asdasd

public/system-app-assets/index.php

@@ -0,0 +1,51 @@
+<?php
+
+declare(strict_types=1);
+
+require_once dirname(__DIR__, 2) . '/src/App/bootstrap.php';
+
+use App\AppPaths;
+
+$projectRoot = dirname(__DIR__, 2);
+$app = trim((string) ($_GET['app'] ?? ''));
+$path = trim((string) ($_GET['path'] ?? ''));
+
+if ($app === '' || $path === '' || str_contains($path, '..')) {
+    http_response_code(400);
+    exit('Invalid system app asset request.');
+}
+
+$appPath = AppPaths::systemAppPath($projectRoot, $app);
+if (!is_dir($appPath)) {
+    http_response_code(404);
+    exit('System app not found.');
+}
+
+$assetPath = realpath($appPath . '/' . ltrim($path, '/'));
+$allowedRoot = realpath($appPath);
+
+if ($assetPath === false || $allowedRoot === false || !str_starts_with($assetPath, $allowedRoot . DIRECTORY_SEPARATOR) || !is_file($assetPath)) {
+    http_response_code(404);
+    exit('Asset not found.');
+}
+
+$extension = strtolower(pathinfo($assetPath, PATHINFO_EXTENSION));
+$contentType = match ($extension) {
+    'css' => 'text/css; charset=utf-8',
+    'js' => 'application/javascript; charset=utf-8',
+    'json' => 'application/json; charset=utf-8',
+    'svg' => 'image/svg+xml',
+    'png' => 'image/png',
+    'jpg', 'jpeg' => 'image/jpeg',
+    'gif' => 'image/gif',
+    'webp' => 'image/webp',
+    default => 'application/octet-stream',
+};
+
+$mtime = filemtime($assetPath);
+if ($mtime !== false) {
+    header('Last-Modified: ' . gmdate('D, d M Y H:i:s', $mtime) . ' GMT');
+}
+header('Content-Type: ' . $contentType);
+header('Cache-Control: public, max-age=300');
+readfile($assetPath);