WebOrbiton
v3.0.0.2

FlatlyPage

← Changes All versions
197 lines · 5.0 KB
  1. <?php
  2. $configPath = __DIR__ . '/data/sitemap-config.php';
  3. if (!is_file($configPath)) {
  4. $configPath = __DIR__ . '/data/default-sitemap-config.php';
  5. }
  6. $config = require $configPath;
  7. ​
  8. if (!isset($config['sitemap']) || $config['sitemap'] !== true) {
  9. http_response_code(404);
  10. exit('Sitemap disabled');
  11. }
  12. ​
  13. @ini_set('display_errors', '0');
  14. @error_reporting(0);
  15. ​
  16. if (function_exists('ob_get_level')) {
  17. while (@ob_get_level()) @ob_end_clean();
  18. }
  19. ​
  20. ob_start();
  21. ​
  22. @header('Content-Type: application/xml; charset=utf-8');
  23. @header('X-Content-Type-Options: nosniff');
  24. @header('X-Frame-Options: DENY');
  25. ​
  26. $rate_limit_file = sys_get_temp_dir() . '/sitemap_rate_' . md5($_SERVER['REMOTE_ADDR'] ?? 'unknown');
  27. $now = time();
  28. $max_requests = 10;
  29. $time_window = 60;
  30. $access_times = [];
  31. ​
  32. if (@file_exists($rate_limit_file)) {
  33. $content = @file_get_contents($rate_limit_file);
  34. $access_times = $content ? @unserialize($content) : [];
  35. if (!is_array($access_times)) {
  36. $access_times = [];
  37. }
  38. }
  39. ​
  40. $access_times = array_filter($access_times, function($timestamp) use ($now, $time_window) {
  41. return ($now - $timestamp) < $time_window;
  42. });
  43. ​
  44. if (count($access_times) >= $max_requests) {
  45. http_response_code(429);
  46. exit('Too many requests');
  47. }
  48. ​
  49. $access_times[] = $now;
  50. ​
  51. @file_put_contents($rate_limit_file, @serialize($access_times));
  52. ​
  53. ​
  54. function safe_xml($str) {
  55. return htmlspecialchars((string)$str, ENT_XML1 | ENT_QUOTES, 'UTF-8');
  56. }
  57. ​
  58. function safe_slug($slug) {
  59. $slug = strtolower(trim((string)$slug, '/'));
  60. $slug = preg_replace('/[^a-z0-9\-_]/', '', $slug);
  61. return substr($slug, 0, 100);
  62. }
  63. ​
  64. function safe_date($file, $base_dir) {
  65. $real_file = @realpath($file);
  66. $real_base = @realpath($base_dir);
  68. if (!$real_file || !$real_base || strpos($real_file, $real_base) !== 0) {
  69. return gmdate('Y-m-d');
  70. }
  72. if (@file_exists($real_file)) {
  73. return gmdate('Y-m-d', @filemtime($real_file));
  74. }
  75. return gmdate('Y-m-d');
  76. }
  77. ​
  78. function validate_url($url, $allowed_domain) {
  79. $parsed = @parse_url($url);
  81. if (!$parsed || !isset($parsed['host'])) {
  82. return false;
  83. }
  85. if ($parsed['host'] !== $allowed_domain) {
  86. return false;
  87. }
  89. if (!in_array($parsed['scheme'] ?? '', ['http', 'https'])) {
  90. return false;
  91. }
  93. return true;
  94. }
  95. ​
  96. $configured_host = strtolower((string) parse_url(preg_match('#^https?://#i', (string) $config['website_domain']) ? $config['website_domain'] : 'https://' . $config['website_domain'], PHP_URL_HOST));
  97. $allowed_hosts = [
  98. $configured_host,
  99. 'www.' . $configured_host
  100. ];
  101. ​
  102. $host = isset($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : '';
  103. $host = preg_replace('/:\d+$/', '', $host);
  104. ​
  105. if (!in_array($host, $allowed_hosts)) {
  106. http_response_code(400);
  107. exit('Invalid host');
  108. }
  109. ​
  110. $protocol = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') ? 'https' : 'http';
  111. $install_base = rtrim(str_replace(chr(92), "/", dirname($_SERVER["SCRIPT_NAME"] ?? "")), "/");
  112. $base_url = $protocol . '://' . $host . $install_base;
  113. ​
  114. ​
  115. $pages = [];
  116. $base_dir = __DIR__;
  117. ​
  118. $pages[] = [
  119. 'loc' => $base_url . '/',
  120. 'lastmod' => gmdate('Y-m-d'),
  121. 'priority' => '1.0'
  122. ];
  123. ​
  124. $data_dir = $base_dir . '/data/';
  125. $real_data_dir = @realpath($data_dir);
  126. $real_base_dir = @realpath($base_dir);
  127. ​
  128. if ($real_data_dir && $real_base_dir &&
  129. strpos($real_data_dir, $real_base_dir) === 0 &&
  130. @is_dir($real_data_dir)) {
  132. $pattern = $real_data_dir . '/product-*.php';
  133. $files = @glob($pattern);
  135. if (is_array($files)) {
  136. $count = 0;
  138. foreach ($files as $file) {
  139. $real_file = @realpath($file);
  141. if (!$real_file || strpos($real_file, $real_data_dir) !== 0) {
  142. continue;
  143. }
  145. $name = basename($real_file, '.php');
  147. if (!preg_match('/^product-[a-z0-9\-]{1,50}$/', $name)) {
  148. continue;
  149. }
  151. $slug = str_replace('product-', '', $name);
  152. $slug = safe_slug($slug);
  154. if (!$slug) {
  155. continue;
  156. }
  158. $url = $base_url . '/' . $slug;
  160. if (!validate_url($url, $host)) {
  161. continue;
  162. }
  164. $pages[] = [
  165. 'loc' => $url,
  166. 'lastmod' => safe_date($real_file, $real_data_dir),
  167. 'priority' => '0.8'
  168. ];
  170. $count++;
  172. if ($count >= 500) {
  173. break;
  174. }
  175. }
  176. }
  177. }
  178. ​
  179. ​
  180. echo '<?xml version="1.0" encoding="UTF-8"?>';
  181. echo "\n";
  182. echo '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">', "\n";
  183. ​
  184. foreach ($pages as $p) {
  185. echo '<url>';
  186. echo '<loc>' . safe_xml($p['loc']) . '</loc>';
  187. echo '<lastmod>' . safe_xml($p['lastmod']) . '</lastmod>';
  188. echo '<changefreq>weekly</changefreq>';
  189. echo '<priority>' . safe_xml($p['priority']) . '</priority>';
  190. echo '</url>', "\n";
  191. }
  192. ​
  193. echo '</urlset>';
  194. ​
  195. ob_end_flush();
  196. exit;
  197. ?>