Файл: downloads/load.php
Строк: 199
<?
$title='Загрузка';
require_once '../system/head.php';
$id = intval($_GET['cat']);
if($user[level]=='1'){
if (empty($_GET[mod]))
{
echo'
<div class="menu">
<form action = "load.php?act=load&cat='.$id.'" method = "post" enctype = "multipart/form-data">
В категорию :<br/>
<select name="cat">';
$sef = mysql_query ("select * from `podcat` WHERE `cat`='$id' order by `id`");
while($ff = mysql_fetch_array ($sef))
{echo '
<option value="'.$ff['id'].'">'.$ff['name'].'</option></br/>';}
echo '</select></div>
<div class="menu">Название : <input name="name" type="text" size="30"><br>Файл : <input type = "file" name = "somename" /><br>..Или ссылка : <input name="import" type="text" size="30"><br>Описание : <input name="opis" type="text" size="30">
</select></div>
<div class="menu">Название : <input name="namea" type="text" size="30"><br><br>Файл : <input type = "file" name = "somenamea" /><br><br>..Или ссылка : <input name="importa" type="text" size="30"><br><br>Описание : <input name="opisa" type="text" size="30">
</select></div>
<div class="menu">Название : <input name="nameb" type="text" size="30"><br><br>Файл : <input type = "file" name = "somenameb" /><br><br>..Или ссылка : <input name="importb" type="text" size="30"><br><br>Описание : <input name="opisb" type="text" size="30">
</select></div>
<div class="menu">Название : <input name="namec" type="text" size="30"><br><br>Файл : <input type = "file" name = "somenamec" /><br><br>..Или ссылка : <input name="importc" type="text" size="30"><br><br>Описание : <input name="opisc" type="text" size="30">
</select></div>
<div class="menu">Название : <input name="named" type="text" size="30"><br><br>Файл : <input type = "file" name = "somenamed" /><br><br>..Или ссылка : <input name="importd" type="text" size="30"><br><br>Описание : <input name="opisd" type="text" size="30">
</select></div>
<div class="menu"><input type = "submit" value = "Загрузить файлы" />
</form></div> ';
}
if ($_GET[act]=='load')
{
$id = intval($_GET['cat']);
$rand=rand(01,99999999);
if(!empty($_POST['cat'])){$cat = protect($_POST['cat']);}
if(!empty($_POST['opis'])){$opis = protect($_POST['opis']);}
if(!empty($_POST['opisa'])){$opisa = protect($_POST['opisa']);}
if(!empty($_POST['opisb'])){$opisb = protect($_POST['opisb']);}
if(!empty($_POST['opisc'])){$opisc = protect($_POST['opisc']);}
if(!empty($_POST['opisd'])){$opisd = protect($_POST['opisd']);}
if(!empty($_POST['name'])){$name = protect($_POST['name']);}
if(!empty($_POST['namea'])){$namea = protect($_POST['namea']);}
if(!empty($_POST['nameb'])){$nameb = protect($_POST['nameb']);}
if(!empty($_POST['namec'])){$namec = protect($_POST['namec']);}
if(!empty($_POST['named'])){$named = protect($_POST['named']);}
if(!empty($_POST['import'])){$import = protect($_POST['import']);}
if(!empty($_POST['importa'])){$importa = protect($_POST['importa']);}
if(!empty($_POST['importb'])){$importb = protect($_POST['importb']);}
if(!empty($_POST['importc'])){$importc = protect($_POST['importc']);}
if(!empty($_POST['importd'])){$importd = protect($_POST['importd']);}
$blacklist = array(".php", ".phtml", ".php3", ".php4", ".html", ".htm");
$nam = $_FILES['somename']['name'];
$nama = $_FILES['somenamea']['name'];
$namb = $_FILES['somenameb']['name'];
$namc = $_FILES['somenamec']['name'];
$namd = $_FILES['somenamed']['name'];
foreach ($blacklist as $item)
if(preg_match("/$item$/i", $_FILES['somename']['name']=''.$_SERVER['HTTP_HOST'].'_'.$nam.'')) exit;
if(preg_match("/$item$/i", $_FILES['somenamea']['name']=''.$_SERVER['HTTP_HOST'].'_'.$nama.'')) exit;
if(preg_match("/$item$/i", $_FILES['somenameb']['name']=''.$_SERVER['HTTP_HOST'].'_'.$namb.'')) exit;
if(preg_match("/$item$/i", $_FILES['somenamec']['name']=''.$_SERVER['HTTP_HOST'].'_'.$namc.'')) exit;
if(preg_match("/$item$/i", $_FILES['somenamed']['name']=''.$_SERVER['HTTP_HOST'].'_'.$namd.'')) exit;
$avatar = $_FILES['somename']['name'];
$avatara = $_FILES['somenamea']['name'];
$avatarb = $_FILES['somenameb']['name'];
$avatarc = $_FILES['somenamec']['name'];
$avatard = $_FILES['somenamed']['name'];
$uploadfile = "files/".$_FILES['somename']['name'];
move_uploaded_file($_FILES['somename']['tmp_name'], $uploadfile);
$uploadfilea = "files/".$_FILES['somenamea']['name'];
move_uploaded_file($_FILES['somenamea']['tmp_name'], $uploadfilea);
$uploadfileb = "files/".$_FILES['somenameb']['name'];
move_uploaded_file($_FILES['somenameb']['tmp_name'], $uploadfileb);
$uploadfilec = "files/".$_FILES['somenamec']['name'];
move_uploaded_file($_FILES['somenamec']['tmp_name'], $uploadfilec);
$uploadfiled = "files/".$_FILES['somenamed']['name'];
move_uploaded_file($_FILES['somenamed']['tmp_name'], $uploadfiled);
$time = time();
if(isset($_POST['name']) and !empty($_POST['name'])){
if(!empty($_POST['import']) and !empty($_POST['import'])){mysql_query("INSERT INTO `files` SET `name`='$name',`cat`='$id',`podcat`='$cat', `time`='$time',`file`= '$import',`bitrate`='$opis',`duration`='1'");}else{
mysql_query("INSERT INTO `files` SET `name`='$name',`cat`='$id',`podcat`='$cat',`time`='$time',`file`= 'files/$avatar',`bitrate`='$opis',`duration`='0'");}}
if(isset($_POST['namea']) and !empty($_POST['namea'])){
if(!empty($_POST['importa']) and !empty($_POST['importa'])){mysql_query("INSERT INTO `files` SET `name`='$namea',`cat`='$id',`podcat`='$cat',`time`='$time',`file`= '$importa',`bitrate`='$opisa',`duration`='1'");}else{
mysql_query("INSERT INTO `files` SET `name`='$namea',`cat`='$id',`podcat`='$cat',`time`='$time',`file`= 'files/$avatara',`bitrate`='$opisa',`duration`='0'");}}
if(isset($_POST['nameb']) and !empty($_POST['nameb'])){
if(!empty($_POST['importb']) and !empty($_POST['importb'])){mysql_query("INSERT INTO `files` SET `name`='$nameb',`cat`='$id',`podcat`='$cat',`time`='$time',`file`= '$importb',`bitrate`='$opisb',`duration`='1'");}else{
mysql_query("INSERT INTO `files` SET `name`='$nameb',`cat`='$id',`podcat`='$cat',`time`='$time',`file`= 'files/$avatarb',`bitrate`='$opisb',`duration`='0'");}}
if(isset($_POST['namec']) and !empty($_POST['namec'])){
if(!empty($_POST['importc']) and !empty($_POST['importc'])){mysql_query("INSERT INTO `files` SET `name`='$namec',`cat`='$id',`podcat`='$cat',`time`='$time',`file`= '$importc',`bitrate`='$opisc',`duration`='1'");}else{
mysql_query("INSERT INTO `files` SET `name`='$namec',`cat`='$id',`podcat`='$cat',`time`='$time',`file`= 'files/$avatarc',`bitrate`='$opisc',`duration`='0'");}}
if(isset($_POST['named']) and !empty($_POST['named'])){
if(!empty($_POST['importd']) and !empty($_POST['importd'])){mysql_query("INSERT INTO `files` SET `name`='$named',`cat`='$id',`podcat`='$cat',`time`='$time',`file`= '$importd',`bitrate`='$opisd',`duration`='1'");}else{
mysql_query("INSERT INTO `files` SET `name`='$name',`cat`='$id',`podcat`='$cat',`time`='$time',`file`= 'files/$avatar',`bitrate`='$opisd',`duration`='0'");}}
echo'<div class="menu">Файлы добавлены<br/>
<a href="load.php">Добавить еще</a><br/><a href="/downloads">На главную</a></div>'; }}else{echo'<div class="menu">Вы не админ</div>';}
require_once '../system/foot.php';
?>