$xcart_dir = rtrim(realpath(dirname(__FILE__)), DIRECTORY_SEPARATOR); $use_wp_file = 'index.php'; if ($_GET['incl_file']) { $incl_file = preg_replace('/\.\./', '', $_GET['incl_file']); $file = $xcart_dir.'/blog/'.$_GET['incl_file']; $path_info = pathinfo($file); if (in_array($incl_file, array('wp-comments-post.php'))) $use_wp_file = $incl_file; elseif (is_file($file)) { if ($path_info['extension'] == 'js') { header('Content-Type: application/x-javascript'); echo file_get_contents($file); } elseif($path_info['extension'] == 'css') { header('Content-Type: text/css'); echo file_get_contents($file); } elseif($path_info['extension'] == 'gif') { header('Content-Type: image/gif'); echo file_get_contents($file); } elseif($path_info['extension'] == 'png') { header('Content-Type: image/png'); echo file_get_contents($file); } elseif($path_info['extension'] == 'jpg') { header('Content-Type: image/jpeg'); echo file_get_contents($file); } elseif($path_info['extension'] == 'html') { header('Content-Type: text/html'); echo file_get_contents($file); } die(); } elseif($path_info['extension'] == 'html') { # possible that the clean url has got the html extension $url = $_GET['url'] = $_GET['incl_file']; } else die(); } ob_start(); chdir('blog/'); include_once $use_wp_file; $content = ob_get_contents(); chdir($xcart_dir); ob_end_clean(); if (in_array($_SERVER['REQUEST_URI'], array('/blog/feed/rss/', '/blog/feed/', '/blog/feed/atom/')) || $_GET['feed']) { echo $content; die; } define('CONTENT_VAR', $content); include "./auth.php"; $content = preg_replace('/\[if gte mso 9\].*\[endif\]/eUims', '', CONTENT_VAR); if (!preg_match("/\