<?
# txt.page v1.0 Final: http://www.desiquintans.com/txtpage
# txt.page is free under version 2 or later of the GPL.
# This program is distributed with cursory support, but without
# warranty or guarantee of any sort.

// Security: setup.php creates a whitelist of what .txt files to allow.
require ('setup.php');

// Security: initialise $filename.
$filename = NULL;
switch(isset($_GET['page'])) {
    case TRUE:
        // Security: basename() strips directories and .txt extension from $_GET['page'] to prevent custom searches and fix bad queries.
        $filename = basename($_GET['page'], '.txt');
        // Security: The stripped $_GET['page'] is searched for as a key in the whitelist to see if it is a clean query.
        switch(array_key_exists($filename, $whitelist)) {
            case TRUE:
                $breadcrumbs =& $whitelist[$filename];
                include ('template/header.htm');
                // Security: force directory and .txt extension to break surviving custom searches.
                echo file_get_contents('./pages/'.$filename.'.txt');
                break;
            default:
                $breadcrumbs =& $whitelist['invalid'];
                include ('template/header.htm');
                echo file_get_contents('./pages/invalid.txt');
                break;
        }
        break;
    default:
    // Least common action: displaying the index page.
        $breadcrumbs =& $whitelist['index'];
        include ('template/header.htm');
        echo file_get_contents('./pages/index.txt');
        break;
}

include ('template/footer.htm');
?>