<?PHP
@include 'include/global.php';
@include 'library/gd.php';
$sql_error = 'SQL Error : ';

//--------------------------
$chars = "abcdefghijklmnopqrstuvwxyz";
$len = strlen($chars);
mt_srand((double)microtime() * 1000000);
for ($i = 0; $i < 15; $i++)
{
    $randomize = mt_rand(0, $len);
    $imagename .= $chars{$randomize};
}

$chars = "abcdefghijklmnopqrstuvwxyz";
$len = strlen($chars);
mt_srand((double)microtime() * 1000000);
for ($i = 0; $i < 3; $i++)
{
    $randomize = mt_rand(0, $len);
    $app .= $chars{$randomize};
}
//--------------------------
        $controller     = $_POST['controller'];
        $pieces         = explode("~", $controller);
        $table          = $pieces[0];
        $qt             = $pieces[1];
        $return         = $pieces[2];
        $id             = $pieces[3];
        
//--------------------------

if ($qt == update && $table == PAGES) {
$SQL = "SELECT * from PAGES WHERE ID = '$id'"; $result = @mysql_query( $SQL ); $row = @mysql_fetch_array( $result );
if ($_SESSION[username] != $row[OWNER]) die("That's not very nice... that does not belong to you.");
}
        
//--------------------------
        if ($table != PAGES && $table != USERS) die("Table is not PAGES or USERS");

        if ($table == USERS && $_POST[STATUS] != $nil) die("Not allowed to update USERS STATUS");



//--------------------------
        if ($_GET[addphoto] == 1) {
                $SQL            = "SELECT * from LISTINGS WHERE ID = '$id'";
                $result         = @mysql_query( $SQL );
                $row            = @mysql_fetch_array( $result );
                $original       = $row[IMAGEPOT];
        }

        if ($qt == insert)
                $qt = 'INSERT INTO';

        if ($qt == update) {
                $qt = 'UPDATE';
                $end = "WHERE ID = '$id'";
        }

        $pre = array_keys( $_POST );
        
        //--------------------------
        mysql_query ("CREATE TABLE IF NOT EXISTS `$table` (`ID` INT NOT NULL AUTO_INCREMENT , PRIMARY KEY ( `id` ) )");
        //-------------------------------------------------------------------------------------------------------------

//....................................................................
//....................................................................

$count = count($pre); $count = $count - 2;
$sql = "$qt $table SET";
for ($i=0; $i < $count; $i++)
{
        $x=$i+1;
        $y = $_POST[$pre[$x]];
        $d = $y;

        mysql_query ("ALTER TABLE `$table` ADD `$pre[$x]` TEXT NOT NULL");
        $sql .= " `$pre[$x]` = '$d',";
}

$sql .= " ID = '$id' $end";
$query = mysql_query($sql) or ($q = 1);

if ($q == 1) {

        $_POST['JBPOT'] = addslashes($_POST['JBPOT']);

        if ($qt == insert) $qt = 'INSERT INTO';
        if ($qt == update) { $qt = 'UPDATE'; $end = "WHERE ID = '$id'"; }
        $pre = array_keys( $_POST );

        $count = count($pre); $count = $count - 2;
        $sql = "$qt $table SET";
        for ($i=0; $i < $count; $i++)
        {
        $x=$i+1;
        $y = $_POST[$pre[$x]];
        $d = $y;

                $d = htmlentities($d, ENT_QUOTES);

        mysql_query ("ALTER TABLE `$table` ADD `$pre[$x]` TEXT NOT NULL");
        $sql .= " `$pre[$x]` = '$d',";
        }

        $sql .= " ID = '$id' $end";
        $query = mysql_query($sql) or die(error66);
}

//....................................................................
//....................................................................

//------------------------------------------------------------------------------------------

        @mkdir("$svr_rootscript/product_images", 0777);
        @mkdir("$svr_rootscript/product_images/thumb", 0777);
        @mkdir("$svr_rootscript/product_images/large", 0777);
        @mkdir("$svr_rootscript/product_images/tmp", 0777);
        
                if (empty($HTTP_POST_FILES['1'])) $HTTP_POST_FILES['1'] = $_FILES['1'];
        
        $file  = $HTTP_POST_FILES['1']['tmp_name'];

        if ($file != $nil && $HTTP_POST_FILES['1'][type] == 'image/jpeg' || $HTTP_POST_FILES['1'][type] == 'image/pjpeg') { 

        move_uploaded_file($HTTP_POST_FILES[1]['tmp_name'], "$svr_rootscript/product_images/tmp/$_POST[IMAGENAME].jpg");

        $pic            = "$svr_rootscript/product_images/tmp/$_POST[IMAGENAME].jpg";
        $loc            = "$svr_rootscript/product_images/large/";
        $new_name       = "$_POST[IMAGENAME].jpg";

        $im = imagecreatefromjpeg($pic);
        $orwidth=imagesx($im); // get original width

        $new_w          = 700;
        if ($orwidth < 700) $new_w = $orwidth;
        create_image($pic,$loc,$new_name,$new_w);

        $pic            = "$svr_rootscript/product_images/tmp/$_POST[IMAGENAME].jpg";
        $loc            = "$svr_rootscript/product_images/";
        $new_name       = "$_POST[IMAGENAME].jpg";

        $im = imagecreatefromjpeg($pic);
        $orwidth=imagesx($im); // get original width

        $new_w          = $rowxxx[PHOTOSIZE];
        if ($orwidth < $rowxxx[PHOTOSIZE]) $new_w = $orwidth;
        create_image($pic,$loc,$new_name,$new_w);

        $pic            = "$svr_rootscript/product_images/tmp/$_POST[IMAGENAME].jpg";
        $loc            = "$svr_rootscript/product_images/thumb/";
        $new_name       = "$_POST[IMAGENAME].jpg";
        $new_w          = $rowxxx[THUMBSIZE];
        create_thumb($pic,$loc,$new_name,$new_w);

        }

//-- Logo upload quickie hack
if ($_GET[addphoto] == 1) {
        $filename = "$svr_rootscript/product_images/$_POST[IMAGENAME].jpg";
        if (file_exists($filename)) { } else {
                $sql            = "UPDATE LISTINGS SET
                IMAGENAME       = '$nil'
                WHERE ID        = '$id'";
                $query = mysql_query($sql);
        }
}
//-- Logo upload quickie hack

        //-------------------------------------------------------
                if (empty($HTTP_POST_FILES['2'])) $HTTP_POST_FILES['2'] = $_FILES['2'];
                
        $file  = $HTTP_POST_FILES['2']['tmp_name'];
        if ($file != $nil && $HTTP_POST_FILES['2'][type] == 'image/jpeg' || $HTTP_POST_FILES['2'][type] == 'image/pjpeg') {
        move_uploaded_file($HTTP_POST_FILES[2]['tmp_name'], "$svr_rootscript/product_images/tmp/$_POST[IMAGEPOTNEW].jpg");
        
        $pic            = "$svr_rootscript/product_images/tmp/$_POST[IMAGEPOTNEW].jpg";
        $loc            = "$svr_rootscript/product_images/large/";
        $new_name       = "$_POST[IMAGEPOTNEW].jpg";

        $im = imagecreatefromjpeg($pic);
        $orwidth=imagesx($im); // get original width

        $new_w          = 700;
        if ($orwidth < 700) $new_w = $orwidth;
        create_image($pic,$loc,$new_name,$new_w);

        $pic            = "$svr_rootscript/product_images/tmp/$_POST[IMAGEPOTNEW].jpg";
        $loc            = "$svr_rootscript/product_images/";
        $new_name       = "$_POST[IMAGEPOTNEW].jpg";

        $im = imagecreatefromjpeg($pic);
        $orwidth=imagesx($im); // get original width

        $new_w          = $rowxxx[PHOTOSIZE];
        if ($orwidth < $rowxxx[PHOTOSIZE]) $new_w = $orwidth;
        create_image($pic,$loc,$new_name,$new_w);

        $pic            = "$svr_rootscript/product_images/tmp/$_POST[IMAGEPOTNEW].jpg";
        $loc            = "$svr_rootscript/product_images/thumb/";
        $new_name       = "$_POST[IMAGEPOTNEW].jpg";
        $new_w          = $rowxxx[THUMBSIZE];
        create_thumb($pic,$loc,$new_name,$new_w);
        } elseIF ($_GET['addphoto'] == '1') {
        $sql            = "UPDATE LISTINGS SET
        IMAGEPOT        = '$original'
        WHERE ID        = '$id'";
        $query = mysql_query($sql);
        }

?>


<?PHP


$SQL = "SELECT * from PAGES";
$result = @mysql_query( $SQL ); while( $row = @mysql_fetch_array( $result ) ) {
$row[HEADER] = EdURL($row[HEADER]);
        $new = "RewriteRule ^$row[HEADER]$appen.html$ index.php?page=pages&id=$row[ID] [NC,L]";
        $pot = "$new\n$pot";
}

$SQL = "SELECT * from CATEGORIES";
$result = @mysql_query( $SQL ); while( $row = @mysql_fetch_array( $result ) ) {
$row[TITLE] = EdURL($row[TITLE]);
        $new = "RewriteRule ^$row[TITLE]$ index.php?page=browse&category=$row[ID] [NC,L]";
        $pot = "$new\n$pot";
}

$somecontent = "
RewriteEngine on
$pot";
unlink("$svr_rootscript/.htaccess");
fopen("$svr_rootscript/.htaccess", "x+");
$filename = "$svr_rootscript/.htaccess";

if (is_writable($filename)) {
        if (!$handle = fopen($filename, 'w+')) {
                echo "Error ($filename)."; exit;
        }

        if (fwrite($handle, $somecontent) === FALSE) {
                echo "Error ($filename)."; exit;
        }
}

?>


<?PHP
if ($_GET[add_listing] == 1)
        sendmail("$rowxxx[EMAIL]","$rowxxx[EMAIL]","idev-ArticleDirectory Notification: An Article has been Added or Modified.","$_POST[HEADER]<BR><BR>This article has been submitted to your directory. Log into the admin panel of $script_title to approve or deny the inclusion of this article in your directory. <BR><BR><b>Article title:</b><BR>$_POST[HEADER]<BR><BR><b>Article summary:</b> $_POST[CAPTION]<BR><BR><b>Article description:</b><br>$_POST[DESCRIPTION]<BR><BR><a href=$svr_urlscript/admin>$script_title Admin Panel</a>");
?>

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<title>One moment please...</title>
<meta http-equiv="REFRESH" content="0;url=index.php?page=<?php echo $return; ?>&reason=<?php echo $reason; ?>"></HEAD>
<BODY></BODY>
</HTML>
