only allow /continue for non-primary domains

1 files changed, 8 insertions, 0 deletions

diff --git a/Psso/Router.php b/Psso/Router.php
index db1f851..ba0dd53 100644
--- a/Psso/Router.php
+++ b/Psso/Router.php
@@ -39,6 +39,14 @@ class Router {
     }
 
     function dispatch(string $path) {
+        // actually check the hostname lol
+        if ($_SERVER['HTTP_HOST'] != $this->config['site']['primary-domain'] &&
+            $path != '/continue') {
+            header('Location: https://'
+                 . $this->config['site']['primary-domain']);
+            return;
+        }
+
         if (str_contains($path, '..')) {
             $this->dealWithError(404, $path);
             return;