Path-style URL routing + anonymity note

[miglen]

Summary

Two follow-ups after the #48 revive — closes the rest of the open issue backlog.

#24 — Path-style URL routing

Adds two new ways to specify the target URL on top of the existing ?_proxurl= form:

Form	Example
Query (default)	phproxy.example/index.php?_proxurl=<encoded>
Path via index.php	phproxy.example/index.php/https://example.com/
Bare path	phproxy.example/https://example.com/

Implementation:

• New root .htaccess with mod_rewrite rule forwarding /http(s):/target/… to index.php/$1
• index.php detects PATH_INFO of form /http(s):/target and synthesises $_GET[_proxurl] before the existing dispatch (Apache normalises consecutive slashes, so we accept http:/X and restore http://X)
• Dockerfile flips AllowOverride None → All on /var/www/ so the shipped .htaccess takes effect inside the container
• README documents the three forms and the Apache requirements for the bare-path form

Outbound URL rewriting is unchanged — pages still link back via the ?_proxurl= form. The new forms are additive entry points.

#21 — Anonymity

Documents an existing invariant rather than changing behaviour. The outbound request builder has always constructed headers from a known-safe whitelist (method, path, Host, User-Agent, Accept, optional Referer, Cookie, Authorization, POST body headers); it never forwards X-Forwarded-For, X-Real-IP, Via, or Forwarded. Added a code comment stating the invariant and a README "Anonymity" section so users (and future maintainers) know what's guaranteed.

#39 — Closed

Re-read the issue: body is two Japanese-language URLs (m.youtube.com, google.co.jp) with no description. Same bucket as #41 / #42 — modern JS/CF-gated sites, fundamental design limitation already documented in #48's README updates. Closing on merge.

Test plan

Smoke-tested inside the php:8.5-apache container (PHP 8.5.6):

• ?_proxurl= query form still works (regression check)
• /index.php/https://example.com/ returns the Example Domain page
• /https://example.com/ (bare path via mod_rewrite) returns the Example Domain page
• /http://example.com/?foo=bar preserves the query string
• Entry form and edit.php settings page unaffected (HTTP 200)
• php -l clean
• Zero deprecations / warnings / notices with error_reporting(E_ALL) + display_errors=1 on the new code paths

🤖 Generated with Claude Code