<?php
/*
 ########################################################################
#                                                                        #
#           Version 4       /                        /   /               #
#          -----------__---/__---__------__----__---/---/-               #
#           | /| /  /___) /   ) (_ `   /   ) /___) /   /                 #
#          _|/_|/__(___ _(___/_(__)___/___/_(___ _/___/___               #
#                       Free Content / Management System                 #
#                                   /                                    #
#                                                                        #
#                                                                        #
#   Copyright 2005-2006 by webspell.org                                  #
#                                                                        #
#   visit webSPELL.org, webspell.info to get webSPELL for free           #
#   - Script runs under the GNU GENERAL PUBLIC LICENSE                   #
#   - It's NOT allowed to remove this copyright-tag                      #
#   -- http://www.fsf.org/licensing/licenses/gpl.html                    #
#                                                                        #
#   Code based on WebSPELL Clanpackage (Michael Gruber - webspell.at),   #
#   Far Development by Development Team - webspell.org                   #
#                                                                        #
#   visit webspell.org                                                   #
#                                                                        #
 ########################################################################
*/

include("_mysql.php");
include("_settings.php");
include("_functions.php");
if(!isanyadmin($userID)) die('No access.');

if($_GET['cwID']) {
    $filepath = "./images/clanwar-screens/";
	$webpath = "images/clanwar-screens/";
	$table = "clanwars";
	$tableid = "cwID";
	$id = $_GET['cwID'];
}
elseif($_GET['newsID']) {
    $filepath = "./images/news-pics/";
	$webpath = "images/news-pics/";
	$table = "news";
	$tableid = "newsID";
	$id = $_GET['newsID'];
}
elseif($_GET['articlesID']) {
    $filepath = "./images/articles-pics/";
	$webpath = "images/articles-pics/";
	$table = "articles";
	$tableid = "articlesID";
	$id = $_GET['articlesID'];
}
else die('Ungültiger Aufruf');

if($_POST['submit']) {
  $screen = $_FILES[screen];
	if(!empty($screen[name])) {
		move_uploaded_file($screen[tmp_name], $filepath.$screen[name]);
		@chmod($filepath.$screen[name], 0755);
		$file_ext=strtolower(substr($screen[name], strrpos($screen[name], ".")));
		$file=$id.'_'.time().$file_ext;
		rename($filepath.$screen[name], $filepath.$file);
		$ergebnis=safe_query("SELECT screens FROM ".PREFIX."$table WHERE $tableid='$id'");
		$ds=mysql_fetch_array($ergebnis);
		$screens=explode("|", $ds[screens]);
		$screens[]=$file;
		$screens_string=implode("|", $screens);
		
		safe_query("UPDATE ".PREFIX."$table SET screens='$screens_string' WHERE $tableid='$id'");
	}
	header("Location: upload.php?$tableid=$id");
}
elseif($_GET['action']=="delete") {
  $file = $_GET['file'];
	if(file_exists($filepath.$file)) @unlink($filepath.$file);
		
	$ergebnis=safe_query("SELECT screens FROM ".PREFIX."$table WHERE $tableid='$id'");
	$ds=mysql_fetch_array($ergebnis);
	$screens=explode("|", $ds[screens]);
	foreach($screens as $pic) {
		if($pic != $file) $newscreens[]=$pic;
	}
	if(is_array($newscreens)) $newscreens_string=implode("|", $newscreens);
	safe_query("UPDATE ".PREFIX."$table SET screens='$newscreens_string' WHERE $tableid='$id'");

	header("Location: upload.php?$tableid=$id");

}
else {
	echo'<html><head><script src="js/bbcode.js" language="jscript" type="text/javascript"></script>
		 <link href="_stylesheet.css" rel="stylesheet" type="text/css"></head>';
	
	echo'<body><center><h2>FILE-UPLOAD:</h2><form method="post" action="upload.php?'.$tableid.'='.$id.'" enctype="multipart/form-data">
		 <table width="100%" cellpadding="4" cellspacing="1" bgcolor="'.BORDER.'">
		 <tr bgcolor="'.BG_1.'"><td align="center">
		 <input type="file" name="screen"> <input type="submit" name="submit" value="upload">
		 <hr noshade size="1" color="'.BORDER.'"><h2>EXISTING FILES:</h2>
		 <table cellpadding="2">';
	
	$ergebnis=safe_query("SELECT screens FROM ".PREFIX."$table WHERE $tableid='$id'");
	
	$ds=mysql_fetch_array($ergebnis);
	if(!empty($ds[screens])) $screens=explode("|", $ds[screens]);
	if(is_array($screens)) {
		foreach($screens as $screen) {
			if($screen!="") {
				echo'<tr><td><a href="'.$webpath.$screen.'" target="_blank">'.$screen.'</a></td>
				 	 <td><input type="text" name="pic" size="70" value="&lt;img src='.$webpath.$screen.' align=left&gt;" class="form_off" onFocus="this.className=\'form_on\'" onBlur="this.className=\'form_off\'"></td>
					 <td><input type="button" class="button" onClick="AddCodeFromWindow(\'&lt;img src='.$webpath.$screen.' align=left&gt; \')" value="add to message"></td>
					 <td><input type="button" class="button" onClick="MM_confirm(\'delete image?\',\'upload.php?action=delete&'.$tableid.'='.$id.'&file='.$screen.'\')" value="delete"></td>
					 </tr>';	  
			}
		}
	}
	
	echo'</table></td></tr></table></center></body></html>';
}
?>
