<?php 
session_set_cookie_params(60*60*24*100);

session_start();
$loggedIn = 0;  

if (isset($_SESSION['logged_in'])) {
  $loggedIn = $_SESSION['logged_in'];
}


?>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>biedacms - admin</title>
 <link rel="stylesheet" href="screen.css" type="text/css" media="screen, projection">
 <link rel="stylesheet" href="print.css" type="text/css" media="print">
<!--[if IE]><link rel="stylesheet" href="ie.css" type="text/css" media="screen, projection"><![endif]-->
</head>

<body>


   <div class="container">
 <div class="span-4">&nbsp</div>
<div class="span-16 titlebar">


<h1>biedacms - admin</h1>
<?php

$action = 'none';
$view = 'content';

$currentDir = realpath(dirname($_SERVER['SCRIPT_FILENAME'])) ."/";

if(isset($_GET['view'])) {
    $view = $_GET['view'];
}

if(isset($_GET['action'])) {
    $action = $_GET['action'];
}


if(isset($_POST['action'])) {
    $action = $_POST['action'];
}

if(!$loggedIn) {
  if($action != 'login') {
    $action = 'none';
  }
  
  $view='login';
}


$writeableFiles=array("content.txt", "title.txt", "index.html", "password.php");

if(!is_writable(".")) {
    $action="error";
    $view='none';
    $f=$currentDir;
      
    ?>
      <div class="error">
	  Directory <tt><?php echo $f;?></tt> is not writeable. 
      <?php
}

foreach($writeableFiles as $f) {

  if(file_exists($f) && !is_writable($f)) {
     $action="error";
     $view='none';
?>
<div class="error">
       File <tt><?php echo $f;?></tt> is not writable. 
</div>
<?php
   }
 }

function store_content($x) {
  file_put_contents("content.txt", $x);
}

function store_title($x) {
  file_put_contents("title.txt", $x);
}

function store_password($password) {
  file_put_contents("password.php", "<?php \$master_password = \"$password\";?>");
}


if($action != 'error') {
  if(!file_exists('content.txt')) {
    store_content("<a href=\"admin.php\">Click here to edit this page. (password: test)</a>");
  }

  if(!file_exists('title.txt')) {
    store_title("biedacms sample page");
  }

  if(!file_exists('password.php')) {
    store_password("test");
  }

  if(!file_exists('index.html')) {
    generate_page(read_title(),read_content());
  }
  
}

if(file_exists('password.php')) {
  require('password.php');
}



function read_content() {
  return file_get_contents("content.txt");
}

function read_title() {
  return file_get_contents("title.txt");
}


function generate_page($title,$content) {
  $template=file_get_contents("template.html");
  $index = str_replace("@TITLE@", $title, $template);
  $index = str_replace("@CONTENT@", $content, $index);
  file_put_contents("index.html", $index);
}


if($action == 'store') {
  $title= stripslashes($_POST['title']);
  $content=stripslashes($_POST['content']);
  store_content($content);
  store_title($title);
  generate_page($title, $content);
?>
<div class="success">Stored. <a href="./">visit page</a></div>
<?php

}

if($action == 'delete_file') {
  $file= stripslashes($_POST['file']);
  if(!is_writable(".")) {
    $action="error";
    ?>
      <div class="error">
	 Couldnt delete file <tt><?php echo $file;?></tt> </div>
      <?php
   }
   unlink($file);

}

if($action == 'change_password') {
  $master_password= stripslashes($_POST['password']);
  store_password($master_password);
   ?><div class="success">Password has been changed.</div><?php
}




function file_upload_error_message($error_code) {
    switch ($error_code) {
        case UPLOAD_ERR_INI_SIZE:
            return 'The uploaded file exceeds the upload_max_filesize directive in php.ini';
        case UPLOAD_ERR_FORM_SIZE:
            return 'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form';
        case UPLOAD_ERR_PARTIAL:
            return 'The uploaded file was only partially uploaded';
        case UPLOAD_ERR_NO_FILE:
            return 'No file was uploaded';
        case UPLOAD_ERR_NO_TMP_DIR:
            return 'Missing a temporary folder';
        case UPLOAD_ERR_CANT_WRITE:
            return 'Failed to write file to disk';
        case UPLOAD_ERR_EXTENSION:
            return 'File upload stopped by extension';
        default:
            return 'Unknown upload error';
    }
}


if($action == 'upload') {

  $uploaddir = $currentDir;
  $uploadfile = $uploaddir . basename($_FILES['userfile']['name']);

  $res =   move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile);
  if ($res) {
    echo "<div class=\"notice\">File was successfully uploaded.</div>";
  } else {
    $error =  file_upload_error_message($_FILES['file']['error']); 
    echo "<div class=\"error\">Possible file upload attack! <tt>$error</tt></div>";

  }
}

if($action == 'login') {
  $password = trim(stripslashes($_POST['password']));
  if($password == $master_password) {
    $_SESSION['logged_in']  = 1;
    $loggedIn = 1;
    $view = 'content';
  }
}

if($action == 'logout') {
    $_SESSION['logged_in']  = 0;
    $loggedIn = 0;
    $view = 'login';
}


if($master_password == 'test') {
    ?> <div class="notice">Default 'test' password is set. Please change it. </div>  <?php
}


?><a href="./">site</a><?php
if($loggedIn) {  ?>
 | <a href="?view=content">edit</a> | <a href="?view=files">files</a> | <a href="?view=password">password</a> | <a href="?action=logout">logout</a>
<hr>
<?php
} 

if($view == 'content') {

$title=read_title();
$content=read_content();

?>
<h2>Edit</h2>
<form name="content" method="POST">
  <input type="hidden" name="action" value="store">
  Title:
  <input type="text" name="title" value="<?php echo $title; ?>">
  <br>
  Content:
  <br>
  <textarea name="content"><?php echo $content; ?></textarea>
  <br>
  <input type="submit" value="Save">
</form>

<?php
}

if($view == 'files') {
?>
<h2>Files</h2>

<form name="delete" method="POST">
 <input type="hidden" name="action" value="delete_file">
 <input type="hidden" name="file" value="">
</form>
    <script content-type="text/javascript">
    function delete_file(name) {
    if(confirm("Do you really want to delete '"+name+"' file?")) {
      document.forms.delete.file.value=name;
      document.forms.delete.submit();
    }
  }
</script>
<table>


<?php

if ($handle = opendir('.')) {
    while (false !== ($file = readdir($handle))) {
        if ($file != "." && $file != "..") {
?>
<tr>
<td><?php  echo "$file"; ?></td>
<td> <a href="<?php  echo "$file"; ?>">view</a> <a href="javascript: delete_file('<?php  echo "$file"; ?>');">delete</a></li> 
</td>
</tr>

<?php
    
        }
    }
    closedir($handle);
}

?>

</table>

<form enctype="multipart/form-data"  method="POST">
    <input type="hidden" name="action" value="upload">
    <input type="hidden" name="MAX_FILE_SIZE" value="10000000">

    File to upload: <input name="userfile" type="file">
    <input type="submit" value="Upload file">
</form>

<?php
}

if($view == 'login') {
?>

<form name="delete" method="POST">
 <input type="hidden" name="action" value="login">
    Password: 
 <input type="password" name="password">
<input type="submit" value="Go!">
</form>

</form>

<?php 
}

if($view == 'password') {
?>

<form name="delete" method="POST">
 <input type="hidden" name="action" value="change_password">
   New password: 
 <input type="password" name="password">
<input type="submit" value="Change password">
</form>

</form>

<?php 
}

?>




<hr>



</div>
</div>


</body>
</html>






