diff --git a/url.php b/url.php index 567f07b..962d0b4 100644 --- a/url.php +++ b/url.php @@ -14,11 +14,13 @@ if(!empty($_REQUEST['r'])){ redirect($_REQUEST['r']); } try{ - $db=new PDO("mysql:host='.DB_HOST.';dbname=" . DB_NAME . ';charset=' . DB_CHARSET, DB_USER, DB_PASS, [PDO::ATTR_ERRMODE=>PDO::ERRMODE_WARNING, PDO::ATTR_PERSISTENT=>true]); + $db=new PDO('mysql:host=' . DB_HOST . ';dbname=' . DB_NAME . ';charset=' . DB_CHARSET, DB_USER, DB_PASS, [PDO::ATTR_ERRMODE=>PDO::ERRMODE_WARNING, PDO::ATTR_PERSISTENT=>true]); }catch(PDOException $e){ } if(empty($_GET['id'])){ - echo ''; + $style = '.red{color:red}'; + send_headers([$style]); + echo ''; echo 'URL-Shortener/Redirector'; echo ''; echo ''; @@ -26,20 +28,19 @@ if(empty($_GET['id'])){ echo ''; echo '

URL-Shortener/Redirector

'; echo '

Shorten a URL or strip referrers by redirecting via '.CANONICAL_URL.'?r=LINK

'; - exit; if(!isset($db)){ - echo '

ERROR: No database connection!

'; + echo '

ERROR: No database connection!

'; echo ''; exit; } - echo "
"; - echo "

Link:
'; + echo '

Link:

'; echo '

'; - echo "
"; + echo ''; echo '

Show info of shortlink-ID:
".CANONICAL_URL."?id=$_REQUEST[info]

"; - echo "

Redirects to: $url

"; + echo '

Short link is: ".CANONICAL_URL."?id=$_REQUEST[info]

"; + echo "

Redirects to: $url

"; }else{ - echo '

Sorry, this redirect doesn\'t exist.

'; + echo '

Sorry, this redirect doesn\'t exist.

'; } }elseif($_SERVER['REQUEST_METHOD']==='POST' && !empty($_POST['addr'])){ if(!( @@ -70,12 +71,12 @@ if(empty($_GET['id'])){ || preg_match('~^((?:[a-z0-9\-]+\.)*[a-z2-7]{16}\.onion)(?![^<>]*>)$~i', $_POST['addr'])// *.onion ) ){ - echo '

ERROR: Invalid address given.

'; + echo '

ERROR: Invalid address given.

'; }else{ $id=$db->query("SELECT COUNT(*) FROM link;")->fetch(PDO::FETCH_NUM); $id=$id[0]+1; $db->prepare("INSERT INTO link (id, url) VALUES (?, ?);")->execute([$id, $_POST['addr']]); - echo '

Your link is: ".CANONICAL_URL."?id=$id

"; + echo '

Your link is: ".CANONICAL_URL."?id=$id

"; } } echo ''; @@ -92,26 +93,47 @@ if(empty($_GET['id'])){ redirect($url); } -function redirect($url){ +function redirect(string $url){ preg_match('~^(.*)://~', $url, $match); $url=preg_replace('~^(.*)://~', '', $url); $escaped=htmlspecialchars($url); + send_headers(); if(isset($match[1]) && ($match[1]==='http' || $match[1]==='https')){ header("Refresh: 0; URL=$match[0]$url"); echo ''; - echo ""; + echo ""; echo ''; - echo "

Redirecting to: $match[0]$escaped.

"; + echo "

Redirecting to: $match[0]$escaped.

"; echo ''; }else{ if(!isset($match[0])){ $match[0]=''; } echo ''; - echo ''; - echo "

Non-http link requested: $match[0]$escaped.

"; - echo "

If it's not working, try this one: http://$escaped.

"; + echo ''; + echo "

Non-http link requested: $match[0]$escaped.

"; + echo "

If it's not working, try this one: http://$escaped.

"; echo ''; } exit; } + +function send_headers(array $styles = []){ + header('Content-Type: text/html; charset=UTF-8'); + header('Pragma: no-cache'); + header('Cache-Control: no-cache, no-store, must-revalidate, max-age=0, private'); + header('Expires: 0'); + header('Referrer-Policy: no-referrer'); + header("Permissions-Policy: accelerometer 'none'; ambient-light-sensor 'none'; autoplay 'none'; battery 'none'; camera 'none'; cross-origin-isolated 'none'; display-capture 'none'; document-domain 'none'; encrypted-media 'none'; geolocation 'none'; fullscreen 'none'; execution-while-not-rendered 'none'; execution-while-out-of-viewport 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; midi 'none'; navigation-override 'none'; payment 'none'; picture-in-picture 'none'; publickey-credentials-get 'none'; screen-wake-lock 'none'; sync-xhr 'none'; usb 'none'; web-share 'none'; xr-spatial-tracking 'none'; clipboard-read 'none'; clipboard-write 'none'; gamepad 'none'; speaker-selection 'none'; conversion-measurement 'none'; focus-without-user-activation 'none'; hid 'none'; idle-detection 'none'; sync-script 'none'; vertical-scroll 'none'; serial 'none'; trust-token-redemption 'none';"); + $style_hashes = ''; + foreach($styles as $style) { + $style_hashes .= " 'sha256-".base64_encode(hash('sha256', $style, true))."'"; + } + header("Content-Security-Policy: base-uri 'self'; default-src 'none'; form-action 'self'; frame-ancestors 'none'; style-src $style_hashes"); + header('X-Content-Type-Options: nosniff'); + header('X-Frame-Options: deny'); + header('X-XSS-Protection: 1; mode=block'); + if($_SERVER['REQUEST_METHOD'] === 'HEAD'){ + exit; // headers sent, no further processing needed + } +}