<?php
// Router for PHP built-in server used by the portable launcher.

$path = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH);
$path = is_string($path) ? rawurldecode($path) : '/';

if ($path === '/' || $path === '') {
  require __DIR__ . '/index.php';
  return true;
}

$full = realpath(__DIR__ . str_replace('/', DIRECTORY_SEPARATOR, $path));
$root = realpath(__DIR__);

if ($full === false || $root === false || strpos($full, $root) !== 0) {
  http_response_code(404);
  echo 'Not found';
  return true;
}

$blocked = ['sql', 'log', 'bak', 'zip', 'lock', 'bat', 'cmd', 'exe', 'ps1', 'env'];
$ext = strtolower(pathinfo($full, PATHINFO_EXTENSION));
if ($ext !== '' && in_array($ext, $blocked, true)) {
  http_response_code(403);
  echo 'Forbidden';
  return true;
}

if (is_file($full)) {
  return false;
}

http_response_code(404);
echo 'Not found';
return true;
