Merge pull request #11 from Rolix44/master

Fix hidden posts disclosure in previous, next posts & sitemap
Ooggle · Apr 26, 2023 · 52da87f · 52da87f
2 parents ad2c26b + 4613582
commit 52da87f
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 1 deletion.
diff --git a/blog/.htaccess b/blog/.htaccess
@@ -1,7 +1,7 @@
 DirectoryIndex sitehome.php
 Options -Indexes
 
-<FilesMatch "\.conf.php$">
+<FilesMatch "\.conf.php|sitemap.json$">
     Order allow,deny
     Deny from all
 </FilesMatch>

diff --git a/blog/post.php b/blog/post.php
@@ -11,6 +11,13 @@
     $selectedPost = '-1';
     $followingPost = '-1';
     $sitemap = json_decode(fread(fopen("sitemap.json", "r"), filesize("sitemap.json")));
+
+    foreach ($sitemap->posts as $key => $post) {
+	    if(isset($post->hidden) && $post->hidden == true && $_GET["file"] !== $post->url) {
+	        unset($sitemap->posts[$key]);
+	    }
+    }
+
     foreach ($sitemap->posts as $key => $post) {
         if($_GET['file'] === $post->url)
         {