<?php

define('ADMIN_FILE', true);
define('ADMIN_MAX', true);
define('CREATE_HEADER', true);
$administration = true;

global $aid, $admin_file, $db;
$aid = trim($aid);

if($aid AND (!isset($admin) OR empty($admin)) AND $op!='login') {
unset($aid);
unset($admin);
echo 'Access denied';
die();
}

include_once('mainfile.php');

// Uncomment the following block of code after editing the next line to match your site domain
// Décommentez les lignes suivantes et remplacez 'www.yourdomainname.com' par votre nom de domaine
/*$domainname = "www.yourdomainname.com";
if ($_SERVER['SERVER_NAME'] != $domainname ) {
  echo "Access denied";
  die();
}*/

if (defined('USER_ALLOW')) {
define('ADMIN_MAX_USER', true);
$sqlconfigadmin = "SELECT `admintheme` FROM `".TABLE_CONFIG_ADMIN."`";
if ( !($resultadmin = $GLOBALS['db']->sql_query($sqlconfigadmin)) )
{ query_die(GENERAL_ERROR, 'Could not obtain Admin admintheme WebSite', '', __LINE__, __FILE__, $sqlconfigadmin);}
$ConfigAdmin = $GLOBALS['db']->sql_fetchrow($resultadmin);
$admintheme  = stripslashes($ConfigAdmin['admintheme']);
} else {
redirect_url('index.php');
}

if (is_file('kernel/nsn.php')) {
	include_once('kernel/nsn.php');
}
if (is_file('admin/modules/max_admin_functions.php')) {
	include_once('admin/modules/max_admin_functions.php');
}


if (isset($daz)){
@setcookie('dazibao', "$actif" , time()+2592000);
redirect_url("".$admin_file.".php");
}
// secure admin
if ( defined('NSN_SECURE_ADMIN') ) {
	if (is_file('kernel/secureadmin.php')) {
		include_once('kernel/secureadmin.php');
	}
}
// fin secure admin

// admin
get_lang('admin');

// KEY ADMIN
$clef2 = "bda6faa04180e97ef40aaeab44a1fee1";

if (strstr($aid, '[^a-zA-Z0-9_-]')) {
    die('Wrong letter used');
}
$aid = substr("$aid", 0,25);
$pwd = substr("$pwd", 0,18);
if ((isset($aid)) && (isset($pwd)) && ($op == "login")) {
    $datekey = date("F j");
    $rcode   = hexdec(md5($_SERVER['HTTP_USER_AGENT'] . $sitekey . $_POST['random_num'] . $datekey));
    $code    = substr($rcode, 2, 6);
    if (extension_loaded("gd") AND $code != $_POST['gfx_check'] AND ($gfx_chk == 1 OR $gfx_chk == 5 OR $gfx_chk == 6 OR $gfx_chk == 7)) {
	redirect_url("".$admin_file.".php");
	die();
    }
    if($aid!="" AND $pwd!="") {
	$pwd   = md5($pwd);
        $sqlid = "SELECT `pwd`, `admlanguage` FROM `".TABLE_AUTHORS."` WHERE `aid`='$aid'";
	if ( !($resultid = $GLOBALS['db']->sql_query($sqlid)) )
{ query_die(GENERAL_ERROR, 'Could not obtain Admin authors WebSite', '', __LINE__, __FILE__, $sqlid);}
	$row = $GLOBALS['db']->sql_fetchrow($resultid);
        $admlanguage = addslashes($row['admlanguage']);
        $rpwd        = stripslashes($row['pwd']);
	$clef3       = md5($keyadmin);
	if(($rpwd == $pwd) && ($clef3 == $clef2)) {
	    $admin  = base64_encode("$aid:$pwd:$admlanguage");
	    $admin2 = base64_encode("$aid:$clef2");
	    @setcookie("admin","$admin",time()+2592000);
	    @setcookie("admin2","$admin2",time()+2592000);
	    AdminLogAllow("Open Session $aid");
	    unset($op);
	}
	if($rpwd != $pwd) { $pdw = 1; }
	if($clef3 != $clef2) { $clfe = 1; }
    }
}

$admintest = 0;$adminsecu = 0;

if(isset($admin) && $admin != "" && isset($admin2) && $admin2 != "" ) {
  $admin       = addslashes(base64_decode($admin));
  $admin       = explode(":", $admin);
  $aid         = addslashes($admin[0]);
  $pwd         = "$admin[1]";
  $admlanguage = "$admin[2]";
  $admin2      = addslashes(base64_decode($admin2));
  $admin2      = explode(":", $admin2);
  $aid2        = addslashes($admin2[0]);
  $keysec      = "$admin2[1]";
  if ($aid=="" || $pwd=="" || $aid2=="" || $keysec=="" || $aid2!=$aid) {
    $admintest = 0;
    $adminsecu = 0;
    AdminLogDeny("Access Admin not Allow");
    echo "<html>\n"
        ."<title>INTRUDER ALERT!!!</title>\n"
        ."<body bgcolor=\"#FFFFFF\" text=\"#000000\">\n\n<br /><br /><br />\n\n"
        ."<center><img src=\"images/eyes.gif\" border=\"0\" alt=\"Get Out\" title=\"Get Out\" /><br /><br />\n"
        ."<font face=\"Verdana\" size=\"+4\"><b>Get Out!</b></font></center>\n"
        ."</body>\n"
        ."</html>\n";
    exit;
  }
  $aid = substr("$aid", 0,25);
  $sqlid2 = "SELECT `pwd` FROM `".TABLE_AUTHORS."` WHERE `aid`='$aid'";
  if ( !($resultid2 = $GLOBALS['db']->sql_query($sqlid2)) )
{ query_die(GENERAL_ERROR, 'Could not obtain Admin authors WebSite', '', __LINE__, __FILE__, $sqlid2);}
  if (!$resultid2) {
        echo 'Selection from database failed!';
        exit;
  } else {
    $row2 = $GLOBALS['db']->sql_fetchrow($resultid2);
    $rpwd = stripslashes($row2['pwd']);
    if($rpwd == $pwd && $rpwd != "" && $keysec == $clef2 && $aid2==$aid) {
        $admintest = 1;
	$adminsecu = 1;
    }
  }
}

if(!isset($op)) { $op = "adminMain"; }
$pagetitle = "- "._ADMINMENU."";

/*********************************************************/
/* Login Function                                        */
/*********************************************************/
function login($pdw, $clfe) {
    global $gfx_chk, $admin_file, $admin, $cookie, $pwd, $rpwd, $admintheme, $clef3, $clef2, $keyadmin;
    define ("ADMINLOG", true);
    incoh();
    mt_srand ((double)microtime()*1000000);
    $maxran = 1000000;
    $random_num = mt_rand(0, $maxran);
    echo '<strong>S.A.M Key: <em>Secure Admin Maximus Key</em></strong>';
if ($rpwd != $pwd) {
    br('1');
    Max_OpenTable();
    echo "<center><img src='images/blocks/security.png' alt=\""._ADMINLOGINWRONG."\" title=\""._ADMINLOGINWRONG."\" />  <font class='title'><b>"._ADMINLOGINWRONG."</b></font></center>";
    AdminLogDeny("Wrong Pass Admin $cookie[1]");
    Max_CloseTable();
    br('1');
    }
    if (($clef3 != $clef2 ) and (!empty($keyadmin))) {
    br('1');
    Max_OpenTable();
    echo "<center><img src='images/key.gif' alt=\""._KEYLOGINWRONG."\" title=\""._KEYLOGINWRONG."\" />  <font class='title'><b>"._KEYLOGINWRONG."</b></font></center>";
    AdminLogDeny("Wrong Key Admin $cookie[1]");
    Max_CloseTable();
    }
    br('4');
    echo "<table border='0' width='500' align='center'><tr>"
        ."<td width='55%' valign='top'><center><img src=\"admin/themes/$admintheme/images/security.png\" alt=\""._WELCOMETOMAX."\" title=\""._WELCOMETOMAX."\" /></center>"
        .""._WELCOMETOMAX."<br /><br />"
        .""._WELCOMETOMAX2.""
        ."</td><td width='45%' valign='top'>"
        ."<img src=\"admin/themes/$admintheme/images/login.gif\" alt=\""._WELCOMETOMAX."\" title=\""._WELCOMETOMAX."\" />";
    Max_OpenTable2();
    echo "<form action=\"".$admin_file.".php\" method='post'>"
        ."<table border='0' width='200' align='center'>"
	."<tr><td width='1%' align='left'><img src='images/blocks/admin.png' alt=\""._ADMINID."\" title=\""._ADMINID."\" />&nbsp;&nbsp;<b>"._ADMINID."</b><br />"
	."<input type='text' name='aid' size='30' maxlenght='25' /></td></tr>"
	."<tr><td width='1%'><img src='images/blocks/security.png' alt=\""._PASSWORD."\" title=\""._PASSWORD."\" />&nbsp;&nbsp;<b>"._PASSWORD."</b><br />"
	."<input type='password' name='pwd' size='30' maxlenght='18' /></td></tr>"
	."<tr><td width='1%'><img src='images/key.gif' alt=\""._KEYADMIN."\" title=\""._KEYADMIN."\" />&nbsp;&nbsp;<b>"._KEYADMIN."</b><br /><input type='password' name='keyadmin' size='30' maxlenght='18' /> <a href='http://www.php-maximus.fr/modules.php?name=Max_KeyRegenerator' target='new'><img src='images/new.gif' alt=\""._GENERATENEWKEY."\" title=\""._GENERATENEWKEY."\" border='0' /></a></td><tr>";
    if (extension_loaded("gd") AND ($gfx_chk == 1 OR $gfx_chk == 5 OR $gfx_chk == 6 OR $gfx_chk == 7)) {
	echo "<tr><td colspan=\"2\" align=\"right\">"._SECURITYCODE.": <img src=\"?gfx=gfx&amp;random_num=$random_num\" border=\"1\" alt=\""._SECURITYCODE."\" title=\""._SECURITYCODE."\" /></td></tr>"
	    ."<tr><td colspan='2' align='right'>"._TYPESECCODE.": <input type='text' name='gfx_check' size='7' maxlenght='6' /></td></tr>";
    }
    echo "</table><br /><table align='center'><center><tr><td align='center'>"
	."<input type='hidden' name='random_num' value=\"$random_num\" />"
	."<input type='hidden' name='op' value='login' />"
	."<input type='submit' value=\""._LOGIN." administration\" onclick=\"this.form.submit();this.disabled=true;this.value='"._WAITING."'\" />"
	."</td></tr></center></table>"
	."</form>";
    Max_CloseTable2();
    echo "</td></tr></table>";
    br('4');
    incof();
}

function adminMain() {
    global $cookie, $bgcolor3,$bgcolor2,$admin, $op, $language, $aid, $sitename, $admin_file, $bgcolor1;
    incoh();

if ($_COOKIE['dazibao'] == "1"){
$gestionadmin = "&nbsp;<a href=\"".$admin_file.".php?daz&amp;dazibao&amp;actif=\"><img src='images/blocks/droite.png' border='0' alt=\""._PANELADMIN."\" title=\""._PANELADMIN."\" />&nbsp;"._PANELADMIN."</a>";
} else {
$gestionadmin ="&nbsp;<a href=\"".$admin_file.".php?daz&amp;dazibao&amp;actif=1\"><img src='images/blocks/droite.png' border='0' alt=\""._DAZIBAOMAX."\" title=\""._DAZIBAOMAX."\" />&nbsp;"._DAZIBAOMAX."</a>";
}

echo "$gestionadmin";
br('2');
if ($_COOKIE['dazibao'] == "1"){
 // Max_OpenTable();
echo "<table width='100%'><tr><td width='15%'></td><td width='85%'>"
    ."<font size='2'><img src='images/arrow.png' alt='' /> "._DAZIBAO1." <img src='images/edit.gif' alt=\""._EDIT."\" title=\""._EDIT."\" /><br />"
    ."<img src='images/arrow.png' alt='' /> "._DAZIBAO2."  <img src='images/trashmini.png' alt=\""._DELETE."\" title=\""._DELETE."\" /><br />"
    ."<img src='images/arrow.png' alt='' /> "._DAZIBAO3."<br />"
    ."<img src='images/arrow.png' alt='' /> "._DAZIBAO4."<br />"
    ."</font></td></tr></table>";

br('1');

 $ipp = 5;
 $sql = "SELECT `id` from `".TABLE_MAXDAZIBAO."` ";
if ( !($result = $GLOBALS['db']->sql_query($sql)) )
{ query_die(GENERAL_ERROR, 'Could not obtain _maxdazibao', '', __LINE__, __FILE__, $sql);}
  $total =  $GLOBALS['db']->sql_numrows($result);
       Max_OpenTable();
echo "<form action=\"".$admin_file.".php\" method='post'>"
    ."<b>"._MESSAGE."</b>";
br('1');
echo "<textarea cols='100' rows='5' name='titre' style='font-size: 14 pt; font-family: Arial; color: #0000FF'></textarea>";
br('2');
echo "<input type='hidden' name='op' value='EnvoyerDazibao' />
    <input type='submit' onclick=\"this.form.submit();this.disabled=true;this.value='"._WAITING."'\" value=\""._DAZIBAO_SAVE."\" />
    </form>";
    Max_CloseTable();
    br('1');
    Max_OpenTable();

	// tablo
echo    "<table border='0' width='100%' cellpadding='4' cellspacing='2'>"
 	."<tr>"
 	."<td bgcolor=\"$bgcolor2\" align='left' width='10%'><b>"._BY."</b></td>"
 	."<td bgcolor=\"$bgcolor2\" align='left' width='60%'><b> "._MESSAGE." </b></td>"
 	."<td bgcolor=\"$bgcolor2\" align='center' width='15%'><b>"._DATE."</b></td>"
	."<td bgcolor=\"$bgcolor2\" align='center' width='5%'><b>"._ACTION."</b></td></tr>";

$a = 0;
$sql2 = "select `id`, `pseudo`, `titre`, `date` from `".TABLE_MAXDAZIBAO."` order by `date` desc limit 0,$ipp";
if ( !($result2 = $GLOBALS['db']->sql_query($sql2)) )
{ query_die(GENERAL_ERROR, 'Could not obtain _maxdazibao', '', __LINE__, __FILE__, $sql2);}
        while ($row = $GLOBALS['db']->sql_fetchrow($result2)) {
	$id     = $GLOBALS['db']->XMFnum($row['id']);
	$pseudo = stripslashes(check_html($row['pseudo'], "nohtml"));
	$titre  = nl2br(stripslashes($row['titre']));
        $date   = stripslashes($row['date']);
        $year   = substr($date,0,4);
        $month  = substr($date,5,2);
        $day    = substr($date,8,2);
        $hour   = substr($date,11,2);
        $minute = substr($date,14,2);
        $second = substr($date,17,2);
        $date   = date("d-m-Y H:i:s",mktime ($hour,$minute,$second,$month,$day,$year));
$a++;
if ($a >= 2) { $a=0; $color = "white"; } else { $color= "$bgcolor3"; }

echo "<tr><td bgcolor=\"$color\"  align='left' width='10%' valign='top'><a href=\"modules.php?name=Your_Account&amp;op=userinfo&amp;username=$pseudo\"><font size='3'><b>$pseudo</b></font></a>";
if (is_god($admin)) {
echo "<br /><a href=\"".$admin_file.".php?op=DelDazibao&amp;id=$id&amp;admin=$admin[0]\"><i>"._DELETE."</i></a>";
}
echo "</td><td bgcolor=\"$color\" align='left' width='60%' valign='top'><font size='2'>$titre</font></td>"
	."<td bgcolor=\"$color\" align='center' width='15%' valign='top'><font size='1'>$date</font></td>"
	."<td bgcolor=\"$color\" align='center' width='5%' valign='top'>";

if ( ($cookie[1] == $pseudo) OR (is_god($admin)) ) {
image_dyn( "images/edit_x.gif", "images/edit.gif", "".$admin_file.".php?op=ModDazibao&amp;did=$id&amp;envoi=$pseudo", ""._EDIT."", "Edit" ) ;
image_dyn( "images/trashmini_x.png", "images/trashmini.png", "".$admin_file.".php?op=DelDazibao&amp;id=$id&amp;envoi=$pseudo", ""._DELETE."", "Delete" ) ;
}
echo "</td></tr>";
    }
echo "</table>";
Max_CloseTable();
echo "<div align='right'><a href=\"".$adminfile."?op=Dazibao\">"._DAZIBAO_ACCESS."</a></div>";
$GLOBALS['db']->sql_freeresult($result);
$GLOBALS['db']->sql_freeresult($result2);
} else {
GraphicAdmin();
}
    incof();
}

if($admintest && $adminsecu)  {

    switch($op) {
        case "AdminPanel":
        incoh();
	GraphicAdmin();
	incof();
	break;

	case "AdminPanelModules":
        incoh();
	GraphicModules();
	incof();
	break;

	case "do_gfx":
	do_gfx();
	break;

	case "deleteNotice":
	deleteNotice($id);
	break;

	case "GraphicAdmin":
        GraphicAdmin();
        break;

	case "adminMain":
	adminMain();
	break;

	case "logout":
		@setcookie("admin", false);
		@setcookie("admin2", false);
		$admin = "";
		$admin2 = "";
                define ("ADMINLOG", true);
		incoh();
		global $cookie;
		Max_OpenTable();
		AdminLogAllow("Close Session $cookie[1]");
		echo "<center><font class='title'><b>"._YOUARELOGGEDOUT."</b></font><br /><br /><a href=\"index.php\"><font class='title'>->  "._HOME."  <-</a><br /><br /></center>";
		Max_CloseTable();
		echo "<meta http-equiv='refresh' content='3;url=index.php'>"
		    ."<meta http-equiv='Pragma' content='no-cache'>";
		incof();
	break;

	case "login";
	unset($op);

	default:
      if (!is_admin($admin)) {
	  login($pdw, $clfe);
      }
	$casedir = dir('admin/case');
	while($func=$casedir->read()) {
	    if(substr($func, 0, 5) == "case.") {
			include_once($casedir->path."/$func");
	    }
	}
	closedir($casedir->handle);
	$sql = "SELECT `title` FROM `".TABLE_MODULES."` ORDER BY `title` ASC";
	if ( !($result = $GLOBALS['db']->sql_query($sql)) )
{ query_die(GENERAL_ERROR, 'Could not obtain Admin modules WebSite', '', __LINE__, __FILE__, $sql);}
	while ($row = $GLOBALS['db']->sql_fetchrow($result)) {
        $adminmodule_title = stripslashes($row['title']);
		if (file_exists("modules/$adminmodule_title/admin/index.php") AND file_exists("modules/$adminmodule_title/admin/links.php") AND file_exists("modules/$adminmodule_title/admin/case.php")) {
if (is_file("modules/$adminmodule_title/admin/case.php")) {
	    	include_once("modules/$adminmodule_title/admin/case.php");}
		}
	}
	break;
	}
} else {
        switch($op) {
	default:
	$pdw  = "";
	$clfe = "";
	login($pdw, $clfe);
	break;
    }
}