diff --git a/assets/css/shimapan-panel.css b/assets/css/shimapan-panel.css
index 5216060..b5e4a50 100644
--- a/assets/css/shimapan-panel.css
+++ b/assets/css/shimapan-panel.css
@@ -4,8 +4,8 @@
/* ---------- GENERAL ---------- */
body {
- background: #eaeaea;
- color: #999;
+ background-color: #060606;
+ color: #d3d3d3;
font: 100%/1.5em sans-serif;
margin: 0;
}
@@ -55,9 +55,9 @@ input[type="submit"] { cursor: pointer; }
}
#login-form h3 {
- background-color: #282830;
+ background-color: #222222;
border-radius: 5px 5px 0 0;
- color: #fff;
+ color: #2a9fd6;
font-size: 14px;
padding: 20px;
text-align: center;
@@ -65,14 +65,14 @@ input[type="submit"] { cursor: pointer; }
}
#login-form fieldset {
- background: #fff;
+ background: #151515;
border-radius: 0 0 5px 5px;
padding: 20px;
position: relative;
}
#login-form fieldset:before {
- background-color: #fff;
+ background-color: #222222;
content: "";
height: 8px;
left: 50%;
@@ -94,13 +94,12 @@ input[type="submit"] { cursor: pointer; }
#login-form input[name="user"],
#login-form input[name="code"],
#login-form input[type="password"] {
- border: 1px solid #dcdcdc;
- padding: 12px 10px;
- width: 238px;
-}
-
-#login-form input[name="user"] {
+ color: #888888;
+ background: #ffffff;
+ border: 1px solid #282828;
border-radius: 3px 3px 0 0;
+ width: 248px;
+ padding: 12px 10px;
}
#login-form input[name="code"],
@@ -110,7 +109,7 @@ input[type="submit"] { cursor: pointer; }
}
#login-form input[type="submit"] {
- background: #1dabb8;
+ background: #454545;
border-radius: 3px;
color: #fff;
float: right;
@@ -127,7 +126,7 @@ input[type="submit"] { cursor: pointer; }
}
.info {
- background: #e5e5e5;
+ background: #2a9fd6;
border-radius: 50%;
display: inline-block;
height: 20px;
@@ -150,9 +149,9 @@ input[type="submit"] { cursor: pointer; }
}
#fail:target h3 {
- background-color: #282830;
+ background-color: #222222;
border-radius: 5px 5px 0 0;
- color: #fff;
+ color: #2a9fd6;
font-size: 14px;
padding: 20px;
text-align: center;
@@ -160,14 +159,14 @@ input[type="submit"] { cursor: pointer; }
}
#fail:target fieldset {
- background: #fff;
+ background: #151515;
border-radius: 0 0 5px 5px;
padding: 20px;
position: relative;
}
#fail:target fieldset:before {
- background-color: #fff;
+ background-color: #151515;
content: "";
height: 8px;
left: 50%;
diff --git a/includes/api.php b/includes/api.php
index 878e485..544703a 100644
--- a/includes/api.php
+++ b/includes/api.php
@@ -6,46 +6,66 @@ if (isset($_GET['do'])) {
switch ($action) {
case "login":
- login($_POST['user'], $_POST['pass']);
+ login($_POST['user'], $_POST['pass']);
break;
case "register":
register($_POST['user'], $_POST['pass'], $_POST['code']);
break;
- case "invite":
- generate($_GET['level']);
+ case "invite":
+ if (!empty($_GET['level']))
+ generate($_GET['level']);
+ else
+ generate(NULL);
break;
- case "fetch":
- fetchFiles($_GET['date'], $_GET['count'], $_GET['keyword'], $_GET['action']);
- break;
+ case "fetch":
+ switch($_GET['method']) {
+ case "Fetch All":
+ fetchFiles($_GET['method'], NULL, $_GET['count'], NULL);
+ break;
- case "search":
- fetchFiles();
- break;
+ case "Fetch":
+ fetchFiles($_GET['method'], $_GET['date'], $_GET['count'], $_GET['keyword']);
+ break;
- case "report":
- report($_POST['file'], $_POST['reason']);
- break;
+ default:
+ fetchFiles(NULL, NULL, NULL, NULL);
+ break;
+ }
+ break;
- case "mod":
- mod($_GET['action'], $_GET['date'], $_GET['count'], $_GET['why'], $_GET['file'], $_GET['keyword'], $_GET['fileid'], $_GET['hash'], $_GET['originalname']);
- break;
+ case "report":
+ if (!empty($_POST['file']))
+ report($_POST['file'], $_POST['reason']);
+ else
+ report(NULL, NULL);
+ break;
+
+ case "reports":
+ reports();
+ break;
+
+
+ case "acceptreport":
+ acceptreport($_GET['id']);
+ break;
+
+ case "dismissreport":
+ dismissreport($_GET['id']);
+ break;
case "panel":
- header('Location: ../panel/index.php');
+ panel();
break;
- case "delete":
- delete($_GET['filename'], $_GET['fileid']);
+ case "delete":
+ delete($_GET['fileid']);
break;
- case "logout":
- session_unset();
- session_destroy();
- session_write_close();
- header('Location: ../login');
+ case "logout":
+ destroySession();
break;
default:
@@ -53,4 +73,4 @@ if (isset($_GET['do'])) {
}
} else {
echo "What are you doing here, baka ?";
-}
\ No newline at end of file
+}
diff --git a/includes/core.php b/includes/core.php
index 7d94f25..0b69e2a 100644
--- a/includes/core.php
+++ b/includes/core.php
@@ -2,81 +2,125 @@
session_start();
require_once 'database.inc.php';
-function register($user, $pass, $code)
-{
- global $db;
- $q = $db->prepare("SELECT id, used, level FROM invites WHERE code = (:code)");
- $q->bindParam(':code', $code);
+/*
+ *
+ * Utilitiy Functions
+ *
+ */
+
+function createSession($id, $username, $level) {
+ $_SESSION['id'] = $id;
+ $_SESSION['user'] = $username;
+ $_SESSION['level'] = $level;
+ redirect('/');
+}
+
+function destroySession() {
+ session_unset();
+ session_destroy();
+ redirect('/login');
+}
+
+function checkSession($requiredLevel) {
+ // Check that they are logged in
+ if (!isset($_SESSION['id']))
+ redirect('/login');
+
+ // Check that they have the required access level
+ if ($_SESSION['level'] > $requiredLevel)
+ exit(header('HTTP/1.0 403 Forbidden'));
+}
+
+function redirect($uri) {
+ $host = $_SERVER['HTTP_HOST'];
+ exit(header('Location: https://'.$host.$uri));
+}
+
+/*
+ *
+ * Core Functions
+ *
+ */
+
+function panel() {
+ global $db;
+ checkSession(3);
+
+ include('./panel.php');
+
+ $q = $db->prepare("SELECT apikey FROM accounts WHERE user = (:user)");
+ $q->bindParam(':user', $_SESSION['user']);
+ $q->execute();
+ $r = $q->fetch();
+
+ echo 'Your API Key is '.$r['apikey'];
+}
+
+function register($user, $pass, $code) {
+ global $db;
+
+ // Check if code exists, if it is used, and store it in $r for later use
+ $q = $db->prepare("SELECT id, used, level FROM invites WHERE code = (:code) AND used = 0");
+ $q->bindParam(':code', $code);
+ $q->execute();
+ $r = $q->fetch();
+ if ($q->rowCount() == 0) redirect('/register/index.html#fail');
+
+ // Check if username is used
+ $q = $db->prepare("SELECT user FROM accounts WHERE user = (:user)");
+ $q->bindParam(':user', $user);
$q->execute();
- $result = $q->fetch();
+ if ($q->rowCount() > 0) redirect('/register/index.html#fail');
- // Check if code is used
- if ($result['used'] == '0') {
- // Check to see if the username is in use
- $q = $db->prepare("SELECT user FROM accounts WHERE user = (:user)");
- $q->bindParam(':user', $user);
- $q->execute();
- if (!($result = $q->fetch())) {
- // Add new account
- $q = $db->prepare("INSERT INTO accounts (user, pass, level, apikey) VALUES (:user, :pass, :level, :apikey)");
- $q->bindParam(':user', $user);
- $q->bindParam(':level', $result['level']);
- $hash = password_hash($pass, PASSWORD_DEFAULT);
- $q->bindParam(':pass', $hash);
- $apikey = generateString(KEY_CHARSET, 32);
- $q->bindParam(':apikey', $apikey);
- $q->execute();
+ // If the checks passed, create the account
+ $q = $db->prepare("INSERT INTO accounts (user, pass, apikey, level) VALUES (:user, :pass, :apikey, :level)");
+ $q->bindParam(':user', $user);
+ $q->bindParam(':pass', password_hash($pass, PASSWORD_DEFAULT));
+ $q->bindParam(':apikey', generateString(KEY_CHARSET, 32));
+ $q->bindParam(':level', $r['level']);
+ $q->execute();
- // Set the code as used
- $q = $db->prepare("UPDATE invites SET used = (:used),usedby = (:usedby) WHERE code = (:code)");
- $q->bindValue(':used', '1');
- $q->bindValue(':usedby', $user);
- $q->bindParam(':code', $code);
- $q->execute();
+ // Set the code as used
+ $q = $db->prepare("UPDATE invites SET used = (:used), usedby = (:usedby) WHERE code = (:code)");
+ $q->bindValue(':used', 1);
+ $q->bindValue(':usedby', $user);
+ $q->bindParam(':code', $code);
+ $q->execute();
- // Log them in
- $_SESSION['id'] = $result['id'];
- $_SESSION['user'] = $user;
- $_SESSION['level'] = $result['level'];
- header('Location: http://www.shimapan.rocks/includes/api.php?do=panel');
- } else {
- header('Location: ../register/index.html#fail');
- }
- } else {
- header('Location: ../register/index.html#fail');
- }
+ // Log them in
+ createSession($r['id'], $user, $r['level']);
}
-function generate($level)
-{
- global $db;
- if (isset($_SESSION['id'])) {
- if ($_SESSION['level'] < '3') {
- if (empty($level)) {
- include_once('./invite.php');
- } else {
- if ($level > $_SESSION['level'] && $level < '4') {
- $q = $db->prepare("INSERT INTO invites (code, level, issuer) VALUES (:code, :level, :issuer)");
- $code = generateString(CODE_CHARSET, 16);
- $q->bindParam(':code', $code);
- $q->bindParam(':level', $level);
- $q->bindParam(':issuer', $_SESSION['user']);
- $q->execute();
- echo 'Generation Successful.
Code: '.$code.'
Access Level: '.$level.'
';
- }
- }
- } else {
- echo 'Insufficient Access Level.';
- }
- } else {
- header('Location: ../login');
- }
+function generate($level) {
+ global $db;
+ checkSession(2);
+
+ // Display form if not generating an invite
+ if (empty($level)) {
+ include_once('./invite.php');
+ exit();
+ }
+
+ // Check to make sure level is valid
+ if ($level < $_SESSION['level'] || $level > 3) {
+ echo 'Invalid Access Level.'.$row['id'].'
- '.strip_tags($row['originalname']).'
- '.$row['filename'].' ('.$row['originalname'].')'.$bytes.' / '.$kilobytes.'
- Remove '.$i.' Files in total at being shown.
';
- echo '';
- } elseif ($action === 'Fetch') {
- if ($_SESSION['level'] === '0') {
- $q = $db->prepare("SELECT * FROM files WHERE originalname LIKE (:keyword) AND date LIKE (:date) OR filename LIKE (:keyword) AND date LIKE (:date) ORDER BY id DESC LIMIT :count");
- } else {
- $q = $db->prepare("SELECT * FROM files WHERE originalname LIKE (:keyword) AND date LIKE (:date) AND user = (:user) OR filename LIKE (:keyword) AND date LIKE (:date) AND user = (:userid) ORDER BY id DESC LIMIT :count");
- $q->bindValue(':user', $_SESSION['user']);
- }
- $q->bindValue(':date', "%".$date."%");
- $q->bindValue(':count', (int) $count, PDO::PARAM_INT);
- $q->bindValue(':keyword', "%".$keyword."%");
- $q->execute();
+ if (empty($method)) {
+ include('./footer.php');
+ exit();
+ }
- $i = 0;
- while ($row = $q->fetch()) {
- $i++;
- $bytes = $row['size'];
- $kilobytes = $row['size'] / 1000;
- echo ''.$row['id'].'
- '.strip_tags($row['originalname']).'
- '.$row['filename'].' ('.$row['originalname'].')'.$bytes.' / '.$kilobytes.'
- Remove '.$i.' Files in total at being shown.
';
- echo '';
- }
- include('./footer.php');
- } else {
- echo 'Insufficient Access Level.';
- }
- } else {
- header('Location: ../login');
- }
+ if ($method == 'Fetch') {
+ // Either fetch all files matching query, or only the user's files
+ if ($_SESSION['level'] == 0)
+ $q = $db->prepare('SELECT * FROM files WHERE (originalname LIKE (:keyword) AND date LIKE (:date)) OR (filename LIKE (:keyword) AND date LIKE (:date)) ORDER BY id DESC LIMIT :count');
+ else {
+ $q = $db->prepare('SELECT * FROM files WHERE user = (:user) AND ((originalname LIKE (:keyword) AND date LIKE (:date)) OR (filename LIKE (:keyword) AND date LIKE (:date))) ORDER BY id DESC LIMIT :count');
+ $q->bindValue(':user', $_SESSION['user']);
+ }
+
+ $q->bindValue(':date', '%'.$date.'%');
+ $q->bindValue(':count', (int)$count, PDO::PARAM_INT);
+ $q->bindValue(':keyword', '%'.$keyword.'%');
+ $q->execute();
+ } else if ($method == 'Fetch All') {
+ // Either fetch all files or only the user's files
+ if ($_SESSION['level'] == 0)
+ $q = $db->prepare('SELECT * FROM files ORDER BY id DESC LIMIT :count');
+ else {
+ $q = $db->prepare('SELECT * FROM files WHERE user = (:user) ORDER BY id DESC LIMIT :count');
+ $q->bindValue(':user', $_SESSION['user']);
+ }
+
+ $q->bindValue(':count', (int)$count, PDO::PARAM_INT);
+ $q->execute();
+ }
+
+ while ($r = $q->fetch()) {
+ $id = $r['id'];
+ $oname = strip_tags($r['originalname']);
+ $fname = $r['filename'];
+ $bytes = $r['size'].' B';
+ $temp = $r['size'] / 1000;
+ $kilobytes = $temp.' KB';
+ $uploadDate = $r['date'];
+ $uploader = $r['user'];
+
+ echo '
+ '.$id.'
+ '.$oname.'
+ '.$fname.' '.$uploadDate.'
+ '.$uploader.'
+ '.$bytes.' / '.$kilobytes.'
+ Remove ';
+ }
+
+ echo ''.$q->rowCount().' files found.
';
+ echo '';
+
+ include('./footer.php');
}
-function report($file, $reason)
-{
+function report($file, $reason) {
global $db;
if (isset($_SESSION['id'])) {
if ($_SESSION['level'] < '4') {
@@ -212,7 +248,7 @@ function report($file, $reason)
$result = $q->fetch();
if ($q->rowCount() != '0') {
- $q = $db->prepare(" header('Location: ../register/index.html#fail');INSERT INTO reports (hash, date, file, fileid, reporter, reason) VALUES (:hash, :date, :file, :fileid, :reporter, :reason)");
+ $q = $db->prepare("INSERT INTO reports (hash, date, file, fileid, reporter, reason) VALUES (:hash, :date, :file, :fileid, :reporter, :reason)");
$q->bindValue(':file', strip_tags($file));
$q->bindValue(':date', date('Y-m-d'));
$q->bindValue(':reporter', $_SESSION['user']);
@@ -221,69 +257,90 @@ function report($file, $reason)
$q->bindValue(':reason', $reason);
$q->execute();
echo 'Thank you, report has been sent. The file will be reviewed.';
- } else {
- echo 'File does not exist.';
- }
+ } else echo 'File does not exist.';
}
- } else {
- echo 'Insufficient Access Level.';
- }
- } else {
- header('Location: ../login');
- }
+ } else echo 'Insufficient Access Level.';
+ } else header('Location: ../login');
}
-function mod($action, $date, $count, $why, $file, $keyword, $fileid, $hash, $orginalname)
-{
- global $db;
- if (isset($_SESSION['id'])) {
- if ($_SESSION['level'] < '2') {
- switch ($action) {
- case "reports":
- $q = $db->prepare("SELECT * FROM reports WHERE status = '0'");
- $q->execute();
+function reports() {
+ global $db;
+ checkSession(1);
- $i = 0;
- include('./reports.php');
- while ($row = $q->fetch()) {
- $i++;
- echo ''.$row['id'].'
- '.strip_tags($row['file']).' '.$row['fileid'].'
- '.$row['reporter'].'
- '.$row['status'].'
- '.$row['reason'].'
- Remove File
- Dismiss Report
+ '.$id.'
+ '.$filename.' '.$fileid.'
+ '.$reporter.'
+ '.$status.'
+ '.$reason.'
+ Remove File
+ Dismiss Report ';
+
+ }
+ echo '';
+
+ include('./footer.php');
+
+ // Display report stats
+ echo $q->rowCount().' Reports in total are being shown.{{siteName}} Panel
- {{siteName}} {% block title %}Services{% endblock %}
{% block body %}What are you doing here, baka ?{% endblock %}
-