<?php
/**
 * la.plume Micro CMS
 * ==================
 * COPYRIGHT Patrick Taylor http://www.mini-print.com/
 */

require ('../cms/inc/settings.php');
require ('../cms/inc/password.php');

function cleanText($text) {
	$text = trim($text);
	$clean = ereg_replace("[^A-Za-z0-9,.~ _-]", "", $text);
	return $clean;
}

$img = cleanText($_GET['img']);
if (strlen($img) < 1) {
	header('Location:' . LOCATION);
}

if (strstr($img, "~")) {
	$protected = TRUE;
	session_start();
}

$title = str_replace(array('.jpg', '.jpeg', '.gif', '.png'), "", $img);
$title = str_replace('-', ' ', $title);

?>
<!DOCTYPE html>
<html lang="en">

<head>

<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title><?php echo $title; ?></title>
<link rel="stylesheet" media="only screen and (min-width: 661px), only screen and (min-device-width: 661px)" href="<?php echo LOCATION; ?>cms/inc/stylesheet.css" type="text/css">
<link rel="stylesheet" media="only screen and (max-width: 660px), only screen and (max-device-width: 660px)" href="<?php echo LOCATION; ?>cms/inc/mobile.css">
<?php echo "<!--[if lte IE 8]>\r\n"; /* Temporary fix for IE8 down */ ?>
<link rel="stylesheet" media="screen" href="<?php echo LOCATION; ?>cms/inc/stylesheet.css" type="text/css">
<?php echo "<![endif]-->\r\n"; ?>
<style type="text/css">
#footer { border-top: 4px dotted #fff; }
</style>
<meta name="robots" content="noindex,nofollow">

</head>

<body>
<div id="wrap">

	<div id="image">

<h1><?php echo $title; ?></h1>

<?php

$sent = 'man';
$allowed = 'woman';

if (isset($_POST['submit0'])) {

	$allowed = array();
	$allowed[] = 'token';
	$allowed[] = 'password';
	$allowed[] = 'submit0';

	$sent = array_keys($_POST);
	if ($sent === $allowed) {
		$user = 'happy';
	}

	$string = $_POST['password'];

	if ((md5($string) == trim($enc_password)) && ($user === 'happy') && (!empty($_POST['token']) && ($_POST['token'] == $_SESSION['token']))) {
		$view = TRUE;
		unset($_SESSION['token']);
	} else {
		$response1 = '<p><em>Access denied.</em></p>';
	}

}

if ($view || !$protected) {

?>

<p><img src="<?php echo $img; ?>" alt=""></p>

<?php

} else {

	$token = md5(uniqid(rand(), TRUE));
	$_SESSION['token'] = $token;

?>

<form id="contactform" action="" method="post">
<label>Enter password:</label><br>
<input type="hidden" name="token" value="<?php echo $token; ?>">
<input type="password" name="password" size="25" maxlength="25"><br>
<input type="submit" name="submit0" class="submit" value="Submit">
</form>

<?php

	if (isset($_POST['submit0'])) {
		echo $response1;
	}

}

?>

	</div>

<?php

require ('../cms/inc/footer.php');
require ('../cms/inc/tracking.php');

?>

</div>
</body>
</html>
