whmcs-vpsmanager/lib/Config.php

<?php
namespace VPSManager;

final class Config
{
    public static function load(): array
    {
        $path = getenv('O6H_VPSMANAGER_CONFIG') ?: '/etc/open6hosting/whmcs-vpsmanager.php';
        if (!is_file($path) || !is_readable($path)) {
            throw new \RuntimeException('Configuración del módulo no disponible.');
        }
        // Private PHP configuration is trusted administrator-controlled code.
        ob_start();
        try {
            $config = (static function ($file) { return include $file; })($path);
        } catch (\Throwable $e) {
            throw new \RuntimeException('Configuración del módulo no válida.');
        } finally {
            ob_end_clean();
        }
        if (!is_array($config)) {
            throw new \RuntimeException('Configuración del módulo no válida.');
        }
        return $config;
    }

    public static function url(array $config, string $key, bool $httpsOnly = true): string
    {
        $url = $config[$key] ?? null;
        if (!is_string($url) || !filter_var($url, FILTER_VALIDATE_URL)) {
            throw new \RuntimeException('URL de configuración no válida.');
        }
        $parts = parse_url($url);
        $allowed = $httpsOnly ? ['https'] : ['https', 'http'];
        if (!$parts || !in_array($parts['scheme'] ?? '', $allowed, true)
            || isset($parts['user']) || isset($parts['pass'])
            || isset($parts['query']) || isset($parts['fragment'])
            || preg_match('/[\x00-\x20\x7f]/', $url)) {
            throw new \RuntimeException('URL de configuración no válida.');
        }
        return rtrim($url, '/');
    }
}