//print_r($config);

 $go = $_GET['go'];

@@ -69,6 +69,7 @@ $section = str_replace("/", "_", $go);

 /* Let the module work */

 include("modules/".$go.".php");

+$title = '';

 include('inc/top.php');

 print $output;

@@ -37,7 +37,7 @@ if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists

 }

 $tmp = explode('/', $go, 2);

 $module = $tmp[0];

-if (! in_array($module, $config['modules']))

+if (! in_array($module, config('modules')))

 {

   die("illegal command");

 }

@@ -61,7 +61,7 @@ $output = "";

 $html_header = "";

 require_once("inc/base.php");

 /* setup module include path */

-ini_set('include_path',ini_get('include_path').':./modules/'.dirname($go).'/include:');

+ini_set('include_path',ini_get('include_path').':./modules/'.$module.'/include:');

 /* Look where we are (but let the module override) */

 $section = str_replace("/", "_", $go);

@@ -2,6 +2,22 @@

 require_once('config.php');

 require_once('inc/debug.php');

+require_once('inc/db_connect.php');

+require_once("inc/base.php");

+

+/*

+ read configuration from database

+*/

+

+$options = db_query( "SELECT `key`, value FROM misc.config" );

+

+while( $object = mysql_fetch_assoc( $options ) ) {

+//	echo "1";

+//	echo $object['key'];

+	$config[$object['key']]=$object['value'];

+}

+//print_r($config);

+

 $go = $_GET['go'];

 /*

@@ -42,6 +42,7 @@ $prefix = $prefix.str_repeat("../", $count);

 require_once('session/start.php');

 $output = "";

+$html_header = "";

 require_once("inc/base.php");

 /* setup module include path */

 ini_set('include_path',ini_get('include_path').':./modules/'.dirname($go).'/include:');

@@ -47,7 +47,7 @@ require_once("inc/base.php");

 ini_set('include_path',ini_get('include_path').':./modules/'.dirname($go).'/include:');

 /* Look where we are (but let the module override) */

-$section = str_replace("/", "_", str_replace(".php", "", $go));

+$section = str_replace("/", "_", $go);

 /* Let the module work */

 include("modules/".$go.".php");

@@ -8,7 +8,14 @@ $go = $_GET['go'];

  sanitize $go

 */

-if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go")) or (! is_file("modules/$go")))

+// filenames can end with .php

+if ( substr( $go, strlen( $go ) - 4 ) == '.php' ) {

+  $go = substr( $go, 0, strlen($go) - 4);

+}

+

+DEBUG($go);

+

+if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go.php")) or (! is_file("modules/$go.php")))

 {

   die("illegal command");

 }

@@ -43,7 +50,7 @@ ini_set('include_path',ini_get('include_path').':./modules/'.dirname($go).'/incl

 $section = str_replace("/", "_", str_replace(".php", "", $go));

 /* Let the module work */

-include("modules/".$go);

+include("modules/".$go.".php");

 include('inc/top.php');

@@ -12,6 +12,12 @@ if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists

 {

   die("illegal command");

 }

+$tmp = explode('/', $go, 2);

+$module = $tmp[0];

+if (! in_array($module, $config['modules']))

+{

+  die("illegal command");

+}

 /*

@@ -15,7 +15,7 @@ if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists

 /*

- contruct prefix

+ construct prefix

 */

 global $prefix;

@@ -33,10 +33,12 @@ require_once("inc/base.php");

 /* setup module include path */

 ini_set('include_path',ini_get('include_path').':./modules/'.dirname($go).'/include:');

+/* Look where we are (but let the module override) */

+$section = str_replace("/", "_", str_replace(".php", "", $go));

+

 /* Let the module work */

 include("modules/".$go);

-$section = str_replace("/", "_", str_replace(".php", "", $go));

 include('inc/top.php');

 print $output;

@@ -8,7 +8,7 @@ $go = $_GET['go'];

  sanitize $go

 */

-if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go")))

+if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go")) or (! is_file("modules/$go")))

 {

   die("illegal command");

 }

@@ -1,5 +1,6 @@

 <?php

+require_once('config.php');

 require_once('inc/debug.php');

 $go = $_GET['go'];

@@ -28,7 +28,7 @@ $prefix = $prefix.str_repeat("../", $count);

 require_once('session/start.php');

 $output = "";

-include("inc/base.php");

+require_once("inc/base.php");

 /* setup module include path */

 ini_set('include_path',ini_get('include_path').':./modules/'.dirname($go).'/include:');

new file mode 100644

@@ -0,0 +1,45 @@

+<?php

+

+require_once('inc/debug.php');

+$go = $_GET['go'];

+

+/*

+ sanitize $go

+*/

+

+if (strstr($go, "..") or strstr($go, "./") or strstr($go, ":") or (! file_exists("modules/$go")))

+{

+  die("illegal command");

+}

+

+

+/*

+ contruct prefix

+*/

+

+global $prefix;

+$prefix = "../";

+$count = 0;

+str_replace("/", "x", $go, $count);

+

+$prefix = $prefix.str_repeat("../", $count);

+

+

+require_once('session/start.php');

+

+$output = "";

+include("inc/base.php");

+/* setup module include path */

+ini_set('include_path',ini_get('include_path').':./modules/'.dirname($go).'/include:');

+

+/* Let the module work */

+include("modules/".$go);

+

+$section = str_replace("/", "_", str_replace(".php", "", $go));

+

+include('inc/top.php');

+print $output;

+include('inc/bottom.php');

+

+

+?>