<?php


	header('Content-Type: text/plain; charset=utf-8');
	// Handles remote AJAX requests from the DevEdit client

	include_once(dirname(__FILE__).DIRECTORY_SEPARATOR."init.php");
	$objRemote = new Remote();

	if
	(
		(!isset($_SESSION["userdocroot"]))
		||
		($_SESSION["userdocroot"]=='')
	)
	{
		die('operation not permitted');
	}

	if($objRemote->_Validate())
	{
		$objRemote->DoIt();
	}
	else
	{
		die('not permitted');
	}


	// *****************************************************

	class Remote
	{
		var $_what;
		var $_hidden = Array();

		function Remote()
		{
			if(isset($_POST["w"]))
				$this->_what = strtolower($_POST["w"]);

			$this->_hidden = array();

		}

		function DoIt()
		{
			switch($this->_what)
			{
				case "getfilelist":
				{
					$this->GetFileList();
					break;
				}
				case "createnewfolder":
				{
					$this->CreateNewFolder();
					break;
				}
				case "renamefilefolder":
				{
					$this->RenameFileFolder();
					break;
				}
				case "deletefilefolder":
				{
					$this->DeleteFileFolder();
					break;
				}
			}
		}

		function GetFileList()
		{
			// Get a list of files and folders
			$path = $_POST["p"];
			$sel = isset($_POST["s"]) ? $_POST["s"] : '';
			$hidden = "";

			if(isset($_POST["t"]))
				$tab = $_POST["t"];
			else
				$tab = 0;

			if(isset($_POST["hidden"]))
				$hidden = unserialize(base64_decode($_POST["hidden"]));

			if(is_array($hidden))
				$this->_hidden = $hidden;

			$folders = array();
			$files = array();

			if($handle = @opendir($path))
			{
				while(false !== ($file = readdir($handle)))
				{
					if($file != "." && $file != "..")
					{
						if(is_dir($path . "/" . $file))
						{
							$folders[] = $file;
						}
						else
						{
							// What type of file is it?
							switch($tab)
							{
								case "0":
								{
									$arr = ValidExtensions("image");
									break;
								}
								case "1":
								{
									$arr = ValidExtensions("flash");
									break;
								}
								case "2":
								{
									$arr = ValidExtensions("media");
									break;
								}
								default:
								{
									// Link manager
									$arr = ValidExtensions();
									$files[] = $file;
								}
							}

							$tmp = explode(".", $file);
							$ext = strtolower($tmp[sizeof($tmp)-1]);
							$files[] = $file;
						}
					}
				}

				natcasesort($folders);
				natcasesort($files);

				$this->FilterHidden($folders);
				$this->FilterHidden($files);

				$return_contents = "";

				foreach($folders as $k => $f)
				{
					$return_contents .= addslashes($f) . "|folder,";
				}

				foreach($files as $k => $f)
				{
					// Flag the file as selected so that we can
					// give it a blue background in the file list
					if($f == $sel)
						$return_contents .= "@" . addslashes($f) . "|file,";
					else
						$return_contents .= addslashes($f) . "|file,";
				}

				echo $return_contents;

				@closedir($handle);
			}
		}

		function CreateNewFolder()
		{
			// Create a new folder
			global $php_errormsg;

			$nf = $this->_RealSafePath($_POST["p"] . "/" . $_POST["f"]);

			if ($nf === false)
			{
				die('operation not permitted');
			}

			if(@mkdir($nf, 0755))
			{
				@chmod($nf, 0755);
				echo "The folder '" . $_POST["f"] . "' has been created successfully!";
			}
			else
			{
				echo "An error occured while trying to create the folder '" . basename($nf) . "': " . $php_errormsg;
			}
		}

		/**
		* always enter the full path here.
		*/
		function _RealSafePath($path)
		{
			// first we get rid of the slashes for the quotes
			while ($path!=str_replace("\'","'",$path))
			{
				$path = str_replace("\'","'",$path);
			}

			// now we make it the real path
			$docroot = realpath($_SESSION["userdocroot"]);

			$allPaths = array('imgDir', 'flashDir', 'mediaDir', 'linkDir');
			$allPathsPossible = array();

			foreach($allPaths as $selPath)
			{
				if (!isset($_SESSION[$selPath]))
				{
					continue;
				}

				$analyze = realpath($docroot . '/' . $_SESSION[$selPath]);

				if
				(
					(strpos($path, $analyze) === false)
					||
					(strpos($path, $analyze) != 0)
				)
				{
					continue;
				}
				return $path;
			}
			return false;

		}

		function _Safe($Path)
		{
			$path = $Path;
			$path = eregi_replace("[.]+/", "", $path);
			return $path;
		}

		function _Validate()
		{
			// Make sure the calls are coming from DevEdit and not somewhere else
			$enc = md5(sprintf("%s|%s", date("mDmYY", time() - 10000), $_SERVER["HTTP_HOST"]));

return true; // stupid code
			if($enc == @$_POST["token"]){
				return true;
			}

			return false;

		}

		function RenameFileFolder()
		{
			// Rename the selected file/folder
			global $php_errormsg;

			$validExtensions = ValidExtensions();

			$of = $this->_RealSafePath($_POST["p"] . "/" . $_POST["o"]);
			$nf = $this->_RealSafePath($_POST["p"] . "/" . $_POST["f"]);

			if
			(
				($nf === false)
				||
				($of === false)
				||
				(dirname($nf)!=dirname($of))
			)
			{
				die('operation not permitted');
			}

			$newExtension = strtolower(array_pop(explode(".", $nf)));

			// If we are renaming a file, make sure the new extension is allowed
			if (is_file($of) && !in_array($newExtension, $validExtensions)) {
				$php_errormsg = "That extension is not allowed";
				echo "An error occured while trying to rename the file/folder '" . basename($of) . "': " . $php_errormsg;
				return false;
			}

			// Attempt to rename the file/folder
			if(@rename($of, $nf))
				echo "The file/folder '" . basename($of) . "' has been renamed to '" . basename($nf) . "' successfully!";
			else
				echo "An error occured while trying to rename the file/folder '". basename($of) . "': " . $php_errormsg;
		}

		function DeleteFileFolder()
		{
			// Delete the selected file/folder
			global $php_errormsg;

			$file = $this->_RealSafePath($_POST["p"] . "/" . $_POST["f"]);

			if ($file === false)
			{
				die('operation not permitted');
			}

			if(@is_dir($file))
			{
				// We need to recursively delete a folder
				if($this->RecursiveDelete($file, $err))
					echo "The folder '" . basename($file) . "' has been deleted successfully!";
				else
					echo "An error occured while trying to delete the folder '" . basename($file) . "': " . $err;
			}
			else
			{
				// It's a file, delete it
				if(@unlink($file))
					echo "The file '" . basename($file) . "' has been deleted successfully!";
				else
					echo "An error occured while trying to delete the file '" . basename($file) . "': " . $php_errormsg;
			}
		}

		function RecursiveDelete($directory, &$err)
		{
			global $php_errormsg;
			$empty = false;

			if(substr($directory, -1) == '/')
				$directory = substr($directory, 0, -1);

			if(!file_exists($directory) || !is_dir($directory))
			{
				$err = $php_errormsg;
				return false;
			}
			elseif(is_readable($directory))
			{
				$handle = @opendir($directory);

				while(false !== ($item = @readdir($handle)))
				{
					if($item != "." && $item != "..")
					{
						$path = $directory . "/" . $item;

						if(@is_dir($path))
						{
							$this->RecursiveDelete($path, $err);
						}
						else
						{
							if(!@unlink($path))
							{
								$err = $php_errormsg;
								return false;
							}
						}
					}
				}

				@closedir($handle);

				if($empty == false)
				{
					if(!@rmdir($directory))
					{
						$err = $php_errormsg;
						return false;
					}
				}
			}

			return true;
		}

		function FilterHidden(&$List)
		{
			foreach($this->_hidden as $pattern)
			{
				$pattern = preg_quote($pattern);
				$pattern = str_replace("*", "(.*)", $pattern);
				$pattern = str_replace("\\(", "(", $pattern);

				foreach($List as $k=>$item)
				{
					if(is_numeric(strpos($pattern, "*")))
					{
						if(eregi($pattern, $item))
							unset($List[$k]);
					}
					else
					{
						if(strtolower($pattern) == strtolower($item))
							unset($List[$k]);
					}
				}
			}
		}
	}
