// // RESPONSE // {"ok":true,"content":""} // {"ok":false,"error":"Invalid id"|"Not found"} // // DEPENDS ON // include/config.php SCRIPTS_DIR // ═══════════════════════════════════════════════════════════════════════════════════════════════ header('Content-Type: application/json'); require_once dirname(__DIR__) . '/include/config.php'; $id = trim($_GET['id'] ?? ''); // Must be relative path within SCRIPTS_DIR, no traversal, must end in .sh or .md if (!$id || str_contains($id, '..') || !preg_match('/^[A-Za-z0-9_.\-\/]+\.(sh|md|php|template)$/', $id)) { echo json_encode(['ok' => false, 'error' => 'Invalid id']); exit; } $path = SCRIPTS_DIR . '/' . $id; if (!file_exists($path)) { echo json_encode(['ok' => false, 'error' => 'Not found']); exit; } echo json_encode(['ok' => true, 'content' => file_get_contents($path)]);