baseUrlRelative = ($basePath === '' || $basePath === '.') ? '/' : $basePath . '/';
// Use the canonical URL so a forged Host header cannot contaminate responses.
$configuredBaseUrl = trim($config->site['base_url'] ?? '');
if ($configuredBaseUrl !== '') {
$config->baseUrl = rtrim($configuredBaseUrl, '/') . '/';
} else {
$https = !empty($_SERVER['HTTPS']) && strtolower((string) $_SERVER['HTTPS']) !== 'off';
$scheme = $https ? 'https' : 'http';
$host = $_SERVER['HTTP_HOST'] ?? 'localhost';
if (!preg_match('/^[a-z0-9.-]+(?::\d{1,5})?$/i', $host)) {
throw new \InvalidArgumentException('Invalid Host header');
}
$config->baseUrl = $scheme . '://' . $host . $config->baseUrlRelative;
}
$handler = new Handler($config);
$handler->handle();
} catch (\Throwable $e) {
error_log('[SSpkS] Request handling failed: ' . $e->getMessage());
$status = $e instanceof \InvalidArgumentException ? 400 : 500;
http_response_code($status);
header('Cache-Control: no-store');
header('X-Content-Type-Options: nosniff');
$unique = isset($_GET['unique']) && is_string($_GET['unique']) ? $_GET['unique'] : '';
if (strpos($unique, 'synology_') === 0) {
header('Content-Type: application/json; charset=utf-8');
echo '{"packages":[]}';
} else {
header('Content-Type: text/html; charset=utf-8');
$title = $status === 400 ? 'Invalid request' : 'Service unavailable';
$message = $status === 400 ? 'The request parameters or host name are invalid.' : 'Please try again later.';
echo '' . $title . '';
echo '' . $title . '
' . $message . '
';
}
}