global $config_title, $_, $MAX_IDLE_TIME, $LOGIN_ATTEMPTS, $LOGIN_DELAYED,

$MAIN_WIDTH, $WIDE_VIEW_WIDTH, $MAX_EDIT_SIZE, $MAX_VIEW_SIZE, $config_excluded,

$config_etypes, $config_stypes,$config_itypes, $config_ftypes, $config_fclass,

$SHOWALLFILES, $etypes, $itypes, $ftypes, $fclasses, $excluded_list,

$LANGUAGE_FILE, $ACCESS_ROOT, $ACCESS_ROOT_len, $WYSIWYG_PLUGIN, $WYSIWYG_VALID, $WYSIWYG_PLUGIN_OS,

$INVALID_CHARS, $WHSPC_SLASH, $VALID_PAGES, $LOGIN_LOG_url, $LOGIN_LOG_file,

$ONESCRIPT, $ONESCRIPT_file, $ONESCRIPT_backup, $ONESCRIPT_file_backup,

$CONFIG_backup, $CONFIG_FILE, $CONFIG_FILE_backup, $VALID_CONFIG_FILE,

$DOC_ROOT, $DOC_ROOT_OS, $WEB_ROOT, $WEBSITE, $PRE_ITERATIONS, $EX, $message, $ENC_OS,

$DELAY_Expired_Reload, $DELAY_Sort_and_Show_msgs, $DELAY_Start_Countdown, $DELAY_final_messages, $MIN_DIR_ITEMS;

//Requires PHP 5.1 or newer, due to changes in explode() (and maybe others).

define('PHP_VERSION_ID_REQUIRED',50100); //Ex: 5.1.23 is 50123

define('PHP_VERSION_REQUIRED' ,'5.1 + '); //Used in exit() message.

//The predefined constant PHP_VERSION_ID has only been available since 5.2.7.

//So, if needed, convert PHP_VERSION (a string) to PHP_VERSION_ID (an integer).

//Ex: 5.1.23 converts to 50123.

if (!defined('PHP_VERSION_ID')) {

$phpversion = explode('.', PHP_VERSION);

define('PHP_VERSION_ID', ($phpversion[0] * 10000 + $phpversion[1] * 100 + $phpversion[2]));

}

if( PHP_VERSION_ID < PHP_VERSION_ID_REQUIRED ) {

exit( 'PHP '.PHP_VERSION.'<br>'.hsc($_['OFCMS_requires']).' '.PHP_VERSION_REQUIRED );

}

mb_detect_order("UTF-8, ASCII, Windows-1252, ISO-8859-1");

//Get server's File System encoding. Windows NTFS uses ISO-8859-1 / Windows-1252.

//Needed when working with non-ascii filenames.

if (php_uname("s") == 'Windows NT') {$ENC_OS = 'Windows-1252';}

else {$ENC_OS = 'UTF-8';}

$DOC_ROOT = $_SERVER['DOCUMENT_ROOT'].'/'; //root folder of website.

$DOC_ROOT_OS = Convert_encoding($DOC_ROOT);

//Allow OneFileCMS.php to be started from any dir on the site.

//This also effects the path in an include("path/somefile.php")

chdir($DOC_ROOT);

$INVALID_CHARS = '< > ? * : " | / \\'; //Illegal characters for file & folder names. Space deliminated.

$WHSPC_SLASH = "\x00..\x20/"; //Whitespace & forward slash. For trimming file & folder name inputs.

$WEB_ROOT = basename($DOC_ROOT).'/'; //Used only for screen output - Non-url use.

$WEBSITE = $_SERVER['HTTP_HOST'].'/';

$ONESCRIPT = URLencode_path($_SERVER['SCRIPT_NAME']); //Used for URL's in HTML attributes

$ONESCRIPT_file = $_SERVER['SCRIPT_FILENAME']; //Non-url file system use.

$ONESCRIPT_backup = $ONESCRIPT.'-BACKUP.txt'; //used for p/w & u/n updates.

$ONESCRIPT_file_backup = $ONESCRIPT_file.'-BACKUP.txt'; //used for p/w & u/n updates.

$LOGIN_ATTEMPTS = $ONESCRIPT_file.'.invalid_login_attempts';//Non-url file system use.

$LOGIN_LOG_url = $ONESCRIPT.'-LOGIN.log';

$LOGIN_LOG_file = $ONESCRIPT_file.'-LOGIN.log';

//If specified & found, include $CONFIG_FILE.

$VALID_CONFIG_FILE = 0;

if (isset($CONFIG_FILE)) {

$CONFIG_FILE_OS = Convert_encoding($CONFIG_FILE);

if (is_file($CONFIG_FILE_OS)) {

$VALID_CONFIG_FILE = 1;

include($CONFIG_FILE_OS);

$CONFIG_backup = URLencode_path($CONFIG_FILE).'-BACKUP.txt'; //used for p/w & u/n updates.

$CONFIG_FILE_backup = $CONFIG_FILE.'-BACKUP.txt'; //used for p/w & u/n updates.

}

else {

$message .= $EX.'<b>$CONFIG_FILE '.hsc($_['Not_found']).':</b> '.$CONFIG_FILE.'<br>';

$CONFIG_FILE = $CONFIG_FILE_OS = '';

}

}

//If specified, check for & load $LANGUAGE_FILE

if (isset($LANGUAGE_FILE)) {

$LANGUAGE_FILE_OS = Convert_encoding($LANGUAGE_FILE);

if (is_file($LANGUAGE_FILE_OS)) {include($LANGUAGE_FILE_OS);}

}

//If specified, validate $WYSIWYG_PLUGIN. Actual include() is at end of OneFileCMS.

$WYSIWYG_VALID = 0; //Default to invalid.

if (isset($WYSIWYG_PLUGIN)) {

$WYSIWYG_PLUGIN_OS = Convert_encoding($WYSIWYG_PLUGIN); //Also used for include()

if (is_file($WYSIWYG_PLUGIN_OS)) { $WYSIWYG_VALID = 1; }

}

//If specified, clean up & validate $ACCESS_ROOT

if (!isset($ACCESS_ROOT)) { $ACCESS_ROOT = ''; } //At least make sure it's set.

$ACCESS_ROOT_OS = Convert_encoding($ACCESS_ROOT);

if (!is_dir($DOC_ROOT_OS.$ACCESS_ROOT_OS) || (Check_path($ACCESS_ROOT,1) === false) ) {

$message .= __LINE__.$EX.'<b>$ACCESS_ROOT '.hsc($_['Invalid_path']).': </b>'.$ACCESS_ROOT.'<br>';

$ACCESS_ROOT = $ACCESS_ROOT_OS = '';

}

if ($ACCESS_ROOT != '') {

$ACCESS_ROOT = trim($ACCESS_ROOT, ' /').'/'; //make sure only a single trailing '/'

$ACCESS_ROOT_OS = Convert_encoding($ACCESS_ROOT);

}

$ACCESS_ROOT_enc = mb_detect_encoding($ACCESS_ROOT);

$ACCESS_ROOT_len = mb_strlen($ACCESS_ROOT, $ACCESS_ROOT_enc);

$MAIN_WIDTH = validate_units($MAIN_WIDTH);

$WIDE_VIEW_WIDTH = validate_units($WIDE_VIEW_WIDTH);

ini_set('session.gc_maxlifetime', $MAX_IDLE_TIME + 100); //in case the default is less.

$VALID_PAGES = array("login","logout","admin","hash","changepw","changeun","index","edit","upload","uploaded","newfile","renamefile","copyfile","deletefile","deletefolder","newfolder","renamefolder","copyfolder","mcdaction", "phpinfo", "raw_view");

//Make arrays out of a few $config_variables for actual use later.

//First, remove spaces and make lowercase (for *types).

$SHOWALLFILES = $stypes = false;

if ($config_stypes == '*') { $SHOWALLFILES = true; }

else { $stypes = explode(',', mb_strtolower(str_replace(' ', '', $config_stypes))); }//shown file types

$etypes = explode(',', mb_strtolower(str_replace(' ', '', $config_etypes))); //editable file types

$itypes = explode(',', mb_strtolower(str_replace(' ', '', $config_itypes))); //images types to display

$ftypes = explode(',', mb_strtolower(str_replace(' ', '', $config_ftypes))); //file types with icons

$fclasses = explode(',', mb_strtolower(str_replace(' ', '', $config_fclass))); //for file types with icons

$excluded_list = explode(',', str_replace(' ', '', $config_excluded));

//A few variables for values that were otherwise hardcoded in js.

//$DELAY_... values are in milliseconds.

//The values were determined thru quick experimentation, and may be tweaked if desired, except as noted.

$DELAY_Sort_and_Show_msgs = 20; //Needed so "Working..." message shows during directory sorts. Mostly for Firefox.

$DELAY_Start_Countdown = 25; //Needs to be > than $Sort_and_Show_msgs. Used in Timeout_Timer().

$DELAY_final_messages = 25; //Needs to be > than $Sort_and_Show_msgs. Delays final Display_Messages().

$DELAY_Expired_Reload = 10000; //Delay from Session Expired to page load of login screen. Ten seconds, but can be less.

$MIN_DIR_ITEMS = 25; //Minimum number of directory items before "Working..." message is needed/displayed.

//Used in hashit() and js_hash_scripts(). IE<9 is WAY slow, so keep it low.

//For 200 iterations: (time on IE8) > (37 x time on FF). And the difference grows with the iterations.

//If you change this, or any other aspect of either hashit() or js_hash_scripts(), do so while logged in.

//Then, manually update your password as instructed on the Admin/Generate Hash page.

$PRE_ITERATIONS = 1000;

global $_;

// OneFileCMS Language Settings v3.5.17

$_['LANGUAGE'] = 'English';

$_['LANG'] = 'EN';

// If no translation or value is desired for a particular setting, do not delete

// the actual setting variable, just set it to an empty string.

// For example: $_['some_unused_setting'] = '';

//

// Remember to slash-escape any single quotes that may be within the text: \'

// The back-slash itself may or may not also need to be escaped: \\

//

// If present as a trailing comment, "## NT ##" means 'Need Translation'.

//

// These first few settings control a few font and layout settings.

// In some instances, some langauges may use significantly longer words or phrases than others.

// So, a smaller font or less spacing may be desirable in those places to preserve page layout.

$_['front_links_font_size'] = '1.0em'; //Buttons on Index page.

$_['front_links_margin_L'] = '1.0em';

$_['MCD_margin_R'] = '1.0em'; //[Move] [Copy] [Delete] buttons

$_['button_font_size'] = '0.9em'; //Buttons on Edit page.

$_['button_margin_L'] = '0.7em';

$_['button_padding'] = '4px 7px 4px 7px'; //T R B L

$_['image_info_font_size'] = '1em'; //show_img_msg_01 & _02

$_['image_info_pos'] = ''; //If 1 or true, moves the info down a line for more space.

$_['select_all_label_size'] = '.84em'; //Font size of $_['Select_All']

$_['select_all_label_width'] = '72px'; //Width of space for $_['Select_All']

$_['HTML'] = 'HTML';

$_['WYSIWYG'] = 'WYSIWYG';

$_['Admin'] = 'Admin';

$_['bytes'] = 'bytes';

$_['Cancel'] = 'Cancel';

$_['cancelled'] = 'cancelled'; //## NT ## as of 3.5.07

$_['Close'] = 'Close';

$_['Copy'] = 'Copy';

$_['Copied'] = 'Copied';

$_['Create'] = 'Create';

$_['Date'] = 'Date';

$_['Delete'] = 'Delete';

$_['DELETE'] = 'DELETE';

$_['Deleted'] = 'Deleted';

$_['Edit'] = 'Edit';

$_['Enter'] = 'Enter';

$_['Error'] = 'Error';

$_['errors'] = 'errors';

$_['ext'] = '.ext'; //## NT ## filename[.ext]ension

$_['File'] = 'File';

$_['files'] = 'files';

$_['Folder'] = 'Folder';

$_['folders'] = 'folders';

$_['From'] = 'From';

$_['Hash'] = 'Hash';

$_['Move'] = 'Move';

$_['Moved'] = 'Moved';

$_['Name'] = 'Name';

$_['on'] = 'on';

$_['Password'] = 'Password';

$_['Rename'] = 'Rename';

$_['reset'] = 'Reset';

$_['save_1'] = 'Save';

$_['save_2'] = 'SAVE CHANGES';

$_['Size'] = 'Size';

$_['Source'] = 'Source';

$_['successful'] = 'successful';

$_['To'] = 'To';

$_['Upload'] = 'Upload';

$_['Username'] = 'Username';

$_['View'] = 'View';

$_['Working'] = 'Working - please wait...';

$_['Log_In'] = 'Log In';

$_['Log_Out'] = 'Log Out';

$_['Admin_Options'] = 'Administration Options';

$_['Are_you_sure'] = 'Are you sure?';

$_['View_Raw'] = 'View Raw'; //## NT ### as of 3.5.07

$_['Open_View'] = 'Open/View in browser window';

$_['Edit_View'] = 'Edit / View';

$_['Wide_View'] = 'Wide View';

$_['Normal_View'] = 'Normal View';

$_['Upload_File'] = 'Upload File';

$_['New_File'] = 'New File';

$_['Ren_Move'] = 'Rename / Move';

$_['Ren_Moved'] = 'Renamed / Moved';

$_['folders_first'] = 'folders first'; //## NT ##

$_['folders_first_info'] = 'Sort folders first, but don\'t change primary sort.'; //## NT ##

$_['New_Folder'] = 'New Folder';

$_['Ren_Folder'] = 'Rename / Move Folder';

$_['Submit'] = 'Submit Request';

$_['Move_Files'] = 'Move File(s)';

$_['Copy_Files'] = 'Copy File(s)';

$_['Del_Files'] = 'Delete File(s)';

$_['Selected_Files'] = 'Selected Folders and Files';

$_['Select_All'] = 'Select All';

$_['Clear_All'] = 'Clear All';

$_['New_Location'] = 'New Location';

$_['No_files'] = 'No files selected.';

$_['Not_found'] = 'Not found';

$_['Invalid_path'] = 'Invalid path';

$_['verify_msg_01'] = 'Session expired.';

$_['verify_msg_02'] = 'INVALID POST';

$_['get_get_msg_01'] = 'File does not exist:';

$_['get_get_msg_02'] = 'Invalid page request:';

$_['check_path_msg_02'] = '"dot" or "dot dot" path segments are not permitted.';

$_['check_path_msg_03'] = 'Path or filename contains an invalid character:';

$_['ord_msg_01'] = 'A file with that name already exists in the target directory.';

$_['ord_msg_02'] = 'Saving as';

$_['rCopy_msg_01'] = 'A folder can not be copied into one of its own sub-folders.';

$_['show_img_msg_01'] = 'Image shown at ~';

$_['show_img_msg_02'] = '% of full size (W x H =';

$_['hash_txt_01'] = 'The hashes generated by this page may be used to manually update $HASHWORD in OneFileCMS, or in an external config file. In either case, make sure you remember the password used to generate the hash!';

$_['hash_txt_06'] = 'Type your desired password in the input field above and hit Enter.';

$_['hash_txt_07'] = 'The hash will be displayed in a yellow message box above that.';

$_['hash_txt_08'] = 'Copy and paste the new hash to the $HASHWORD variable in the config section.';

$_['hash_txt_09'] = 'Make sure to copy ALL of, and ONLY, the hash (no leading or trailing spaces etc).';

$_['hash_txt_10'] = 'A double-click should select it...';

$_['hash_txt_12'] = 'When ready, logout and login.';

$_['pass_to_hash'] = 'Password to hash:';

$_['Generate_Hash'] = 'Generate Hash';

$_['login_txt_01'] = 'Username:';

$_['login_txt_02'] = 'Password:';

$_['login_msg_01a'] = 'There have been';

$_['login_msg_01b'] = 'invalid login attempts.';

$_['login_msg_02a'] = 'Please wait';

$_['login_msg_02b'] = 'seconds to try again.';

$_['login_msg_03'] = 'INVALID LOGIN ATTEMPT #';

$_['edit_note_00'] = 'NOTES:';

$_['edit_note_01a'] = 'Remember- ';

$_['edit_note_01b'] = 'is';

$_['edit_note_02'] = 'So save changes before the clock runs out, or the changes will be lost!';

$_['edit_note_03'] = 'With some browsers, such as Chrome, if you click the browser [Back] then browser [Forward], the file state may not be accurate. To correct, click the browser\'s [Reload].';

$_['edit_h2_1'] = 'Viewing:';

$_['edit_h2_2'] = 'Editing:';

$_['edit_txt_00'] = 'Edit disabled.'; //## NT ## as of 3.5.07

$_['edit_txt_01'] = 'Non-text or unkown file type. Edit disabled.';

$_['edit_txt_02'] = 'File possibly contains an invalid character. Edit and view disabled.';

$_['edit_txt_03'] = 'htmlspecialchars() returned an empty string from what may be an otherwise valid file.';

$_['edit_txt_04'] = 'This behavior can be inconsistant from version to version of php.';

$_['too_large_to_edit_01'] = 'Edit disabled. Filesize >';

$_['too_large_to_edit_02'] = 'Some browsers (ie: IE) bog down or become unstable while editing a large file in an HTML <textarea>.';

$_['too_large_to_edit_03'] = 'Adjust $MAX_EDIT_SIZE in the configuration section of OneFileCMS as needed.';

$_['too_large_to_edit_04'] = 'A simple trial and error test can determine a practical limit for a given browser/computer.';

$_['too_large_to_view_01'] = 'View disabled. Filesize >';

$_['too_large_to_view_02'] = 'Click [View Raw] to view the raw/"plain text" file contents in a seperate browser window.'; //** NT ** changed wording as of 3.5.07

$_['too_large_to_view_03'] = 'Adjust $MAX_VIEW_SIZE in the configuration section of OneFileCMS as needed.';

$_['too_large_to_view_04'] = '(The default value for $MAX_VIEW_SIZE is completely arbitrary, and may be adjusted as desired.)';

$_['meta_txt_01'] = 'Filesize:';

$_['meta_txt_03'] = 'Updated:';

$_['edit_msg_01'] = 'File saved:';

$_['edit_msg_02'] = 'bytes written.';

$_['edit_msg_03'] = 'There was an error saving file.';

$_['upload_txt_03'] = 'Maximum size of each file:';

$_['upload_txt_01'] = '(php.ini: upload_max_filesize)';

$_['upload_txt_04'] = 'Maximum total upload size:';

$_['upload_txt_02'] = '(php.ini: post_max_size)';

$_['upload_txt_05'] = 'For uploaded files that already exist: ';

$_['upload_txt_06'] = 'Rename (to filename.ext.001 etc...)';

$_['upload_txt_07'] = 'Overwrite';

$_['upload_err_01'] = 'Error 1: File too large. From php.ini:';

$_['upload_err_02'] = 'Error 2: File too large. (Exceeds MAX_FILE_SIZE HTML form element)';

$_['upload_err_03'] = 'Error 3: The uploaded file was only partially uploaded.';

$_['upload_err_04'] = 'Error 4: No file was uploaded.';

$_['upload_err_05'] = 'Error 5:';

$_['upload_err_06'] = 'Error 6: Missing a temporary folder.';

$_['upload_err_07'] = 'Error 7: Failed to write file to disk.';

$_['upload_err_08'] = 'Error 8: A PHP extension stopped the file upload.';

$_['upload_error_01a'] = 'Upload Error. Total POST data (mostly filesize) exceeded post_max_size =';

$_['upload_error_01b'] = '(from php.ini)';

$_['upload_msg_02'] = 'Destination folder invalid:';

$_['upload_msg_03'] = 'Upload cancelled.';

$_['upload_msg_04'] = 'Uploading:';

$_['upload_msg_05'] = 'Upload successful!';

$_['upload_msg_06'] = 'Upload failed:';

$_['upload_msg_07'] = 'A pre-existing file was overwritten.';

$_['new_file_txt_01'] = 'File or Folder will be created in the current folder.';

$_['new_file_txt_02'] = 'Some invalid characters are:';

$_['new_file_msg_01'] = 'File or folder not created:';

$_['new_file_msg_02'] = 'Name contains an invalid character:';

$_['new_file_msg_04'] = 'File or folder already exists:';

$_['new_file_msg_05'] = 'Created file:';

$_['new_file_msg_07'] = 'Created folder:';

$_['CRM_txt_02'] = 'The new location must already exist.';

$_['CRM_txt_04'] = 'New Name';

$_['CRM_msg_01'] = 'Error - new parent location does not exist:';

$_['CRM_msg_02'] = 'Error - source file does not exist:';

$_['CRM_msg_03'] = 'Error - new file or folder already exists:';

$_['CRM_msg_05'] = 'Error during';

$_['delete_msg_03'] = 'Delete error:';

$_['session_warning'] = 'Warning: Session timeout soon!';

$_['session_expired'] = 'SESSION EXPIRED';

$_['unload_unsaved'] = ' Unsaved changes will be lost!';

$_['confirm_reset'] = 'Reset file and loose unsaved changes?';

$_['OFCMS_requires'] = 'OneFileCMS requires PHP';

$_['logout_msg'] = 'You have successfully logged out.';

$_['edit_caution_01'] = 'CAUTION'; //##### No longer used as of 3.5.07

$_['edit_caution_02'] = 'You are viewing the active copy of OneFileCM.'; //## NT ## changed wording 3.5.07

$_['time_out_txt'] = 'Session time out in:';

$_['error_reporting_01'] = 'Display errors is';

$_['error_reporting_02'] = 'Log errors is';

$_['error_reporting_03'] = 'Error reporting is set to';

$_['error_reporting_04'] = 'Showing error types';

$_['error_reporting_05'] = 'Unexpected early output';

$_['error_reporting_06'] = '(nothing, not even white-space, should have been output yet)';

$_['admin_txt_00'] = 'Old Backup Found';

$_['admin_txt_01'] = 'A backup file was created in case of an error during a username or password change. Therefore, it may contain old information and should be deleted if not needed. In any case, it will be automatically overwritten on the next password or username change.';

$_['admin_txt_02'] = 'General Information';

$_['admin_txt_14'] = 'For a small improvement to security, change the default salt and/or method used by OneFileCMS to hash the password (and keep them secret, of course). Every little bit helps...';

$_['admin_txt_16'] = 'OneFileCMS can not be used to edit itself directly. However, you can make a copy & edit it. Then simply run the copy.'; //## NT ## Changed wording in 3.5.07

$_['pw_current'] = 'Current Password';

$_['pw_change'] = 'Change Password';

$_['pw_new'] = 'New Password';

$_['pw_confirm'] = 'Confirm New Password';

$_['un_change'] = 'Change Username';

$_['un_new'] = 'New Username';

$_['un_confirm'] = 'Confirm New Username';

$_['pw_txt_02'] = 'Password / Username rules:';

$_['pw_txt_04'] = 'Case-sensitive: "A" =/= "a"';

$_['pw_txt_06'] = 'Must contain at least one non-space character.';

$_['pw_txt_08'] = 'May contain spaces in the middle. Ex: "This is a password or username!"';

$_['pw_txt_10'] = 'Leading and trailing spaces are ignored.';

$_['pw_txt_12'] = 'In recording the change, only one file is updated: either the active copy of OneFileCMS, or - if specified, an external configuration file.';

$_['pw_txt_14'] = 'If an incorrect current password is entered, you will be logged out, but you may log back in.';

$_['change_pw_01'] = 'Password changed!';

$_['change_pw_02'] = 'Password NOT changed.';

$_['change_pw_03'] = 'Incorrect current password. Login to try again.';

$_['change_pw_04'] = '"New" and "Confirm New" values do not match.';

$_['change_pw_05'] = 'Updating';

$_['change_pw_06'] = 'external config file';

$_['change_pw_07'] = 'All fields are required.';

$_['change_un_01'] = 'Username changed!';

$_['change_un_02'] = 'Username NOT changed.';

$_['update_failed'] = 'Update failed - could not save file.';

$_['mcd_msg_01'] = 'file(s) and/or folder(s) moved.'; //#####

$_['mcd_msg_02'] = 'file(s) and/or folder(s) copied.'; //#####

$_['mcd_msg_03'] = 'file(s) and/or folder(s) deleted.'; //#####

//Determine if valid units are set for $cssvalue: px, pt, em, or %.

$main_units = mb_substr($cssvalue, -2);

if ( ($main_units != "px") && ($main_units != "pt") && ($main_units != "em") && (mb_substr($cssvalue, -1) != '%')) {

$cssvalue = ($cssvalue * 1).'px'; //If not, assume px.

}

return $cssvalue;

$enc = mb_detect_encoding($input); //It should always be UTF-8 (or ASCII), but, just in case...

if ($enc == 'ASCII') {$enc = 'UTF-8';} //htmlspecialchars() doesn't recognize "ASCII"

return htmlspecialchars($input, ENT_QUOTES, $enc);

global $ENC_OS;

//mb_convert_encoding($string, $to_enc, $from_enc)

if ($to_enc == 'UTF-8') {return mb_convert_encoding($string, 'UTF-8', $ENC_OS);} // Convert to UTF-8

else /* default */ {return mb_convert_encoding($string, $ENC_OS, 'UTF-8');} // Convert to server's/OS's filesystem enc

global $SESSION_NAME, $page, $VALID_POST;

$limit = 0; //0 = session.

$path = '';

$domain = ''; // '' = hostname

$https = false;

$httponly = true; //true = unaccessable via javascript. Some XSS protection.

session_set_cookie_params($limit, $path, $domain, $https, $httponly);

session_name($SESSION_NAME);

session_start();

//Set initial defaults...

$page = 'login';

$VALID_POST = 0;

if ( !isset($_SESSION['valid']) ) { $_SESSION['valid'] = 0; }

//Logging in?

if ( isset($_POST['username']) && isset($_POST['password']) ) { Login_response(); }

session_regenerate_id(true); //Helps prevent session fixation & hijacking.

if ( $_SESSION['valid'] ) { Verify_IDLE_POST_etc(); }

$_SESSION['nuonce'] = sha1(mt_rand().microtime()); //provided in <forms> to verify POST

global $_, $page, $EX, $message, $VALID_POST, $MAX_IDLE_TIME;

//Verify consistant user agent. This is set during login. (every little bit helps every little bit)

if ( !isset($_SESSION['user_agent']) || ($_SESSION['user_agent'] != $_SERVER['HTTP_USER_AGENT']) ) { Logout(); }

//Check idle time

if ( isset($_SESSION['last_active_time']) ) {

$idle_time = ( time() - $_SESSION['last_active_time'] );

if ( $idle_time > $MAX_IDLE_TIME ) {

Logout();

$message .= hsc($_['verify_msg_01']).'<br>';

return;

}

}

$_SESSION['last_active_time'] = time();

//If POSTing, verify...

if ( isset($_POST['nuonce']) ) {

if ( $_POST['nuonce'] == $_SESSION['nuonce'] ) {

$VALID_POST = 1;

}else{ //If it exists but doesn't match - something's wrong. Probably a page reload.

$page = "index";

$_POST = "";

$message .= $EX.'<b>'.hsc($_['verify_msg_02']).'</b><br>';

}

}

//This is the super-secret stuff - Keep it secret, keep it safe!

//If you change anything here, or the $SALT, manually update the hash for your password from the Generate Hash page.

global $SALT, $PRE_ITERATIONS;

$hash = trim($key); // trim off leading & trailing whitespace.

//If generating a hash from the Hash_Page(), also do the "pre-hash". Generally,

//the "pre-hash" is done client-side during a login attempt, or when changing p/w or u/n.

if ($pre) { for ( $x=0; $x < $PRE_ITERATIONS; $x++ ) {$hash = hash('sha256', $hash.$SALT);} }

for ( $x=0; $x < 10001; $x++ ) { $hash = hash('sha256', $hash.$SALT); }

return $hash;

//Display the status of error_reporting(), and ini_get() of display_errors & log_errors.

//Also displays any early output caught by ob_start().

global $_, $early_output;

$E_level = error_reporting();

$E_types = '';

$spc = ' &nbsp; '; // or '<br>' or PHP_EOL or whatever...

if ( $E_level & 1 ) { $E_types .= 'E_ERROR' .$spc; }

if ( $E_level & 2 ) { $E_types .= 'E_WARNING' .$spc; }

if ( $E_level & 4 ) { $E_types .= 'E_PARSE' .$spc; }

if ( $E_level & 8 ) { $E_types .= 'E_NOTICE' .$spc; }

if ( $E_level & 16 ) { $E_types .= 'E_CORE_ERROR' .$spc; }

if ( $E_level & 32 ) { $E_types .= 'E_CORE_WARNING' .$spc; }

if ( $E_level & 64 ) { $E_types .= 'E_COMPILE_ERROR' .$spc; }

if ( $E_level & 128 ) { $E_types .= 'E_COMPILE_WARNING' .$spc; }

if ( $E_level & 256 ) { $E_types .= 'E_USER_ERROR' .$spc; }

if ( $E_level & 512 ) { $E_types .= 'E_USER_WARNING' .$spc; }

if ( $E_level & 1024 ) { $E_types .= 'E_USER_NOTICE' .$spc; }

if ( $E_level & 2048 ) { $E_types .= 'E_STRICT' .$spc; }

if ( $E_level & 4096 ) { $E_types .= 'E_RECOVERABLE_ERROR'.$spc; }

if ( $E_level & 8192 ) { $E_types .= 'E_DEPRECATED' .$spc; }

if ( $E_level & 16384 ) { $E_types .= 'E_USER_DEPRECATED' .$spc; }

if ( $show_status && ( (error_reporting() != 0) ||

(ini_get('display_errors') == 'on') ||

(ini_get('log_errors') == 'on') ) )

{

?> <style>

.E_box {margin: 0; background-color: #F00; font-size: 1em; color: white;

padding: 2px 5px 2px 5px; border: 1px solid white; }

</style>

<?php

echo '<p class="E_box"><b>PHP '.PHP_VERSION.$spc;

echo hsc($_['error_reporting_01']).': '.ini_get('display_errors').'.'.$spc;

echo hsc($_['error_reporting_02']).': '.ini_get('log_errors') .'.'.$spc;

echo hsc($_['error_reporting_03']).': '.error_reporting() .'.'.$spc;

echo 'E_ALL = '.E_ALL.$spc.'</b>';

if ($show_types) {

echo '<br><b>'.hsc($_['error_reporting_04']).': </b>';

echo '<span style="font: 400 .8em arial">'.$E_types.'</span>';

}

echo '</p>';

}//end if (error reporting on)

//$early_output is contents of ob_get_clean(), just before page output.

if (mb_strlen($early_output) > 0 ) {

echo '<pre style="background-color: #F00; border: 0px solid #F00;"><b>';

echo hsc($_['error_reporting_05']).'</b> ';

echo hsc($_['error_reporting_06']).'<b>:</b> ';

echo '<span style="background-color: white; border: 1px solid white">';

echo hsc($early_output).'</span></pre>';

}

global $page;

if (!isset($_SESSION['recent_pages'])) { $_SESSION['recent_pages'] = array($page); }

$pages = count($_SESSION['recent_pages']);

//Only update if actually a new page

if ( $page != $_SESSION['recent_pages'][0] ) {

array_unshift($_SESSION['recent_pages'], $page);

$pages = count($_SESSION['recent_pages']);

}

//Only need 3 most recent pages (increase if needed)

if ($pages > 3) { array_pop($_SESSION['recent_pages']); }

function strip_array($var) {

//stripslashes() also handles cases when magic_quotes_sybase is on.

if (is_array($var)) {return array_map("strip_array", $var); }

else {return stripslashes($var); }

}//end strip_array()

if (get_magic_quotes_gpc()) {

if (isset($_GET)) { $_GET = strip_array($_GET); }

if (isset($_POST)) { $_POST = strip_array($_POST); }

if (isset($_COOKIE)) { $_COOKIE = strip_array($_COOKIE); }

}

global $_, $ipath, $filename, $page, $param1, $param2, $param3, $IS_OFCMS, $EX, $message;

//Pages that require a valid $filename

$file_pages = array("edit", "renamefile", "copyfile", "deletefile");

//Make sure $filename & $page go together

if ( ($filename != "") && !in_array($page, $file_pages) ) { $filename = ""; }

if ( ($filename == "") && in_array($page, $file_pages) ) { $page = "index"; }

//Init $param's used in <a> href's & <form> actions

$param1 = '?i='.URLencode_path($ipath); //$param1 must not be blank.

if ($filename == "") { $param2 = ""; } else { $param2 = '&amp;f='.rawurlencode(basename($filename)); }

if ($page == "" ) { $param3 = ""; } else { $param3 = '&amp;p='.$page; }

//Used to restrict edit/del/etc. on active copy of OneFileCMS.

$IS_OFCMS = 0;

if ($filename == trim($_SERVER['SCRIPT_NAME'], '/')) { $IS_OFCMS = true; }

//$gotoroot: if true, return to index page of $ACCESS_ROOT.

global $ipath, $ipath_OS, $filename, $param1, $param2, $param3, $ACCESS_ROOT, $ACCESS_ROOT_len, $message;

//Limit access to the folder $ACCESS_ROOT:

//$ACCESS_ROOT = some/root/path/

//$path = some/root/path/...(or deeper) : good

//$path = some/root/ : bad

//$path = some/other/path/ : bad

$path_len = mb_strlen($path);

$path_root = mb_substr($path, 0, $ACCESS_ROOT_len);

$good_path = false;

if (isset($_SESSION['admin_page']) && $_SESSION['admin_page']) {

//Permit Admin actions: changing p/w, u/n, viewing OneFile...

$ACCESS_ROOT == '';

return true;

}

elseif ( $path_len < $ACCESS_ROOT_len ) { $good_path = false; }

else { $good_path = ($path_root == $ACCESS_ROOT); }

if (!$good_path && $gotoroot) {

$ipath = $ACCESS_ROOT;

$ipath_OS = Convert_encoding($ipath);

$filename = '';

//$page = 'index'; //#### If set to index here, can't logout.

$param1 = '?i='.$ipath;

$param2 = '';

$param3 = '';

$_GET = '';

$_POST = '';

}

return $good_path;

global $_, $ipath, $ipath_OS, $filename, $filename_OS, $page, $VALID_PAGES, $EX, $message;

// i=some/path/, f=somefile.xyz, p=somepage, m=somemessage

// $ipath = i , $filename = $ipath.f , $page = p , $message

// (NOTE: in some functions $filename = just the file's name, ie: $_GET['f'], with no path/)

//##### (Normalize $filename program-wide??)

// Perform initial, basic, validation.

// Get_GET() should not be called unless $_SESSION['valid'] == 1 (or true)

//Initialize & validate $ipath

$ipath = $ipath_OS = "";

if (isset($_GET["i"])) {

$ipath = Check_path($_GET["i"],1);

$ipath_OS = Convert_encoding($ipath);

if ( $ipath === false || !is_dir($ipath_OS)) { $ipath = $ipath_OS = ''; }

}

//Initialize & validate $filename

if (isset($_GET["f"])) { $filename = $ipath.$_GET["f"]; } else { $filename = ""; }

$filename_OS = Convert_encoding($filename);

if ( ($filename != "") && !is_file($filename_OS) ) {

$message .= $EX.'<b>'.hsc($_['get_get_msg_01']).'</b> ';

$message .= hsc(dir_name($filename)).'<b>'.hsc(basename($filename)).'</b><br>';

$filename = $filename_OS = "";

}

//Initialize & validate $page

if (isset($_GET["p"])) { $page = $_GET["p"]; } else { $page = "index"; }

if (!in_array($page, $VALID_PAGES)) {

$message .= $EX.hsc($_['get_get_msg_02']).' <b>'.hsc($page).'</b><br>';

$page = "index"; //If invalid $_GET["p"]

}

//Sanitize any message. Initialized on line 1 / top of this file.

if (isset($_GET["m"])) { $message .= hsc($_GET["m"]); }

global $_, $ONESCRIPT_file, $ipath, $ipath_OS, $param1, $filename, $filename_OS, $page, $EX, $message,

$VALID_POST, $IS_OFCMS;

//If exited admin pages, restore $ipath

if ( ($page == "index") && $_SESSION['admin_page'] ) {

//...unless clicked www/some/path/ from edit or copy page while in admin pages.

if ( ($_SESSION['recent_pages'][0] != 'edit') && ($_SESSION['recent_pages'][0] != 'copyfile') ){

$ipath = $_SESSION['admin_ipath'];

$param1 = '?i='.URLencode_path($ipath);

}

$_SESSION['admin_page'] = false;

$_SESSION['admin_ipath'] = '';

}

//Don't load login screen when already in a valid session.

//$_SESSION['valid'] may be false after Respond_to_POST()

elseif ( ($page == "login") && $_SESSION['valid'] ) { $page = "index"; }

elseif ( $page == "logout" ) {

Logout();

$message .= hsc($_['logout_msg']);

}

//Don't load rename or delete folder pages at webroot.

elseif ( ($page == "deletefolder" || $page == "renamefolder") && ($ipath == "") ) {

$page = "index";

}

//Prep MCD_Page() to delete a single folder selected via (x) icon on index page.

elseif ($page == "deletefolder") {

$_POST['files'][1] = basename($ipath); //Must precede next line (change of $ipath).

$ipath = dir_name($ipath);

$ipath_OS = Convert_encoding($ipath);

$param1 = '?i='.$ipath;

}

//There must be at least one 'file', and 'mcdaction' must = "move", "copy", or "delete"

elseif ($page == "mcdaction") {

if (!isset($_POST['mcdaction'] )) { $page = "index"; }

elseif (!isset($_POST['files']) ) { $page = "index"; }

elseif ( ($_POST['mcdaction'] != "move") && ($_POST['mcdaction'] != "copy") && ($_POST['mcdaction'] != "delete") ) {

$page = "index";

}

}

//if size of $_POST > post_max_size, PHP only returns empty $_POST & $_FILE arrays.

elseif ( ($page == "uploaded") && !$VALID_POST ) {

$message .= $EX.'<b> '.hsc($_['upload_error_01a']).' '.ini_get('post_max_size').'</b> '.hsc($_['upload_error_01b']).'<br>';

$page = "index";

}

//[View Raw] file contents in a browser window (in plain text, NOT HTML).

if ($page == "raw_view"){

$raw_contents = file_get_contents($filename_OS);

$file_ENC = mb_detect_encoding($raw_contents); //ASCII, UTF-8, etc...

header('Content-type: text/plain; charset=utf-8');

echo mb_convert_encoding($raw_contents, 'UTF-8', $file_ENC);

die;

}

global $INVALID_CHARS;

$INVALID_CHARS_array = explode(' ', $INVALID_CHARS);

foreach ($INVALID_CHARS_array as $bad_char) {

if (mb_strpos($string, $bad_char) !== false) { return true; }

}

return false;

$path = str_replace('\\','/',$path); //Make sure all forward slashes.

$TS = ''; // Trailing Slash/

if (mb_substr($path, -1) == '/' ) { $TS = '/'; } //start with a $TS?

$path_array = explode('/',$path);

$path = "";

foreach ($path_array as $level) { $path .= rawurlencode($level).'/'; }

$path = rtrim($path,'/').$TS; //end with $TS only if started with one

return $path;

//Modified dirname().

$parent = dirname($path);

if ($parent == "." || $parent == "/" || $parent == '\\' || $parent == "") { return ""; }

else { return $parent.'/'; }

// check for invalid characters & "dot" or "dot dot" path segments.

// Does NOT check if exists - only if of valid construction.

global $_, $message, $EX, $INVALID_CHARS, $WHSPC_SLASH;

$path = str_replace('\\','/',$path); //Make sure all forward slashes.

$path = trim($path, $WHSPC_SLASH); // trim whitespace & slashes

if ( ($path == "") || ($path == ".") ){ return ""; } // At root.

$err_msg = "";

$errors = 0;

$pathparts = explode( '/', $path);

foreach ($pathparts as $part) {

//Check for any '.' and '..' parts of the path to protect directories outside webroot.

//They also cause issues in <h2>www / current / path /</h2>

if ( ($part == '.') || ($part == '..') ) {

$err_msg .= $EX.' <b>'.hsc($_['check_path_msg_02']).'</b><br>';

$errors++;

break;

}

//Check for invalid characters

$invalid_chars = str_replace(' /','',$INVALID_CHARS); //The forward slash is not present, or invalid, at this point.

if ( has_invalid_char($part) ) {

$err_msg .= $EX.' <b>'.hsc($_['check_path_msg_03']).' &nbsp; <span class="mono"> '.$invalid_chars.'</span></b><br>';

$errors++;

break;

}

}

if ($errors > 0) {

if ($show_msg) { $message .= $err_msg; }

return false;