mirror of
https://github.com/myronblair/epictravelexpeditions
synced 2026-07-27 16:32:33 -05:00
myron
0dfcfa2f7e
- mailer.php: re-enable TLS certificate verification for CyberMail API calls (was CURLOPT_SSL_VERIFYPEER => false, exposing outbound mail traffic to MITM). - .htaccess / api/.htaccess: block direct HTTP access to .git/, db/, and api/config.php via mod_rewrite [F] rules. Confirmed live that /.git/config, /.git/logs/HEAD, and /db/schema.sql were all directly downloadable (200 OK with real content) - .git exposure leaks the repo's embedded GitHub token and full history; schema.sql leaks the DB layout. Also drops the dead "/setup -> setup_password.php" rewrite, since that file was already deleted from production. - index.php: remove the 'download' route, which required a api/download.php that has never existed in this repo - confirmed live that GET /api/download returns a fatal 500. - functions.php / upload.php / testimonials.php: extract the duplicated image-upload validation/move logic (MIME check, size check, UUID rename, move_uploaded_file) into one handleImageUpload() helper used by both upload endpoints. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
80 lines
2.1 KiB
PHP
80 lines
2.1 KiB
PHP
<?php
|
|
/**
|
|
* Epic Travel & Expeditions - Main API Entry Point
|
|
* This file routes all API requests to appropriate handlers
|
|
*/
|
|
|
|
// Load configuration and dependencies
|
|
require_once __DIR__ . '/config.php';
|
|
require_once __DIR__ . '/includes/database.php';
|
|
require_once __DIR__ . '/includes/jwt.php';
|
|
require_once __DIR__ . '/includes/functions.php';
|
|
require_once __DIR__ . '/includes/mailer.php';
|
|
|
|
// Set CORS headers (handles OPTIONS preflight too)
|
|
setCorsHeaders();
|
|
|
|
// Get request method and path
|
|
$method = $_SERVER['REQUEST_METHOD'];
|
|
$path = isset($_SERVER['PATH_INFO']) ? $_SERVER['PATH_INFO'] : '/';
|
|
$path = trim($path, '/');
|
|
|
|
// Parse path
|
|
$pathParts = explode('/', $path);
|
|
$resource = isset($pathParts[0]) ? $pathParts[0] : '';
|
|
$id = isset($pathParts[1]) ? $pathParts[1] : null;
|
|
|
|
// Health check endpoint
|
|
if ($path === '' || $path === 'api') {
|
|
jsonResponse([
|
|
'message' => 'Epic Travel API is running',
|
|
'status' => 'healthy'
|
|
]);
|
|
}
|
|
|
|
// Route to appropriate handler
|
|
try {
|
|
switch ($resource) {
|
|
case 'auth':
|
|
require __DIR__ . '/api/auth.php';
|
|
break;
|
|
|
|
case 'destinations':
|
|
require __DIR__ . '/api/destinations.php';
|
|
break;
|
|
|
|
case 'specials':
|
|
require __DIR__ . '/api/specials.php';
|
|
break;
|
|
|
|
case 'contact':
|
|
require __DIR__ . '/api/contact.php';
|
|
break;
|
|
|
|
case 'newsletter':
|
|
require __DIR__ . '/api/newsletter.php';
|
|
break;
|
|
|
|
case 'upload':
|
|
require __DIR__ . '/api/upload.php';
|
|
break;
|
|
|
|
case 'testimonials':
|
|
require __DIR__ . '/api/testimonials.php';
|
|
break;
|
|
|
|
case 'categories':
|
|
require __DIR__ . '/api/categories.php';
|
|
break;
|
|
|
|
default:
|
|
jsonResponse(['error' => 'Endpoint not found'], 404);
|
|
}
|
|
} catch (Exception $e) {
|
|
if (DEBUG_MODE) {
|
|
jsonResponse(['error' => $e->getMessage()], 500);
|
|
} else {
|
|
jsonResponse(['error' => 'Internal server error'], 500);
|
|
}
|
|
}
|