isPathTraversal()) { foreach ($arUrlRewrite as $val) { if (preg_match($val["CONDITION"], $requestUri)) { if (!empty($val["RULE"])) { $url = preg_replace($val["CONDITION"], ($val["PATH"] <> '' ? $val["PATH"] . "?" : "") . $val["RULE"], $requestUri); } else { $url = $val["PATH"]; } if (($pos = strpos($url, "?")) !== false) { $params = substr($url, $pos + 1); parse_str($params, $vars); $_GET += $vars; $_REQUEST += $vars; $_SERVER["QUERY_STRING"] = Web\Uri::urnEncode($params, false); $url = substr($url, 0, $pos); // actualize context if it is initialized already Context::getCurrent()?->getRequest()->modifyByQueryString($_SERVER["QUERY_STRING"]); } $url = _normalizePath($url); if (!$io->FileExists($_SERVER['DOCUMENT_ROOT'] . $url)) { continue; } if (!$io->ValidatePathString($url)) { continue; } $urlTmp = strtolower(ltrim($url, "/\\")); $urlTmp = str_replace(".", "", $urlTmp); if ((str_starts_with($urlTmp, "upload/") || (str_starts_with($urlTmp, "bitrix/") && !str_starts_with($urlTmp, "bitrix/services/") && !str_starts_with($urlTmp, "bitrix/groupdavphp")))) { continue; } $ext = strtolower(GetFileExtension($url)); if ($ext != "php") { continue; } // D7 response is not available here if (stristr(php_sapi_name(), "cgi") !== false && (!defined("BX_HTTP_STATUS") || !BX_HTTP_STATUS)) { header("Status: 200 OK"); } else { header($_SERVER["SERVER_PROTOCOL"] . " 200 OK"); } $_SERVER["REAL_FILE_PATH"] = $url; include_once $io->GetPhysicalName($_SERVER['DOCUMENT_ROOT'] . $url); die(); } } } //admin section 404 if (str_starts_with($requestUri, "/bitrix/admin/")) { $_SERVER["REAL_FILE_PATH"] = "/bitrix/admin/404.php"; include $_SERVER["DOCUMENT_ROOT"] . "/bitrix/admin/404.php"; die(); } define("BX_CHECK_SHORT_URI", true);