<?php session_start();
/* * ********************************************************************
*  Copyright notice PHP Enter
*
*  (c) 2011 Predrag Rukavina - admin[at]phpenter[dot]net
*  All rights reserved
*
*  This script is part of the PHP Enter project. 
*  The PHP Enter project is free software; you can redistribute it and/or
*  modify it under the terms of the GNU General Public License
*  as published by the Free Software Foundation; either version 2
*  of the License, or (at your option) any later version.
*
*  This program is distributed in the hope that it will be useful,
*  but WITHOUT ANY WARRANTY; without even the implied warranty of
*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
*  GNU General Public License for more details.
*
*  You should have received a copy of the GNU General Public License
*  along with this program; if not, write to the Free Software
*  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,
*  MA  02110-1301, USA.
*
*  This copyright notice MUST appear in all copies of the script!
* ********************************************************************** */
include ('settings.php');
require_once 'admin/salt.php';
require_once 'admin/classes/securesession.class.php';
$ss = new SecureSession();
$ss->check_browser = true;
$ss->check_ip_blocks = 2;
$ss->secure_word = $salt;
$ss->regenerate_id = true;
if(!$ss->Check() || !isset($_SESSION['logged_in']) || !$_SESSION['logged_in']) {
$_SESSION = array();
header('Location: admin/signin.php');
die();
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<link rel="stylesheet" type="text/css" href="<?php echo $sitepath; ?>/admin/style/style.css" />
<link href="<?php echo $sitepath; ?>/themes/<?php echo $themes; ?>/styles/images/favicon.ico" type="image/x-icon" rel="shortcut icon" />
</head>
<body>
<table width="950px" background="<?php echo $sitepath; ?>/admin/style/images/header.jpg" height="35px" cellspacing="2" cellpadding="5" align="center" border="0">
 <tr>
  <td align="right" width="180px">
   <div id=stopnavy><strong><a href="<?php echo $sitepath; ?>/admin">Control Panel</a></strong></div>
   </td>
   <td>
   </td>
   <td align="left" width="180px"><strong><font color="#FFFFFF"><div id="topnavy"><div id="stopnavy"><a href="<?php echo $sitepath; ?>/postadmin.php">New Story</a></div></div></font></strong>
  </td>
 </tr>
</table>
<table cellspacing=1 cellpadding=0 width="952px" align="center" border="0">
 <tr>
   <td>
<div id="borders">
<?php
if (!$_SESSION['incsess'])
{
 echo "<div class='column center error'>Something went wrong with your session. Please <a href='admin/signout.php'>sign out</a> and sign in again</div></div></div></div>";
 include('admin/footer.php');
 die();
}
define('CONST_VALE','1');
if(isset($_POST['query'])) {
 $token = $_SESSION['confirm'];
 unset($_SESSION['confirm']);
 session_write_close();
 if ($token && $_POST['token'] == $token) {
 //do nothing
 }else{
   echo "<div class='column error'>$lang[139]</div></div>";
   include ('admin/footer.php');
   die();
 }
 if($editortrue == 2) {
  $editor = '2';
 }
 if($editortrue == 1) {
  $editor = '1';
 }
 if(get_magic_quotes_gpc()) {
  $main = stripslashes($_POST['main']);
  $idblog = stripslashes($_POST['idblog']);
  $title = stripslashes($_POST['title']);
  $brief = stripslashes($_POST['brief']);
  $address = stripslashes($_POST['address']);
  $longdesc = stripslashes($_POST['longdesc']);
 } else {
  $main = $_POST['main'];
  $idblog = $_POST['idblog'];
  $title = $_POST['title'];
  $brief = $_POST['brief'];
  $address = $_POST['address'];
  $longdesc = $_POST['longdesc'];
 }
 if(strlen($idblog) < 1) {
   echo "<div class='column error'>$lang[238] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div>";
   include ('admin/footer.php');
   die();
  }
 $delimiter = explode("|",$idblog);
 $idblog = $delimiter[0];
 $idname = $delimiter[1];
 $seoname = $delimiter[2];
 if(@$_SESSION["reload"] == $title) {
 echo "<div class='column error'>$lang[136]</div></div>";
  include ('admin/footer.php');
  die();
 }
 enterCheck($address,$title,$brief,$longdesc,$smarty);
 enterBlacklist($address,$title,$brief,$longdesc,$smarty);
 if(strlen($title) < 5 or strlen($title) > 160) {
   echo "<div class='column error'>$lang[239] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div>";
   include ('admin/footer.php');
   die();
  }
 if(strlen($brief) > 500) {
   echo "<div class='column error'>$lang[240] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div>";
   include ('admin/footer.php');
   die();
  }
 if(strlen($longdesc) < 50 or strlen($longdesc) > $maxposting) {
   echo "<div class='column error'>$lang[241] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div>";
   include ('admin/footer.php');
   die();
  }
 if($_FILES['image']['name'] == "") {
  $newimage = "0";
 } else {
  $newimage = $_FILES['image']['name'];
  if($newimage == false) {
   $newimage = "0";
  } else {
   $newimage = $_FILES['image']['name'];
   $time = date("ymdHis");
   $filetype = substr(strrchr($newimage,'.'),1);
   if(($filetype != "jpeg") && ($filetype != "jpg") && ($filetype != "JPG") && ($filetype != "gif") && ($filetype != "png")) {
    echo "<div class='column error'>$lang[190] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div>";
    include ('admin/footer.php');
    die();
   }
   $imagesize = getimagesize($_FILES['image']['tmp_name']);
   if($imagesize == false) {
    echo "<div class='column error'>$lang[190] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div>";
    include ('admin/footer.php');
    die();
   }
   $newimage = $time.".".$filetype;
   $destination = "uploads/".$newimage;
   $action = copy($_FILES['image']['tmp_name'],$destination);
   $picwidth = $imagesize[0];
   $picheight = $imagesize[1];
   if($picwidth > 2800 || $picheight > 2800) {
    echo "<div class='column error'>$lang[191] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div>";
    include ('admin/footer.php');
    $conn->Close();
    die();
   }
   if($picwidth < 250 || $picheight < 250) {
    echo "<div class='column error'>$lang[236] <a href='javascript:history.go(-1)'>$lang[135]</a></div></div>";
    include ('admin/footer.php');
    $conn->Close();
    die();
   }
  }
  enterThumb($destination,'maxthumb/'.$newimage,380,300);
  enterThumb($destination,'minthumb/'.$newimage,184,112);
 }
 $first = array('onload','onclick','javascript','script');
 $second = array('-','-','-','-');
 $longdesc = str_replace($first,$second,$longdesc);
 $helper = preg_replace('/([?,\s+,|,\/,!,",\',:,#,@,$,^,.,%,<,>,&,*,(,),[,\,\],\,])/',"-",$title);
 $except = htmlspecialchars_decode($longdesc);
 $except = strip_tags($except);
 $univer = date("ymdHis");
 $ae = $conn->Prepare('INSERT INTO newser (main,univer,idblog,idname,seoname,editor,userid,user,userpic,title,helper,brief,address,except,image,longdesc) VALUES ('.$conn->qstr($main).','.$conn->qstr($univer).','.$conn->qstr($idblog).','.$conn->qstr($idname).','.$conn->qstr($seoname).','.$conn->qstr($editor).','.$conn->qstr('0').','.$conn->qstr('0').','.$conn->qstr('0').','.$conn->qstr($title).','.$conn->qstr($helper).','.$conn->qstr($brief).','.$conn->qstr($address).','.$conn->qstr($except).','.$conn->qstr($newimage).','.$conn->qstr($longdesc).')');
 if($conn->Execute($ae) === false) {
  print $conn->ErrorMsg();
 }
 $_SESSION["reload"] = $title;
$asty = $_SERVER['HTTP_REFERER'];
if($asty == false){
$asty = $sitepath;
}
?>
<div class="alert alert-success"><?php echo $lang['141'] ?><br /><br /><img src="<?php echo $sitepath; ?>/themes/<?php echo $themes; ?>/styles/images/ajax-loader.gif"  /><br /><br /></div>
<script>
setTimeout("location.href = '<?php echo $asty ?>';",400);
</script>
<?php
} else {
 $token= md5(uniqid());
 $_SESSION['confirm'] = $token;
 session_write_close();
 include ('includes/postadmin.php');
}
?>
</div>
<?php
include ('admin/footer.php');
######################################
##postadmin.php                 BETA##
######################################
?>