<?php
############################ GENERAL FUNCTIONS ###########################
function endudate($datum)
{
# CONVERT ENGLISH DATE TO DUTCH #
$datetime = split(' ', $datum);
$partdate = split('-', $datetime[0]);
$date = $partdate[2].'-'.$partdate[1].'-'.$partdate[0].' '. $datetime[1];
return $date;
}
function IP()
{
# GET IP FROM USERS #
if (@getenv ($_SERVER['HTTP_X_FORWARDED_FOR']))
{
$ip = @getenv ($_SERVER['HTTP_X_FORWARDED_FOR']);
}
elseif (@getenv ($_SERVER['HTTP_CLIENT_IP']))
{
$ip = @getenv ($_SERVER['HTTP_CLIENT_IP']);
}
else
{
$ip = $_SERVER['REMOTE_ADDR'];
}
return $ip;
}
function ctchars($str, $type = 'encode', $customcharset = false)
{
$defaultcharset = array
(
'33' => '!', '34' => '"', '36' => '$', '37' => '%',
'39' => '\'', '40' => '(', '41' => ')', '42' => '*',
'43' => '+', '44' => ',', '45' => '-', '46' => '.',
'47' => '/', '58' => ':', '60' => '<', '61' => '=',
'62' => '>', '63' => '?', '64' => '@', '91' => '[',
'92' => '\\', '93' => ']', ' 94' => '^', '95' => '_',
'96' => '`', '123' => '{', '124' => '|', '125' => '}',
'126' => '~',
);
if(!$customcharset)
{
$charset = $defaultcharset;
}
elseif(!is_array($customcharset))
{
return("<b>Warning:</b> Wrong argument 3 for convertchars(), argument 3 must be an array");
}
foreach($charset as $key => $value)
{
$parse = '&#'.$key.';';
if($type == 'encode')
{
if(ereg($parse, $str))
{
$pos[1] = strpos($str, $parse);
$pos[2] = (strlen($parse) + strpos($str, $parse));
$tmp[0] = convertchars($parse, decode);
$tmp[1] = htmlentities($tmp[0]);
$str = substr_replace($str, $tmp[0], $pos[1], $pos[2]);
}
//$str = str_replace($value, $parse, $str);
return preg_replace('/[^!-%\x27-;=?-~ ]/e', '"&#".ord("$0").chr(59)', $str);
}
elseif($type == 'decode')
{
$str = str_replace($parse, $value, $str);
}
else
{
return('<b>Warning</b>: Incorrect argument 2 for convertchars()');
}
}
return $str;
}
// Database
$cmysql = mysql_select_db($cfg['database'], mysql_connect($cfg['host'], $cfg['user'], $cfg['pass'])) or die(mysql_error());
$smysql = mysql_query("SELECT * FROM `content` WHERE `pagina` = '". mysql_real_escape_string($_GET['p']) ."'");
$amysql = mysql_fetch_array($smysql);
if(mysql_num_rows($smysql)) {
$content['left'] = $amysql['links'];
$content['right'] = $amysql['rechts'];
} else {
$content['left'] = 'pagina bestaat niet';
}
$smysqlphoto = mysql_query("SELECT * FROM `images` WHERE `pagina` = '". mysql_real_escape_string($_GET['p']) ."'");
$i=1;
while($rows = mysql_fetch_array($smysqlphoto)) {
$data['beschrijving'][$i] = $rows['beschrijving'];
$data['file'][$i] = $rows['file'];
$i++;
}
// Form handle
if($_SERVER['REQUEST_METHOD'] == 'POST' && !isset($_POST['login'])) {
$errors = array();
// Contactformulier is onvangen
if(!isset($_POST['naam']) || empty($_POST['naam'])) {
array_push($errors, '- U heeft geen naam ingevuld');
}
if(!eregi('^[a-zA-Z0-9._-]+@[a-zA-Z0-9-]+\.[a-zA-Z.]{2,5}$', $_POST['email'])) {
array_push($errors, '- Email adres is ongeldig of niet ingevuld');
}
if(!isset($_POST['onderwerp']) || empty($_POST['onderwerp'])) {
array_push($errors, '- U heeft geen onderwerp ingevuld');
}
if(!isset($_POST['bericht']) || strlen($_POST['bericht']) < 10) {
array_push($errors, '- Het bericht is te kort');
}
if(isset($_POST['bericht']) && strlen($_POST['bericht']) > 1000) {
array_push($errors, '- Het bericht is te lang');
}
$maxupload = $cfg['maxfilesize'] * 1024 * 1024;
if ($_FILES['bestand']['size'] > $maxupload) {
array_push($errors, '- De bijlage is te groot.');
}
// Alle errors valideren
if(count($errors) == 0) {
// Geen errors :)
$message = wordwrap($_POST['bericht'], 70);
$headers = "From: ".$_POST['naam']." <".$_POST['email'].">\r\n";
$headers .= "Reply-To: ".$_POST['naam']." <".$_POST['email'].">\r\n";
$headers .= "MIME-Version: 1.0\r\n";
// email bestaat uit meerdere bestanden dus vertel wat de scheidings teken is en dat het een multipart is
$headers .= "Content-Type: multipart/mixed; boundary=\"".bound."\"\r\n";
if(!empty($_FILES['bestand']['name'])) {
$bestand = file_get_contents($_FILES['bestand']['tmp_name']);
}
$body.= "This is a multi-part message in MIME format.\r\n";
$body.= "\r\n";
$body.= "--".bound."\r\n";
$body.= "Content-Type: text/plain; charset=iso-8859-1\r\n";
$body.= "Content-Transfer-Encoding: 7bit\r\n";
$body.= "\r\n";
$body.= $message ."\r\n";
$body.= "--".bound."\r\n";
$body.= "Content-Type: application/octet-stream; name=".$_FILES['bestand']['name']."\r\n";
$body.= "Content-Transfer-Encoding: base64\r\n";
$body.= "Content-disposition: attachment\r\n";
$body.= "\n";
$body.= chunk_split(base64_encode($bestand )) . "\r\n";
$mailOK = mail($cfg['email'], $_POST['onderwerp'], $headers.$body);
if($mailOK) {
header('Location: /');
} else {
array_push($errors, 'Er is een fout onbekende opgetreden, en het bericht kon niet verzoden worden.');
}
}
}
// login
if(isset($_POST['login'])) {
if($_POST['username'] == $cfg['username'] && $_POST['password'] == $cfg['password']) {
$randomkey = md5(rand(0,9999999999));
setcookie("acsk", $randomkey, time() + 3600);
mysql_query("REPLACE INTO `login` (`code`, `ip`, `date`) VALUES ('". $randomkey ."', '". IP() ."', NOW())") or die(mysql_error());
header("Location: content.php?p=admin");
} else {
echo 'gebruikersnaam of wachtwoord onjuist';
}
}
$gsession = mysql_query("SELECT * FROM `login` WHERE `code` = '". $_COOKIE['acsk'] ."' AND `ip` = '". IP() ."'") or die(mysql_error());
if(mysql_num_rows($gsession) > 0) {
$tmp = mysql_fetch_assoc($gsession);
$session['inl'] = 'ja';
$session['ses'] = $tmp['code'];
$session['dat'] = $tmp['date'];
$session['ipa'] = $tmp['ip'];
if(isset($_POST['savep'])) {
$_POST['links'] = stripslashes($_POST['links']);
$_POST['rechts'] = stripslashes($_POST['rechts']);
mysql_query("UPDATE `content` SET `links` = '". mysql_real_escape_string(ctchars($_POST['links'], 'decode')) ."',
`rechts` = '". mysql_real_escape_string(ctchars($_POST['rechts'], 'decode')) ."'
WHERE `pagina` = '". mysql_real_escape_string($_GET['page']) ."'");
header("Location: content.php?p=admin&view=pages");
}
if($_GET['p'] == 'admin' && $_GET['view'] == 'ilhis' && $_GET['actie'] == 'rm') {
mysql_query("DELETE FROM `login` WHERE `date` != '". $session['dat'] ."'");
header("Location: content.php?p=admin&view=ilhis");
}
if($_GET['p'] == 'admin' && $_GET['view'] == 'pages' && $_GET['actie'] == 'rm') {
mysql_query("DELETE FROM `content` WHERE `pagina` = '". $_GET['page'] ."'") or die(mysql_error());
header("Location: content.php?p=admin&view=pages");
}
if($_GET['p'] == 'admin' && $_GET['view'] == 'photo' && $_GET['actie'] == 'rm') {
mysql_query("DELETE FROM `images` WHERE `file` = '". $_GET['foto'] ."'") or die(mysql_error());
header("Location: content.php?p=admin&view=photo&album=". $_GET['album']);
}
if($_GET['p'] == 'admin' && $_GET['view'] == 'pages' && $_GET['actie'] == 'new' && isset($_POST['saven'])) {
mysql_query("INSERT INTO `content` (`pagina`, `links`, `rechts`) VALUES ('". $_POST['pnaam']."', '". mysql_real_escape_string(ctchars($_POST['links'], 'decode'))."', '". mysql_real_escape_string(ctchars($_POST['rechts'], 'decode'))."')") or die(mysql_error());
header("Location: content.php?p=admin&view=pages");
}
if($_GET['p'] == 'admin' && $_GET['view'] == 'config' && isset($_POST['sconfig'])) {
$vcfg = '<?php
';
foreach($cfg as $key => $value) {
if(!is_numeric($_POST[$key])) {$w="'";}else{$w="";}
$vcfg.='$cfg[\''.$key.'\'] = '. $w.$_POST[$key].$w .';
';
}
$vcfg.='?>';
if(file_exists('config.php')) {
unlink('config.php');
}
$fo=fopen('config.php', 'w+');
fputs($fo, $vcfg);
fclose($fo);
header("Location: content.php?p=admin&view=config");
}
if($_GET['p'] == 'admin' && $_GET['view'] == 'photo' && $_GET['actie'] == 'new' && isset($_POST['nfoto'])) {
if (!$_FILES['upload']) {
print ("Geef een bestand op!");
} else {
$OK = move_uploaded_file($_FILES['upload']['tmp_name'], $cfg['imagepath'].$_FILES['upload']['name']);
}
if($OK) {
$OK2 = mysql_query("INSERT INTO `images` (`datum`, `file`, `pagina`, `naam`, `beschrijving`) VALUES (NOW(), '". $_FILES['upload']['name'] ."', '".$_POST['pagina']."', '". $_POST['naam'] ."', '". $_POST['beschrijving'] ."') ") or die(mysql_error());
if($OK2) {
header('location: '. $_SERVER['REQUEST_URI']);
} else {
$error = 'fout bij beschrijving';
}
} else {
$error = 'Fout bij uploaden';
}
header("Location: content.php?p=admin&view=photo&album=".$_GET['album']);
}
if($_GET['p'] == 'admin' && $_GET['actie'] == 'loguit') {
setcookie("acsk", $randomkey, time() - 3600);
header("Location: content.php?p=admin");
}
} else {
$session['inl'] = 'nee';
}
if($_GET['p'] == 'admin') {
if($session['inl'] == 'nee') {
?>
<html>
<head>
<title>Login</title>
<style type="text/css">
div.lblayout {
margin-right: auto;
margin-left: auto;
width: 55em;
height: auto;
}
div.lbtopmargin {
margin-top: 100px;
}
div.lball {
text-align: center;
}
div.lbcontainer {
background-color: #ececec;
margin-top: 3px;
padding: 10px;
border: solid 1px #555555;
overflow: hidden;
}
div.lbinfo {
background: url(themes/default/images/vstippled.gif) repeat-y right top;
text-align: center;
float: left;
padding-right: 1em;
width: 25em;
}
div.lbfields {
background: url(themes/default/images/vstippled.gif) repeat-y left top;
float: left;
margin-left: -1px;
padding-left: 1em;
width: 28em;
}
div.lbfieldstext {
float: left;
}
div.lbinput {
float: left;
margin-left: 10px;
}
input.lbsubmit {
color: #ffffff;
background-color: #999999;
margin-top: 5px;
cursor: pointer;
}
input.lbpassword {
margin-top: 5px;
}
input.order {
width:2em;
font-size: 1em;
text-align: center;
}
p.lbuser {
color: #555555;
font-size: 1.2em;
}
p.lbpass {
color: #555555;
font-size: 1.2em;
margin-top: 10px;
}
</style>
</head>
<body>
<div id="loginbox" class="lblayout lbcontainer">
<div class="lbinfo">
<p>Voer een geldige gebruikersnaam en -wachtwoord combinatie in om toegang te krijgen tot het beheerpaneel. <br /><br />
</p>
</div>
<div class="lbfields">
<div class="lbfieldstext">
<p class="lbuser">Gebruikersnaam:</p>
<p class="lbpass">Wachtwoord:</p>
</div>
<div class="lbinput">
<form action="content.php?p=admin" method="post">
<p>
<input name="username" class="defaultfocus" type="text" size="15" value="" /><br />
<input class="lbpassword" name="password" type="password" size="15" /><br />
<input class="lbsubmit" name="login" type="submit" value="Versturen" />
<input class="lbsubmit" name="logincancel" type="submit" value="Annuleren" />
</p>
</form>
</div>
</div>
</div>
</body>
</html>
<?php
}
if($session['inl'] == 'ja') {
?>
<html>
<head>
<title>Admin pagina</title>
<style type="text/css">
#wrap { width: 805px; margin: 0 auto;background-color: #DDD; }
#head { background-color: #000; height: 50px; color: #FFF; font-size: 12px;}
#head h1 {float:left;color:#012345; height: 40px; margin: 0 10px; background-color: #ABCDEF; padding: 5px;}
#left { float: left; width: 210px; font-size:12px; background-color: #ffcc69; height: 70%; }
#right { float: left; width: 580px; padding: 5px; font-size: 12px; }
#thead { font-weight: bold;}
#thead td { margin: 0 4px; }
#menu { background-color: #556654; display: block; }
#menu a { text-decoration: none; color: d9d1a2; font-weight: bold; font-size: 12px; }
a { text-decoration: none; color: #012345; }
a:hover { color: #000; }
li { color: orange; }
body { margin: 0 auto; }
table { font-size: 12px; }
.oneven { background-color: #CCC; }
.even { background-color: #FFF; }
.tarea { width: 230px; height: 100px;}
.tarea2 { width: 530px; height: 600px; background-color: #FFF; }
</style>
<link rel="stylesheet" type="text/css" href="css/styles.css" />
<script type="text/javascript" src="jscripts/tiny_mce/tiny_mce.js"></script>
<script type="text/javascript">
tinyMCE.init({
// General options
mode : "textareas",
theme : "advanced",
plugins : "safari,pagebreak,style,layer,table,save,advhr,advimage,advlink,emotions,iespell,inlinepopups,insertdatetime,preview,media,searchreplace,print,contextmenu,paste,directionality,fullscreen,noneditable,visualchars,nonbreaking,xhtmlxtras,template",
// Theme options
theme_advanced_buttons1 : "save,newdocument,|,bold,italic,underline,strikethrough,|,justifyleft,justifycenter,justifyright,justifyfull,|,styleselect,formatselect,fontselect,fontsizeselect",
theme_advanced_buttons2 : "cut,copy,paste,pastetext,pasteword,|,search,replace,|,bullist,numlist,|,outdent,indent,blockquote,|,undo,redo,|,link,unlink,anchor,image,cleanup,help,code,|,insertdate,inserttime,preview,|,forecolor,backcolor",
theme_advanced_buttons3 : "tablecontrols,|,hr,removeformat,visualaid,|,sub,sup,|,charmap,emotions,iespell,media,advhr,|,print,|,ltr,rtl,|,fullscreen",
theme_advanced_buttons4 : "insertlayer,moveforward,movebackward,absolute,|,styleprops,|,cite,abbr,acronym,del,ins,attribs,|,visualchars,nonbreaking,template,pagebreak",
theme_advanced_toolbar_location : "top",
theme_advanced_toolbar_align : "left",
theme_advanced_statusbar_location : "bottom",
theme_advanced_resizing : true,
// Example content CSS (should be your site CSS)
content_css : "css/content.css",
// Drop lists for link/image/media/template dialogs
template_external_list_url : "lists/template_list.js",
external_link_list_url : "lists/link_list.js",
external_image_list_url : "lists/image_list.js",
media_external_list_url : "lists/media_list.js",
// Replace values for the template plugin
template_replace_values : {
username : "Some User",
staffid : "991234"
}
});
</script>
<script type="text/javascript">
function verwijder(item) {
var check=confirm("Weet u zeker dat u de pagina \""+item+"\" wilt verwijderen?");
if(check) {
window.location = "content.php?p=admin&view=pages&actie=rm&page="+item;
} else {
alert("Het bestand is niet verwijderd.");
}
}
function verwijder2(item) {
var check=confirm("Weet u zeker dat u de foto \""+item+"\" wilt verwijderen?");
if(check) {
window.location = "content.php?p=admin&view=photo&album=<?=$_GET['album'];?>&actie=rm&foto="+item;
} else {
alert("Het bestand is niet verwijderd.");
}
}
</script>
</head>
<body>
<div id="wrap">
<div id="head">
<h1>Admin Pagina</h1>
<br clear="all" />
</div>
<div id="left">
<?='Ingelogd als: '.$cfg['username'].'<br />Op ip: '.$session['ipa'].'<br />Op datum: '.endudate($session['dat']);?>
<ul id="menu">
<li><a href="content.php?p=admin">Admin home</a></li>
<li><a href="content.php?p=admin&view=ilhis">Inlog geschiedenis</a></li>
<li><a href="content.php?p=admin&view=pages">Pagina beheer</a></li>
<li><a href="content.php?p=admin&view=photo">Foto beheer</a></li>
<li><a href="content.php?p=admin&view=config">Configuratie</a></li>
<li><a href="content.php?p=admin&actie=loguit">Uitloggen</a></li>
</ul>
</div>
<div id="right">
<?php
if(isset($_GET['view'])) {
if($_GET['view'] == 'ilhis') {
$ggg = mysql_query("SELECT * FROM `login` ORDER BY `date` DESC LIMIT 20") or die(mysql_error());
?>
<table border="0" cellpadding="0" cellspacing="0" width="490" style="border-collapse:collapse;table-layout:fixed">
<col width="144">
<col width="79">
<col width="114">
<col width="250">
<tr id="thead">
<td>Datum</td>
<td>Gebruiker</td>
<td>ip</td>
<td>Sessie</td>
</tr>
<?php
$i=0;
while($lst=mysql_fetch_array($ggg)) {
if($lst['date'] == $session['dat']) { continue; }
if($i%2){$t='even';}else{$t='oneven';}
?>
<tr>
<td class="<?=$t;?>"><?=endudate($lst['date']);?></td>
<td class="<?=$t;?>"> <?=$cfg['username'];?></td>
<td class="<?=$t;?>"> <?=$lst['ip'];?></td>
<td class="<?=$t;?>"> <?=$lst['code'];?></td>
</tr>
<?php
$i++;
}
echo '</table>';
if(mysql_num_rows($ggg) == 1) {
echo '<i>Geen geschiedenis</i>';
} else {
echo '<a href="content.php?p=admin&view=ilhis&actie=rm">Verwijder geschiedenis</a>';
}
?>
<?php
}
if($_GET['view'] == 'pages' && !isset($_GET['page']) && !isset($_GET['actie'])) {
$ggg = mysql_query("SELECT * FROM `content`");
$i=0;
?>
<table><tr id="thead"><td>Pagina</td><td>
<input type="button" onClick="window.location='content.php?p=admin&view=pages&actie=new';" value="Nieuw" /></tr>
<?php
while($lst=mysql_fetch_array($ggg)) {
if($i%2){$t='even';}else{$t='oneven';}
echo '<form method="post" action="'. $_SERVER['REQUEST_URI'] .'&page='.$lst['pagina'].'">';
echo '<input type="hidden" name="savep" value="true" />';
echo '<tr><td class="'. $t .'"><a href="content.php?p='.$lst['pagina'].'">'.$lst['pagina'].'</a></td>';
echo '<td class="'. $t .'"><input type="button" value="Verwijder" onclick="verwijder(\''.$lst['pagina'].'\');" /><br /><input type="button" onclick="window.location=\'content.php?p=admin&view=pages&page='. $lst['pagina'].'\';" value="Openen" /></td></tr>';
echo '</form>';
$i++;
}
}
if($_GET['view'] == 'pages' && isset($_GET['page']) && !isset($_GET['actie'])) {
$ggg = mysql_query("SELECT * FROM `content` WHERE `pagina` = '". mysql_real_escape_string($_GET['page']) ."'");
$lst = mysql_fetch_array($ggg);
echo '<form method="post" action="'. $_SERVER['REQUEST_URI'] .'">';
echo '<h1>'.$lst['pagina'].'</h1>';
echo '<b>Linksboven:</b><br /><textarea id="txtlinks" name="links" class="tarea2">'.ctchars($lst['links']).'</textarea><br />';
echo '<br /><b>Rechtsonder:</b><br /><textarea id="txtrechts" cols="40" name="rechts" class="tarea2">'.ctchars($lst['rechts']).'</textarea>';
echo '<br /><input type="hidden" name="savep" value="opslaan" />';
echo '</form>';
}
if($_GET['view'] == 'pages' && !isset($_GET['page']) && isset($_GET['actie']) && $_GET['actie'] == 'new') {
echo '<form method="post" action="'. $_SERVER['REQUEST_URI'] .'">';
echo '<b>Paginanaam:</b><input type="text" name="pnaam" /><br />';
echo '<b>Linksboven:</b><br /><textarea name="links" class="tarea2"></textarea><br />';
echo '<br /><b>Rechtsonder:</b><br /><textarea name="rechts" class="tarea2"></textarea>';
echo '<br /><input type="hidden" name="saven" value="opslaan" />';
echo '</form>';
}
if($_GET['view'] == 'config') {
$discription = array('MB ( bijlage contactformulier )',
'( onvangersadres contactformulier )',
'( Gebruikersnaam Admin pagina )',
'( Wachtwoord Admin Pagina )',
'( MySQL host )',
'( MySQL gebruiker )',
'( MySQL wachtwoord )',
'( MySQL database )',
'( Folder voor de foto\'s )');
$i=0;
echo '<form action="'. $_SERVER['REQUEST_URI'] .'" method="post" />';
foreach($cfg as $key => $value) {
if($i==3||$i==6){$q='password';}else{$q='text';}
echo '<b>'.$key.':</b><input type="'.$q.'" name="'.$key.'" value="'. $value .'" />';
echo ' '. $discription[$i] .'<br />';
$i++;
}
echo '<input type="submit" name="sconfig" value="Opslaan" />';
echo '<input type="reset" value="Herstel" />';
echo '</form>';
}
if($_GET['view'] == 'photo') {
if(!isset($_GET['album'])) {
if(!isset($_GET['actie'])) {
$ggg = mysql_query("SELECT DISTINCT `pagina` FROM `images`");
?><a href="content.php?p=admin&view=photo&album=<?=$_GET['album'];?>&actie=new">Nieuw</a><br /><br /><?php
while($lst=mysql_fetch_array($ggg)) {
echo '<a href="content.php?p=admin&view=photo&album='.$lst['pagina'].'">'.$lst['pagina'].'</a><br />';
}
} else {
}
} else {
if(isset($_GET['actie'])) {
?>
<form action="<?=$_SERVER['REQUEST_URI'];?>" method="post" enctype="multipart/form-data">
Pagina: <input type="text" name="pagina" value="<?=$_GET['album'];?>" /><br />
Foto: <input type="file" name="upload" /><br />
Naam: <input type="text" name="naam" /><br />
Beschrijving: <input type="text" name="beschrijving" /><br />
<input type="submit" name="nfoto" value="Toevoegen" />
</form>
<?php
} else {
$ggg = mysql_query("SELECT * FROM `images` WHERE `pagina` = '". mysql_real_escape_string($_GET['album'])."'");
?><table>
<tr id="thead">
<td>Foto</td>
<td>Beschrijving</td>
<td><input type="button" value="Nieuw" onClick="window.location='content.php?p=admin&view=photo&album=<?=$_GET['album'];?>&actie=new';" /></td>
</tr>
<?php
while($lst=mysql_fetch_array($ggg)) {
?>
<tr>
<td class="even">
<img src="image.php?width=50&image=fotos/<?=$lst['file'];?>" alt="img" />
</td>
<td class="even" style="width: 300px;">
<?=$lst['beschrijving'];?>
</td>
<td class="even">
<input type="button" onClick="verwijder2('<?=$lst['file'];?>')" value="Verwijder" />
</td>
</tr>
<?php
}
?>
</table>
<?php
}
}
}
}
?>
</div><br clear="all" />
</div>
</body>
</html>
<?php
}
die();
}
)
