- Fixed a missing variable bug

src/File.php

@@ -14,20 +14,20 @@ class File
         $beginning = false;
         $text = array();
 
-        while ($counter && ! $beginning) {
+        while ($counter && !$beginning) {
             $t = "";
 
             while ($t !== PHP_EOL) {
-                if(fseek($handle, $pos, SEEK_END) == -1) {
+                if (fseek($handle, $pos, SEEK_END) == -1) {
                     $beginning = true;
                     break;
                 }
 
                 $t = fgetc($handle);
-                $pos --;
+                $pos--;
             }
 
-            $counter --;
+            $counter--;
 
             if ($beginning) {
                 rewind($handle);
@@ -36,8 +36,26 @@ class File
             $text[$lines - $counter - 1] = fgets($handle);
         }
 
-        fclose ($handle);
+        fclose($handle);
 
         return array_reverse($text);
     }
+
+    public static function sanitizeFilePath($path) : string
+    {
+        // Remove null bytes
+        $path = str_replace("\0", "", $path);
+
+        $path = str_replace([ "\\", "/" ], DIRECTORY_SEPARATOR, $path);
+
+        $path = preg_replace('#' . DIRECTORY_SEPARATOR . '+#', DIRECTORY_SEPARATOR, $path);
+
+        // Remove . and .. directory traversal attempts
+        $path = preg_replace('#\.{1,2}/#', '', $path);
+
+        $path = trim($path, '/\\');
+
+        return $path;
+    }
+
 }

src/Kernel.php

@@ -58,10 +58,9 @@ class Kernel
         if (($keys = getenv('KEYS')) && ($auth = $_SERVER["HTTP_X_DEV_AUTH"] ?? null) && in_array($auth, explode(',', $keys))) {
             unset($_SERVER["HTTP_X_DEV_AUTH"]);
 
-            unset($_ENV[$name], $_SERVER[$name]);
+            unset($_ENV['KEYS'], $_SERVER['KEYS']);
             putenv("KEYS=");
 
-
             foreach(['APP_ENV', 'DEBUG',] as $env) {
                 if (null !== $value = $_SERVER["HTTP_X_$env"] ?? null) {
                     static::putenv($env, $value);