Security update for Core, with self-updated composer

[yaffs-website] / vendor / drush / drush / commands / runserver / d8-rs-router.php

diff --git a/vendor/drush/drush/commands/runserver/d8-rs-router.php b/vendor/drush/drush/commands/runserver/d8-rs-router.php
index d04d41d52817a0928ef933ae2fefedaa6a8a7051..dc47a9a52e3d850b9974fc2463a911610a4a7944 100644 (file)
--- a/vendor/drush/drush/commands/runserver/d8-rs-router.php
+++ b/vendor/drush/drush/commands/runserver/d8-rs-router.php
@@ -46,7 +46,7 @@ function runserver_env($key) {
 }
 
 $url = parse_url($_SERVER["REQUEST_URI"]);
-if (file_exists('.' . $url['path'])) {
+if (file_exists('.' . urldecode($url['path']))) {
   // Serve the requested resource as-is.
   return FALSE;
 }
@@ -60,8 +60,37 @@ $base_url = runserver_env('RUNSERVER_BASE_URL');
 // contain multiple dots (such as config entity IDs) in the path. Since this is
 // a virtual resource, served by index.php set the script name explicitly.
 // See https://github.com/drush-ops/drush/issues/2033 for more information.
-$_SERVER['SCRIPT_NAME'] = '/index.php';
+// Work around the PHP bug. Update $_SERVER variables to point to the correct
+// index-file.
+$path = $url['path'];
+$script = 'index.php';
+if (strpos($path, '.php') !== FALSE) {
+  // Work backwards through the path to check if a script exists. Otherwise
+  // fallback to index.php.
+  do {
+    $path = dirname($path);
+    if (preg_match('/\.php$/', $path) && is_file('.' . $path)) {
+      // Discovered that the path contains an existing PHP file. Use that as the
+      // script to include.
+      $script = ltrim($path, '/');
+      break;
+    }
+  } while ($path !== '/' && $path !== '.');
+}
+
+// Update $_SERVER variables to point to the correct index-file.
+$index_file_absolute = $_SERVER['DOCUMENT_ROOT'] . DIRECTORY_SEPARATOR . $script;
+$index_file_relative = DIRECTORY_SEPARATOR . $script;
+
+// SCRIPT_FILENAME will point to the router script itself, it should point to
+// the full path of index.php.
+$_SERVER['SCRIPT_FILENAME'] = $index_file_absolute;
+
+// SCRIPT_NAME and PHP_SELF will either point to index.php or contain the full
+// virtual path being requested depending on the URL being requested. They
+// should always point to index.php relative to document root.
+$_SERVER['SCRIPT_NAME'] = $index_file_relative;
+$_SERVER['PHP_SELF'] = $index_file_relative;
 
-// Include the main index.php and let Drupal take over.
-// n.b. Drush sets the cwd to the Drupal root during bootstrap.
-include 'index.php';
+// Require the script and let core take over.
+require $_SERVER['SCRIPT_FILENAME'];
\ No newline at end of file