<?php @session_start();
/* * ********************************************************************
*  Copyright notice PHP Enter
*
*  (c) 2011 Predrag Rukavina - admin[at]phpenter[dot]net
*  All rights reserved
*
*  This script is part of the PHP Enter project. 
*  The PHP Enter project is free software; you can redistribute it and/or
*  modify it under the terms of the GNU General Public License
*  as published by the Free Software Foundation; either version 2
*  of the License, or (at your option) any later version.
*
*  This program is distributed in the hope that it will be useful,
*  but WITHOUT ANY WARRANTY; without even the implied warranty of
*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
*  GNU General Public License for more details.
*
*  You should have received a copy of the GNU General Public License
*  along with this program; if not, write to the Free Software
*  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
*  MA  02110-1301, USA.
*
*  This copyright notice MUST appear in all copies of the script!
* ********************************************************************** */
include ('settings.php');
require_once ('includes/library/HTMLPurifier.auto.php');
$config = HTMLPurifier_Config::createDefault();
$config->set('Core.Encoding', 'UTF-8');
$purifier = new HTMLPurifier($config);
define('CONST_VALS','1');
require_once ('salt.php');
require_once ('classes/securesession.class.php');
enterLogin($salt);
$ac = $conn->Execute('SELECT * FROM categori ORDER BY name ASC');
if(!$ac)
 print $conn->ErrorMsg();
else
 while(!$ac->EOF) {
  if($ac->fields['cord'] == 0) {
   $categori[] = $ac->fields;
  } else {
   $subcat[] = $ac->fields;
  }
  $ac->MoveNext();
 }
$smarty->assign('categori',$categori);
$smarty->assign('subcat',@$subcat);
$smarty->display('blank.php');
echo '<div class="ten">';
echo '<div class="main">';
if(!@$_SESSION['inecsess']) {
 echo "<div class='errors'>$lang[176]</div></div></div>";
 $smarty->display('footer.php');
 die();
}
$shouter = @$_SESSION['INC_USER_ID'];
$ad = $conn->Execute('SELECT * FROM users WHERE usid = '.$conn->qstr($shouter).' LIMIT 1');
if(!$ad)
 print $conn->ErrorMsg();
else
 while(!$ad->EOF) {
  $priv = $ad->fields['privilege'];
  $kori = $ad->fields['usid'];
  $usercc = $ad->fields['username'];
  $thumbnails = $ad->fields['thumbs'];
  if($priv == 1) {
   echo "<div class='errors'>".$lang['232']."</div></div></div>";
   $smarty->display('footer.php');
   die();
  }
  $ad->MoveNext();
 }
if(isset($_POST['query'])) {
 $token = $_SESSION['confirm'];
 unset($_SESSION['confirm']);
 session_write_close();
 if ($token && $_POST['token'] == $token) {
 //do nothing
 }else{
 echo "<div class='errors'>$lang[139]</div></div></div>";
 $smarty->display('footer.php');
 die();
 }
 $cuniver = $_POST['title'];
 if(get_magic_quotes_gpc()) {
  $main = stripslashes(@$_POST['main']);
  $myoption = stripslashes(@$_POST['myoption']);
  $newsid = stripslashes($_POST['newsid']);
  $idblog = stripslashes($_POST['idblog']);
  $title = stripslashes($_POST['title']);
  $brief = stripslashes($_POST['brief']);
  $longdesc = stripslashes($_POST['longdesc']);
 } else {
  $main = @$_POST['main'];
  $myoption = @$_POST['myoption'];
  $newsid = $_POST['newsid'];
  $idblog = $_POST['idblog'];
  $title = $_POST['title'];
  $brief = $_POST['brief'];
  $longdesc = $_POST['longdesc'];
 }
 $main = $purifier->purify($main);
 $myoption = $purifier->purify($myoption);
 $newsid = $purifier->purify($newsid);
 $idblog = $purifier->purify($idblog);
 $title = $purifier->purify($title);
 $brief = $purifier->purify($brief);
 $longdesc = $purifier->purify($longdesc);
 if(strlen($idblog) < 1) {
    echo "<div class='errors'>$lang[238] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div></div></div>";
    $smarty->display('footer.php');
   die();
  }
 $delimiter = explode("|",$idblog);
 $idblog = $delimiter[0];
 $idname = $delimiter[1];
 $seoname = $delimiter[2];
 enterChecker($title,$brief,$longdesc,$smarty);
 enterBlacklister($title,$brief,$longdesc,$smarty);
 if(strlen($title) < 5 or strlen($title) > 160) {
   echo "<div class='errors'>$lang[239] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  }
 if(strlen($brief) > 500) {
   echo "<div class='errors'>$lang[240] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  }
 if(strlen($longdesc) < 50 or strlen($longdesc) > $maxposting) {
   echo "<div class='errors'>$lang[241] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div></div></div>";
   $smarty->display('footer.php');
   die();
  }
 if($_FILES['image']['name'] == "") {
  $newimage = "0";
 } else {
  $newimage = $_FILES['image']['name'];
  if($newimage == false) {
   $newimage = "0";
  } else {
   $newimage = $_FILES['image']['name'];
   $time = date("ymdHis");
   $filetype = substr(strrchr($newimage,'.'),1);
   if(($filetype != "jpeg") && ($filetype != "jpg") && ($filetype != "JPG") && ($filetype != "gif") && ($filetype != "png")) {
    echo "<div class='errors'>$lang[190] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div></div></div>";
    $smarty->display('footer.php');
    die();
   }
   $imagesize = getimagesize($_FILES['image']['tmp_name']);
   if($imagesize == false) {
    echo "<div class='errors'>$lang[190] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div></div></div>";
    $smarty->display('footer.php');
    die();
   }
   $newimage = $time.".".$filetype;
   $destination = "uploads/".$newimage;
   $action = copy($_FILES['image']['tmp_name'],$destination);
   $picwidth = $imagesize[0];
   $picheight = $imagesize[1];
   if($picwidth > 2200 || $picheight > 2200) {
    echo "<div class='errors'>$lang[191] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div></div></div>";
    $smarty->display('footer.php');
    $conn->Close();
    die();
   }
    if($picwidth < 250 || $picheight < 250) {
    echo "<div class='errors'>$lang[236] <a href='post.php'>$lang[135]</a></div></div></div></div>";
    $smarty->display('footer.php');
    $conn->Close();
    die();
   }
  }
  enterThumb($destination,'maxthumb/'.$newimage,380,300);
  enterThumb($destination,'minthumb/'.$newimage,184,112);
 }
 $first = array('onload','onclick','javascript','script');
 $second = array('-','-','-','-');
 $longdesc = str_replace($first,$second,$longdesc);
 $helper = preg_replace('/([?,\s+,|,\/,!,",\',:,#,@,$,^,.,%,<,>,&,*,(,),[,\,\],\,])/',"-",$title);
 $except = htmlspecialchars_decode($longdesc);
 $except = strip_tags($except);
 if(@$myoption == 1) {
 $sql = $conn->Prepare('UPDATE newser SET 
main = '.$conn->qstr($main).',
idblog = '.$conn->qstr($idblog).',
idname = '.$conn->qstr($idname).',
seoname = '.$conn->qstr($seoname).',
title = '.$conn->qstr($title).',
helper = '.$conn->qstr($helper).',
brief = '.$conn->qstr($brief).',
except = '.$conn->qstr($except).',
image = '.$conn->qstr($newimage).',
longdesc = '.$conn->qstr($longdesc).'
WHERE  newsid = '.$conn->qstr($newsid).' and userid = '.$conn->qstr($shouter).'');
 if($conn->Execute($sql) === false) {
  print '<div class="errors">'.$conn->ErrorMsg().'</div>';
 }
}else{
$sql = $conn->Prepare('UPDATE newser SET 
main = '.$conn->qstr($main).',
idblog = '.$conn->qstr($idblog).',
idname = '.$conn->qstr($idname).',
seoname = '.$conn->qstr($seoname).',
title = '.$conn->qstr($title).',
helper = '.$conn->qstr($helper).',
brief = '.$conn->qstr($brief).',
except = '.$conn->qstr($except).',
longdesc = '.$conn->qstr($longdesc).'
WHERE  newsid = '.$conn->qstr($newsid).' and userid = '.$conn->qstr($shouter).'');
 if($conn->Execute($sql) === false) {
  print '<div class="errors">'.$conn->ErrorMsg().'</div>';
 }
}
 $body = "<div><h4>$sitetitle</h4></div><div>$lang[218]</div><br /><br /><div>$lang[237] via $usercc.</div><br /><br /><div>$except</div><br /><br /><div><a href='$sitepath'>$sitetitle</a></div>";
 $subject = $lang['183']." ".$sitetitle;
 $headers = 'MIME-Version: 1.0'."\r\n";
 $headers .= 'Content-type: text/html; charset=utf-8'."\r\n";
 $headers .= "From: $sitetitle <$sitemail>"."\r\n";
 mail($sitemail,$subject,$body,$headers); ?>
<script type="text/javascript">
function delayer(){
window.location = "<?php echo $sitepath; ?>"
}
</script>
</head>
<body onLoad="setTimeout('delayer()', 300)">
<div class="ten column center"><div class="reload"><?php echo $lang['141'] ?><br /><br /><img src="themes/<?php echo $themes; ?>/styles/images/ajax-loader.gif" border="0"></div></div>
<?php } else {
 $id = $_GET['id'];
 $ag = $conn->Execute('SELECT * FROM newser WHERE newsid = '.$conn->qstr($id).' and userid = '.$conn->qstr($shouter).' LIMIT 1');
 if($ag->fields == 0) {
  echo "<div class='errors'>$lang[139]</div></div></div>";
  $smarty->display('footer.php');
  die();
 }
 while(!$ag->EOF) {
  $newsid = $ag->fields['newsid'];
  $main = $ag->fields['main'];
  $univer = $ag->fields['univer'];
  $idblog = $ag->fields['idblog'];
  $idname = $ag->fields['idname'];
  $seoname = $ag->fields['seoname'];
  $editor = $ag->fields['editor'];
  $userid = $ag->fields['userid'];
  $title = $ag->fields['title'];
  $brief = $ag->fields['brief'];
  $image = $ag->fields['image'];
  $longdesc = $ag->fields['longdesc'];
  $ag->MoveNext();
 }
 $token= md5(uniqid());
 $_SESSION['confirm'] = $token;
 session_write_close();
 include ('includes/edit.php');
}
?>
</div>
</div>
<?php
$smarty->display('footer.php');
######################################
##edit.php                      BETA##
######################################
?>