JezK

Edit File: url.php

<?php
defined('ABSPATH') || die('Restricted Access');

//It will remove the undefined thing added by tinyMCE
    // And URL with twice the domain
    $text = str_replace(
        [
            'href="../undefined/',
            'href="../../undefined/',
            'href="../../../undefined//',
            'href="undefined/',
            ACYM_LIVE.'http://',
            ACYM_LIVE.'https://',
        ],
        [
            'href="'.$mainurl,
            'href="'.$mainurl,
            'href="'.$mainurl,
            'href="'.ACYM_LIVE,
            'http://',
            'https://',
        ],
        $text
    );
    //We remove errors with /administrator links and our tags
    //We replace /{ by { , it's also a bug with the editor...
    $text = preg_replace('#href="(/?administrator)?/({|%7B)#Ui', 'href="$2', $text);

//We replace http:/ by http:// , it will avoid a user bug! seriously we are nice guys...
    $text = preg_replace('#href="http:/([^/])#Ui', 'href="http://$1', $text);

//Sometimes clients add links without http:// but directly with their website url... let's try to catch some of these errors
    $text = preg_replace(
        '#href="'.preg_quote(str_replace(['http://', 'https://'], '', $mainurl), '#').'#Ui',
        'href="'.$mainurl,
        $text
    );

$replace = [];
    $replaceBy = [];
    //We don't convert urls starting with { or [ into absolute url otherwise it could break a tag
    //WE don't modify links starting with \\ as it replaces the protocole http / https
    if ($mainurl !== ACYM_LIVE) {
        //url like ../ your site...
        //We don't transform mailto: # http:// ...

$replace[] = '#(href|src|action|background)[ ]*=[ ]*\"(?!(\{|%7B|\[|\#|\\\\|[a-z]{3,15}:|/))(?:\.\./)#i';
        $replaceBy[] = '$1="'.substr(ACYM_LIVE, 0, strrpos(rtrim(ACYM_LIVE, '/'), '/') + 1);

//sub folder : substr(ACYM_LIVE,strrpos(rtrim(ACYM_LIVE,'/'),'/'))
        //We remove the sub folder if there is a tag... otherwise we will break the whole thing.
        //We had an issue with that when selecting the readonline link via the front-end

$subfolder = substr(ACYM_LIVE, strrpos(rtrim(ACYM_LIVE, '/'), '/'));
        $replace[] = '#(href|src|action|background)[ ]*=[ ]*\"'.preg_quote($subfolder, '#').'(\{|%7B)#i';
        $replaceBy[] = '$1="$2';
    }

$replace[] = '#(href|src|action|background)[ ]*=[ ]*\"(?!(\{|%7B|\[|\#|\\\\|[a-z]{3,15}:|/))(?:\.\./|\./)?#i';
    $replaceBy[] = '$1="'.ACYM_LIVE;
    $replace[] = '#(href|src|action|background)[ ]*=[ ]*\"(?!(\{|%7B|\[|\#|\\\\|[a-z]{3,15}:))/#i';
    $replaceBy[] = '$1="'.$mainurl;

//background images for div
    $replace[] = '#((?:background-image|background)[ ]*:[ ]*url\((?:\'|"|&quot;)?(?!(\\\\|[a-z]{3,15}:|/|\'|"|&quot;))(?:\.\./|\./)?)#i';
    $replaceBy[] = '$1'.ACYM_LIVE;

return preg_replace($replace, $replaceBy, $text);
}

if ($otherArguments && strpos($link, $otherArguments) === false) {
        $link = $otherArguments.$link;
    }

return $baseUrl;
}

function acym_currentURL(): string
{
    $protocol = isset($_SERVER['HTTPS']) || !empty($_SERVER['HTTP_UPGRADE_INSECURE_REQUESTS']) ? 'https' : 'http';

$httpHost = acym_getVar('string', 'HTTP_HOST', '', 'SERVER');
    $serverName = acym_getVar('string', 'SERVER_NAME', '', 'SERVER');

$host = empty($httpHost)
        ? (
        empty($serverName)
            ? getenv('HTTP_HOST')
            : $serverName
        )
        : $httpHost;

$requestUri = acym_getVar('string', 'REQUEST_URI', '', 'SERVER');

return $protocol.'://'.$host.$requestUri;
}

function acym_cleanUrl(string $url, array $parametersToRemove): string
{
    $parts = acym_parseUrl($url);

if (empty($parts['query'])) {
        return $url;
    }

$queryParams = [];
    parse_str($parts['query'], $queryParams);

foreach ($parametersToRemove as $parameter) {
        unset($queryParams[$parameter]);
    }

return $parts['scheme'].'://'.$parts['host'].$parts['path'].'?'.http_build_query($queryParams);
}

function acym_isLocalWebsite(): bool
{
    return strpos(ACYM_LIVE, 'localhost') !== false || strpos(ACYM_LIVE, '127.0.0.1') !== false;
}

function acym_internalUrlToPath(string $url): string
{
    $base = str_replace(['http://www.', 'https://www.', 'http://', 'https://'], '', ACYM_LIVE);
    $replacements = ['https://www.'.$base, 'http://www.'.$base, 'https://'.$base, 'http://'.$base];
    foreach ($replacements as $oneReplacement) {
        $position = strpos($url, $oneReplacement);
        if ($position === false) {
            continue;
        }

// Remove parameters
        $relativeUrl = substr($url, $position + strlen($oneReplacement));
        $relativeUrl = preg_replace('/[?#].*$/', '', $relativeUrl);

// Remove encoded / and .
        $segments = [];
        foreach (explode('/', $relativeUrl) as $oneSegment) {
            $decodedSegment = urldecode($oneSegment);
            if (preg_match('#[/\\\\?\#]#', $decodedSegment) === 1 || in_array($decodedSegment, ['.', '..'], true)) {
                return $url;
            }
            $segments[] = $decodedSegment;
        }

return ACYM_ROOT.implode(DS, $segments);
    }

return $url;
}

function acym_isValidUrl(string $url): bool
{
    // If this option is not activated in the php.ini file, we return true because the function get_headers will not work
    if (empty(ini_get('allow_url_fopen'))) {
        return true;
    }
    // If we detect youtu.be url, we don't check the headers because it's a redirection to a valid Url
    if (strpos($url, 'youtu.be') !== false) {
        return true;
    }

$headers = @get_headers($url);

return !empty($headers) && strpos($headers[0], '200');
}

function acym_isImageUrl(string $url): bool
{
    $extension = strtolower(pathinfo($url, PATHINFO_EXTENSION));

return in_array($extension, acym_getImageFileExtensions(true));
}