WebSVN - taios - Path Comparison - / Rev 264 and / Rev 522

Ignore whitespace Rev 264 → Rev 522

 /_taios.php
 ,537 → 1,643
-<?php
-require '_config.php';
-class Taios_Page
-{
-    function __construct($title, $url = "")
-    {
-        $this->title = $title;
-        $this->url = $url;
-        $this->drawnHeader = false;
-        $this->drawnMiddle = false;
-        $this->drawnFooter = false;
-        $this->db = mysql_connect(MYSQL_HOST, MYSQL_USER, MYSQL_PASSWORD);
-        if (!$this->db)
-        {
-            $this->drawError('Failed to connect to database: ' . mysql_error());
-        }
-        if (!mysql_select_db('Tim32'))
-        {
-            $this->drawError('Failed to select database: ' . mysql_error());
-        }
-    }
-    function drawHeader()
-    {
-        if (!$this->drawnHeader)
-        {
-            write('<!DOCTYPE html>');
-            write('<html>');
-            write('<head>');
-            write('<meta http-equiv="Content-Type" content="text/html;charset=utf-8">');
-            write('<title>Tim32 &middot; ' . $this->title . '</title>');
-            write('<link href="' . $this->url . 'styles.css" rel="stylesheet" type="text/css" media="screen">');
-            write('</head>');
-            write('<body>');
-            write('<div class="sidebar">');
-            write('<div class="sidebar-header">');
-            write('<h1>Tim32</h1>');
-            write('</div>');
-            write('<div class="sidebar-menu">');
-            $this->drawMenuItem('Home', 'index.php');
-            $this->drawMenuItem('Blog', 'blog/');
-            $this->drawMenuItem('Projects', 'projects/');
-            $this->drawMenuItem('Forums', 'forums/');
-            $this->drawMenuItem('Wiki', 'wiki/');
-            $this->drawMenuItem('Photos', 'photos/');
-            write('<br />');
-            if ($this->isLoggedIn())
-            {
-                $this->drawMenuItem('Administration', 'admin/');
-                $this->drawMenuItem('Logout', 'logout-do.php');
-            }
-            else
-            {
-                $this->drawMenuItem('Login', 'login.php');
-                $this->drawMenuItem('Register', 'register.php');
-            }
-            write('<br />');
-            $this->drawnHeader = true;
-        }
-    }
-    function drawMenuItem($t, $u)
-    {
-        write('<p><a href="' . $this->url . $u . '">' . $t . '</a></p>');
-    }
-    function drawMiddle()
-    {
-        if (!$this->drawnMiddle)
-        {
-            write('<br />');
-            write('</div>');
-            write('</div>');
-            write('<div class="content">');
-            write('<h2>' . $this->title . '</h2>');
-            $this->drawnMiddle = true;
-        }
-    }
-    function drawFooter()
-    {
-        if (!$this->drawnFooter)
-        {
-            write('</div>');
-            write('</body>');
-            write('</html>');
-            $this->drawnFooter = true;
-        }
-        die();
-    }
-    function drawError($text, $die = true)
-    {
-        $this->drawHeader();
-        $this->drawMiddle();
-        write('<h4 style="color: red;">Error: ' . $text . '</h4>');
-        if ($die)
-        {
-            $this->drawFooter();
-            die();
-        }
-    }
-    function drawBlogPostTree($id, $first = false)
-    {
-        $post = $this->getBlogPost($id);
-        if ($first)
-        {
-            write('<h3><a href="post.php?id=' . $id . '">' . $post->title. '</a> <a href="post.php?id=' . $post->parent->ID . '">^</a></h3>');
-        }
-        else
-        {
-            write('<a href="post.php?id=' . $id . '"><h3>' . $post->title. '</h3></a>');
-        }
-        write('<h5 style="color: #666666;">Posted On ' . date('l j F Y', $post->datePosted) . ' by ' . $post->user->name . ' (' . $post->user->username . ')</h5>');
-        write('<p>' . $this->replaceBBCode($post->content) . '</p>');
-        write('<br />');
-        if ($this->isUserNormal($this->getLoggedInUser()))
-        {
-            echo '<p class="bold"><a href="add-post.php?id=' . $id . '">Add Comment</a>';
-            if ($this->isUserAdmin($this->getLoggedInUser()) || $this->getLoggedInUser()->ID == $post->author->ID)
-            {
-                echo ' &middot <a href="edit-post.php?id=' . $id . '">Edit Post</a>';
-                echo ' &nbsp;&nbsp; &middot &nbsp;&nbsp; <a href="del-post.php?id=' . $id . '">Delete Post</a>';
-            }
-            write('</p><br />');
-        }
-        $ids = $this->findIDs('BlogPosts', 'WHERE ParentID=' . $id);
-        for ($i = 0; $i < count($ids); $i++)
-        {
-            write('<div class="indent">');
-            $this->drawBlogPostTree($ids[$i]);
-            write('</div>');
-        }
-    }
-    function drawBlogCategoriesMenu()
-    {
-        $cats = array();
-        $ids = $this->findIDs('BlogPosts', 'WHERE ParentID = -1');
-        for ($i = 0; $i < count($ids); $i++)
-        {
-            $cat = $this->getBlogPost($ids[$i])->category;
-            if (!in_array($cat, $cats))
-            {
-                array_push($cats, $cat);
-            }
-        }
-        write('<h3>Categories</h3>');
-        for ($i = 0; $i < count($cats); $i++)
-        {
-            $this->drawMenuItem($cats[$i], 'blog/index.php?cat=' . $cats[$i]);
-        }
-    }
-    function replaceBBCode($str)
-    {
-        $newstr = str_replace("\n", '</p><p>', $str);
-        $newstr = str_replace('  ', '&nbsp;&nbsp;', $newstr);
-        $newstr = str_replace(' :)', ' <img src="' . $this->url . 'data/smilies/face-smile.png" class="smiley" />', $newstr);
-        $newstr = str_replace(' :p', ' <img src="' . $this->url . 'data/smilies/face-raspberry.png" class="smiley" />', $newstr);
-        $newstr = str_replace(' :P', ' <img src="' . $this->url . 'data/smilies/face-raspberry.png" class="smiley" />',$newstr);
-        $newstr = str_replace(' :|', ' <img src="' . $this->url . 'data/smilies/face-plain.png" class="smiley" />',$newstr);
-        $newstr = str_replace(' :D', ' <img src="' . $this->url . 'data/smilies/face-laugh.png" class="smiley" />',$newstr);
-        $newstr = str_replace(' =D', ' <img src="' . $this->url . 'data/smilies/face-laugh.png" class="smiley" />',$newstr);
-        $newstr = str_replace(' :(', ' <img src="' . $this->url . 'data/smilies/face-sad.png" class="smiley" />',$newstr);
-        $newstr = str_replace(' :0', ' <img src="' . $this->url . 'data/smilies/face-surprise.png" class="smiley" />',$newstr);
-        $newstr = str_replace(' :o', ' <img src="' . $this->url . 'data/smilies/face-surprise.png" class="smiley" />',$newstr);
-        $newstr = str_replace(' :O', ' <img src="' . $this->url . 'data/smilies/face-surprise.png" class="smiley" />',$newstr);
-        $newstr = str_replace(' :/', ' <img src="' . $this->url . 'data/smilies/face-uncertain.png" class="smiley" />',$newstr);
-        $newstr = str_replace(' ;)', ' <img src="' . $this->url . 'data/smilies/face-wink.png" class="smiley" />',$newstr);
-        $bbcode = array(
-        '/\[b\](.+?)\[\/b\]/is',
-        '/\[i\](.+?)\[\/i\]/is',
-        '/\[u\](.+?)\[\/u\]/is',
-        '/\[url\](.+?)\[\/url\]/is',
-        '/\[code\](.+?)\[\/code\]/is',
-        '/\[img\](.+?)\[\/img\]/is'
-        );
-        $html = array(
-        '<b>$1</b>',
-        '<i>$1</i>',
-        '<u>$1</u>',
-        '<a href="$1">$1</a>',
-        '<div class="code">$1</div>',
-        '<img src="$1" />'
-        );
-        $newstr = preg_replace($bbcode, $html, $newstr);
-        return $newstr;
-    }
-    function redirect($u)
-    {
-        header('Location: ' . $u);
-        die();
-    }
-    function isLoggedIn()
-    {
-        $cookie = $_COOKIE['Tim32_Login'];
-        if (!empty($cookie))
-        {
-            $clist = explode('|~|', $cookie);
-            $user = $this->getUserByUsername($clist[0]);
-            if ($user)
-            {
-                if ($user->password == $clist[1])
-                {
-                    return true;
-                }
-            }
-        }
-        return false;
-    }
-    function isUserAdmin()
-    {
-        if ($this->isLoggedIn())
-        {
-            if ($this->getLoggedInUser()->accessID <= 0)
-            {
-                return true;
-            }
-        }
-        return false;
-    }
-    function isUserGM()
-    {
-        if ($this->isLoggedIn())
-        {
-            if ($this->getLoggedInUser()->accessID <= 1)
-            {
-                return true;
-            }
-        }
-        return false;
-    }
-    function isUserNormal()
-    {
-        if ($this->isLoggedIn())
-        {
-            if ($this->getLoggedInUser()->accessID <= 2)
-            {
-                return true;
-            }
-        }
-        return false;
-    }
-    function checkLoggedIn()
-    {
-        if (!$this->isLoggedIn())
-        {
-            $this->drawError('You need to be logged in.');
-        }
-    }
-    function query($query)
-    {
-        $result = mysql_query($query);
-        if (!$result)
-        {
-            $this->drawError('Query Failed: ' . $query . "\n" . 'MySQL Error: ' . mysql_error());
-        }
-        return $result;
-    }
-    function findIDs($table, $query = '')
-    {
-        $array = array();
-        $result = $this->query('SELECT ID FROM ' . $table . ' ' . $query);
-        while ($row = mysql_fetch_array($result))
-        {
-            array_push($array, $row['ID']);
-        }
-        return $array;
-    }
-    function getUserByID($id)
-    {
-        $result = $this->query('SELECT * FROM Users WHERE ID = ' . $id);
-        while ($row = mysql_fetch_array($result))
-        {
-            $user = new User;
-            $user->ID = $row['ID'];
-            $user->accessID = $row['AccessID'];
-            $user->username = $row['Username'];
-            $user->password = $row['Password'];
-            $user->emailAddress = $row['EmailAddress'];
-            $user->name = $row['Name'];
-            $user->challengeID = $row['ChallengeID'];
-            return $user;
-        }
-        return false;
-    }
-    function getUserByUsername($username)
-    {
-        $result = $this->query('SELECT * FROM Users WHERE Username = "' . $username . '"');
-        while ($row = mysql_fetch_array($result))
-        {
-            return $this->getUserByID($row['ID']);
-        }
-        return false;
-    }
-    function getLoggedInUser()
-    {
-        if ($this->isLoggedIn())
-        {
-            $clist = explode('|~|', $_COOKIE['Tim32_Login']);
-            return $this->getUserByUsername($clist[0]);
-        }
-        return false;
-    }
-    function getBlogPost($id)
-    {
-        $result = $this->query('SELECT * FROM BlogPosts WHERE ID = ' . $id);
-        while ($row = mysql_fetch_array($result))
-        {
-            $post = new BlogPost;
-            $post->ID = $row['ID'];
-            if ($row['ParentID'] == -1)
-            {
-                $post->parent = -1;
-            }
-            else
-            {
-                $post->parent = $this->getBlogPost($row['ParentID']);
-            }
-            $post->author = $this->getUserByID($row['AuthorID']);
-            $post->user = $this->getUserByID($row['AuthorID']); // For some older pages
-            $post->title = $row['Title'];
-            $post->content = $row['Content'];
-            $post->datePosted = strtotime($row['DatePosted']);
-            $post->category = $row['Category'];
-            $post->spam = $row['Spam'];
-            return $post;
-        }
-        $this->drawError('Cannot find blog post, #' . $id);
-    }
-    function getProject($id)
-    {
-        $result = $this->query('SELECT * FROM Projects WHERE ID = ' . $id);
-        while ($row = mysql_fetch_array($result))
-        {
-            $project = new Project;
-            $project->ID = $row['ID'];
-            $project->author = $this->getUserByID($row['AuthorID']);
-            $project->title = $row['Title'];
-            $project->description = $row['Description'];
-            $project->logoURL = $row['LogoURL'];
-            $project->downloadURL = $row['DownloadURL'];
-            $project->websiteURL = $row['WebsiteURL'];
-            $project->latestVersion = $row['LatestVersion'];
-            $project->lastUpdate = strtotime($row['LastUpdate']);
-            return $project;
-        }
-        return false;
-    }
-    function getForumCategory($id)
-    {
-        $result = $this->query('SELECT * FROM ForumCategories WHERE ID = ' . $id);
-        while ($row = mysql_fetch_array($result))
-        {
-            $f = new ForumCategory;
-            $f->ID = $row['ID'];
-            $f->parent = $this->getForumCategory($row['ParentID']);
-            $f->title = $row['Title'];
-            $f->description = $row['Description'];
-            return $f;
-        }
-        return false;
-    }
-    function getForumPost($id)
-    {
-        $result = $this->query('SELECT * FROM ForumPosts WHERE ID = ' . $id);
-        while ($row = mysql_fetch_array($result))
-        {
-            $f = new ForumPost;
-            $f->ID = $row['ID'];
-            $f->author = $this->getUserByID($row['AuthorID']);
-            $f->category = $this->getForumCategory($row['CategoryID']);
-            $f->parent = $this->getForumPost($row['ParentID']);
-            $f->title = $row['Title'];
-            $f->content = $row['Content'];
-            $f->datePosted = strtotime($row['DatePosted']);
-            $f->spam = $row['Spam'];
-            return $f;
-        }
-        return false;
-    }
-    function delBlogPost($id)
-    {
-        $ids = $this->findIDs('BlogPosts', 'WHERE ParentID=' . $id);
-        for ($i = 0; $i < count($ids); $i++)
-        {
-            $this->delBlogPost($ids[$i]);
-        }
-        $this->query('DELETE FROM BlogPosts WHERE ID=' . $id);
-    }
-    function getGetID()
-    {
-        $id = $_GET['id'];
-        if (empty($id))
-        {
-            $id = 1;
-        }
-        return $id;
-    }
-    function getPostID()
-    {
-        $id = $_POST['id'];
-        if (empty($id))
-        {
-            $id = 1;
-        }
-        return $id;
-    }
-}
-class User
-{
-    public $ID;
-    public $accessID;
-    public $username;
-    public $password;
-    public $emailAddress;
-    public $name;
-    public $challengeID;
-}
-class BlogPost
-{
-    public $ID;
-    public $parent;
-    public $author;
-    public $title;
-    public $content;
-    public $datePosted;
-    public $category;
-    public $spam;
-}
-class Project
-{
-    public $ID;
-    public $author;
-    public $title;
-    public $description;
-    public $logoURL;
-    public $downloadURL;
-    public $websiteURL;
-    public $latestVersion;
-    public $lastUpdate;
-}
-class ForumCategory
-{
-    public $ID;
-    public $parent;
-    public $title;
-    public $description;
-}
-class ForumPost
-{
-    public $id;
-    public $author;
-    public $category;
-    public $parent;
-    public $title;
-    public $content;
-    public $datePosted;
-    public $spam;
-}
-function write($str)
-{
-    echo $str;
-    echo "\n";
-}
-?>
+<?php
+require '_config.php';
+class Taios_Page
+{
+    function __construct($title, $url = "")
+    {
+        $this->title = $title;
+        $this->url = $url;
+        $this->drawnHeader = false;
+        $this->drawnMiddle = false;
+        $this->drawnFooter = false;
+        try {
+                        $this->db = new PDO("mysql:dbname=Tim32;host=" . MYSQL_HOST, MYSQL_USER, MYSQL_PASSWORD,
+                                array( PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES 'UTF8'" ));
+                } catch (PDOException $e) {
+                        $this->drawError("Failed to connect to database!");
+                }
+    }
+    function drawHeader()
+    {
+        if (!$this->drawnHeader)
+        {
+            write('<!DOCTYPE html>');
+            write('<html lang="en">');
+            write('<head>');
+            write('<meta http-equiv="Content-Type" content="text/html;charset=utf-8">');
+            write('<title>Tim32 &middot; ' . htmlentities($this->title, ENT_QUOTES) . '</title>');
+            write('<link href="' . $this->url . 'styles.css" rel="stylesheet" type="text/css" media="all" />');
+            write('<link rel="shortcut icon" href="' . $this->url . 'data/favicon.png" />');
+            write('<script type="text/javascript" src="//code.jquery.com/jquery-1.9.0.min.js"></script>');
+            write('<script type="text/javascript" src="' . $this->url . 'tcp.js"></script>');
+            write('</head>');
+            write('<body>');
+            write('<div class="sidebar">');
+            write('<div class="sidebar-header">');
+            write('<a href="' . $this->url . '"><h1>Tim32</h1></a>');
+            write('</div>');
+            write('<div class="sidebar-menu">');
+            $this->drawMenuItem('Home', 'index.php');
+            $this->drawMenuItem('Blog', 'blog/');
+            $this->drawMenuItem('Projects', 'projects/');
+            $this->drawMenuItem('Forums', 'forums/');
+            $this->drawMenuItem('Wiki', 'wiki/');
+            $this->drawMenuItem('Photos', 'photos/');
+            write('<br />');
+            if ($this->isLoggedIn() && $this->isUserNormal($this->getLoggedInUser())) {
+                $this->drawMenuItem('Administration', 'admin/');
+                $this->drawMenuItem('Logout', 'logout-do.php');
+            } else if ($this->isLoggedIn()) {
+                $this->drawMenuItem('Logout', 'logout-do.php');
+                if ($this->getLoggedInUser()->username != "cake") {
+                    $this->drawMenuItem('You are banned', NULL);
+                } else {
+                    $this->drawMenuItem('<span style="color:#032865">#undefined</span>', '/challenge/cakefolder');
+                }
+            } else {
+                $this->drawMenuItem('Login', 'login.php');
+                $this->drawMenuItem('Register', 'register.php');
+            }
+            write('<br />');
+            $this->drawnHeader = true;
+        }
+    }
+    function drawMenuItem($t, $u) {
+        if ($u == NULL) {
+            write('<p style="color:red">' . $t . '</p>');
+        } else {
+            write('<p><a href="' . $this->url . $u . '">' . $t . '</a></p>');
+        }
+    }
+    function drawMiddle()
+    {
+        if (!$this->drawnMiddle) {
+            write('</div>');
+            write('</div>');
+            write('<div class="content">');
+            write('<a href="./"><h2>' . $this->title . '</h2></a>');
+            $this->drawnMiddle = true;
+        }
+    }
+    function drawFooter()
+    {
+        if (!$this->drawnFooter)
+        {
+            write('</div>');
+            write('</body>');
+            write('</html>');
+            $this->drawnFooter = true;
+        }
+        die();
+    }
+    function drawError($text, $die = true)
+    {
+        $this->drawHeader();
+        $this->drawMiddle();
+        write('<h4 style="color: red;">Error: ' . $text . '</h4>');
+        if ($die) {
+            $this->drawFooter();
+            die();
+        }
+    }
+    function drawBlogPostTree($id, $first = false)
+    {
+        $post = $this->getBlogPost($id);
+        if ($first)
+        {
+            write('<h3><a href="post.php?id=' . $id . '">' . htmlentities($post->title, ENT_QUOTES). '</a> <a href="post.php?id=' . $post->parent->ID . '">^</a></h3>');
+        }
+        else
+        {
+            write('<a href="post.php?id=' . $id . '"><h3>' . htmlentities($post->title, ENT_QUOTES). '</h3></a>');
+        }
+        write('<h5 style="color: #666666;">Posted On ' . date('l j F Y', $post->datePosted) . ' by ' . htmlentities($post->user->name, ENT_QUOTES) . ' (' . htmlentities($post->user->username, ENT_QUOTES) . ')</h5>');
+        write('<p>' . $this->replaceBBCode($post->content) . '</p>');
+        if ($this->isUserNormal($this->getLoggedInUser()))
+        {
+            echo '<p class="bold"><a href="add-post.php?id=' . $id . '">Add Comment</a>';
+            if ($this->isUserAdmin($this->getLoggedInUser()) || $this->getLoggedInUser()->ID == $post->author->ID)
+            {
+                echo ' &nbsp; &middot &nbsp; <a href="edit-post.php?id=' . $id . '">Edit Post</a>';
+                echo ' &nbsp; &middot &nbsp; <a href="del-post.php?id=' . $id . '">Delete Post</a>';
+            }
+            write('</p><br />');
+        }
+        $ids = $this->findIDs('BlogPosts', 'WHERE ParentID=?', array($id));
+        for ($i = 0; $i < count($ids); $i++)
+        {
+            write('<div class="indent">');
+            $this->drawBlogPostTree($ids[$i]);
+            write('</div>');
+        }
+    }
+    function drawBlogCategoriesMenu()
+    {
+        $cats = array();
+        $ids = $this->findIDs('BlogPosts', 'WHERE ParentID = -1');
+        for ($i = 0; $i < count($ids); $i++)
+        {
+            $cat = $this->getBlogPost($ids[$i])->category;
+            if (!in_array($cat, $cats) && ($cat != "Drafts" || $this->isUserGM($this->getLoggedInUser())))
+            {
+                array_push($cats, $cat);
+            }
+        }
+        write('<h3>Categories</h3>');
+        for ($i = 0; $i < count($cats); $i++)
+        {
+            $this->drawMenuItem(htmlentities($cats[$i], ENT_QUOTES), 'blog/index.php?cat=' . $cats[$i]);
+        }
+    }
+    function replaceBBCode($str)
+    {
+        $newstr = htmlentities($str, ENT_QUOTES);
+        $newstr = str_replace("\n", "<br />", $newstr);
+        $newstr = str_replace('  ', '&nbsp;&nbsp;', $newstr);
+        $bbcode = array(
+            '/\[b\](.+?)\[\/b\]/is',
+            '/\[i\](.+?)\[\/i\]/is',
+            '/\[u\](.+?)\[\/u\]/is',
+            '/\[s\](.+?)\[\/s\]/is',
+            '/\[url\](.+?)\[\/url\]/is',
+            '/\[w\](.+?)\[\/w\]/is',
+            '/\[url=(?:&quot;)?(.+?)(?:&quot;)?\](.+?)\[\/url\]/is',
+            '/\[w=(?:&quot;)?(.+?)(?:&quot;)?\](.+?)\[\/w\]/is',
+            '/\[code\](.+?)\[\/code\]/is',
+            '/\[img\](.+?)\[\/img\]/is',
+            '/\[ul\](.+?)\[\/ul\]/is',
+            '/\[ol\](.+?)\[\/ol\]/is',
+            '/\[li\](.+?)\[\/li\]/is',
+            '/\[mono\](.+?)\[\/mono\]/is',
+            '/\[tcp\](.+?)\[\/tcp\]/is'
+        );
+        $html = array(
+            '<b>$1</b>',
+            '<i>$1</i>',
+            '<u>$1</u>',
+            '<del>$1</del>',
+            '<a href="$1">$1</a>',
+            '<a href="/wiki/index.php?page=$1">$1</a>',
+            '<a href="$1">$2</a>',
+            '<a href="/wiki/index.php?page=$1">$2</a>',
+            '</p><div class="code">$1</div><p>',
+            '<img src="$1" alt="BBCode-included image" />',
+            '<ul>$1</ul>',
+            '<ol>$1</ol>',
+            '<li>$1</li>',
+            '<span style="font-family: Droid Sans Mono, monospace, fixed; margin-left: 1em; margin-right: 1em;">$1</span>',
+            '<span class="tcp" data-status="closed" data-text="$1">$1<img title="Open TCP Editor" class="tcp_button" src="//tim32.org/timlan/goTCP.png" alt="Open TCP Editor" /></span>'
+        );
+        $newstr = preg_replace($bbcode, $html, $newstr);
+        return $newstr;
+    }
+    function acceptFile($fname)
+    {
+        if (!ALLOW_FILES)
+        {
+            $this->drawError("This system doesn't allow file uploading.");
+            return false;
+        }
+        $this->checkLoggedIn();
+        if ($this->getLoggedInUser()->accessID >= 2)
+        {
+            $this->drawError('You do not have permission to access this page.');
+        }
+        $allowedExts = array("gif", "jpeg", "jpg", "png", "tga");
+        $temp = explode(".", $_FILES[$fname]["name"]);
+        $extension = end($temp);
+        if ((($_FILES[$fname]["type"] == "image/gif")
+            || ($_FILES[$fname]["type"] == "image/jpeg")
+            || ($_FILES[$fname]["type"] == "image/jpg")
+            || ($_FILES[$fname]["type"] == "image/pjpeg")
+            || ($_FILES[$fname]["type"] == "image/x-png")
+            || ($_FILES[$fname]["type"] == "image/png")
+            || ($_FILES[$fname]["type"] == "image/x-targa")
+            || ($_FILES[$fname]["type"] == "image/x-tga"))
+            && ($_FILES[$fname]["size"] < 200000) // file size limit (bytes)
+            && in_array($extension, $allowedExts))
+        {
+            if ($_FILES[$fname]["error"] > 0)
+            {
+                $this->drawError("File Upload Error: " . $_FILES[$fname]["error"]);
+            }
+            else
+            {
+                $lname = "upload/" . $this->rndString(12) . "." . $extension;
+                while (file_exists($lname))
+                {
+                    $lname = "upload/" . $this->rndString(12) . "." . $extension;
+                }
+                move_uploaded_file($_FILES[$fname]["tmp_name"], $this->url .  $lname);
+                return ROOT_PATH . $lname;
+            }
+        }
+        else
+        {
+            $this->drawError("Invalid file");
+        }
+        return false;
+    }
+    function redirect($u)
+    {
+        header('Location: ' . $u);
+        die();
+    }
+    function isLoggedIn()
+    {
+        $cookie = $_COOKIE['Tim32_Login'];
+        if (!empty($cookie))
+        {
+            $clist = explode('|~|', $cookie);
+            $user = $this->getUserByUsername($clist[0]);
+            if ($user)
+            {
+                if ($user->password == $clist[1])
+                {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    function isUserAdmin()
+    {
+        if ($this->isLoggedIn())
+        {
+            if ($this->getLoggedInUser()->accessID <= 0)
+            {
+                return true;
+            }
+        }
+        return false;
+    }
+    function isUserGM()
+    {
+        if ($this->isLoggedIn())
+        {
+            if ($this->getLoggedInUser()->accessID <= 1)
+            {
+                return true;
+            }
+        }
+        return false;
+    }
+    function isUserNormal()
+    {
+        if ($this->isLoggedIn())
+        {
+            if ($this->getLoggedInUser()->accessID <= 2)
+            {
+                return true;
+            }
+        }
+        return false;
+    }
+    function isUserBanned()
+    {
+        if ($this->isLoggedIn())
+        {
+            if ($this->getLoggedInUser()->accessID >= 3)
+            {
+                return true;
+            }
+        }
+        return false;
+    }
+    function checkChallengeStatus($challengeID, $previous, $next)
+    {
+        $currentChallengeID = $this->getLoggedInUser()->challengeID;
+        if (!$this->isLoggedIn())
+        {
+            $this->redirect('index.php');
+        }
+        else if ($currentChallengeID > $challengeID)
+        {
+            $this->redirect($next . '.php');
+        }
+        else if ($currentChallengeID < $challengeID)
+        {
+            $this->redirect($previous . '.php');
+        }
+    }
+    function checkLoggedIn()
+    {
+        if (!$this->isLoggedIn())
+        {
+            $this->drawError('You need to be logged in.');
+        }
+    }
+    function query($query, $args = array())
+    {
+                $statement = $this->db->prepare($query);
+                if (!$statement->execute($args)) {
+                    $this->drawError("Query Failed! MySQL Error: " . $statement->errorInfo());
+                }
+                return $statement->fetchAll();
+    }
+    function findIDs($table, $query = '', $args = array())
+    {
+        $array = array();
+        $results = $this->query('SELECT ID FROM ' . $table . ' ' . $query, $args);
+        foreach ($results as $row) {
+            array_push($array, $row['ID']);
+        }
+        return $array;
+    }
+    function getUserByID($id)
+    {
+        foreach ($this->query("SELECT * FROM Users WHERE ID = ?", array($id)) as $row) {
+            $user = new User();
+            $user->ID = $row['ID'];
+            $user->accessID = $row['AccessID'];
+            $user->username = $row['Username'];
+            $user->password = $row['Password'];
+            $user->salt = $row['Salt'];
+            $user->emailAddress = $row['EmailAddress'];
+            $user->name = $row['Name'];
+            $user->csrftoken = $row['CSRFToken'];
+            $user->challengeID = $row['ChallengeID'];
+            return $user;
+        }
+        return false;
+    }
+    function getUserByUsername($username) {
+        foreach ($this->query("SELECT ID FROM Users WHERE Username = ?", array($username)) as $row) {
+            return $this->getUserByID($row['ID']);
+        }
+        return false;
+    }
+    function getLoggedInUser() {
+        if ($this->isLoggedIn()) {
+            $clist = explode('|~|', $_COOKIE['Tim32_Login']);
+            return $this->getUserByUsername($clist[0]);
+        }
+        return false;
+    }
+    function getBlogPost($id) {
+        foreach ($this->query("SELECT * FROM BlogPosts WHERE ID = ?", array($id)) as $row) {
+            $post = new BlogPost;
+            $post->ID = $row['ID'];
+            if ($row['ParentID'] == -1) {
+                $post->parent = -1;
+            } else {
+                $post->parent = $this->getBlogPost($row['ParentID']);
+            }
+            $post->author = $this->getUserByID($row['AuthorID']);
+            $post->user = $this->getUserByID($row['AuthorID']); // For some older pages
+            $post->title = $row['Title'];
+            $post->content = $row['Content'];
+            $post->datePosted = strtotime($row['DatePosted']);
+            $post->category = $row['Category'];
+            $post->spam = $row['Spam'];
+            return $post;
+        }
+        $this->drawError('Cannot find blog post, #' . $id);
+    }
+    function getProject($id) {
+        foreach ($this->query("SELECT * FROM Projects WHERE ID = ?", array($id)) as $row) {
+            $project = new Project;
+            $project->ID = $row['ID'];
+            $project->author = $this->getUserByID($row['AuthorID']);
+            $project->title = $row['Title'];
+            $project->description = $row['Description'];
+            $project->logoURL = $row['LogoURL'];
+            $project->downloadURL = $row['DownloadURL'];
+            $project->websiteURL = $row['WebsiteURL'];
+            $project->latestVersion = $row['LatestVersion'];
+            $project->lastUpdate = strtotime($row['LastUpdate']);
+            return $project;
+        }
+        return false;
+    }
+    function getForumCategory($id) {
+        foreach ($this->query("SELECT * FROM ForumCategories WHERE ID = ?", array($id)) as $row) {
+            $f = new ForumCategory;
+            $f->ID = $row['ID'];
+            $f->parent = $this->getForumCategory($row['ParentID']);
+            $f->title = $row['Title'];
+            $f->description = $row['Description'];
+            return $f;
+        }
+        return false;
+    }
+    function getForumPost($id) {
+        foreach ($this->query("SELECT * FROM ForumPosts WHERE ID = ?", array($id)) as $row) {
+            $f = new ForumPost;
+            $f->ID = $row['ID'];
+            $f->author = $this->getUserByID($row['AuthorID']);
+            $f->category = $this->getForumCategory($row['CategoryID']);
+            $f->parent = $this->getForumPost($row['ParentID']);
+            $f->title = $row['Title'];
+            $f->content = $row['Content'];
+            $f->datePosted = strtotime($row['DatePosted']);
+            $f->spam = $row['Spam'];
+            return $f;
+        }
+        return false;
+    }
+    function delBlogPost($id) {
+        foreach ($this->findIDs("BlogPosts", "WHERE ParentID = ?", array($id)) as $i) {
+            $this->delBlogPost($i);
+        }
+        $this->query("DELETE FROM BlogPosts WHERE ID = ?", array($id));
+    }
+    function saltAndBurn($pass, $salt) {
+        return sha1($salt . $pass);
+    }
+    function rndString($len = 8) {
+        $chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZlolphp';
+        $clen = strlen($chars);
+        $res = '';
+        for ($i = $len - 1; $i >= 0; $i--) {
+            $res .= $chars[rand(0, $clen - 1)];
+        }
+        return $res;
+    }
+    function getCSRFToken($id) {
+        $token = $this->rndString();
+        $this->query("UPDATE Users Set CSRFToken = ? WHERE ID = ?", array($token, $id));
+        return $token;
+    }
+    function checkCSRFToken($id, $token) {
+        $user = $this->getUserByID($id);
+        if ($token !== $user->csrftoken) {
+            die("a death");
+        }
+        $this->getCSRFToken($id); // change to something else so we can't re-use it
+    }
+    function getGetID() {
+        $id = $_GET['id'];
+        if (empty($id)) {
+            $id = 1;
+        }
+        return $id;
+    }
+    function getPostID() {
+        $id = $_POST['id'];
+        if (empty($id)) {
+            $id = 1;
+        }
+        return $id;
+    }
+}
+class User
+{
+    public $ID;
+    public $accessID;
+    public $username;
+    public $password;
+    public $salt;
+    public $emailAddress;
+    public $name;
+    public $csrftoken;
+    public $challengeID;
+}
+class BlogPost
+{
+    public $ID;
+    public $parent;
+    public $author;
+    public $title;
+    public $content;
+    public $datePosted;
+    public $category;
+    public $spam;
+}
+class Project
+{
+    public $ID;
+    public $author;
+    public $title;
+    public $description;
+    public $logoURL;
+    public $downloadURL;
+    public $websiteURL;
+    public $latestVersion;
+    public $lastUpdate;
+}
+class ForumCategory
+{
+    public $ID;
+    public $parent;
+    public $title;
+    public $description;
+}
+class ForumPost
+{
+    public $id;
+    public $author;
+    public $category;
+    public $parent;
+    public $title;
+    public $content;
+    public $datePosted;
+    public $spam;
+}
+function write($str)
+{
+    echo $str;
+    echo "\n";
+}
+?>

 /admin/account.php
 ,7 → 11,7
 $userID = $page->getGetID();
 $user = $page->getUserByID($userID);
-if (($page->getLoggedInUser()->ID == $userID || $page->isUserAdmin($page->getLoggedInUser())) && $user)
+if (($page->getLoggedInUser()->ID == $userID || $page->isUserAdmin($page->getLoggedInUser())) && $user && $page->isUserNormal($page->getLoggedInUser()))
 {
 ?>
 ,10 → 32,10
     write('<tr><td class="bold">AccessID: </td><td>' . $user->accessID . '</td></tr>');
 }
 ?>
-<tr><td class="bold">Username: </td><td><?php echo $user->username; ?></td></tr>
+<tr><td class="bold">Username: </td><td><?php echo htmlentities($user->username, ENT_QUOTES); ?></td></tr>
 <tr><td class="bold">Password: </td><td><input type="password" name="password" /></td></tr>
-<tr><td class="bold">Email Address: </td><td><input type="text" name="email" value="<?php echo $user->emailAddress; ?>" /></td></tr>
-<tr><td class="bold">Name: </td><td><input type="text" name="name" value="<?php echo $user->name; ?>" /></td></tr>
+<tr><td class="bold">Email Address: </td><td><input type="text" name="email" value="<?php echo htmlentities($user->emailAddress, ENT_QUOTES); ?>" /></td></tr>
+<tr><td class="bold">Name: </td><td><input type="text" name="name" value="<?php echo htmlentities($user->name, ENT_QUOTES); ?>" /></td></tr>
 <tr><td></td><td><input type="submit" value="Update Account" /></td></tr>
 </table>
 </form>

 /admin/all-accounts.php
 ,7 → 17,7
     write('<td class="bold">ID</td>');
     write('<td class="bold">AccessID</td>');
     write('<td class="bold">Username</td>');
-    write('<td class="bold">Password</td>');
+    write('<td class="bold">Salt and Burned Password</td>');
     write('<td class="bold">Name</td>');
     write('<td class="bold">Email Address</td>');
     write('<td class="bold">Challenge ID</td>');
 ,10 → 30,10
         write('<tr>');
         write('<td><a href="account.php?id=' . $user->ID . '">' . $user->ID . '</a></td>');
         write('<td>' . $user->accessID . '</td>');
-        write('<td>' . $user->username . '</td>');
+        write('<td>' . htmlentities($user->username, ENT_QUOTES) . '</td>');
         write('<td>' . $user->password . '</td>');
-        write('<td>' . $user->name . '</td>');
-        write('<td>' . $user->emailAddress . '</td>');
+        write('<td>' . htmlentities($user->name, ENT_QUOTES) . '</td>');
+        write('<td>' . htmlentities($user->emailAddress, ENT_QUOTES) . '</td>');
         write('<td>' . $user->challengeID . '</td>');
         write('</tr>');
     }

 /admin/all-blog-posts.php
 ,24 → 27,28
     $ids = $page->findIDs('BlogPosts', 'ORDER BY DatePosted DESC');
     for ($i = 0; $i < count($ids); $i++)
     {
-        $post = $page->getBlogPost($ids[$i]);
-        write('<tr>');
-        write('<td><a href="../blog/edit-post.php?id=' . $post->ID . '">' . $post->ID . '</a></td>');
-        if ($post->parent == -1)
+        $id_str = $ids[$i];
+        if (!empty($id_str))
         {
-            write('<td style="color: #444444;">No Parent</td>');
+            $post = $page->getBlogPost($id_str);
+            write('<tr>');
+            write('<td><a href="../blog/edit-post.php?id=' . $post->ID . '">' . $post->ID . '</a></td>');
+            if ($post->parent == -1)
+            {
+                write('<td style="color: #444444;">No Parent</td>');
+            }
+            else
+            {
+                write('<td>' . htmlentities($post->parent->title, ENT_QUOTES) . '</td>');
+            }
+            write('<td><a href="account.php?id=' . $post->author->ID . '">' . htmlentities($post->author->name, ENT_QUOTES) . '</a></td>');
+            write('<td>' . $post->title . '</td>');
+            write('<td>' . str_replace("\n", '<br />', htmlentities($post->content, ENT_QUOTES)) . '</td>');
+            write('<td>' . date('j/m/Y H:i', $post->datePosted) . ' <a href="nowify.php?id=' . $post->ID . '">Nowify</a></td>');
+            write('<td>' . htmlentities($post->category, ENT_QUOTES) . '</td>');
+            write('<td>' . $post->spam . '</td>');
+            write('</tr>');
         }
-        else
-        {
-            write('<td>' . $post->parent->title . '</td>');
-        }
-        write('<td><a href="account.php?id=' . $post->author->ID . '">' . $post->author->name . '</a></td>');
-        write('<td>' . $post->title . '</td>');
-        write('<td>' . str_replace("\n", '<br />', $post->content) . '</td>');
-        write('<td>' . date('j/m/Y H:i', $post->datePosted) . '</td>');
-        write('<td>' . $post->category . '</td>');
-        write('<td>' . $post->spam . '</td>');
-        write('</tr>');
     }
     write('</table>');

 /admin/all-forum-categories.php
 ,10 → 32,10
         }
         else
         {
-            write('<td>' . $cat->parent->title . '</td>');
+            write('<td>' . htmlentities($cat->parent->title, ENT_QUOTES) . '</td>');
         }
-        write('<td>' . $cat->title . '</td>');
-        write('<td>' . $cat->description . '</td>');
+        write('<td>' . htmlentities($cat->title, ENT_QUOTES) . '</td>');
+        write('<td>' . htmlentities($cat->description, ENT_QUOTES) . '</td>');
         write('</tr>');
     }

 /admin/all-forum-posts.php
 ,7 → 30,7
         $post = $page->getForumPost($ids[$i]);
         write('<tr>');
         write('<td><a href="../forums/post.php?id=' . $post->ID . '">' . $post->ID . '</a></td>');
-        write('<td><a href="account.php?id=' . $post->author->ID . '">' . $post->author->name . '</a></td>');
+        write('<td><a href="account.php?id=' . $post->author->ID . '">' . htmlentities($post->author->name, ENT_QUOTES) . '</a></td>');
         if (!$post->category)
         {
             write('<td style="color: #444444;">No Category</td>');
 ,7 → 37,7
         }
         else
         {
-            write('<td>' . $post->category->title . '</td>');
+            write('<td>' . htmlentities($post->category->title, ENT_QUOTES) . '</td>');
         }
         if (!$post->parent)
         {
 ,10 → 45,10
         }
         else
         {
-            write('<td>' . $post->parent->title . '</td>');
+            write('<td>' . htmlentities($post->parent->title, ENT_QUOTES) . '</td>');
         }
-        write('<td>' . $post->title . '</td>');
-        write('<td>' . str_replace("\n", ' ', $post->content) . '</td>');
+        write('<td>' . htmlentities($post->title, ENT_QUOTES) . '</td>');
+        write('<td>' . str_replace("\n", ' ', htmlentities($post->content, ENT_QUOTES)) . '</td>');
         write('<td>' . date('j/m/Y H:i', $post->datePosted) . '</td>');
         write('<td>' . $post->spam . '</td>');
         write('</tr>');

 /admin/all-projects.php
 ,13 → 31,13
         $project = $page->getProject($ids[$i]);
         write('<tr>');
         write('<td><a href="../projects/edit-project.php?id=' . $project->ID . '">' . $project->ID . '</a></td>');
-        write('<td><a href="account.php?id=' . $project->author->ID . '">' . $project->author->name . '</a></td>');
-        write('<td>' . $project->title . '</td>');
-        write('<td>' . str_replace("\n", '<br />', $project->description) . '</td>');
-        write('<td><img src="' . $project->logoURL . '" /></td>');
-        write('<td><a href="' . $project->downloadURL . '">Link</a></td>');
-        write('<td><a href="' . $project->websiteURL . '">Link</a></td>');
-        write('<td>' . $project->latestVersion . '</td>');
+        write('<td><a href="account.php?id=' . $project->author->ID . '">' . htmlentities($project->author->name, ENT_QUOTES) . '</a></td>');
+        write('<td>' . htmlentities($project->title, ENT_QUOTES) . '</td>');
+        write('<td>' . str_replace("\n", '<br />', htmlentities($project->description, ENT_QUOTES)) . '</td>');
+        write('<td><img src="' . htmlentities($project->logoURL, ENT_QUOTES) . '" /></td>');
+        write('<td><a href="' . htmlentities($project->downloadURL, ENT_QUOTES) . '">Link</a></td>');
+        write('<td><a href="' . htmlentities($project->websiteURL, ENT_QUOTES) . '">Link</a></td>');
+        write('<td>' . htmlentities($project->latestVersion, ENT_QUOTES) . '</td>');
         write('<td>' . date('j/m/Y H:i', $project->lastUpdate) . '</td>');
         write('</tr>');
     }

 /admin/nowify.php
 ,0 → 1,60
+<?php
+require '../_taios.php';
+$page = new Taios_Page('Nowify', '../');
+if (isset($_GET['id'])) {
+    $id = $_GET['id'];
+} else if (isset($_POST['id'])) {
+    $id = $_POST['id'];
+} else {
+    $page->drawError('No ID set.');
+}
+$page->checkLoggedIn();
+$post = $page->getBlogPost($id);
+if ((!$page->isUserAdmin($page->getLoggedInUser()) && $page->getLoggedInUser()->ID != $post->author->ID) || !$page->isUserNormal($page->getLoggedInUser())) {
+    $page->drawError('You do not have permission to access this page.');
+}
+$error = '';
+if (isset($_POST['id']))
+{
+    $title = $_POST['title'];
+    $page->query("UPDATE BlogPosts SET DatePosted = NOW() WHERE ID = ?", array($id));
+    $page->redirect('/blog/post.php?id=' . $id);
+}
+$page->drawHeader();
+$page->drawBlogCategoriesMenu();
+$page->drawMiddle();
+if (!empty($error)) {
+    $page->drawError($error, false);
+}
+?>
+<form action="nowify.php" method="post">
+Press Sumbit if you wish to nowify post <?php echo htmlentities($post->title, ENT_QUOTES); ?>.<br /><br />
+<?php
+write('<input type="hidden" name="id" value="' . $id . '" />');
+?>
+<tr>
+<td class="bold"></td>
+<td><input type="submit" value="Submit" /></td>
+</tr>
+</table>
+</form>
+<?php
+$page->drawFooter();
+?>

 /admin/account-do.php
 ,36 → 13,27
 $name = $_POST['name'];
 $user = $page->getUserByID($userID);
-if (($page->getLoggedInUser()->ID == $userID || $page->isUserAdmin($page->getLoggedInUser())) && $user)
-{
-    if (isset($accessID) && $page->isUserAdmin($page->getLoggedInUser()))
-    {
-        $page->query('UPDATE Users SET AccessID = "' . $accessID . '" WHERE ID = ' . $userID);
+if (($page->getLoggedInUser()->ID == $userID || $page->isUserAdmin($page->getLoggedInUser())) && $user && $page->isUserNormal($page->getLoggedInUser())) {
+    if (isset($accessID) && $page->isUserAdmin($page->getLoggedInUser())) {
+        $page->query("UPDATE Users SET AccessID = ? WHERE ID = ?", array($accessID, $userID));
     }
-    if (!empty($password))
-    {
-        $page->query('UPDATE Users SET Password = "' . sha1($password) . '" WHERE ID = ' . $userID);
+    if (!empty($password)) {
+        $salt = $user->username . "sheeps";
+        $page->query("UPDATE Users SET Password = ?, Salt = ? WHERE ID = ?", array($page->saltAndBurn($password, $salt), $salt, $userID));
     }
-    if (!empty($email))
-    {
-        $page->query('UPDATE Users SET EmailAddress = "' . $email . '" WHERE ID = ' . $userID);
+    if (!empty($email)) {
+        $page->query("UPDATE Users SET EmailAddress = ? WHERE ID = ?", array($email, $userID));
     }
-    if (!empty($name))
-    {
-        $page->query('UPDATE Users SET Name = "' . $name . '" WHERE ID = ' . $userID);
+    if (!empty($name)) {
+        $page->query("UPDATE Users SET Name = ? WHERE ID = ?", array($name, $userID));
     }
-}
-else
-{
-    if (!$user)
-    {
+} else {
+    if (!$user) {
         $page->drawError('No such user, #' . $userID);
-    }
-    else
-    {
+    } else {
         $page->drawError('You do not have permission to access this page.');
     }
 }

 /admin/index.php
 ,7 → 9,14
 $page->checkLoggedIn();
 $user = $page->getLoggedInUser();
-write('<h4><a href="account.php?id=' . $user->ID. '">Manage Account</a></h4>');
+if ($page->isUserNormal($user))
+{
+    write('<h4><a href="account.php?id=' . $user->ID. '">Manage Account</a></h4>');
+}
+else
+{
+    $page->drawError('You do not have permission to access this page.');
+}
 if ($page->isUserAdmin($user))
 {

 /blog/edit-post.php
 ,7 → 20,7
 $page->checkLoggedIn();
 $post = $page->getBlogPost($id);
-if (!$page->isUserAdmin($page->getLoggedInUser()) && $page->getLoggedInUser()->ID != $post->author->ID)
+if ((!$page->isUserAdmin($page->getLoggedInUser()) && $page->getLoggedInUser()->ID != $post->author->ID) || !$page->isUserNormal($page->getLoggedInUser()))
 {
     $page->drawError('You do not have permission to access this page.');
 }
 ,23 → 27,20
 $error = '';
-if (isset($_POST['id']))
-{
+if (isset($_POST['id'])) {
+    $page->checkCSRFToken($page->getLoggedInUser()->ID, $_POST['csrftoken']);
     $title = $_POST['title'];
     $content = $_POST['content'];
     $category = $_POST['category'];
-    if (empty($title))
-    {
+    if (empty($title)) {
         $error = "No Title Specified";
-    }
-    else if (empty($content))
-    {
+    } else if (empty($content)) {
         $error = "No Content Specified";
-    }
-    else
-    {
-        $page->query('UPDATE BlogPosts SET Content = "' . $content . '", Title = "' . $title . '", Category = "' . $category . '" WHERE ID = ' . $id);
+    } else {
+                $args = array($content, $title, $category, $id);
+        $page->query("UPDATE BlogPosts SET Content = ?, Title = ?, Category = ? WHERE ID = ?", $args);
         $page->redirect('post.php?id=' . $id);
     }
 }
 ,8 → 49,7
 $page->drawBlogCategoriesMenu();
 $page->drawMiddle();
-if (!empty($error))
-{
+if (!empty($error)) {
     $page->drawError($error, false);
 }
 ,22 → 59,23
 <table>
 <tr>
 <td class="bold">Title: </td>
-<td><input type="text" name="title" value="<?php echo $post->title; ?>"/></td>
+<td><input type="text" name="title" value="<?php echo htmlentities($post->title, ENT_QUOTES); ?>"/></td>
 </tr>
 <tr>
 <td class="bold">Content: </td>
-<td><textarea name="content"><?php echo $post->content; ?></textarea></td>
+<td><textarea name="content"><?php echo htmlentities($post->content, ENT_QUOTES); ?></textarea></td>
 </tr>
 <tr>
 <td class="bold">Catagory: </td>
-<td><input type="text" name="category" value="<?php echo $post->category; ?>" /></td>
+<td><input type="text" name="category" value="<?php echo htmlentities($post->category, ENT_QUOTES); ?>" /></td>
 </tr>
 <?php
 write('<input type="hidden" name="id" value="' . $id . '" />');
 ?>
+<input type="hidden" name="csrftoken" value="<?php echo $page->getCSRFToken($page->getLoggedInUser()->ID); ?>" />
-<tr>
+    <tr>
 <td class="bold"></td>
 <td><input type="submit" value="Edit" /></td>
 </tr>

 /blog/index.php
 ,6 → 5,8
 $page = new Taios_Page('Blog Posts', '../');
 $page->drawHeader();
 $page->drawBlogCategoriesMenu();
+write('<br /><h3>RSS</h3>');
+$page->drawMenuItem('RSS Feed', 'blog/rss.php');
 $page->drawMiddle();
 if ($page->isUserGM($page->getLoggedInUser()))
 ,24 → 16,29
 }
 $query = 'WHERE ParentID = -1';
+$args = array();
-if (isset($_GET['cat']))
-{
-    $query = $query . ' AND Category = "' . $_GET['cat'] . '"';
-    write('<p>Only showing blog posts from the ' . $_GET['cat'] . ' category. <a href="index.php">Reset Filtering</a></p><br />');
+if (isset($_GET['cat'])) {
+    $query = $query . " AND Category = ?";
+    array_push($args, $_GET['cat']);
+    write('<p>Only showing blog posts from the ' . htmlentities($_GET['cat'], ENT_QUOTES) . ' category. <a href="index.php">Reset Filtering</a></p><br />');
 }
+if (!$page->isUserGM($page->getLoggedInUser())) {
+    $query = $query . ' AND Category != "Drafts"';
+}
 $query = $query . " ORDER BY DatePosted DESC";
-$ids = $page->findIDs('BlogPosts', $query);
-for ($i = 0; $i < count($ids); $i++)
-{
-    $id = $ids[$i];
+foreach ($page->findIDs('BlogPosts', $query, $args) as $id) {
     $post = $page->getBlogPost($id);
+    $ids2 = $page->findIDs('BlogPosts', 'WHERE ParentID="' . $id . '"');
-    write('<a href="post.php?id=' . $id . '"><h3>' . $post->title. '</h3></a>');
-    write('<h5 style="color: #666666;">Posted On ' . date('l j F Y', $post->datePosted) . ' by ' . $post->user->name . ' (' . $post->user->username . ')</h5>');
+    write('<a href="post.php?id=' . $id . '"><h3>' . htmlentities($post->title, ENT_QUOTES). '</h3></a>');
+    write('<h5 style="color: #666666;">Posted On ' . date('l j F Y', $post->datePosted) . ' by ' . htmlentities($post->user->name, ENT_QUOTES) . ' (' . htmlentities($post->user->username, ENT_QUOTES) . ')</h5>');
     write('<p>' . $page->replaceBBCode($post->content) . '</p>');
+    write('<h5 style="color: #666666;"><a href="post.php?id=' . $id . '">' . count($ids2) . ' Comments</a></h5>');
     write('<br />');
 }

 /blog/post.php
 ,6 → 9,8
     $page->redirect('index.php');
 }
+$page->title = 'Blog Post &middot; ' . htmlentities($page->getBlogPost($page->getGetID())->title, ENT_QUOTES);
 $page->drawHeader();
 $page->drawBlogCategoriesMenu();
 $page->drawMiddle();

 /blog/rss.php
 ,0 → 1,34
+<?php
+require '../_taios.php';
+header("Content-type: application/rss+xml");
+$page = new Taios_Page('Blog RSS Feed', '../');
+write('<?xml version="1.0" encoding="UTF-8" ?>');
+write('<rss version="2.0">');
+write('<channel>');
+write('<title>Tim32 Blog RSS</title>');
+write('<description>This is the RSS feed for the Tim32 Blog.</description>');
+write('<link>http://tim32.org/blog/</link>');
+$ids = $page->findIDs('BlogPosts', 'WHERE ParentID = -1 AND CATEGORY != "Drafts" ORDER BY DatePosted DESC');
+for ($i = 0; $i < count($ids); $i++)
+{
+    $id = $ids[$i];
+    $post = $page->getBlogPost($id);
+    write('<item>');
+    write('<title>' . htmlentities($post->title, ENT_QUOTES) . '</title>');
+    write('<link>http://tim32.org/blog/post.php?id=' . $id . '</link>');
+    write('<guid>' . $id . '</guid>');
+    write('<pubDate>' . date('D, d M Y H:i:s O', $post->datePosted). '</pubDate>');
+    write('<description><![CDATA[' . $page->replaceBBCode($post->content) . ']]></description>');
+    write('</item>');
+}
+write('</channel>');
+write('</rss>');
+?>

 /blog/add-post-img.php
 ,0 → 1,97
+<?php
+require '../_taios.php';
+$page = new Taios_Page('Edit Post', '../');
+if (isset($_GET['id']))
+{
+    $id = $_GET['id'];
+}
+else if (isset($_POST['id']))
+{
+    $id = $_POST['id'];
+}
+else
+{
+    $page->drawError('No ID set.');
+}
+$page->checkLoggedIn();
+$post = $page->getBlogPost($id);
+if ((!$page->isUserAdmin($page->getLoggedInUser()) && $page->getLoggedInUser()->ID != $post->author->ID) || !$page->isUserNormal($page->getLoggedInUser()))
+{
+    $page->drawError('You do not have permission to access this page.');
+}
+$error = '';
+if (isset($_POST['id'])) {
+    $page->checkCSRFToken($page->getLoggedInUser()->ID, $_POST['csrftoken']);
+    $lname = $page->acceptFile("file");
+    if ($lname == false)
+        die();
+    $content = $post->content;
+    if (isset($_POST['label']))
+    {
+       $label = $_POST['label'];
+       $content = $content . "\n\n[b]" . $label . "[/b]\n";
+    }
+    $content = $content . "[img]" . $lname . "[/img]";
+    if (empty($title)) {
+        $args = array($content, $id);
+        $page->query("UPDATE BlogPosts SET Content = ? WHERE ID = ?", $args);
+        $page->redirect('post.php?id=' . $id);
+    }
+}
+$page->drawHeader();
+$page->drawBlogCategoriesMenu();
+$page->drawMiddle();
+if (!empty($error)) {
+    $page->drawError($error, false);
+}
+?>
+<form action="add-post-img.php" method="post" enctype="multipart/form-data">
+<table>
+<tr>
+<td class="bold">Post Title: </td>
+<td><?php echo $post->title; ?></td>
+</tr>
+<tr>
+<td class="bold">Label: </td>
+<td><input type="text" name="label" value=""/></td>
+</tr>
+<tr>
+<td class="bold">File: </td>
+<td><input type="file" name="file" id="file"></td>
+</tr>
+<?php
+write('<input type="hidden" name="id" value="' . $id . '" />');
+?>
+<input type="hidden" name="csrftoken" value="<?php echo $page->getCSRFToken($page->getLoggedInUser()->ID); ?>" />
+    <tr>
+<td class="bold"></td>
+<td><input type="submit" value="Add Image" /></td>
+</tr>
+</table>
+</form>
+<?php
+$page->drawFooter();
+?>

 /blog/add-post.php
 ,6 → 21,8
 if (isset($_POST['post']))
 {
+    $page->checkCSRFToken($page->getLoggedInUser()->ID, $_POST['csrftoken']);
     $title = $_POST['title'];
     $content = $_POST['content'];
     $parentID = $_POST['parentID'];
 ,12 → 42,13
     }
     else
     {
-        if ($page->getLoggedInUser()->accessID >= 2 && $parentID == -1)
+        if (($page->getLoggedInUser()->accessID >= 2 && $parentID == -1) || $page->getLoggedInUser()->accessID > 2)
         {
             $page->drawError('You do not have permission to access this page.');
         }
-        $page->query('INSERT INTO BlogPosts VALUES(0, ' . $parentID . ', "' . $page->getLoggedInUser()->ID . '", "' . $title . '", "' . $content . '", NOW(), "' . $category . '", 0)');
+                $args = array(0, $parentID, $page->getLoggedInUser()->ID, $title, $content, $category, 0);
+        $page->query("INSERT INTO BlogPosts VALUES(?, ?, ?, ?, ?, NOW(), ?, ?)", $args);
         $page->redirect('post.php?id=' . $parentID);
     }
 }
 ,6 → 80,7
 </tr>
 <input type="hidden" name="post" value="yes" />
+<input type="hidden" name="csrftoken" value="<?php echo $page->getCSRFToken($page->getLoggedInUser()->ID); ?>" />
 <?php
 write('<input type="hidden" name="parentID" value="' . getParentID() . '" />');

 /blog/del-post.php
 ,7 → 7,7
 $id = $_GET['id'];
 if ($id)
 {
-    if ($page->isUserAdmin($page->getLoggedInUser()) || $page->getLoggedInUser()->ID == $page->getBlogPost($id)->author->ID)
+    if ($page->isUserAdmin($page->getLoggedInUser()) || $page->getLoggedInUser()->ID == $page->getBlogPost($id)->author->ID && $page->isUserNormal($page->getLoggedInUser()))
     {
         $page->delBlogPost($id);
     }

 /forums/edit-category.php
 ,0 → 1,59
+<?php
+require '../_taios.php';
+$page = new Taios_Page('Edit Category', '../');
+$page->drawHeader();
+$page->drawMiddle();
+$page->checkLoggedIn();
+$id = $page->getGetID();
+$cat = $page->getForumCategory($id);
+if ($page->isUserAdmin($page->getLoggedInUser()) && $cat)
+{
+if (isset($_GET['error']))
+{
+    $page->drawError($_GET['error'], false);
+}
+?>
+<form action="edit-category-do.php" method="POST">
+<input type="hidden" name="id" value="<?php echo $id; ?>" />
+<table>
+<tr>
+<td class="bold">Title: </td>
+<td><input type="text" name="title" value="<?php echo htmlentities($cat->title, ENT_QUOTES); ?>" /></td>
+</tr>
+<tr>
+<td class="bold">Description: </td>
+<td><input type="text" name="description" value="<?php echo htmlentities($cat->description, ENT_QUOTES); ?>" /></td>
+</tr>
+<tr>
+<td></td>
+<td><input type="submit" value="Edit" /></td>
+</tr>
+</table>
+</form>
+<?php
+}
+else
+{
+    if (!$cat)
+    {
+        $page->drawError('No such Forum Category, #' . $id);
+    }
+    else
+    {
+        $page->drawError('You do not have permission to access this page.');
+    }
+}
+$page->drawFooter();
+?>

 /forums/index.php
 ,8 → 3,6
 require '../_taios.php';
 $page = new Taios_Page('Forums', '../');
-$page->drawHeader();
-$page->drawMiddle();
 $parentID = $_GET['parentID'];
 if (empty($parentID))
 ,8 → 10,46
     $parentID = -1;
 }
-$ids = $page->findIDs('ForumCategories', 'WHERE ParentID = ' . $parentID . ' ORDER BY Title ASC');
+if (!is_numeric($parentID))
+{
+    $parentID = -1;
+}
+if ($parentID != -1)
+{
+    $page->title = $page->getForumCategory($parentID)->title;
+}
+$page->drawHeader();
+$page->drawMiddle();
+write('<p><i>The forums are still under construction.</i></p>');
+write('<p class="bold">');
+if ($parentID != -1)
+{
+    write('<a href="index.php?parentID=-1">Back to root</a>');
+}
+if ($page->isLoggedIn() && $page->isUserNormal($page->getLoggedInUser()))
+{
+    if ($parentID != -1)
+    {
+        write(' &middot; ');
+    }
+    write('<a href="add-post.php?categoryID=' . $parentID . '">Add Post</a>');
+}
+if ($page->isUserAdmin($page->getLoggedInUser()))
+{
+    if ($page->isLoggedIn())
+    {
+        write(' &middot; ');
+    }
+    write('<a href="add-category.php?parentID=' . $parentID . '">Add Category</a>');
+}
+write('</p><br />');
+$ids = $page->findIDs('ForumCategories', 'WHERE ParentID = "' . $parentID . '" ORDER BY Title ASC');
 if (count($ids) >= 1)
 {
     write('<h3>Categories</h3>');
 ,12 → 58,16
 for ($i = 0; $i < count($ids); $i++)
 {
     $forumCategory = $page->getForumCategory($ids[$i]);
-    write('<h4><a href="index.php?parentID=' . $forumCategory->ID . '">' . $forumCategory->title . '</a></h4>');
-    write('<p>' . $forumCategory->description . '</p>');
+    write('<h4><a href="index.php?parentID=' . $forumCategory->ID . '">' . htmlentities($forumCategory->title, ENT_QUOTES) . '</a></h4>');
+    write('<p>' . htmlentities($forumCategory->description, ENT_QUOTES) . '</p>');
+    if ($page->isUserAdmin($page->getLoggedInUser()))
+    {
+        write('<p class="bold"><a href="edit-category.php?id=' . $forumCategory->ID . '">Edit Category</a> &nbsp; &middot; &nbsp; <a href="delete-category-do.php?id=' . $forumCategory->ID . '">Delete Category</a></p>');
+    }
     write('<br />');
 }
-$ids = $page->findIDs('ForumPosts', 'WHERE CategoryID = ' . $parentID . ' AND ParentID = -1 ORDER BY Title ASC');
+$ids = $page->findIDs('ForumPosts', 'WHERE CategoryID = "' . $parentID . '" AND ParentID = -1 ORDER BY Title ASC');
 if (count($ids) >= 1)
 {
 ,7 → 77,7
 for ($i = 0; $i < count($ids); $i++)
 {
     $forumPost = $page->getForumPost($ids[$i]);
-    write('<h4><a href="post.php?id=' . $forumPost->ID . '">' . $forumPost->title . '</a></h4>');
+    write('<h4><a href="post.php?id=' . $forumPost->ID . '">' . htmlentities($forumPost->title, ENT_QUOTES) . '</a></h4>');
     write('<br />');
 }

 /forums/post.php
 ,29 → 1,45
-<?php
-require '../_taios.php';
-$page = new Taios_Page('Forum Post', '../');
-$page->drawHeader();
-$page->drawMiddle();
-$id = $page->getGetID();
-$forumPost = $page->getForumPost($id);
-write('<p class="bold"><a href="index.php?parentID=' . $forumPost->category->ID . '">Back to Topics</a></p><br />');
-write('<h3>' . $forumPost->title . '</h3>');
-write('<p>' . $page->replaceBBCode($forumPost->content) . '</p>');
-write('<br />');
-$ids = $page->findIDs('ForumPosts', 'WHERE ParentID = ' . $id . ' ORDER BY DatePosted DESC');
-for ($i = 0; $i < count($ids); $i++)
-{
-    $forumPost = $page->getForumPost($ids[$i]);
-write('<h4>' . $forumPost->title . '</h4>');
-write('<p>' . $page->replaceBBCode($forumPost->content) . '</p>');
-write('<br />');
-}
-$page->drawFooter();
-?>
+<?php
+require '../_taios.php';
+$page = new Taios_Page('Forum Post', '../');
+$page->drawHeader();
+$page->drawMiddle();
+$id = $page->getGetID();
+$forumPost = $page->getForumPost($id);
+write('<p class="bold"><a href="index.php?parentID=' . $forumPost->category->ID . '">Back to Topics</a></p><br />');
+write('<h3>' . htmlentities($forumPost->title, ENT_QUOTES) . '</h3>');
+write('<h5 style="color: #666666;">Posted On ' . date('l j F Y', $forumPost->datePosted) . ' by ' . htmlentities($forumPost->author->name, ENT_QUOTES) . ' (' . htmlentities($forumPost->author->username, ENT_QUOTES) . ')</h5>');
+write('<p>' . $page->replaceBBCode($forumPost->content) . '</p>');
+if ($page->isLoggedIn())
+{
+    write('<p class="bold"><a href="add-post.php?parentID=' . $id . '">Post Reply</a>');
+    if ($page->isUserAdmin($page->getLoggedInUser()) || $forumPost->author->ID == $page->getLoggedInUser()->ID)
+    {
+        write(' &nbsp; &middot; &nbsp; <a href="edit-post.php?id=' . $id . '">Edit Post</a>');
+        write(' &nbsp; &middot; &nbsp; <a href="delete-post-do.php?id=' . $id . '">Delete Post</a>');
+    }
+    write('</p>');
+}
+write('<br />');
+$ids = $page->findIDs('ForumPosts', 'WHERE ParentID = "' . $id . '" ORDER BY DatePosted ASC');
+for ($i = 0; $i < count($ids); $i++)
+{
+    $forumPost = $page->getForumPost($ids[$i]);
+    write('<h4>' . htmlentities($forumPost->title, ENT_QUOTES) . '</h4>');
+    write('<h5 style="color: #666666;">Posted On ' . date('l j F Y', $forumPost->datePosted) . ' by ' . htmlentities($forumPost->author->name, ENT_QUOTES) . ' (' . htmlentities($forumPost->author->username, ENT_QUOTES) . ')</h5>');
+    write('<p>' . $page->replaceBBCode($forumPost->content) . '</p>');
+    if ($page->isUserAdmin($page->getLoggedInUser()) || $forumPost->author->ID == $page->getLoggedInUser()->ID)
+    {
+        write('<p class="bold"><a href="edit-post.php?id=' . $ids[$i] . '">Edit Post</a>');
+        write(' &nbsp; &middot; &nbsp; <a href="delete-post-do.php?id=' . $ids[$i] . '">Delete Post</a></p>');
+    }
+    write('<br />');
+}
+$page->drawFooter();
+?>

 /forums/add-post-do.php
 ,0 → 1,39
+<?php
+require '../_taios.php';
+$page = new Taios_Page('Add Category', '../');
+$page->checkLoggedIn();
+$parentID = $_POST['parentID'];
+if (empty($parentID)) {
+    $parentID = -1;
+}
+$categoryID = $_POST['categoryID'];
+if (empty($categoryID)) {
+    $parentID = -1;
+}
+$title = $_POST['title'];
+$content = $_POST['content'];
+if (!$page->isUserNormal($page->getLoggedInUser())) {
+    $page->redirect('add-post.php?error=You do not have permission to access this page');
+}
+if (empty($title)) {
+    $page->redirect('add-post.php?error=No Title Specified');
+}
+if (empty($title)) {
+    $page->redirect('add-post.php?error=No Content Specified');
+}
+$args = array($page->getLoggedInUser()->ID, $categoryID, $parentID, $title, $content);
+$page->query("INSERT INTO ForumPosts VALUES (0, ?, ?, ?, ?, ?, NOW(), FALSE)", $args);
+$page->redirect('index.php?parentID=' . $categoryID);
+?>

 /forums/delete-category-do.php
 ,0 → 1,19
+<?php
+require '../_taios.php';
+$page = new Taios_Page('Delete Category', '../');
+$page->checkLoggedIn();
+$id = $page->getGetID();
+if ($page->isUserAdmin($page->getLoggedInUser())) {
+    $page->query("DELETE FROM ForumCategories WHERE ID = ?", array($id));
+    $page->redirect('index.php');
+} else {
+    $page->drawError('You do not have permission to access this page.');
+}
+?>

 /forums/edit-category-do.php
 ,0 → 1,26
+<?php
+require '../_taios.php';
+$page = new Taios_Page('Edit Category', '../');
+$page->checkLoggedIn();
+$id = $page->getPostID();
+$title = $_POST['title'];
+$description = $_POST['description'];
+if ($page->isUserAdmin($page->getLoggedInUser())) {
+    if (empty($title)) {
+        $page->redirect('edit-category.php?error=No Title Specified');
+    }
+    $args = array($title, $description, $id);
+    $page->query("UPDATE ForumCategories SET Title = ?, Description = ? WHERE ID = ?", $args);
+    $page->redirect('index.php');
+} else {
+    $page->drawError('You do not have permission to access this page.');
+}
+?>

 /forums/add-category-do.php
 ,0 → 1,28
+<?php
+require '../_taios.php';
+$page = new Taios_Page('Add Category', '../');
+$page->checkLoggedIn();
+$parentID = $_POST['parentID'];
+if (empty($parentID)) {
+    $parentID = -1;
+}
+$title = $_POST['title'];
+$description = $_POST['description'];
+if ($page->isUserAdmin($page->getLoggedInUser())) {
+    if (empty($title)) {
+        $page->redirect('add-category.php?error=No Title Specified');
+    }
+    $page->query("INSERT INTO ForumCategories VALUES (0, ?, ?, ?)", array($parentID, $title, $description));
+    $page->redirect('index.php?parentID=' . $parentID);
+} else {
+    $page->drawError('You do not have permission to access this page.');
+}
+?>

 /forums/delete-post-do.php
 ,0 → 1,23
+<?php
+require '../_taios.php';
+$page = new Taios_Page('Delete Post', '../');
+$page->checkLoggedIn();
+$id = $page->getGetID();
+$post = $page->getForumPost($id);
+if (($page->isUserAdmin($page->getLoggedInUser()) || $post->author->ID == $page->getLoggedInUser()->ID) && $post && $page->isUserNormal($page->getLoggedInUser())) {
+    $page->query("DELETE FROM ForumPosts WHERE ID = ?", array($id));
+    $page->redirect('index.php');
+} else {
+    if (!$post) {
+        $page->drawError('No such forum post, #' . $id);
+    } else {
+        $page->drawError('You do not have permission to access this page.');
+    }
+}
+?>

 /forums/add-post.php
 ,0 → 1,62
+<?php
+require '../_taios.php';
+$page = new Taios_Page('Add Post', '../');
+$page->drawHeader();
+$page->drawMiddle();
+$page->checkLoggedIn();
+$parentID = $_GET['parentID'];
+if (empty($parentID))
+{
+    $parentID = -1;
+}
+$categoryID = $_GET['categoryID'];
+if (empty($categoryID))
+{
+    $categoryID = -1;
+}
+if ($page->isLoggedIn() && $page->isUserNormal($page->getLoggedInUser))
+{
+if (isset($_GET['error']))
+{
+    $page->drawError($_GET['error'], false);
+}
+?>
+<form action="add-post-do.php" method="POST">
+<input type="hidden" name="parentID" value="<?php echo $parentID; ?>" />
+<input type="hidden" name="categoryID" value="<?php echo $categoryID; ?>" />
+<table>
+<tr>
+<td class="bold">Title: </td>
+<td><input type="text" name="title" /></td>
+</tr>
+<tr>
+<td class="bold">Content: </td>
+<td><textarea name="content"></textarea></td>
+</tr>
+<tr>
+<td></td>
+<td><input type="submit" value="Add" /></td>
+</tr>
+</table>
+</form>
+<?php
+}
+else
+{
+    $page->drawError('You do not have permission to access this page.');
+}
+$page->drawFooter();
+?>

 /forums/add-category.php
 ,0 → 1,55
+<?php
+require '../_taios.php';
+$page = new Taios_Page('Add Category', '../');
+$page->drawHeader();
+$page->drawMiddle();
+$page->checkLoggedIn();
+$parentID = $_GET['parentID'];
+if (empty($parentID))
+{
+    $parentID = -1;
+}
+if ($page->isUserAdmin($page->getLoggedInUser()))
+{
+if (isset($_GET['error']))
+{
+    $page->drawError($_GET['error'], false);
+}
+?>
+<form action="add-category-do.php" method="POST">
+<input type="hidden" name="parentID" value="<?php echo $parentID; ?>" />
+<table>
+<tr>
+<td class="bold">Title: </td>
+<td><input type="text" name="title" /></td>
+</tr>
+<tr>
+<td class="bold">Description: </td>
+<td><input type="text" name="description" /></td>
+</tr>
+<tr>
+<td></td>
+<td><input type="submit" value="Add" /></td>
+</tr>
+</table>
+</form>
+<?php
+}
+else
+{
+    $page->drawError('You do not have permission to access this page.');
+}
+$page->drawFooter();
+?>

 /index.php
 ,33 → 4,36
 $page = new Taios_Page('Home');
 $page->drawHeader();
-write('<h3>Pages</h3>');
-$page->drawMenuItem('Biggles', '/~biggles/');
-$page->drawMenuItem('Freddie', '/~freddie/');
-$page->drawMenuItem('Muzer', '/~muzer/');
-$page->drawMenuItem('Sh4rk', '/~szabot/');
-$page->drawMenuItem('Tom', '/~tom/');
 $page->drawMiddle();
 ?>
 <p class="bold">Welcome to Tim32!</p>
-<p>Tim32 is a 10 year-old laptop running Ubuntu Server Edition 10.04.</p>
+<?php
+write('<p>Tim32 is a ' . (date("Y") - 2000) . '-year-old laptop running Ubuntu Server Edition 14.04.</p>');
+write('<p>On the other hand, Tim36 (which is serving this page) is a ' . (date("Y") - 2007) . '-year-old laptop running Ubuntu Server Edition 10.04.</p>');
+?>
+<p>By using this website, you hereby accept cookies being stored on your computer.</p>
 <br />
-<h3>Latest Blog Posts</h3>
+<h3 title="Take the Tim32 challenge: http://tim32.org/challenge/">Latest Blog Posts</h3>
+<p><a href="blog/rss.php">Rss Feed</a></p>
 <?php
-$ids = $page->findIDs('BlogPosts', 'WHERE ParentID = -1 ORDER BY DatePosted DESC');
-for ($i = 0; $i < 5 && $i < count($ids); $i++)
+$ids = $page->findIDs('BlogPosts', 'WHERE ParentID = -1 AND Category != "Drafts" ORDER BY DatePosted DESC');
+for ($i = 0; $i < 4 && $i < count($ids); $i++)
 {
     $id = $ids[$i];
     $post = $page->getBlogPost($id);
-    write('<h4><a href="blog/post.php?id=' . $post->ID . '">' . $post->title. '</a></h4>');
-    write('<h5 style="color: #666666;">Posted On ' . date('l j F Y', $post->datePosted) . ' by ' . $post->user->name . ' (' . $post->user->username . ')</h5>');
+    $comment_count = 0;
+    $ids2 = $page->findIDs('BlogPosts', 'WHERE ParentID="' . $id . '"');
+    write('<a href="blog/post.php?id=' . $id . '"><h3>' . htmlentities($post->title, ENT_QUOTES). '</h3></a>');
+    write('<h5 style="color: #666666;">Posted On ' . date('l j F Y', $post->datePosted) . ' by ' . htmlentities($post->user->name, ENT_QUOTES) . ' (' . htmlentities($post->user->username, ENT_QUOTES) . ')</h5>');
     write('<p>' . $page->replaceBBCode($post->content) . '</p>');
+    write('<h5 style="color: #666666;">' . count($ids2) . ' Comments</h5>');
     write('<br />');
 }

 /photos/album.php
 ,8 → 28,6
 }
 $page = new Taios_Page('Photo Albums', '../');
-$page->drawHeader();
-$page->drawMiddle();
 $dirName = $_GET['dir'];
 if (empty($dirName))
 ,34 → 35,83
     $page->redirect('index.php');
 }
+while (strpos($dirName, '../') !== false) {
+    $dirName = str_replace("../", "/", $dirName);
+}
+$page->drawHeader();
+write('<br /><h3>RSS</h3>');
+$page->drawMenuItem('RSS Feed', 'photos/rss.php?dir=' . $dirName);
+$page->drawMiddle();
 write('<p class="bold"><a href="index.php">Back to Photos</a></p><br />');
+if (file_exists("albums/" . $dirName . "/description.txt"))
+{
+    write('<p>' . $page->replaceBBCode(file_get_contents("albums/" . $dirName . "/description.txt")) . '</p><br />');
+}
 write('<table>');
 write('<tr>');
+$directory = "albums/" . $dirName . "/";
+$sortOrder = "newestFirst";
+$results = array();
+$handler = opendir($directory);
+while ($file = readdir($handler))
+{
+    if ($file != '.' && $file != '..' && $file != "robots.txt" && $file != ".htaccess" && getimagesize($directory . $file))
+    {
+           $currentModified = filectime($directory . $file);
+           $file_names[] = $file;
+           $file_dates[] = $currentModified;
+    }
+}
+closedir($handler);
+if ($sortOrder == "newestFirst")
+{
+    arsort($file_dates);
+}
+else
+{
+    asort($file_dates);
+}
+$file_names_Array = array_keys($file_dates);
+foreach ($file_names_Array as $idx => $name) $name=$file_names[$name];
+$file_dates = array_merge($file_dates);
+$i = 0;
+$indexInArray = 0;
 $i = 0;
-$dir = dir('albums/' . $dirName);
-while (($file = $dir->read()) !== false)
+foreach ($file_dates as $$file_dates)
 {
-    if ($file[0] != '.')
+    $j = $file_names_Array[$indexInArray];
+    $file = $file_names[$j];
+    if ($i >= 3)
     {
-        if ($i >= 4)
-        {
-            write('</tr><tr>');
-        }
+        write('</tr><tr>');
+        $i = 0;
+    }
-        $filename = 'albums/' . $dirName . '/' . $file;
-        $size = getImageSizes($filename, 200, 200);
-        write('<td><a href="' . $filename . '"><img wdith="' . $size[0] . '" height="' . $size[1] . '" src="' . $filename . '" /></a></td>');
+    $filename = $directory . $file;
+    $size = getImageSizes($filename, 280, 260);
+    write('<td><a href="' . str_replace(" ", "%20", $filename) . '"><img width="' . $size[0] . '" height="' . $size[1] . '" src="' . str_replace(" ", "%20", $filename) . '" /></a></td>');
-        $i++;
-    }
+    $i++;
+    $indexInArray++;
 }
 write('</tr>');
-write('<table>');
+write('</table>');
 $page->drawFooter();

 /photos/rss.php
 ,0 → 1,80
+<?php
+require '../_taios.php';
+header("Content-type: application/rss+xml");
+$page = new Taios_Page('Photos RSS Feed', '../');
+$dirName = $_GET['dir'];
+if (empty($dirName))
+{
+    $dirName = "Lassitor";
+}
+while (strpos($dirName, '../') !== false) {
+    $dirName = str_replace("../", "/", $dirName);
+}
+write('<?xml version="1.0" encoding="UTF-8" ?>');
+write('<rss version="2.0">');
+write('<channel>');
+write('<title>Tim32 Photo RSS - ' . $dirName . '</title>');
+write('<description>This is the RSS feed for the Tim32 Photos.</description>');
+write('<link>http://tim32.org/photos/album.php?dir=' . $dirName . '</link>');
+$directory = "albums/" . $dirName . "/";
+$sortOrder = "newestFirst";
+$results = array();
+$handler = opendir($directory);
+while ($file = readdir($handler))
+{
+    if ($file != '.' && $file != '..' && $file != "robots.txt" && $file != ".htaccess" && getimagesize($directory . $file))
+    {
+           $currentModified = filectime($directory . $file);
+           $file_names[] = $file;
+           $file_dates[] = $currentModified;
+    }
+}
+closedir($handler);
+if ($sortOrder == "newestFirst")
+{
+    arsort($file_dates);
+}
+else
+{
+    asort($file_dates);
+}
+$file_names_Array = array_keys($file_dates);
+foreach ($file_names_Array as $idx => $name) $name=$file_names[$name];
+$file_dates = array_merge($file_dates);
+$indexInArray = 0;
+foreach ($file_dates as $date)
+{
+    $j = $file_names_Array[$indexInArray];
+    $file = $file_names[$j];
+    $filename = $directory . $file;
+    write('<item>');
+    write('<title>' . $file . '</title>');
+    write('<link>http://tim32.org/photos/' . str_replace(" ", "%20", $filename) . '</link>');
+    write('<guid>id_' . $file . '</guid>');
+    write('<pubDate>' . date('D, d M Y H:i:s O', $date). '</pubDate>');
+    write('<description><![CDATA[<img src="http://tim32.org/photos/' . str_replace(" ", "%20", $filename) . '" />]]></description>');
+    write('</item>');
+    $indexInArray++;
+}
+write('</channel>');
+write('</rss>');
+?>

 /photos/index.php
 ,9 → 8,17
 write('<p>Here we have all sorts of photos from Tim32.</p><br />');
+$dirs = array();
 $dir = dir('albums/');
 while (($file = $dir->read()) !== false)
 {
+    array_push($dirs, $file);
+}
+asort($dirs);
+foreach ($dirs as $file)
+{
     if ($file[0] != '.')
     {
         write('<p><a href="album.php?dir=' . $file . '">' . $file . '</a></p>');

 /projects/edit-project.php
 ,6 → 6,8
 $page->drawHeader();
 $page->drawMiddle();
+$page->checkLoggedIn();
 $project = $page->getProject($page->getGetID());
 if (!$project)
 {
 ,32 → 36,33
 <table>
 <tr>
 <td class="bold">Title: </td>
-<td><input type="text" name="title" value="<?php echo $project->title; ?>" /></td>
+<td><input type="text" name="title" value="<?php echo htmlentities($project->title, ENT_QUOTES); ?>" /></td>
 </tr>
 <tr>
 <td class="bold">Description: </td>
-<td><textarea name="description"><?php echo $project->description; ?></textarea></td>
+<td><textarea name="description"><?php echo htmlentities($project->description, ENT_QUTOES); ?></textarea></td>
 </tr>
 <tr>
 <td class="bold">Logo URL: </td>
-<td><input type="text" name="logourl" value="<?php echo $project->logoURL; ?>" /></td>
+<td><input type="text" name="logourl" value="<?php echo htmlentities($project->logoURL, ENT_QUOTES); ?>" /></td>
 </tr>
 <tr>
 <td class="bold">Website URL: </td>
-<td><input type="text" name="websiteurl" value="<?php echo $project->websiteURL; ?>" /></td>
+<td><input type="text" name="websiteurl" value="<?php echo htmlentities($project->websiteURL, ENT_QUOTES); ?>" /></td>
 </tr>
 <tr>
 <td class="bold">DownloadURL: </td>
-<td><input type="text" name="downloadurl" value="<?php echo $project->downloadURL; ?>" /></td>
+<td><input type="text" name="downloadurl" value="<?php echo htmlentities($project->downloadURL, ENT_QUOTES); ?>" /></td>
 </tr>
 <tr>
 <td class="bold">Latest Version: </td>
-<td><input type="text" name="latestversion" value="<?php echo $project->latestVersion; ?>" /></td>
+<td><input type="text" name="latestversion" value="<?php echo htmlentities($project->latestVersion, ENT_QUTOES); ?>" /></td>
 </tr>
 <tr>
 <td class="bold"></td>
 <td><input type="submit" value="Edit Project" /></td>
 </tr>
+<input type="hidden" name="csrftoken" value="<?php echo $page->getCSRFToken($page->getLoggedInUser()->ID); ?>" />
 </table>
 </form>

 /projects/index.php
 ,10 → 19,10
     $id = $ids[$i];
     $project = $page->getProject($id);
-    write('<h3>' . $project->title . '</h3>');
+    write('<h3>' . htmlentities($project->title, ENT_QUOTES) . '</h3>');
     write('<table style="border: 0px;">');
     write('<tr>');
-    write('<td style="border: 0px; vertical-align: top;"><img class="smiley" src="' . $project->logoURL . '" /></td>');
+    write('<td style="border: 0px; vertical-align: top;"><img class="smiley" src="' . htmlentities($project->logoURL, ENT_QUOTES). '" alt="' . htmlentities($project->title, ENT_QUOTES) . ' logo" /></td>');
     write('<td style="border: 0px;">');
     if (empty($project->latestVersion))
     {
 ,18 → 30,18
     }
     else
     {
-        write('<h4>Latest Version: ' . $project->latestVersion . '</h4>');
+        write('<h4>Latest Version: ' . htmlentities($project->latestVersion, ENT_QUOTES) . '</h4>');
     }
-    write('<p>Project Author: ' . $project->author->name . '</p>');
+    write('<p>Project Author: ' . htmlentities($project->author->name, ENT_QUOTES) . '</p>');
     write('<p>' . $page->replaceBBCode($project->description) . '</p>');
     write('<p>');
     if (!empty($project->websiteURL))
     {
-        write('<a href="' . $project->websiteURL . '">Website</a>');
+        write('<a href="' . htmlentities($project->websiteURL, ENT_QUOTES) . '">Website</a>');
     }
     if (!empty($project->downloadURL))
     {
-        write(' &middot; <a href="' . $project->downloadURL . '">Download</a>');
+        write(' &middot; <a href="' . htmlentities($project->downloadURL, ENT_QUOTES) . '">Download</a>');
     }
     write('</p>');
     write('</td>');
 ,7 → 49,7
     write('</table>');
     if ($page->isUserAdmin($page->getLoggedInUser()) || $user->ID == $project->author->ID)
     {
-        write('<p><a href="edit-project.php?id=' . $project->ID . '">Edit Project</a> &nbsp;&nbsp; &middot; &nbsp;&nbsp; <a href="delete-project-do.php?id=' . $project->ID . '">Delete Project</a></p>');
+        write('<p class="bold"><a href="edit-project.php?id=' . $project->ID . '">Edit Project</a> &nbsp;&nbsp; &middot; &nbsp;&nbsp; <a href="delete-project-do.php?id=' . $project->ID . '">Delete Project</a></p>');
     }
     write('<br />');
 }

 /projects/edit-project-do.php
 ,6 → 4,8
 $page = new Taios_Page('Edit Project', '../');
+$page->checkCSRFToken($page->getLoggedInUser()->ID, $_POST['csrftoken']);
 $project = $page->getProject($page->getPostID());
 if (!$project)
 {
 ,37 → 24,34
 if ($page->isUserAdmin($page->getLoggedInUser()) || $page->getLoggedInUser()->ID == $project->author->ID)
 {
-    if (!empty($title))
-    {
-        $page->query('UPDATE Projects SET Title = "' . $title . '" WHERE ID = ' . $project->ID);
+    if (!empty($title)) {
+        $page->query("UPDATE Projects SET Title = ? WHERE ID = ?", array($title, $project->ID));
     }
-    if (!empty($description))
-    {
-        $page->query('UPDATE Projects SET Description = "' . $description . '" WHERE ID = ' . $project->ID);
+    if (!empty($description)) {
+        $page->query("UPDATE Projects SET Description = ? WHERE ID = ?", array($description, $project->ID));
     }
-    if (!empty($logoURL))
-    {
-        $page->query('UPDATE Projects SET LogoURL = "' . $logoURL . '" WHERE ID = ' . $project->ID);
+    if (!empty($logoURL)) {
+        $page->query("UPDATE Projects SET LogoURL = ? WHERE ID = ?", array($logoURL, $project->ID));
     }
-    if (!empty($websiteURL))
-    {
-        $page->query('UPDATE Projects SET WebsiteURL = "' . $websiteURL . '" WHERE ID = ' . $project->ID);
+    if (!empty($websiteURL)) {
+        $page->query("UPDATE Projects SET WebsiteURL = ? WHERE ID = ?", array($websiteURL, $project->ID));
     }
-    if (!empty($downloadURL))
-    {
-        $page->query('UPDATE Projects SET DownloadURL = "' . $downloadURL . '" WHERE ID = ' . $project->ID);
+    if (!empty($downloadURL)) {
+        $page->query("UPDATE Projects SET DownloadURL = ? WHERE ID = ?", array($downloadURL, $project->ID));
     }
-    if (!empty($latestVersion))
-    {
-        $page->query('UPDATE Projects SET LatestVersion = "' . $latestVersion . '" WHERE ID = ' . $project->ID);
+    if (!empty($latestVersion)) {
+        $page->query("UPDATE Projects SET LatestVersion = ? WHERE ID = ?", array($latestVersion,  $project->ID));
     }
-    $page->query('UPDATE Projects SET LastUpdate = NOW() WHERE ID = ' . $project->ID);
+    $page->query("UPDATE Projects SET LastUpdate = NOW() WHERE ID = ?", array($project->ID));
     $page->redirect('index.php');
-}
-else
-{
+} else {
     $page->drawError('You do not have permission to access this page.');
 }

 /projects/add-project-do.php
 ,6 → 4,8
 $page = new Taios_Page('Add Project', '../');
+$page->checkCSRFToken($page->getLoggedInUser()->ID, $_POST['csrftoken']);
 $title = $_POST['title'];
 $description = $_POST['description'];
 $logoURL = $_POST['logourl'];
 ,22 → 16,19
 $page->checkLoggedIn();
 $user = $page->getLoggedInUser();
-if (empty($title))
-{
+if (empty($title)) {
     $page->redirect('add-project.php?error=No Title Specified');
 }
-if (empty($description))
-{
+if (empty($description)) {
     $page->redirect('add-project.php?error=No Title Specified');
 }
-if ($page->isUserGM($user))
-{
-    $page->query('INSERT INTO Projects VALUES (0, ' . $user->ID . ', "' . $title . '", "' . $description . '", "' . $logoURL . '", "' . $downloadURL . '", "' . $websiteURL . '", "' . $latestVersion . '", NOW())');
+if ($page->isUserGM($user)) {
+        $args = array($user->ID, $title, $description, $logoURL, $downloadURL, $websiteURL, $latestVersion);
+    $page->query("INSERT INTO Projects VALUES (0, ?, ?, ?, ?, ?, ?, ?, NOW())", $args);
     $page->redirect('index.php');
-}
-else
-{
+} else {
     $page->drawError('You do not have permission to access this page.');
 }

/projects/add-project.php
54,6 → 54,7
<td class="bold"></td>
<td><input type="submit" value="Add Project" /></td>
</tr>
<input type="hidden" name="csrftoken" value="<?php echo $page->getCSRFToken($page->getLoggedInUser()->ID); ?>" />
</table>
</form>

 /projects/delete-project-do.php
 ,19 → 8,13
 $id = $page->getGetID();
 $project = $page->getProject($id);
-if (($page->isUserAdmin($page->getLoggedInUser()) || $page->getLoggedInUser()->ID == $project->author->ID) && $project)
-{
-    $page->query('DELETE FROM Projects WHERE ID = ' . $id);
+if (($page->isUserAdmin($page->getLoggedInUser()) || $page->getLoggedInUser()->ID == $project->author->ID) && $project) {
+    $page->query("DELETE FROM Projects WHERE ID = ?", array($id));
     $page->redirect('index.php');
-}
-else
-{
-    if (!$project)
-    {
+} else {
+    if (!$project) {
         $page->drawError('No such project, #' . $id);
-    }
-    else
-    {
+    } else {
         $page->drawError('You do not have permission to access this page.');
     }
 }

 /tcp.js
 ,0 → 1,51
+function updateResult(box, text) {
+    box.find(".tcp_inner_result").html("<i>Loading...</i>");
+    $.get('//tim32.org/timlan/lookup/tcppop.php?totr=' + text, function(data) {
+        box.find(".tcp_inner_result").html(data);
+    });
+}
+function openBox(box) {
+    var text = box.attr("data-text");
+    box.append("<div class=\"tcp_inner\"><input type=\"text\" value=\"" + text + "\" /><input type=\"submit\" value=\"Parse\" /><br /><div class=\"tcp_inner_result\"></div></div>");
+    box.children(".tcp_inner").hide().fadeIn();
+    updateResult(box, text);
+    box.find("input[type=submit]").click(function() {
+        updateResult(box, box.find("input[type=text]").val());
+        return false;
+    });
+    box.find("input[type=text]").change(function() {
+        updateResult(box, $(this).val());
+    });
+}
+function closeBox(box) {
+    $(box).children(".tcp_inner").fadeOut(function() {
+        $(this).remove();
+    });
+}
+$(document).ready(function() {
+    $(".tcp .tcp_button").on("click", function() {
+        var box = $(this).parent();
+        var s = box.attr("data-status");
+        if (s == "closed") {
+            box.attr("data-status", "open");
+            $(this).attr("src", "//tim32.org/timlan/noTCP.png");
+            $(this).attr("title", "Close TCP Editor");
+            openBox(box);
+        } else {
+            box.attr("data-status", "closed");
+            $(this).attr("src", "//tim32.org/timlan/goTCP.png");
+            $(this).attr("title", "Open TCP Editor");
+            closeBox(box);
+        }
+    });
+});

 /wiki/edit-do.php
 ,6 → 2,22
 require '../_taios.php';
+if (get_magic_quotes_gpc()) {
+    $process = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
+    while (list($key, $val) = each($process)) {
+        foreach ($val as $k => $v) {
+            unset($process[$key][$k]);
+            if (is_array($v)) {
+                $process[$key][stripslashes($k)] = $v;
+                $process[] = &$process[$key][stripslashes($k)];
+            } else {
+                $process[$key][stripslashes($k)] = stripslashes($v);
+            }
+        }
+    }
+    unset($process);
+}
 $pageName = $_POST['page'];
 if (empty($pageName))
 {
 ,9 → 26,18
 $page = new Taios_Page('Edit Page - ' . $pageName, '../');
+$page->checkLoggedIn();
 if ($page->isUserGM($page->getLoggedInUser()))
 {
+    while (strpos($pageName, '../') !== false) {
+        $pageName = str_replace("../", "/", $pageName);
+    }
     $filename = 'pages/' . $pageName . '.txt';
+    if(!is_dir(dirname($filename)))
+        mkdir(dirname($filename), 0777, true);
     $fp = @fopen($filename, 'w');
     if ($fp)

 /wiki/edit.php
 ,7 → 1,21
 <?php
 require '../_taios.php';
+if (get_magic_quotes_gpc()) {
+    $process = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
+    while (list($key, $val) = each($process)) {
+        foreach ($val as $k => $v) {
+            unset($process[$key][$k]);
+            if (is_array($v)) {
+                $process[$key][stripslashes($k)] = $v;
+                $process[] = &$process[$key][stripslashes($k)];
+            } else {
+                $process[$key][stripslashes($k)] = stripslashes($v);
+            }
+        }
+    }
+    unset($process);
+}
 $pageName = $_GET['page'];
 if (empty($pageName))
 {
 ,12 → 22,18
     $pageName = 'Index';
 }
-$page = new Taios_Page('Edit Page - ' . $pageName, '../');
+$page = new Taios_Page('Edit Page - ' . htmlentities($pageName, ENT_QUOTES), '../');
 $page->drawHeader();
 $page->drawMiddle();
+$page->checkLoggedIn();
 if ($page->isUserGM($page->getLoggedInUser()))
 {
+    while (strpos($pageName, '../') !== false) {
+        $pageName = str_replace("../", "/", $pageName);
+    }
     $filename = 'pages/' . $pageName . '.txt';
     $content = "";
 ,10 → 48,10
 ?>
 <form action="edit-do.php" method="POST">
-<input type="hidden" name="page" value="<?php echo $pageName; ?>" />
+<input type="hidden" name="page" value="<?php echo htmlentities($pageName, ENT_QUOTES); ?>" />
 <table>
 <tr>
-<td><textarea name="content"><?php echo $content; ?></textarea></td>
+<td><textarea name="content"><?php write(htmlentities($content, ENT_QUOTES)); ?></textarea></td>
 </tr>
 <tr>
 <td><input type="submit" value="Edit" /></td>

 /wiki/index.php
 ,7 → 1,28
 <?php
+function endswith($string, $test) {
+    $strlen = strlen($string);
+    $testlen = strlen($test);
+    if ($testlen > $strlen) return false;
+    return substr_compare($string, $test, -$testlen) === 0;
+}
 require '../_taios.php';
+if (get_magic_quotes_gpc()) {
+    $process = array(&$_GET, &$_POST, &$_COOKIE, &$_REQUEST);
+    while (list($key, $val) = each($process)) {
+        foreach ($val as $k => $v) {
+            unset($process[$key][$k]);
+            if (is_array($v)) {
+                $process[$key][stripslashes($k)] = $v;
+                $process[] = &$process[$key][stripslashes($k)];
+            } else {
+                $process[$key][stripslashes($k)] = stripslashes($v);
+            }
+        }
+    }
+    unset($process);
+}
 $pageName = $_GET['page'];
 if (empty($pageName))
 {
 ,15 → 29,40
     $pageName = 'Index';
 }
-$page = new Taios_Page('Wiki - ' . $pageName, '../');
+$page = new Taios_Page('Wiki &middot; ' . htmlentities($pageName, ENT_QUOTES), '../');
+if (isset($_GET['random']))
+{
+    $results = array();
+    $handler = opendir('pages/');
+    while ($file = readdir($handler))
+    {
+        if ($file != '.' && $file != '..' && endswith($file, ".txt"))
+        {
+            $results[] = substr($file, 0, count($file) - 5);
+        }
+    }
+    $index = rand() % count($results);
+    $result = $results[$index];
+    $page->redirect('index.php?page=' . $result);
+}
 $page->drawHeader();
+write('<h3>Wiki</h3>');
+$page->drawMenuItem('Index', 'wiki/index.php');
+$page->drawMenuItem('Random Page', 'wiki/index.php?random');
 $page->drawMiddle();
 if ($page->isUserGM($page->getLoggedInUser()))
 {
-    write('<p><a href="edit.php?page=' . $pageName . '">Edit Page</a></p><br />');
+    write('<p class="bold"><a href="edit.php?page=' . htmlentities($pageName, ENT_QUOTES) . '">Edit Page</a></p><br />');
 }
+while (strpos($pageName, '../') !== false) {
+    $pageName = str_replace("../", "/", $pageName);
+}
 $filename = 'pages/' . $pageName . '.txt';
 $fp = @fopen($filename, 'r');
 ,6 → 76,26
     write('<p>This page is empty.</p>');
 }
+if(is_dir('pages/' . $pageName))
+{
+    write('<p>Directory listing of ' . htmlentities($pageName, ENT_QUOTES) . ':</p>');
+    write('<ul>');
+    $dir = opendir('pages/' . $pageName);
+    if($dir)
+    {
+        while (($file = readdir($dir)) !== false)
+        {
+            if($file != '.' && $file != '..' && (preg_match('/\.txt$/', $file) || is_dir('pages/' . $pageName . '/' . $file)))
+            {
+                $file = preg_replace('/\.txt$/', '', $file);
+                write('<li><a href="index.php?page=' . htmlentities($pageName, ENT_QUOTES) . '/' . htmlentities($file, ENT_QUOTES) . '">' . htmlentities($file, ENT_QUOTES) . '</a></li>');
+            }
+        }
+    }
+    write('</ul>');
+    write('<p>End of directory listing</p>');
+}
 $page->drawFooter();
 ?>

/wiki/pages/Index.txt
File deleted

Property changes:
Deleted: svn:executable
## -1 +0,0 ##
-*
\ No newline at end of property
Index: _config.dummy.php
===================================================================
--- _config.dummy.php (nonexistent)
+++ _config.dummy.php (revision 522)
@@ -0,0 +1,11 @@
+
+
+define('MYSQL_HOST', 'localhost');
+define('MYSQL_USER', 'taios');
+define('MYSQL_PASSWORD', 'dummy');
+define('ALLOW_FILES', false);
+define('ROOT_PATH', 'http://wolves.org/~dummy/taios/');
+define('RECAPTCHA_PUBLICKEY', 'dummy');
+define('RECAPTCHA_PRIVATEKEY', 'dummy');
+
+?>
Index: install.sql
===================================================================
--- install.sql (revision 264)
+++ install.sql (revision 522)
@@ -11,6 +11,8 @@
Password TEXT,
EmailAddress TEXT,
Name TEXT,
+ Salt TEXT,
+ CSRFToken TEXT,
ChallengeID INT,
PRIMARY KEY(ID)
);
@@ -64,7 +66,7 @@
PRIMARY KEY(ID)
);
-INSERT INTO Users VALUES (1, 0, "admin", SHA1("password"), "admins@tim32.org", "Tim32 Admin", 0);
+INSERT INTO Users VALUES (1, 0, "admin", SHA1("passwordrostok"), "admins@tim32.org", "Tim32 Admin", "rostok", "rostok", 0);
INSERT INTO BlogPosts VALUES(1, -1, 1, "Welcome to Tim32!", "Welcome to the new Tim32 website! It has had a complete design re-think to make it simpler and easier to use!", NOW(), "Tim32", FALSE);
INSERT INTO Projects VALUES (1, 1, "TAIOS", "TAIOS (The All In One System) is a PHP based system to make the Tim32 website very self contained and altogether.", "http://websvn.kde.org/checkout/trunk/kdesupport/oxygen-icons/64x64/categories/applications-internet.png", "", "http://tim32.org/~tom/taios/", "SVN", NOW());
INSERT INTO ForumCategories VALUES (1, -1, "Tim32", "Talk about Tim32 in here");

 /register-do.php
 ,6 → 1,7
 <?php
 require '_taios.php';
+require_once '_recaptchalib.php';
 $page = new Taios_Page('Login');
 ,6 → 10,7
 $password2 = $_POST['password2'];
 $email = $_POST['email'];
 $name = $_POST['name'];
+$maths = $_POST['maths'];
 if (empty($username))
 {
 ,9 → 28,25
 {
     $page->redirect('register.php?error=Passwords do not match');
 }
+if ($maths != '75')
+{
+    $page->redirect('register.php?error=Incorrect maths answer');
+}
-$page->query('INSERT INTO Users (AccessID, Username, Password, EmailAddress, Name, ChallengeID) VALUES (2, "' . $username . '", "' . sha1($password) . '", "' . $email . '", "' . $name . '", 0)');
+$resp = recaptcha_check_answer(RECAPTCHA_PRIVATEKEY, $_SERVER["REMOTE_ADDR"],
+                               $_POST["recaptcha_challenge_field"],
+                               $_POST["recaptcha_response_field"]);
+if (!$resp->is_valid)
+{
+    $page->redirect('register.php?error=Incorrect reCAPTCHA response');
+}
+$salt = $username . "horses";
+$args = array(2, $username, $page->saltAndBurn($password, $salt), $salt, $email, $name, $page->rndString(), 0);
+$page->query("INSERT INTO Users (AccessID, Username, Password, Salt, EmailAddress, Name, CSRFToken, ChallengeID) VALUES (?, ?, ?, ?, ?, ?, ?, ?)", $args);
 $page->redirect('login.php');
 ?>

 /login-do.php
 ,19 → 8,24
 $password = $_POST['password'];
 $remember = $_POST['remember'] == 'yes';
+if(strpos($_POST['oldurl'], "tim32.org") === FALSE || strpos($_POST['oldurl'], "login") !== FALSE)
+    $redirurl = "http://tim32.org";
+else
+    $redirurl = $_POST['oldurl'];
 if (empty($username))
 {
-    $page->redirect('login.php?error=No Username Specified');
+    $page->redirect('login.php?error=No Username Specified&oldurl=' . urlencode($redirurl));
 }
 if (empty($password))
 {
-    $page->redirect('login.php?error=No Password Specified');
+    $page->redirect('login.php?error=No Password Specified&oldurl=' . urlencode($redirurl));
 }
 $user = $page->getUserByUsername($username);
-if (!$user || $user->password != sha1($password))
+if (!$user || $user->password !== $page->saltAndBurn($password, $user->salt))
 {
-    $page->redirect('login.php?error=Incorrect Username or Password');
+    $page->redirect('login.php?error=Incorrect Username or Password&oldurl=' . urlencode($redirurl));
 }
 $expires = -1;
 ,6 → 37,6
 setcookie('Tim32_Login', $user->username . '|~|' . $user->password, $expires, '/');
-$page->redirect('index.php');
+$page->redirect($redirurl);
 ?>

 /styles.css
 ,22 → 1,23
 body {
-    background-color: #FFFFFF;
     color: #000000;
     font-family: Droid Sans, Tahoma, sans-serif;
-    font-size: 11pt;
+    font-size: 10pt;
+    margin: 0px;
+    padding: 0px;
+    height: 100%;
 }
 h1 {
     font-size: 28pt;
-    margin: 6px;
+    margin: 8px;
     margin-top: 0px;
-    color: #000089;
-    border-bottom: 1px solid #000000;
+    color: #FFFFFF;
+    border-bottom: 1px solid #FFFFFF;
 }
 h2 {
     font-size: 20pt;
-    margin: 6px;
+    margin: 8px;
     margin-left: 8px;
     color: #00004B;
 }
 ,7 → 24,7
 h3 {
     font-size: 16pt;
-    margin: 6px;
+    margin: 8px;
     margin-left: 10px;
     color: #000055;
 }
 ,7 → 31,7
 h4 {
     font-size: 12pt;
-    margin: 6px;
+    margin: 8px;
     margin-left: 12px;
     color: #00005F;
 }
 ,14 → 38,14
 h5 {
     font-size: 10pt;
-    margin: 6px;
+    margin: 8px;
     margin-left: 14px;
     color: #000069;
 }
 p, table, span {
-    font-size: 11pt;
-    margin: 6px;
+    font-size: 10pt;
+    margin: 8px;
     margin-left: 16px;
 }
 ,8 → 62,15
     border: 1px solid #000000;
     color: #000000;
     background-color: #B5D7FF;
+    padding: 4px;
+    margin: 5px;
+    font-size: 11pt;
 }
+input[type=text], input[type=password] {
+    width: 500px;
+}
 table {
     border: 1px solid #222222;
 }
 ,21 → 95,23
 }
 .sidebar {
+    top: 0px;
     left: 0px;
-    top: 0px;
-    position: fixed;
+    position: absolute;
+    float: left;
+    width: 156px;
     padding: 0px;
     padding-left: 32px;
-    border-right: 1px solid #000089;
-    background-color: #FFFF73;
-    background-image: url('data/sidebar-gradient.png');
-    background-repeat: repeat-x;
-    background-position: center bottom;
+    border-right: 2px solid #000049;
+    border-bottom: 2px solid #000049;
+    color: #FFFFFF;
+    z-index: 50;
+    background-color: #032865;
 }
 .sidebar-header {
-    left: 0px;
     width: 140px;
     padding: 6px;
     text-align: right;
 ,10 → 120,12
 .sidebar-menu {
     text-align: right;
     padding: 6px;
+    color: #FFFFFF;
 }
 .sidebar-menu h3 {
     margin: 6px;
+    color: #FFFFFF;
 }
 .sidebar-menu p {
 ,11 → 133,23
     margin: 4px;
 }
+.sidebar-menu a {
+    color: #FFFFFF;
+}
 .content {
-    left: 200px;
     top: 0px;
-    position: absolute;
-    margin-right: 32px;
+/*    left: 0px;*/
+    margin-left: 190px;
+/*    padding-top: 0px*/
+/*    position: absolute;*/
+/*    margin-right: 32px;*/
+    background-color: #FFFFFF;
+    height: 100%;
+    height: auto !important;
+    width: auto;
+    display: block;
+/*    display: inline-block;*/
 }
 .bold {
 ,6 → 156,10
     font-weight: bold;
 }
+.italic {
+    font-style: italic;
+}
 .indent {
     margin-left: 14px;
     border-left: 1px solid #BBBBBB;
 ,8 → 166,51
 }
 .code {
-    border: 1px solid #333333;
+    border-top: 2px solid #999999;
+    border-bottom: 2px solid #999999;
+    margin: 4px 16px;
+    padding: 3px;
     background-color: #DDDDDD;
     font-family: Droid Sans Mono, Monospace, Fixed;
+    font-size: 10pt;
 }
+.tcp_button {
+    border: none;
+    margin: 0px 14px;
+    cursor: pointer;
+}
+.tcp_inner {
+    margin: 4px;
+    padding: 2px;
+    border: 1px solid #000000;
+}
+.tcp_inner_result {
+    margin: 6px;
+}
+.copyright {
+    color: #BBBBBB;
+    text-align: left;
+    font-size: 9pt;
+}
+.copyright a {
+    color: #BBBBBB;
+}
+.recaptchatable .recaptcha_image_cell, #recaptcha_table {
+    background-color: #4B9DE0 !important; //reCaptcha widget background color
+}
+#recaptcha_table {
+    border-color: #3874A4 !important; //reCaptcha widget border color
+}
+#recaptcha_response_field {
+    border-color: #000000 !important; //Text input field border color
+    background-color:#FFFFFF !important; //Text input field background color
+}

 /404.php
 ,15 → 1,14
 <?php
+header('Status: 404 Not Found');
 require '_taios.php';
-$page = new Taios_Page('404');
+$page = new Taios_Page('404 - Page not found', '/');
 $page->drawHeader();
 write('<h3>Pages</h3>');
-$page->drawMenuItem('Biggles', '/~biggles/');
-$page->drawMenuItem('Freddie', '/~freddie/');
-$page->drawMenuItem('Muzer', '/~muzer/');
-$page->drawMenuItem('Sh4rk', '/~szabot/');
-$page->drawMenuItem('Tom', '/~tom/');
+$page->drawMenuItem('FredFace', '~freddie/');
+$page->drawMenuItem('Muzer', '~muzer/');
 $page->drawMiddle();
 ?>
 ,6 → 15,7
 <p class="bold">404 - Page not found</p>
 <p>The page you requested could not be found.</p>
+<br />
 <h4>Useful Links</h4>
 ,7 → 22,11
 <?php
 $page->drawMenuItem('Tim32 Homepage', 'index.php');
+$page->drawMenuItem('Youfail.org', 'http://youfail.org');
+?>
+<iframe src="http://notfound-static.fwebservices.be/404/index.html?&amp;key=30aca9cedc0df2682afc4e195eedb1e2" width="100%" height="650" frameborder="0"></iframe>
+<?php
 $page->drawFooter();
 ?>

 /login.php
 ,6 → 9,7
 ?>
 <p class="bold">Here you can login to Tim32 using your Tim32 account.</p>
+<p>By using this website, you hereby accept cookies being stored on your computer.</p>
 <br />
 <?php
 ,6 → 22,12
 ?>
 <form action="login-do.php" method="POST">
+<?php
+$redirurl = $_SERVER['HTTP_REFERER'];
+if($_GET['oldurl'])
+    $redirurl = $_GET['oldurl'];
+write('<input type="hidden" name="oldurl" value="' . $redirurl . '" />');
+?>
 <table>
 <tr>
 <td class="bold">Username: </td>

/data/favicon.png
Cannot display: file marked as a binary type.
svn:mime-type = application/octet-stream

/data/favicon.png

Property changes:

Added: svn:mime-type

## -0,0 +1 ##

+application/octet-stream

\ No newline at end of property

Index: register.php

===================================================================

--- register.php (revision 264)

+++ register.php (revision 522)

@@ -1,6 +1,7 @@

require '_taios.php';

+require_once '_recaptchalib.php';

$page = new Taios_Page('Register');

$page->drawHeader();

@@ -20,6 +21,12 @@

: :


@@ -35,18 +42,28 @@



-	Email Address
+	Email Address:



-	Name
+	Name:




+
+
+
+	3 + 9 * 8
+
+
+
+

By registering to Tim32, you agree to be reasonable in all your suggestion/accusations and advoid subjectivity. Suvbjective posts/comments are subject to removal by a Subject of the Tim32 Admins.

 /_recaptchalib.php
 ,0 → 1,277
+<?php
+/*
+ * This is a PHP library that handles calling reCAPTCHA.
+ *    - Documentation and latest version
+ *          http://recaptcha.net/plugins/php/
+ *    - Get a reCAPTCHA API Key
+ *          https://www.google.com/recaptcha/admin/create
+ *    - Discussion group
+ *          http://groups.google.com/group/recaptcha
+ *
+ * Copyright (c) 2007 reCAPTCHA -- http://recaptcha.net
+ * AUTHORS:
+ *   Mike Crawford
+ *   Ben Maurer
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+/**
+ * The reCAPTCHA server URL's
+ */
+define("RECAPTCHA_API_SERVER", "http://www.google.com/recaptcha/api");
+define("RECAPTCHA_API_SECURE_SERVER", "https://www.google.com/recaptcha/api");
+define("RECAPTCHA_VERIFY_SERVER", "www.google.com");
+/**
+ * Encodes the given data into a query string format
+ * @param $data - array of string elements to be encoded
+ * @return string - encoded request
+ */
+function _recaptcha_qsencode ($data) {
+        $req = "";
+        foreach ( $data as $key => $value )
+                $req .= $key . '=' . urlencode( stripslashes($value) ) . '&';
+        // Cut the last '&'
+        $req=substr($req,0,strlen($req)-1);
+        return $req;
+}
+/**
+ * Submits an HTTP POST to a reCAPTCHA server
+ * @param string $host
+ * @param string $path
+ * @param array $data
+ * @param int port
+ * @return array response
+ */
+function _recaptcha_http_post($host, $path, $data, $port = 80) {
+        $req = _recaptcha_qsencode ($data);
+        $http_request  = "POST $path HTTP/1.0\r\n";
+        $http_request .= "Host: $host\r\n";
+        $http_request .= "Content-Type: application/x-www-form-urlencoded;\r\n";
+        $http_request .= "Content-Length: " . strlen($req) . "\r\n";
+        $http_request .= "User-Agent: reCAPTCHA/PHP\r\n";
+        $http_request .= "\r\n";
+        $http_request .= $req;
+        $response = '';
+        if( false == ( $fs = @fsockopen($host, $port, $errno, $errstr, 10) ) ) {
+                die ('Could not open socket');
+        }
+        fwrite($fs, $http_request);
+        while ( !feof($fs) )
+                $response .= fgets($fs, 1160); // One TCP-IP packet
+        fclose($fs);
+        $response = explode("\r\n\r\n", $response, 2);
+        return $response;
+}
+/**
+ * Gets the challenge HTML (javascript and non-javascript version).
+ * This is called from the browser, and the resulting reCAPTCHA HTML widget
+ * is embedded within the HTML form it was called from.
+ * @param string $pubkey A public key for reCAPTCHA
+ * @param string $error The error given by reCAPTCHA (optional, default is null)
+ * @param boolean $use_ssl Should the request be made over ssl? (optional, default is false)
+ * @return string - The HTML to be embedded in the user's form.
+ */
+function recaptcha_get_html ($pubkey, $error = null, $use_ssl = false)
+{
+        if ($pubkey == null || $pubkey == '') {
+                die ("To use reCAPTCHA you must get an API key from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a>");
+        }
+        if ($use_ssl) {
+                $server = RECAPTCHA_API_SECURE_SERVER;
+        } else {
+                $server = RECAPTCHA_API_SERVER;
+        }
+        $errorpart = "";
+        if ($error) {
+           $errorpart = "&amp;error=" . $error;
+        }
+        return '<script type="text/javascript" src="'. $server . '/challenge?k=' . $pubkey . $errorpart . '"></script>
+        <noscript>
+                <iframe src="'. $server . '/noscript?k=' . $pubkey . $errorpart . '" height="300" width="500" frameborder="0"></iframe><br/>
+                <textarea name="recaptcha_challenge_field" rows="3" cols="40"></textarea>
+                <input type="hidden" name="recaptcha_response_field" value="manual_challenge"/>
+        </noscript>';
+}
+/**
+ * A ReCaptchaResponse is returned from recaptcha_check_answer()
+ */
+class ReCaptchaResponse {
+        var $is_valid;
+        var $error;
+}
+/**
+  * Calls an HTTP POST function to verify if the user's guess was correct
+  * @param string $privkey
+  * @param string $remoteip
+  * @param string $challenge
+  * @param string $response
+  * @param array $extra_params an array of extra variables to post to the server
+  * @return ReCaptchaResponse
+  */
+function recaptcha_check_answer ($privkey, $remoteip, $challenge, $response, $extra_params = array())
+{
+        if ($privkey == null || $privkey == '') {
+                die ("To use reCAPTCHA you must get an API key from <a href='https://www.google.com/recaptcha/admin/create'>https://www.google.com/recaptcha/admin/create</a>");
+        }
+        if ($remoteip == null || $remoteip == '') {
+                die ("For security reasons, you must pass the remote ip to reCAPTCHA");
+        }
+        //discard spam submissions
+        if ($challenge == null || strlen($challenge) == 0 || $response == null || strlen($response) == 0) {
+                $recaptcha_response = new ReCaptchaResponse();
+                $recaptcha_response->is_valid = false;
+                $recaptcha_response->error = 'incorrect-captcha-sol';
+                return $recaptcha_response;
+        }
+        $response = _recaptcha_http_post (RECAPTCHA_VERIFY_SERVER, "/recaptcha/api/verify",
+                                          array (
+                                                 'privatekey' => $privkey,
+                                                 'remoteip' => $remoteip,
+                                                 'challenge' => $challenge,
+                                                 'response' => $response
+                                                 ) + $extra_params
+                                          );
+        $answers = explode ("\n", $response [1]);
+        $recaptcha_response = new ReCaptchaResponse();
+        if (trim ($answers [0]) == 'true') {
+                $recaptcha_response->is_valid = true;
+        }
+        else {
+                $recaptcha_response->is_valid = false;
+                $recaptcha_response->error = $answers [1];
+        }
+        return $recaptcha_response;
+}
+/**
+ * gets a URL where the user can sign up for reCAPTCHA. If your application
+ * has a configuration page where you enter a key, you should provide a link
+ * using this function.
+ * @param string $domain The domain where the page is hosted
+ * @param string $appname The name of your application
+ */
+function recaptcha_get_signup_url ($domain = null, $appname = null) {
+        return "https://www.google.com/recaptcha/admin/create?" .  _recaptcha_qsencode (array ('domains' => $domain, 'app' => $appname));
+}
+function _recaptcha_aes_pad($val) {
+        $block_size = 16;
+        $numpad = $block_size - (strlen ($val) % $block_size);
+        return str_pad($val, strlen ($val) + $numpad, chr($numpad));
+}
+/* Mailhide related code */
+function _recaptcha_aes_encrypt($val,$ky) {
+        if (! function_exists ("mcrypt_encrypt")) {
+                die ("To use reCAPTCHA Mailhide, you need to have the mcrypt php module installed.");
+        }
+        $mode=MCRYPT_MODE_CBC;
+        $enc=MCRYPT_RIJNDAEL_128;
+        $val=_recaptcha_aes_pad($val);
+        return mcrypt_encrypt($enc, $ky, $val, $mode, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0");
+}
+function _recaptcha_mailhide_urlbase64 ($x) {
+        return strtr(base64_encode ($x), '+/', '-_');
+}
+/* gets the reCAPTCHA Mailhide url for a given email, public key and private key */
+function recaptcha_mailhide_url($pubkey, $privkey, $email) {
+        if ($pubkey == '' || $pubkey == null || $privkey == "" || $privkey == null) {
+                die ("To use reCAPTCHA Mailhide, you have to sign up for a public and private key, " .
+                     "you can do so at <a href='http://www.google.com/recaptcha/mailhide/apikey'>http://www.google.com/recaptcha/mailhide/apikey</a>");
+        }
+        $ky = pack('H*', $privkey);
+        $cryptmail = _recaptcha_aes_encrypt ($email, $ky);
+        return "http://www.google.com/recaptcha/mailhide/d?k=" . $pubkey . "&c=" . _recaptcha_mailhide_urlbase64 ($cryptmail);
+}
+/**
+ * gets the parts of the email to expose to the user.
+ * eg, given johndoe@example,com return ["john", "example.com"].
+ * the email is then displayed as john...@example.com
+ */
+function _recaptcha_mailhide_email_parts ($email) {
+        $arr = preg_split("/@/", $email );
+        if (strlen ($arr[0]) <= 4) {
+                $arr[0] = substr ($arr[0], 0, 1);
+        } else if (strlen ($arr[0]) <= 6) {
+                $arr[0] = substr ($arr[0], 0, 3);
+        } else {
+                $arr[0] = substr ($arr[0], 0, 4);
+        }
+        return $arr;
+}
+/**
+ * Gets html to display an email address given a public an private key.
+ * to get a key, go to:
+ *
+ * http://www.google.com/recaptcha/mailhide/apikey
+ */
+function recaptcha_mailhide_html($pubkey, $privkey, $email) {
+        $emailparts = _recaptcha_mailhide_email_parts ($email);
+        $url = recaptcha_mailhide_url ($pubkey, $privkey, $email);
+        return htmlentities($emailparts[0]) . "<a href='" . htmlentities ($url) .
+                "' onclick=\"window.open('" . htmlentities ($url) . "', '', 'toolbar=0,scrollbars=0,location=0,statusbar=0,menubar=0,resizable=0,width=500,height=300'); return false;\" title=\"Reveal this e-mail address\">...</a>@" . htmlentities ($emailparts [1]);
+}
+?>

Subversion Repositories taios

Compare Revisions

Ignore whitespace Rev 264 → Rev 522