!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/alumni/admin/pages/gallery/   drwxr-xr-x
Free 50.65 GB of 127.8 GB (39.63%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     index.php (33.55 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

/********************************************************************************
    - MemHT Portal -
    
    Copyright (C) 2007-2008 by Miltenovik Manojlo
    http://www.memht.com
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your opinion) any later version.
    
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License along
    with this program; if not, see <http://www.gnu.org/licenses/> (GPLv2)
    or write to the Free Software Foundation, Inc., 51 Franklin Street,
    Fifth Floor, Boston, MA02110-1301, USA.
        
********************************************************************************/

if (!defined("_LOAD_PAGE_")) {
    die(
"<table style='padding: 2px; border: 1px solid #999; background-color: #EEE; font-family: Verdana; font-size: 10px;' align='center'><tr><td><b>Error:</b> This file cannot be opened directly!</td></tr></table>");
}

if (isset(
$_GET['op'])) { $op inCode($_GET['op']); } else { $op ""; }
if (isset(
$_GET['id'])) { $id inCode($_GET['id']); } else { $id ""; }
if (isset(
$_GET['pg'])) { $pg inCode($_GET['pg']); } else { $pg 1; }
if (isset(
$_GET['ok'])) { $ok inCode($_GET['ok']); } else { $ok false; }

global 
$dblink;

$cfgrow $dblink->get_row("SELECT * FROM memht_gallery_config");
$rows intval($cfgrow['rows']);
$cols intval($cfgrow['cols']);
$cat_max_weight intval($cfgrow['cat_max_weight']);
$cat_max_w intval($cfgrow['cat_max_w']);
$cat_max_h intval($cfgrow['cat_max_w']);
$thumb_max_weight intval($cfgrow['thumb_max_weight']);
$thumb_max_w intval($cfgrow['thumb_max_w']);
$thumb_max_h intval($cfgrow['thumb_max_h']);
$img_max_weight intval($cfgrow['img_max_weight']);
$img_max_w intval($cfgrow['img_max_w']);
$img_max_h intval($cfgrow['img_max_h']);

$ofsppg $cols*$rows//Items per page
$ofsbgn = ($pg*$ofsppg)-$ofsppg;

function 
galleryMain() {
    global 
$dblink;
    
    
$a 0;
    echo 
"<table align='center' border='0'>\n";
    
$result $dblink->get_list("SELECT * FROM memht_gallery_categories ORDER BY name");
    foreach (
$result as $row) {
        
$cid intval($row['id']);
        
$cname outCode($row['name']);
        
$cimgfile outCode($row['imgfile']);
        
$cdescription outCode($row['description']);
        
$cenabled intval($row['enabled']);
        
        
$info = ($cenabled==0) ? "<img src='images/off.gif' alt='"._OFF_."'> " "" ;
        
$num_img $dblink->get_num("SELECT * FROM memht_gallery_images WHERE category='$cid' AND enabled=1");
        
        if (
$a==0) { echo "<tr>"; }
            echo 
"<td valign='top'><table style='margin: 10px;'>";
                echo 
"<tr><td nowrap><a href='admin.php?page=gallery&op=showGallery&id=$cid' title='$cname'><b>$cname</b></a> ($num_img) $info<a href='admin.php?page=gallery&op=editCategory&id=$cid' title='"._EDIT_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=gallery&op=deleteCategory&id=$cid' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></td></tr>\n";
                echo 
"<tr><td valign='top' width='1'><a href='admin.php?page=gallery&op=showGallery&id=$cid' title='$cname'><img src='pages/gallery/images/categories/$cimgfile' border='0' title=\"header=[$cname] body=[<b>"._DESCRIPTION_."</b>:<br>$cdescription]\"></a></td><td valign='top'>";
                echo 
"</td></tr>\n";
            echo 
"</table></td>";
        if (
$a>=3) { echo "</tr>\n"$a 0; } else { $a++; }
    }
    echo 
"</table>";
}

function 
showGallery($id,$ofsbgn,$ofsppg) {
    global 
$dblink,$pg,$cols;
    
$id intval($id);

    
$n 0;    
    
$amt 1;
    
    
$crow $dblink->get_row("SELECT * FROM memht_gallery_categories WHERE id='$id'");
    
$catname outCode($crow['name']);
    
    
$query "SELECT * FROM memht_gallery_images WHERE category='$id' AND enabled=1 ORDER BY id DESC LIMIT $ofsbgn,$ofsppg";
    if (
$dblink->get_num($query)>0) {
        echo 
"<div class='box' align='center'><b>$catname</b></div>";
        echo 
"<table border='0' cellspacing='0' cellpadding='0' align='center'>\n";
        
$result $dblink->get_list($query);
        foreach (
$result as $row) {
            
$iid intval($row['id']);
            
$ititle outCode($row['title']);
            
$iimgfile outCode($row['imgfile']);
            
$ithumb outCode($row['thumb']);
            
$iattachfile outCode($row['attachfile']);
            
$idescription outCode($row['description']);
            
$ienabled intval($row['enabled']);
            
            
$imagesize=@getimagesize("pages/gallery/gallery/".$iimgfile);
            
$ix ceil($imagesize[0]);
            
$iy ceil($imagesize[1]);
            
            
$mydesc = ($idescription!="") ? "<br><b>"._DESCRIPTION_."</b>: $idescription" "" ;
            
$info = ($ienabled==0) ? "<img src='images/off.gif' alt='"._OFF_."'> " "" ;
            
            if (
$amt==1) { echo "<tr>\n"; }
            echo 
"<td align='center' valign='top' class='small'><div style='margin:8px;'><table style='padding: 2px; background-color:#FFFFFF;'><tr><td><a href='pages/gallery/gallery/$iimgfile' rel='lightbox[gallery]' title='$ititle'><img src='pages/gallery/gallery/thumb/$ithumb' border='0' title=\"header=[$ititle] body=[<b>"._SIZE_."</b>: $ix x $iy (".strSize(filesize(htmlspecialchars("pages/gallery/gallery/$iimgfile"))).")$mydesc]\"></a></td></tr></table>";        
                if (
$iattachfile!="") {
                    echo 
"<div><a href=\"$iattachfile\" target='_blank' title=\"header=["._ATTACHMENT_."] body=[$iattachfile]\"><img src='pages/gallery/images/attachment.gif' border='0'></a></div>";
                }
            echo 
"<div style='padding:2px;'>$info<a href='admin.php?page=gallery&op=editImage&id=$iid' title='"._EDIT_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=gallery&op=deleteImage&id=$iid' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></div>\n";
            echo 
"</div></td>\n";
            if (
$amt==$cols) { echo "</tr>\n"$amt 1; } else { $amt++; }
        }
        echo 
"</table>\n";
        
        
//Pages
        
include_once("inc/class/paginationSystem.class.php");
        
$ps = new paginationSystem();
        
$ps->items $ofsppg;
        
$ps->actpg $pg;
        
$ps->query "SELECT id FROM memht_gallery_images WHERE category='$id' AND enabled=1";
        
$ps->url "admin.php?page=gallery&op=showGallery&id=$id&pg={{N}}";
        
$ps->show();
    } else {
        echo 
"<div align='center'>"._EMPTY_."</div>\n";
        echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=gallery'>";
    }
}
            
function 
addCategory($cat_max_weight,$cat_max_w,$cat_max_h,$ok=false) {
    global 
$dblink;
    
    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form' method='post' action='admin.php?page=gallery&op=addCategory&ok=true' enctype='multipart/form-data'>";
            echo 
"<tr><th>"._NAME_."</th><td><input type='text' name='name' size='60' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._THUMBNAIL_."</th><td><input type='file' name='catimg' size='25'></td></tr>\n";            
            echo 
"<tr><th valign='top'>"._DESCRIPTION_."</th><td>";
                
textarea("description","100%","200px",1,"fulladmin");
            echo 
"</td></tr>\n";
            echo 
"<tr><th>"._ENABLED_."</th><td>";
            echo 
"<select name='enabled'>\n";
                echo 
"<option value='1' selected>"._YES_."</option>\n";
                echo 
"<option value='0'>"._NO_."</option>\n";
            echo 
"</select></td></tr>\n";
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {
        
$save true;
        if (isset(
$_POST['name'])) { $name eregi_replace("[/_']","-",inCode($_POST['name'])); } else { $save false$msg "<div align='center' id='errorText'><b>"._NAMEEMPTY_."</b></div>"; }
        if (isset(
$_POST['description'])) { $description inCode($_POST['description']); } else { $description ""; }
        if (isset(
$_POST['enabled'])) { $enabled intval($_POST['enabled']); } else { $enabled ""; }
        
        require_once(
"inc/class/uploadFile.class.php");
        
$upload = new uploadFile();
        
$upload->show_errors false;
        
$upload->mime = array('image/gif','image/pjpeg','image/jpeg','image/png','image/tiff','image/bmp');
        
$upload->path "pages/gallery/images/categories/";
        
$upload->resize true;
        
$upload->resize_width $cat_max_w;
        
$upload->resize_height $cat_max_h;
        
$upload->max_size $cat_max_weight;
        
$upload->field "catimg";
        if (!
$imgfile $upload->upload()) {
            if (
$upload->selected) {
                
$save false;
                
$msg $upload->error;
            } else {
                
$imgfile "default.png";
            }
        }

        if (
$save) {
            
$dblink->query("INSERT INTO memht_gallery_categories (id,name,imgfile,description,enabled)
                            VALUES (null,'$name','$imgfile','$description','$enabled')"
);
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=gallery&op=main'>";
        } else {
            echo 
"<div align='center' id='errorText'>$msg</div>";
        }
    }
}

function 
editCategory($id,$cat_max_weight,$cat_max_w,$cat_max_h,$ok=false) {
    global 
$dblink;
    
    
$id intval($id);
    
    
$dbrow $dblink->get_row("SELECT * FROM memht_gallery_categories WHERE id='$id'");
    
$dbname outCode($dbrow['name']);
    
$dbthumbnail outCode($dbrow['imgfile']);
    
$dbdescription outCode($dbrow['description']);
    
$dbenabled intval($dbrow['enabled']);
    
    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form' method='post' action='admin.php?page=gallery&op=editCategory&id=$id&ok=true' enctype='multipart/form-data'>";
            echo 
"<tr><th>"._NAME_."</th><td><input type='text' name='name' value=\"$dbname\" size='60' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._THUMBNAIL_."</th><td><input type='file' name='catimg' size='25'> <span id='info'>"._COMPILEONLYIFCHANGING_."</span></td></tr>\n";            
            echo 
"<tr><th valign='top'>"._DESCRIPTION_."</th><td>";
                
textarea("description","100%","200px",1,"fulladmin",$dbdescription);
            echo 
"</td></tr>\n";
            echo 
"<tr><th>"._ENABLED_."</th><td>";
            echo 
"<select name='enabled'>\n";
                if (
$dbenabled==1) {
                    echo 
"<option value='1' selected>"._YES_."</option>\n";
                    echo 
"<option value='0'>"._NO_."</option>\n";
                } else {
                    echo 
"<option value='1'>"._YES_."</option>\n";
                    echo 
"<option value='0' selected>"._NO_."</option>\n";
                }
            echo 
"</select></td></tr>\n";
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {
        
$save true;
        if (isset(
$_POST['name'])) { $name inCode($_POST['name']); } else { $save false$msg "<div align='center' id='errorText'><b>"._NAMEEMPTY_."</b></div>"; }
        if (isset(
$_POST['description'])) { $description inCode($_POST['description']); } else { $description ""; }
        if (isset(
$_POST['enabled'])) { $enabled intval($_POST['enabled']); } else { $enabled ""; }
        
        require_once(
"inc/class/uploadFile.class.php");
        
$upload = new uploadFile();
        
$upload->show_errors false;
        
$upload->mime = array('image/gif','image/pjpeg','image/jpeg','image/png','image/tiff','image/bmp');
        
$upload->path "pages/gallery/images/categories/";
        
$upload->resize true;
        
$upload->resize_width $cat_max_w;
        
$upload->resize_height $cat_max_h;
        
$upload->max_size $cat_max_weight;
        
$upload->field "catimg";
        if (
$imgfile $upload->upload()) {
            @
unlink($upload->path.$dbthumbnail);
        } else {
            if (
$upload->selected) {
                
$save false;
                
$msg $upload->error;
            } else {
                
$imgfile $dbthumbnail;
            }
        }
        
        if (
$save) {
            
$dblink->query("UPDATE memht_gallery_categories SET name='$name',imgfile='$imgfile',description='$description',enabled='$enabled' WHERE id='$id'");
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=gallery&op=main'>";
        } else {
            echo 
"<div align='center' id='errorText'>$msg</div>";
        }
    }
}

function 
deleteCategory($id,$ok=false) {
    global 
$dblink;
    
    
$id intval($id);
    
    
$path "pages/gallery/images/categories/";
    
$imgpath "pages/gallery/gallery/";
    
$thumbpath "pages/gallery/gallery/thumb/";
    if (
is_writable($path)) {
        if (
$ok) {
            
$drow $dblink->get_row("SELECT * FROM memht_gallery_categories WHERE id='$id'");
            
$imgfile outCode($drow['imgfile']);
            if (
$imgfile!="" AND $imgfile!="default.png") { @unlink("pages/gallery/images/categories/".$imgfile); }
            
            
$dblink->query("DELETE FROM memht_gallery_categories WHERE id='$id'");
            
$result $dblink->get_list("SELECT * FROM memht_gallery_images WHERE category='$id'");
            foreach (
$result as $row) {
                @
unlink($imgpath.outCode($row['imgfile']));
                @
unlink($thumbpath.outCode($row['thumb']));
                
$dblink->query("DELETE FROM memht_gallery_images WHERE id='".$row['id']."'");
            }
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=gallery&op=main'>";        
        } else {
            echo 
"<div align='center'><b>"._SUREDELETECATEGORY_."</b><br><a href='admin.php?page=gallery&op=deleteCategory&id=$id&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=gallery&op=main' title='"._NO_."'>"._NO_."</a></div>";
        }
    } else {
        echo 
"<div align='center' id='errorText'><b>"._FOLDER_NOT_WRITABLE_."</b> ($path)</div>";
    }
}

function 
addImage($thumb_max_weight,$thumb_max_w,$thumb_max_h,$img_max_weight,$img_max_w,$img_max_h,$ok=false) {
    global 
$dblink;
    
    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form' method='post' action='admin.php?page=gallery&op=addImage&ok=true' enctype='multipart/form-data'>";
            echo 
"<tr><th>"._CATEGORY_."</th><td>";
            echo 
"<select name='category'>\n";
                
$cres $dblink->get_list("SELECT * FROM memht_gallery_categories WHERE enabled=1 ORDER BY name");
                foreach (
$cres as $crow) {
                    
$cid intval($crow['id']);
                    
$cname outCode($crow['name']);
                    
                    echo 
"<option value='$cid'>$cname</option>\n";
                }
            echo 
"</select></td></tr>\n";
            echo 
"<tr><th>"._NAME_."</th><td><input type='text' name='name' size='60' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._IMAGE_."</th><td><input type='file' name='image' size='25'></td></tr>\n";
            if (!
extension_loaded('gd')) {
                echo 
"<tr><th>"._THUMBNAIL_."</th><td><input type='file' name='thumbnail' size='25'> <span id='info'>"._ACTIVE_WHEN_GD_OFF_."</span></td></tr>\n";
            }
            echo 
"<tr><th>"._ATTACHMENT_."</th><td><input type='text' name='attachfile' size='40' maxlength='255'></td></tr>\n";
            echo 
"<tr><th valign='top'>"._DESCRIPTION_."</th><td>";
                
textarea("description","100%","200px",1,"fulladmin");
            echo 
"</td></tr>\n";
            echo 
"<tr><th>"._ENABLED_."</th><td>";
            echo 
"<select name='enabled'>\n";
                echo 
"<option value='1' selected>"._YES_."</option>\n";
                echo 
"<option value='0'>"._NO_."</option>\n";
            echo 
"</select></td></tr>\n";
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {
        
$save true;
        if (isset(
$_POST['category'])) { $category inCode($_POST['category']); } else { $category ""; }
        if (isset(
$_POST['name'])) { $name inCode($_POST['name']); } else { $save false$msg "<div align='center' id='errorText'><b>"._NAMEEMPTY_."</b></div>"; }
        if (isset(
$_POST['attachfile'])) { $attachfile inCode($_POST['attachfile']); } else { $attachfile ""; }
        if (isset(
$_POST['description'])) { $description inCode($_POST['description']); } else { $description ""; }
        if (isset(
$_POST['enabled'])) { $enabled intval($_POST['enabled']); } else { $enabled ""; }
        
        
//====================================================
        
if ($save) {
            require_once(
"inc/class/uploadFile.class.php");
            
$upload = new uploadFile();
            
$upload->show_errors false;
            
$upload->mime = array('image/gif','image/pjpeg','image/jpeg','image/png','image/tiff','image/bmp');
            
$upload->path "pages/gallery/gallery/";
            
$upload->path_thumb "pages/gallery/gallery/thumb/";
            
$upload->max_width $img_max_w;
            
$upload->max_height $img_max_h;
            
$upload->max_size $img_max_weight;
            if (
extension_loaded('gd')) { $upload->createthumb true; }
            
$upload->thumb_width $thumb_max_w;
            
$upload->thumb_height $thumb_max_h;
            
            
$upload->field "image";
            if (!
$imgfile $upload->upload()) { $save false$msg $upload->error; }
                        
            if (!
extension_loaded('gd') AND $save) {
                
$upload->path "pages/gallery/gallery/thumb";
                
$upload->max_width $thumb_max_w;
                
$upload->max_height $thumb_max_h;
                
$upload->max_size $thumb_max_weight;
                
$upload->field "thumbnail";
                if (!
$thumb $upload->upload()) { $save false$msg $upload->error; }
            } else {
                
$thumb $upload->thumbname;
            }
        }
        
//====================================================
        
        
if ($save) {
            
$dblink->query("INSERT INTO memht_gallery_images (id,category,title,imgfile,thumb,attachfile,description,enabled)
                            VALUES (null,'$category','$name','$imgfile','$thumb','$attachfile','$description','$enabled')"
);
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=gallery&op=main'>";
        } else {
            echo 
"<div align='center' id='errorText'>$msg</div>";
        }
    }
}

function 
editImage($id,$thumb_max_weight,$thumb_max_w,$thumb_max_h,$img_max_weight,$img_max_w,$img_max_h,$ok=false) {
    global 
$dblink;
    
    
$row_img $dblink->get_row("SELECT * FROM memht_gallery_images WHERE id='$id'");
    
$dbcategory intval($row_img['category']);
    
$dbtitle outCode($row_img['title']);
    
$dbimgfile outCode($row_img['imgfile']);
    
$dbthumb outCode($row_img['thumb']);
    
$dbattachfile outCode($row_img['attachfile']);
    
$dbdescription outCode($row_img['description']);
    
$dbenabled intval($row_img['enabled']);
    
    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form' method='post' action='admin.php?page=gallery&op=editImage&id=$id&ok=true' enctype='multipart/form-data'>";
            echo 
"<tr><th>"._CATEGORY_."</th><td>";
            echo 
"<select name='category'>\n";
                
$cres $dblink->get_list("SELECT * FROM memht_gallery_categories WHERE enabled=1 ORDER BY name");
                foreach (
$cres as $crow) {
                    
$cid intval($crow['id']);
                    
$cname outCode($crow['name']);
                    
                    echo (
$dbcategory==$cid) ? "<option value='$cid' selected>$cname</option>\n" "<option value='$cid'>$cname</option>\n" ;
                }
            echo 
"</select></td></tr>\n";
            echo 
"<tr><th>"._NAME_."</th><td><input type='text' name='name' value=\"$dbtitle\" size='60' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._IMAGE_."</th><td><input type='file' name='image' size='25'></td></tr>\n";    
            if (!
extension_loaded('gd')) {
                echo 
"<tr><th>"._THUMBNAIL_."</th><td><input type='file' name='thumbnail' size='25'> <span id='info'>"._ACTIVE_WHEN_GD_OFF_."</span></td></tr>\n";
            }
            echo 
"<tr><th>"._ATTACHMENT_."</th><td><input type='text' name='attachfile' value=\"$dbattachfile\" size='40' maxlength='255'></td></tr>\n";
            echo 
"<tr><th valign='top'>"._DESCRIPTION_."</th><td>";
                
textarea("description","100%","200px",1,"fulladmin",$dbdescription);
            echo 
"</td></tr>\n";
            echo 
"<tr><th>"._ENABLED_."</th><td>";
            echo 
"<select name='enabled'>\n";
                if (
$dbenabled==1) {
                    echo 
"<option value='1' selected>"._YES_."</option>\n";
                    echo 
"<option value='0'>"._NO_."</option>\n";
                } else {
                    echo 
"<option value='1'>"._YES_."</option>\n";
                    echo 
"<option value='0' selected>"._NO_."</option>\n";
                }
            echo 
"</select></td></tr>\n";
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {
        
$save true;
        if (isset(
$_POST['category'])) { $category inCode($_POST['category']); } else { $category ""; }
        if (isset(
$_POST['name'])) { $name inCode($_POST['name']); } else { $save false$msg "<div align='center' id='errorText'><b>"._NAMEEMPTY_."</b></div>"; }
        if (isset(
$_POST['attachfile'])) { $attachfile inCode($_POST['attachfile']); } else { $attachfile ""; }
        if (isset(
$_POST['description'])) { $description inCode($_POST['description']); } else { $description ""; }
        if (isset(
$_POST['enabled'])) { $enabled intval($_POST['enabled']); } else { $enabled ""; }
        
        
//====================================================
        
if ($save) {
            require_once(
"inc/class/uploadFile.class.php");
            
$upload = new uploadFile();
            
$upload->show_errors false;
            
$upload->mime = array('image/gif','image/pjpeg','image/jpeg','image/png','image/tiff','image/bmp');
            
$upload->path "pages/gallery/gallery/";
            
$upload->path_thumb "pages/gallery/gallery/thumb/";
            
$upload->max_width $img_max_w;
            
$upload->max_height $img_max_h;
            
$upload->max_size $img_max_weight;
            if (
extension_loaded('gd')) { $upload->createthumb true; }
            
$upload->thumb_width $thumb_max_w;
            
$upload->thumb_height $thumb_max_h;
            
            
$upload->field "image";
            if (
$imgfile $upload->upload()) {
                @
unlink($upload->path.$dbimgfile);
                if (
extension_loaded('gd')) { @unlink($upload->path_thumb.$dbthumb); }
            } else {
                if (
$upload->selected) {
                    
$save false;
                    
$msg $upload->error;
                } else {
                    
$imgfile $dbimgfile;
                }
            }
                        
            if (!
extension_loaded('gd') AND $save) {
                
$upload->path "pages/gallery/gallery/thumb";
                
$upload->max_width $thumb_max_w;
                
$upload->max_height $thumb_max_h;
                
$upload->max_size $thumb_max_weight;
                
$upload->field "thumbnail";
                if (
$thumb $upload->upload()) {
                    @
unlink($upload->path.$dbthumb);
                } else {
                    if (
$upload->selected) {
                        
$save false;
                        
$msg $upload->error;
                    } else {
                        
$thumb $dbthumb;
                    }
                }
            } else if (
$upload->error=="") {
                
$thumb $upload->thumbname;
            } else {
                
$thumb $dbthumb;
            }
        }
        
//====================================================
        
        
if ($save) {
            
$dblink->query("UPDATE memht_gallery_images SET category='$category',title='$name',imgfile='$imgfile',thumb='$thumb',attachfile='$attachfile',description='$description',enabled='$enabled' WHERE id='$id'");
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=gallery&op=showGallery&id=$dbcategory'>";
        } else {
            echo 
"<div align='center' id='errorText'>$msg</div>";
        }
    }
}

function 
deleteImage($id,$ok=false) {
    global 
$dblink;
    
$id intval($id);
    
    
$path "pages/gallery/gallery/";
    
$path_th "pages/gallery/gallery/thumb/";
    if (
is_writable($path)) {
        if (
is_writable($path_th)) {
            
$drow $dblink->get_row("SELECT * FROM memht_gallery_images WHERE id='$id'");
            
$cid outCode($drow['category']);
            
            if (
$ok) {
                
$imgfile outCode($drow['imgfile']);
                
$fname file_name($imgfile);
                
$fext file_ext($imgfile);
                
$imgfile_th $fname."_thumb.".$fext;
                if (
$imgfile!="") { @unlink("pages/gallery/gallery/".$imgfile); }
                if (
$imgfile_th!="") { @unlink("pages/gallery/gallery/thumb/".$imgfile_th); }
                
                
$dblink->query("DELETE FROM memht_gallery_images WHERE id='$id'");
                echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=gallery&op=showGallery&id=$cid'>";        
            } else {
                echo 
"<div align='center'><b>"._SUREDELETEIMAGE_."</b><br><a href='admin.php?page=gallery&op=deleteImage&id=$id&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=gallery&op=showGallery&id=$cid' title='"._NO_."'>"._NO_."</a></div>";
            }
        } else {
            echo 
"<div align='center' id='errorText'><b>"._FOLDER_NOT_WRITABLE_."</b> ($path_th)</div>";
        }
    } else {
        echo 
"<div align='center' id='errorText'><b>"._FOLDER_NOT_WRITABLE_."</b> ($path)</div>";
    }
}

function 
configGallery($rows,$cols,$cat_max_weight,$cat_max_w,$cat_max_h,$thumb_max_weight,$thumb_max_w,$thumb_max_h,$img_max_weight,$img_max_w,$img_max_h,$ok=false) {
    global 
$dblink;
    
    if (!
$ok) {    
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
            echo 
"<form name='form_iucfg' method='post' action='admin.php?page=gallery&op=config&ok=true'>";
        
            echo 
"<tr><th>"._ROWS_."</th><td align='right'><input type='text' name='rows' value=\"$rows\" size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._COLUMNS_."</th><td align='right'><input type='text' name='cols' value=\"$cols\" size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._CAT_MAX_WEIGHT_."</th><td align='right'><input type='text' name='cat_max_weight' value=\"$cat_max_weight\" size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._CAT_MAX_W_."</th><td align='right'><input type='text' name='cat_max_w' value=\"$cat_max_w\" size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._CAT_MAX_H_."</th><td align='right'><input type='text' name='cat_max_h' value=\"$cat_max_h\" size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._THUMB_MAX_WEIGHT_."</th><td align='right'><input type='text' name='thumb_max_weight' value=\"$thumb_max_weight\" size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._THUMB_MAX_W_."</th><td align='right'><input type='text' name='thumb_max_w' value=\"$thumb_max_w\" size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._THUMB_MAX_H_."</th><td align='right'><input type='text' name='thumb_max_h' value=\"$thumb_max_h\" size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._IMG_MAX_WEIGHT_."</th><td align='right'><input type='text' name='img_max_weight' value=\"$img_max_weight\" size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._IMG_MAX_W_."</th><td align='right'><input type='text' name='img_max_w' value=\"$img_max_w\" size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._IMG_MAX_H_."</th><td align='right'><input type='text' name='img_max_h' value=\"$img_max_h\" size='20' maxlength='255'></td></tr>\n";
            
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._SAVE_."'></td></tr>\n";

        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {
        
$save true;
        if (isset(
$_POST['rows'])) { $rows intval($_POST['rows']); } else { $save false; }
        if (isset(
$_POST['cols'])) { $cols intval($_POST['cols']); } else { $save false; }
        if (isset(
$_POST['cat_max_weight'])) { $cat_max_weight intval($_POST['cat_max_weight']); } else { $save false; }
        if (isset(
$_POST['cat_max_w'])) { $cat_max_w intval($_POST['cat_max_w']); } else { $save false; }
        if (isset(
$_POST['cat_max_h'])) { $cat_max_h intval($_POST['cat_max_h']); } else { $save false; }
        if (isset(
$_POST['thumb_max_weight'])) { $thumb_max_weight intval($_POST['thumb_max_weight']); } else { $save false; }
        if (isset(
$_POST['thumb_max_w'])) { $thumb_max_w intval($_POST['thumb_max_w']); } else { $save false; }
        if (isset(
$_POST['thumb_max_h'])) { $thumb_max_h intval($_POST['thumb_max_h']); } else { $save false; }
        if (isset(
$_POST['img_max_weight'])) { $img_max_weight intval($_POST['img_max_weight']); } else { $save false; }
        if (isset(
$_POST['img_max_w'])) { $img_max_w intval($_POST['img_max_w']); } else { $save false; }
        if (isset(
$_POST['img_max_h'])) { $img_max_h intval($_POST['img_max_h']); } else { $save false; }
        
        if (
$save) {
            echo 
"<div align='center'><b>"._SAVINGCONFIGURATION_."</b></div>";
            
$dblink->query("UPDATE memht_gallery_config SET rows='$rows',cols='$cols',cat_max_weight='$cat_max_weight',cat_max_w='$cat_max_w',cat_max_h='$cat_max_h',thumb_max_weight='$thumb_max_weight',thumb_max_w='$thumb_max_w',thumb_max_h='$thumb_max_h',img_max_weight='$img_max_weight',img_max_w='$img_max_w',img_max_h='$img_max_h'");
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=gallery&op=config'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b></div>";
        }
    }
}

function 
importArchive($ok=false) {
    global 
$dblink;
    
    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form' method='post' action='admin.php?page=gallery&op=import&ok=true' enctype='multipart/form-data'>";
            echo 
"<tr><th>"._CATEGORY_."</th><td>";
            echo 
"<select name='category'>\n";
                
$cres $dblink->get_list("SELECT * FROM memht_gallery_categories WHERE enabled=1 ORDER BY name");
                foreach (
$cres as $crow) {
                    
$cid intval($crow['id']);
                    
$cname outCode($crow['name']);
                    
                    echo 
"<option value='$cid'>$cname</option>\n";
                }
            echo 
"</select></td></tr>\n";
            echo 
"<tr><th>"._NAME_."</th><td><input type='text' name='name' size='60' maxlength='255'></td></tr>\n";
            echo 
"<tr><th>"._ARCHIVE_."</th><td><input type='file' name='archive' size='25'> <span id='info'>Max: 5mb</span></td></tr>\n";
            echo 
"<tr><td></td><td><span id='info'>"._GALLERY_IMPORT_INFO_."</span></td></tr>\n";
            echo 
"<tr><th>"._ATTACHMENT_."</th><td><input type='text' name='attachfile' size='40' maxlength='255'></td></tr>\n";
            echo 
"<tr><th valign='top'>"._DESCRIPTION_."</th><td>";
                
textarea("description","100%","200px",1,"fulladmin");
            echo 
"</td></tr>\n";
            echo 
"<tr><th>"._ENABLED_."</th><td>";
            echo 
"<select name='enabled'>\n";
                echo 
"<option value='1' selected>"._YES_."</option>\n";
                echo 
"<option value='0'>"._NO_."</option>\n";
            echo 
"</select></td></tr>\n";
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {
        
$save true;
        if (isset(
$_POST['category'])) { $category inCode($_POST['category']); } else { $category ""; }
        if (isset(
$_POST['name'])) { $name inCode($_POST['name']); } else { $save false$msg "<div align='center' id='errorText'><b>"._NAMEEMPTY_."</b></div>"; }
        if (isset(
$_POST['attachfile'])) { $attachfile inCode($_POST['attachfile']); } else { $attachfile ""; }
        if (isset(
$_POST['description'])) { $description inCode($_POST['description']); } else { $description ""; }
        if (isset(
$_POST['enabled'])) { $enabled intval($_POST['enabled']); } else { $enabled ""; }
        
        
//====================================================
        
if ($save) {
            require_once(
"inc/class/uploadFile.class.php");
            
$upload = new uploadFile();
            
$upload->show_errors false;
            
$upload->mime = array('application/x-compressed','application/x-zip-compressed','application/zip,multipart/x-zip');
            
$upload->path "pages/gallery/";
            
$upload->max_size 5242880;
            
            
$upload->field "archive";
            if (!
$archive $upload->upload()) {
                echo 
$upload->error;
            } else {
                require 
"inc/class/zip.class.php";
                
$zipfile = new zipfile;
                
$zipfile->read_zip("pages/gallery/$archive");
                
                include(
"inc/class/fileUtils.class.php");
                
$file = new fileUtils();
                
                
$images = array();
                
$thumbs = array();                
                foreach(
$zipfile->files as $filea) {
                    if (
eregi("_thumb",$filea['name'])) {
                        
$thumbs[] = $filea['name'];
                        
$file->writeFile("pages/gallery/gallery/thumb/".$filea['name'],$filea['data']);
                    } else {
                        
$images[] = $filea['name'];
                        
$file->writeFile("pages/gallery/gallery/".$filea['name'],$filea['data']);
                    }
                }
                @
sort($images);
                @
reset($images);
                for(
$i=0;$i<sizeof($images);$i++) {
                    
$thumb = (sizeof($thumbs)==sizeof($images)) ? $thumbs[$i] : "nothumb.png" ;
                    
$dblink->query("INSERT INTO memht_gallery_images (id,category,title,imgfile,thumb,attachfile,description,enabled)
                                    VALUES (null,'$category','$name ($i)','"
.$images[$i]."','$thumb','$attachfile','$description','$enabled')");
                }
                @
unlink("pages/gallery/$archive");
                echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=gallery'>";
            }
        } else {
            echo 
"<div align='center' id='errorText'>$msg</div>";
        }
    }
}

require_once(
"admin/inc/inc_header.php");
    
admin_page_title($page);
                    
    
openTable();
        echo 
"<div align='center' class='box'>";
            echo 
"<a href='admin.php?page=gallery&op=main' title='"._MAIN_."'><img src='admin/icons/gallery.png' border='0' title='"._MAIN_."' align='top'> "._MAIN_."</a>";
            echo 
" - <a href='admin.php?page=gallery&op=addCategory' title='"._ADD_CATEGORY_."'><img src='admin/icons/add.png' border='0' title='"._ADD_CATEGORY_."' align='top'> "._ADD_CATEGORY_."</a>";
            echo 
" - <a href='admin.php?page=gallery&op=addImage' title='"._ADD_IMAGE_."'><img src='admin/icons/add.png' border='0' title='"._ADD_IMAGE_."' align='top'> "._ADD_IMAGE_."</a>";
            echo 
" - <a href='admin.php?page=gallery&op=import' title='"._IMPORT_."'><img src='admin/icons/add.png' border='0' title='"._IMPORT_."' align='top'> "._IMPORT_."</a>";
            echo 
" - <a href='admin.php?page=gallery&op=config' title='"._CONFIGURATION_."'><img src='admin/icons/config.png' border='0' title='"._CONFIGURATION_."' align='top'> "._CONFIGURATION_."</a>";
        echo 
"</div>";
    
closeTable();
    
    
openTable();
    
        switch(
$op) {
            case 
"showGallery":
                
showGallery($id,$ofsbgn,$ofsppg);
            break;
            
            case 
"addCategory":
                
addCategory($cat_max_weight,$cat_max_w,$cat_max_h,$ok);
            break;
            
            case 
"editCategory":
                
editCategory($id,$cat_max_weight,$cat_max_w,$cat_max_h,$ok);
            break;
            
            case 
"deleteCategory":
                
deleteCategory($id,$ok);
            break;
            
            case 
"addImage":
                
addImage($thumb_max_weight,$thumb_max_w,$thumb_max_h,$img_max_weight,$img_max_w,$img_max_h,$ok);
            break;
            
            case 
"editImage":
                
editImage($id,$thumb_max_weight,$thumb_max_w,$thumb_max_h,$img_max_weight,$img_max_w,$img_max_h,$ok);
            break;
            
            case 
"deleteImage":
                
deleteImage($id,$ok);
            break;
            
            case 
"config":
                
configGallery($rows,$cols,$cat_max_weight,$cat_max_w,$cat_max_h,$thumb_max_weight,$thumb_max_w,$thumb_max_h,$img_max_weight,$img_max_w,$img_max_h,$ok);
            break;
            
            case 
"import":
                
importArchive($ok);
            break;
        
            case 
"main":
            default:
                
galleryMain();
            break;
        }
    
    
closeTable();
require_once(
"admin/inc/inc_footer.php");

?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0243 ]--