<?php

# Copyright (C) 2010 - onwards. The Napata CMS Project.
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License along
# with this program; if not, write to the Free Software Foundation, Inc.,
# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
# http://www.gnu.org/copyleft/gpl.html

require_once("./npt-file-cms.php");

session_start();

function IndexPage() {

			$content = @file_get_contents('./INDEX.txt');
			
			$content = preg_replace("/<([^>]+)?script.*>/", "", $content);
			
			$content = preg_replace("/\<\/script>$/", "", $content);
			
			return $content;
			
}

function GotoPage($get, $file) {
	
	require_once("./npt-file-cms.php");
	require_once(DIRPATH.'sec/sec.php');
	
	#Preliminary checks to disallow evil query strings. Still judging whether it is necessary to do this.
		/*-----------------------------------------------------------------------------------------------------*/
		
	if(isset($_GET[$get])){
		if(preg_match("#([A-Za-z0-9 \-\_\+]+)([^>]+)?\.([php|js|html|phtml|shtml|php5|log])$#", $_GET[$get]) == 1 || preg_match("#([\.\/\\\\]+)#", $_GET[$get]) == 1 || preg_match("#(<([^>]+)?(script).*>)(.+)(<\/script>)#", $_GET[$get]) == 1)
		{
		
			echo "<br /><center><div style='padding: 20px; background-color: #ffe4e1; border: 1px solid #0000ff;'>Illegal file extension detected. This article is not available.</div></center>";
								
			exit;
			
		}
		elseif(filter_var($_GET[$get], FILTER_VALIDATE_URL))
		{
		
			echo "<br /><center><div style='padding: 20px; background-color: #ffe4e1; border: 1px solid #0000ff;'>Illegal query detected. This article is not available.</div></center>";
								
			exit;
			
		}
	}
	
	blockhack();
	
	if(!(empty($_GET[$get])) && $get == 'post' && $_GET[$get] = $file) {
		
		$d = opendir('./articles');
		
			while(false !== $dop = readdir($d))
			{
		
				if($dop[0] == "." || $dop[0] == "..") continue;
				
				else
				{
					$t[]= $dop;
				}
				
			}
			
			$art_file = $file.'.txt';
			if(!in_array($art_file, $t)){
				header('HTTP/1.0 404 Not Found');		
				echo "<br><center><div style='padding: 20px; background-color: #ffe4e1; border: 1px solid #0000ff;'>File article  not found.</div></center><br>";  
			}
			
			foreach($t as $article){
					
				if(is_file("./articles/$article") && file_exists("./articles/$article") && $article == $_GET[$get].'.txt')
				{
						
					if(substr($article, -4, 4) == ".txt")
					{
						$post = $article;
								
						$content = @file_get_contents("./articles/$post");
				
						$content = preg_replace("/<([^>]+)?script.*>/", "", $content);
				
						$content = preg_replace("/\<\/script>$/U", "", $content);
				
						return $content;
								
					}
					else
					{
							
					echo "<center><div style='padding: 20px; background-color: #ffe4e1; border: 1px solid #0000ff;'>Illegal file extension detected. This article is not available.</div></center>";
								
					}
					break;		
				}
							
			}
			
	
	}
	elseif(!empty($_GET[$get]) && $get = 'page')
	{
	
		$page = basename($_GET[$get], '.php');
		$page = strip_tags($_GET[$get]);
		
		if(file_exists($page.'.php')){
		
			require_once($page.'.php');
			
			exit;
		}
		else
		{
		
			header('HTTP/1.0 404 Not Found');
			
			echo "<center><div style='padding: 20px; background-color: #ffe4e1; border: 1px solid #0000ff;'>File does not exist</div></center>";
			
			exit;
			
		}
		
	}
	
}

GotoPage('page', 'login.php');
GotoPage('page', 'console.php');
GotoPage('page', 'admin.php');
GotoPage('page', 'all.php');

function Display () {

require_once("./npt-file-cms.php");
$cms = new NapataFileCMS;

if(!isset($_GET['post'])){

	$cms->title = "Home";
	
}
else
{

	$cms->title = basename($_GET['post'], '.txt');
	
}

$cms->Header();

$title = $cms->title;

?>
<div id="leftsideBar">
<?php require('./sidebar.php'); ?>
</div>
	
<div id="content">

<?php $cms->ActionLinks();?>

<h1><?php echo $title; ?></h1>	
			
<?php 
if(!isset($_GET['post'])){

	echo IndexPage();
	
}
else
{

	echo GotoPage('post', $_GET['post']);
	
}

//echo $content;?>
			
<?php //AuthorData(); ?>

<?php $cms->ActionLinks();?><!--Repeated because of usability reasons-->

</div>
<br>
<div id="footer"><?php include_once("./footer.php"); echo footer();?></div>
</body>
</html>
<?php

}

Display ();


?>