

<?php

// C:/htdocs/save.php

header("Access-Control-Allow-Origin: *");

header("Access-Control-Allow-Headers: Content-Type");



$data = json_decode(file_get_contents('php://input'), true);



if ($data && isset($data['path']) && isset($data['html'])) {

    // Construct the absolute path based on the server root

    $targetFile = $_SERVER['DOCUMENT_ROOT'] . $data['path'];

    

    // Ensure the script isn't tricked into writing outside htdocs

    if (strpos(realpath(dirname($targetFile)), realpath($_SERVER['DOCUMENT_ROOT'])) === 0) {

        file_put_contents($targetFile, $data['html']);

        http_response_code(200);

        echo "Saved";

    } else {

        http_response_code(403);

    }

}

?>