From 1dfaa74cb3a496ad1c8b4af366c79ddd91d53f20 Mon Sep 17 00:00:00 2001
From: winter Sparkles
Date: Sun, 9 Aug 2026 15:51:51 +0100
Subject: only allow /continue for non-primary domains

---
 Psso/Router.php | 8 ++++++++
 1 file changed, 8 insertions(+)

(limited to 'Psso')

diff --git a/Psso/Router.php b/Psso/Router.php
index db1f851..ba0dd53 100644
--- a/Psso/Router.php
+++ b/Psso/Router.php
@@ -39,6 +39,14 @@ class Router {
     }
 
     function dispatch(string $path) {
+        // actually check the hostname lol
+        if ($_SERVER['HTTP_HOST'] != $this->config['site']['primary-domain'] &&
+            $path != '/continue') {
+            header('Location: https://'
+                 . $this->config['site']['primary-domain']);
+            return;
+        }
+
         if (str_contains($path, '..')) {
             $this->dealWithError(404, $path);
             return;
-- 
cgit v1.3