Hype banners loader

function.php

/**
 * @param string $container_id
 * @param string $target_script Relative path to loader file
 * @param array $loader_config
 */
function product_block_loader($container_id, $target_script, Array $loader_config = [])
{
    $product_block_callback_name = sanitize_file_name(str_replace('-', '_', "callback{$container_id}"));

    $loader_url = theme_base_url('static/third-paty/product-block/hype-loader.php');

    $loader_params = http_build_query([
        'script'   => $target_script,
        'callback' => $product_block_callback_name
    ]);

    $loader_callback_config = array_merge($loader_config, [
        'containerId' => $container_id
    ]);
    ?>
    <script>
        function <?= $product_block_callback_name ?>() {
            return <?= json_encode($loader_callback_config) ?>
        }
    </script>

    <script class="productBlockLoader" type="text/html" charset="utf-8"
            src="<?= $loader_url . '?' . $loader_params ?>"></script>
    <?
}

hype-loader.php

<?
$requested_url = (isset($_SERVER['HTTPS']) ? "https" : "http") . "://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]";

if (!function_exists('sanitize_file_path'))
{
    function sanitize_file_path($file_path)
    {
        $file_path = '/' . trim($file_path, '/');

        $base_dir = __DIR__;
        $path = realpath($base_dir . $file_path);

        // if baseDir isn't at the front 0==strpos, most likely hacking attempt
        if (strpos($path, $base_dir) !== 0 || strpos($path, $base_dir) === FALSE)
        {
            return FALSE;
        }
        elseif (is_readable($path))
        {
            return $path;
        }
        else
        {
            return FALSE;
        }
    }
}

$callback_function_id = empty($_GET['callback']) ? 'none' : $_GET['callback'];

$script_file_relative_path = trim($_GET['script'], '/');

if (!$script_file_path = sanitize_file_path($script_file_relative_path))
{
    http_response_code(403);

    die('Forbidden');
}

$script_content = file_get_contents($script_file_path);

$script_resources_generated_path = basename(dirname($script_file_path));
$script_resources_real_path = dirname($requested_url) . '/' . dirname($script_file_relative_path);
$script_container_generated_name = basename($script_file_path, '_hype_generated_script.js');

$replaces = [
    "\"{$script_resources_generated_path}\""                => json_encode($script_resources_real_path),
    '"reference"'                                           => 'config.reference',
    "\"{$script_container_generated_name}_hype_container\"" => 'config.containerId',
];

$script_content = str_replace(
    array_keys($replaces),
    array_values($replaces),
    $script_content
);

$script_wrapper_code = "
(function () {
    var config = window.$callback_function_id();
    
    $script_content
})();
";

header('Content-Type: text/javascript');

echo trim($script_wrapper_code);

page.php

<?
static $block_number = 0;

$product_block_container_id = 'productBlock' . $block_number++;
$product_relative_path = is_mobile()
    ? 'mobile/100x385_mobile.hyperesources/100x385mobile_hype_generated_script.js'
    : 'desktop/100x300_desktop.hyperesources/100x300desktop_hype_generated_script.js';
?>

<div class="article-product-block" id="<?= $product_block_container_id ?>">
    <? product_block_loader(
        $product_block_container_id,
        $product_relative_path,
        ['reference' => $article_footer_banner_link]
    ); ?>
</div>