<?php
/**
 * la.plume Micro CMS
 * ==================
 * COPYRIGHT Patrick Taylor http://www.mini-print.com/
 */

$sent = 'man';
$allowed = 'woman';

if ($_POST['submit0']) {
	$allowed = array();
	$allowed[] = 'token';
	$allowed[] = 'password';
	$allowed[] = 'submit0';

	$sent = array_keys($_POST);
	if ($sent === $allowed) {
		$user = 'happy';
	} else {
		unset($content);
		unset($show_comments);
	}
}

$c_sent = 'plate';
$c_allowed = 'food';

if ($_POST['submitcomment']) {
	$c_allowed = array();
	$c_allowed[] = 'comment';
	$c_allowed[] = 'commentform';
	$c_allowed[] = 'submitcomment';

	$c_sent = array_keys($_POST);
	if ($c_sent === $c_allowed) {
		$user = 'eats';
	} else {
		unset($show_comments);
	}
}

if (COMMENTS && isset($_POST['submitcomment']) && ($user === 'eats')) {
	unset($pword_form);
	unset($display);
	$show_comments = TRUE;
}

if ($pword_form == TRUE) {

	include_once('password.php');

	if (!isset($_POST['submit0'])) {
		$display = TRUE;
		unset($content);
		unset($show_comments);
	} else if (isset($_POST['submit0'])) {
		$string = $_POST['password'];
		$strip = array("<", ">", "\"", "'", "\\");
		$string = str_replace($strip, "", $string);
		if ((md5($string) == trim($enc_password)) && ($user === 'happy') && (!empty($_POST['token']) && ($_POST['token'] == $_SESSION['token']))) {
			unset($display);
			$show_comments = TRUE;
			unset($_SESSION['token']);
		} else {
			$display = TRUE;
			unset($content);
			unset($show_comments);
			$response1 = '<p><em>Sorry. Wrong password.</em></p>';
		}
	}

	if ($display) {
		$server_self = htmlspecialchars($_SERVER["PHP_SELF"], ENT_QUOTES, "utf-8");
		$server_self = str_replace("/cms", "", $server_self);
		$server_self = str_replace(".php", "", $server_self);

		$token = md5(uniqid(rand(), TRUE));
		$_SESSION['token'] = $token;

?>

<form id="contactform" action="<?php echo $server_self; ?>" method="post">
<label>Enter password:</label><br>
<input type="hidden" name="token" value="<?php echo $token; ?>">
<input type="password" name="password" size="25" maxlength="25"><br>
<input type="submit" name="submit0" class="submit" value="Submit">
</form>

<?php

		if (isset($_POST['submit0'])) {
			echo $response1;
		}
	}
}

?>