From 617a2b96d11cc8b1bf7e11c407649f81de27d33a Mon Sep 17 00:00:00 2001
From: "Nicolas A. Tonne" <nixatto@gmail.com>
Date: Fri, 13 Feb 2015 12:10:26 +0100
Subject: [PATCH] Fixed faulty redirect

---
 index.php      | 4 ++--
 php/change.php | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/index.php b/index.php
index b2be6927..521a1a6c 100755
--- a/index.php
+++ b/index.php
@@ -1,9 +1,9 @@
 <?php 
-    if(isset($_GET['chan'])) header('Location: '.$_GET['chan']);
+    if(isset($_GET['chan'])) {header('Location: '.$_GET['chan']); exit;}
     $list = explode("/", htmlspecialchars(strtolower($_SERVER["REQUEST_URI"])));
     if($list[1]==""||!isset($list[1])||count($list)<=1){$list="";include('php/nochan.php');die();}
     else if ($list[1] != preg_replace('/[^\da-z]/i', '', urldecode($list[1]))){
-    	header('Location: ../'.preg_replace('/[^\da-z]/i', '', urldecode($list[1])));
+    	header('Location: ../'.preg_replace('/[^\da-z?=]/i', '', urldecode($list[1])));
     	exit;
     }
     else $list=$list[1];
diff --git a/php/change.php b/php/change.php
index 99bb6702..e55954d9 100755
--- a/php/change.php
+++ b/php/change.php
@@ -5,7 +5,7 @@ $guid=substr(base64_encode(crc32($_SERVER['HTTP_USER_AGENT'].$_SERVER['REMOTE_AD
 //save or delete(oid)                                             //getting the list we are in
 $list = explode("/", htmlspecialchars(strtolower($_SERVER["REQUEST_URI"])));
 if($list[1]==""||!isset($list[1])||count($list)<=1)$list="videos";
-else $list = preg_replace('/[^\da-z]/i', '', urldecode($list[1]));
+else $list = preg_replace('/[^\da-z=?]/i', '', urldecode($list[1]));
 
 $list="../lists/".$list.".json";                                   //actually setting the list for the target. Under is the array for an empty list being created
 $array = array("nowPlaying" => array("30H2Z8Lr-4c" => array("id" => "30H2Z8Lr-4c", "title" => "Empty Channel, search to add a video")), "songs" => array(), "conf" => array("startTime" => time(), "views" => array(), "skips" => array(), "vote" => "false", "addsongs" => "false", "longsongs" => "true", "frontpage" => "true", "allvideos" => "true", "removeplay" => "false", "adminpass" => ""));