From 06ddd768aaa3c68acbca2b96323ce0a12ab4dda5 Mon Sep 17 00:00:00 2001
From: Yasen Pramatarov <yasen@lindeas.com>
Date: Fri, 28 Nov 2025 18:39:48 +0200
Subject: [PATCH] Adds plugin asset page

---
 app/pages/plugin-asset.php | 74 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)
 create mode 100644 app/pages/plugin-asset.php

diff --git a/app/pages/plugin-asset.php b/app/pages/plugin-asset.php
new file mode 100644
index 0000000..8ee1091
--- /dev/null
+++ b/app/pages/plugin-asset.php
@@ -0,0 +1,74 @@
+<?php
+/**
+ * Plugin Asset handler
+ *
+ * Serves plugin assets (CSS, JS, images, fonts, etc.) securely by validating the
+ * requested plugin name, asset path and enabled status. This way each plugin can
+ * keep its assets in its local folders and only load them when needed.
+ */
+
+require_once __DIR__ . '/../classes/session.php';
+
+$pluginName = $_GET['plugin'] ?? '';
+$assetPath = $_GET['path'] ?? '';
+
+$sendError = static function(int $code, string $message): void {
+    http_response_code($code);
+    header('Content-Type: text/plain');
+    exit($message);
+};
+
+if ($pluginName === '' || !preg_match('/^[a-zA-Z0-9_-]+$/', $pluginName)) {
+    $sendError(400, 'Invalid plugin specified');
+}
+
+if ($assetPath === '') {
+    $sendError(400, 'No asset path specified');
+}
+
+if (!preg_match('/^[a-zA-Z0-9_\-.\/]+$/', $assetPath) || strpos($assetPath, '..') !== false) {
+    $sendError(400, 'Invalid asset path');
+}
+
+if (!isset($GLOBALS['enabled_plugins'][$pluginName])) {
+    $sendError(404, 'Plugin not enabled');
+}
+
+$pluginsRoot = realpath(dirname(__DIR__, 2) . '/plugins');
+if ($pluginsRoot === false) {
+    $sendError(500, 'Plugins directory missing');
+}
+
+$pluginBase = realpath($pluginsRoot . '/' . $pluginName);
+if ($pluginBase === false || strpos($pluginBase, $pluginsRoot) !== 0) {
+    $sendError(404, 'Plugin not found');
+}
+
+$fullPath = realpath($pluginBase . '/' . ltrim($assetPath, '/'));
+if ($fullPath === false || strpos($fullPath, $pluginBase) !== 0 || !is_file($fullPath) || !is_readable($fullPath)) {
+    $sendError(404, 'Asset not found');
+}
+
+$extension = strtolower(pathinfo($fullPath, PATHINFO_EXTENSION));
+$contentTypes = [
+    'css'  => 'text/css',
+    'js'   => 'application/javascript',
+    'json' => 'application/json',
+    'png'  => 'image/png',
+    'jpg'  => 'image/jpeg',
+    'jpeg' => 'image/jpeg',
+    'gif'  => 'image/gif',
+    'svg'  => 'image/svg+xml',
+    'webp' => 'image/webp',
+    'woff' => 'font/woff',
+    'woff2'=> 'font/woff2',
+    'ttf'  => 'font/ttf',
+    'eot'  => 'application/vnd.ms-fontobject'
+];
+
+header('Content-Type: ' . ($contentTypes[$extension] ?? 'application/octet-stream'));
+header('Content-Length: ' . filesize($fullPath));
+header('Cache-Control: public, max-age=86400');
+header('Expires: ' . gmdate('D, d M Y H:i:s', time() + 86400) . ' GMT');
+
+readfile($fullPath);