· 10 years ago · Jun 14, 2016, 05:51 PM
1<?php
2session_start();
3
4define("DEBUG",false); // enable logging with PHP echo (printed at the top of the page)
5define("MYSQL_SERVER", "existingmysqlservername");
6define("MYSQL_USER", "existingmysqlserverusername");
7define("MYSQL_PASSWORD", "existingmysqlserverpassword");
8define("MYSQL_DB", "mysqlserverdbtocreate");
9define("MAIN_TABLE_NAME", "mysqlservertabletocreate");
10define("LOG_IP", false); // to enable ip logging of users
11define("DELETE_ALL_LOGGED_IP", false); // to enable emptying of ip logs
12define("CREATE_DB_IF_NOT_EXISTS", true);
13define("CREATE_TABLES_IF_NOT_EXIST", true);
14define("DEFAULT_TITLE","RW-PHPArticles v1.0"); // default website name
15define("DEFAULT_TITLE2","Contenu"); // default title of the website
16define("DEFAULT_SUBTITLE","Page des news et articles NTIC"); // defaults subtitle of the website
17
18// if no admin account in db, create admin account with defined password (after hashing it)
19if (isset($_POST['password']) && isset($_POST['confirmpassword']) ) {
20 $password = $_POST['password'];
21 $confirmpassword = $_POST['confirmpassword'];
22
23 if (trim($password) == '' || trim($confirmpassword) == ''){
24 if (DEBUG) echo 'Password of Confirm password is empty.<br/>';
25 exit;
26 }
27
28 if ($password != $confirmpassword){
29 if (DEBUG) echo 'Cannot create admin account because password do not match.<br/>';
30 exit;
31 }
32 if ($password == $confirmpassword){
33 $hashed = md5($password);
34 $db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
35 if ($db->connect_errno) {
36 $db->close();
37 exit;
38 }
39 $r = mysqli_query($db, "select * from " . MAIN_TABLE_NAME . "_" . "user where trim(lower(username))='admin'");
40 if ($r->num_rows != 0){
41 if (DEBUG) echo 'Admin account already exists.<br/>';
42 $db->close();
43 exit;
44 }
45
46 $r = mysqli_query($db, "insert into " . MAIN_TABLE_NAME . "_" . "user (username, password) values ('admin','" . $hashed . "')");
47 if (DEBUG) echo 'Admin account created OK.<br/>';
48 $db->close();
49 }
50}
51
52
53if (isset($_POST['login']) && isset($_POST['password'])){
54
55 $login = trim(strtolower($_POST['login']));
56 $passwordhash = md5($_POST['password']);
57
58 if (DEBUG) echo 'login and password received in POST : ' . $login . " ; " . $passwordhash . '<br/>';
59
60 $db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
61 if ($db->connect_errno) {
62 $db->close();
63 exit;
64 }
65 $r = mysqli_query($db, "select * from " . MAIN_TABLE_NAME . "_" . "user where username='" . $login . "' and password='" . $passwordhash . "'");
66 if ($r->num_rows > 0){
67 if (DEBUG) echo 'Login attempt OK. Creating session.<br/>';
68 $_SESSION['passwordhash'] = $passwordhash;
69 $_SESSION['login'] = trim(strtolower($login));
70 } else {
71 if (DEBUG) echo 'Login attempt NOT OK.<br/>';
72 }
73 $db->close();
74}
75
76// gerer allowed ici uniquement
77if ( isset($_SESSION['passwordhash']) && isset($_SESSION['login']) ){
78 $passwordhash = $_SESSION['passwordhash'];
79 $login = $_SESSION['login'];
80
81 $db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
82 if ($db->connect_errno) {
83 $db->close();
84 exit;
85 }
86 $r = mysqli_query($db, "select * from " . MAIN_TABLE_NAME . "_" . "user where username='" . $login . "' and password='" . $passwordhash . "'");
87 if ($r->num_rows > 0){
88 if (DEBUG) echo 'Session existing and credentials OK.<br/>';
89 $allowed = true;
90 } else {
91 if (DEBUG) echo 'Session existing and credentials NOT OK.<br/>';
92 if (DEBUG) echo 'Credentials received : login = ' . $login . ' and passwordhash = ' . $passwordhash . "<br/>";
93 $allowed = false;
94 }
95
96 $db->close();
97}
98
99if ($allowed == true){
100 if (isset($_POST['adminfunction'])){
101 $adminfunction = $_POST['adminfunction'];
102 if (DEBUG) echo '003:allowed is true ; adminfunction<br/>';
103 if (DEBUG) echo 'adminfunction = ' . $adminfunction .'<br/>';
104 $array = explode("?delete_article&id=", $adminfunction);
105 if (!is_null($array) && count($array)>0){
106 $id = $array[1];
107
108 $db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
109 if ($db->connect_errno) {
110 if (DEBUG) echo 'error.<br/>';
111 exit;
112 }
113
114 $str = "delete from " . MAIN_TABLE_NAME . " where id = " . $id;
115 if (DEBUG) echo 'request=[' . $str . ']<br/>';
116
117 $r = mysqli_query($db, "delete from " . MAIN_TABLE_NAME . " where id = " . $id);
118 $db->close();
119 }
120 }
121}
122
123if (isset($_GET['disconnect'])){
124 if (trim(strtolower($_GET['disconnect'])) == "true"){
125 $_SESSION['login'] = '';
126 $_SESSION['passwordhash'] = '';
127 if (DEBUG) echo 'Ctredentials in session have been reset.<br/>';
128 $allowed = false;
129 if (DEBUG) echo 'allowed is becoming FALSE.<br/>';
130 }
131}
132
133
134// supprimer toutes les données de la table annuaire si paramètre get delete_data = true
135$delete_data = false;
136if (isset($_GET['delete_data'])){
137 if (trim(strtolower($_GET['delete_data'])) == "true"){
138 $delete_data = true;
139 }
140}
141
142if ($delete_data == true){
143 // DELETE ALL DATA
144 $db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
145 if ($db->connect_errno) {
146 exit;
147 }
148 $sql = "DELETE FROM `" . MAIN_TABLE_NAME . "`";
149 $r = mysqli_query($db, $sql);
150 $db->close();
151 if (DEBUG) echo 'data deleted.<br/>';
152}
153
154// supprimer toutes les données de la table ip_address_log si paramètre get delete_ip = true
155$delete_ip = false;
156if (isset($_GET['delete_ip'])){
157 if (trim(strtolower($_GET['delete_ip'])) == "true"){
158 $delete_ip = true;
159 }
160}
161
162if ($delete_ip == true){
163 // DELETE ALL IP
164 $db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
165 if ($db->connect_errno) {
166 exit;
167 }
168 $r = mysqli_query($db, "delete from " . MAIN_TABLE_NAME . "_" . "ip_address_log");
169 $db->close();
170 if (DEBUG) echo 'ip deleted.<br/>';
171}
172
173// si le paramètre CREATE_DB_IF_NOT_EXISTS est défini à true alors tenter de créer la base de données dans paramètre MYSQL_DB
174if (CREATE_DB_IF_NOT_EXISTS == true){
175 // CREATE DB IF NOT EXISTS
176 $db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD);
177 if ($db->connect_errno) {
178 exit;
179 }
180 $r = mysqli_query($db, "create database if not exists " . MYSQL_DB);
181 $db->close();
182}
183
184// si le paramètre existe alors tenter de créer les tables annuaire et ip_address_log
185if (CREATE_TABLES_IF_NOT_EXIST == true){
186 // CREATE TABLE IF NOT EXISTS
187 $db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
188 if ($db->connect_errno) {
189 exit;
190 }
191 $sql = "CREATE TABLE IF NOT EXISTS `" . MAIN_TABLE_NAME . "` (`id` bigint(20) NOT NULL AUTO_INCREMENT, `titre` varchar(256) COLLATE latin1_general_ci NOT NULL, `contenu` varchar(8192) COLLATE latin1_general_ci NOT NULL, PRIMARY KEY (`id`) ) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_general_ci";
192 $r = mysqli_query($db, $sql);
193
194 $sql = "CREATE TABLE IF NOT EXISTS `" . MAIN_TABLE_NAME . "_" . "ip_address_log` (`id` bigint(20) NOT NULL AUTO_INCREMENT, `access_date_time` datetime NOT NULL, `ip_address` varchar(32) COLLATE latin1_general_ci NOT NULL, `url` varchar(255) COLLATE latin1_general_ci DEFAULT NULL, PRIMARY KEY (`id`)) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_general_ci";
195 $r = mysqli_query($db, $sql);
196
197 $sql = "CREATE TABLE IF NOT EXISTS `" . MAIN_TABLE_NAME . "_" . "user` (`id` BIGINT NOT NULL AUTO_INCREMENT , `username` VARCHAR( 64 ) NOT NULL , `password` VARCHAR( 256 ) NOT NULL , PRIMARY KEY ( `id` )) ENGINE = MYISAM";
198 $r = mysqli_query($db, $sql);
199
200 $sql = "CREATE TABLE IF NOT EXISTS `" . MAIN_TABLE_NAME . "_" . "parameters` (`id` bigint(20) NOT NULL AUTO_INCREMENT, `name` varchar(128) COLLATE latin1_general_ci NOT NULL, `value` varchar(512) COLLATE latin1_general_ci NOT NULL, PRIMARY KEY (`id`)) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_general_ci";
201 $r = mysqli_query($db, $sql);
202
203 $db->close();
204}
205
206
207// LOG IP si paramètre LOG_IP = true
208if (LOG_IP==true){
209 $db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
210 if ($db->connect_errno) {
211 exit;
212 }
213 $client_ip = $_SERVER['REMOTE_ADDR'];
214 $url = $_SERVER['PHP_SELF'];
215 $r = mysqli_query($db, "insert into " . MAIN_TABLE_NAME . "_" . "ip_address_log(ip_address, access_date_time, url) values ('" . $client_ip . "',NOW(),'" . $url . "')");
216 $db->close();
217}
218
219// Sauvegarde du nom de cette page pour définition des url de post
220if (!isset($_POST['current_file_name']))
221{
222 $_POST['current_file_name'] = getCurrentFileName();
223 //echo "current file name = " . $_POST['current_file_name'];
224}
225
226if ( isset($_GET['delete_article']) && isset($_GET['id']) ){
227 $id=$_GET['id'];
228
229 $db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
230 if ($db->connect_errno) {
231 if (DEBUG) echo 'error.<br/>';
232 exit;
233 }
234
235 $r = mysqli_query($db, "delete from " . MAIN_TABLE_NAME . " where id = " . $id);
236 $db->close();
237}
238
239// AJOUT SITE
240if ( isset($_POST['titre']) && isset($_POST['contenu']) ){
241 $titre = $_POST['titre'];
242 $contenu = $_POST['contenu'];
243
244 if (DEBUG) echo 'titre et contenu reçus en POST.<br/>';
245 if (DEBUG) echo "titre = " . $titre . " et contenu = " . $contenu . "<br/>";
246
247 if ( (trim($titre)!='') && (trim($contenu) !='') )
248 {
249 $db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
250 if ($db->connect_errno) {
251 if (DEBUG) echo 'error.<br/>';
252 exit;
253 }
254
255 $r = mysqli_query($db, "select * from " . MAIN_TABLE_NAME . " where titre = '" . addslashes($titre) . "'");
256 if ($r->num_rows>0){
257 $r = mysqli_query($db, "delete from " . MAIN_TABLE_NAME . " where titre = '" . $titre . "'");
258 }
259
260 $r = mysqli_query($db, "insert into " . MAIN_TABLE_NAME . " (titre, contenu) values ( '" . $titre . "', '" . $contenu . "')");
261 $db->close();
262
263 $_POST['titre'] = "";
264 $_POST['contenu'] = "";
265 }
266}
267
268
269function getCurrentFileName()
270{
271 if (!isset($_SERVER['REQUEST_URI'])) {
272 return "";
273 }
274 $uri = $_SERVER['REQUEST_URI'];
275 $array = explode("/", $uri);
276 if (!is_null($array))
277 {
278 if (count($array)>0)
279 {
280 $nb = count($array);
281 return $array[$nb-1];
282 }
283 }
284}
285
286
287// Obtention du titre paramétré dans la table parameters champs name=title
288$title = "";
289$title2 = "";
290$subtitle = "";
291
292$db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
293if ($db->connect_errno) {
294 $db->close();
295 exit;
296}
297
298$r = mysqli_query($db, "select * from " . MAIN_TABLE_NAME . "_" . "parameters where name='title'");
299if ($r->num_rows>0){
300 $row = $r->fetch_assoc();
301 $title = $row["value"];
302} else {
303 // si le paramètre title n'existe pas alors on le créée avec la valeur par défaut
304 $s = mysqli_query($db, "insert into " . MAIN_TABLE_NAME . "_" . "parameters(name, value) values('title','" . DEFAULT_TITLE . "')");
305}
306$r = mysqli_query($db, "select * from " . MAIN_TABLE_NAME . "_" . "parameters where name='title2'");
307if ($r->num_rows>0){
308 $row = $r->fetch_assoc();
309 $title2 = $row["value"];
310} else {
311 // si le paramètre title2 n'existe pas alors on le créée avec la valeur par défaut
312 $s = mysqli_query($db, "insert into " . MAIN_TABLE_NAME . "_" . "parameters(name, value) values('title2','" . DEFAULT_TITLE2 . "')");
313}
314$r = mysqli_query($db, "select * from " . MAIN_TABLE_NAME . "_" . "parameters where name='subtitle'");
315if ($r->num_rows>0){
316 $row = $r->fetch_assoc();
317 $subtitle = $row["value"];
318} else {
319 // si le paramètre subtitle n'existe pas alors on le créée avec la valeur par défaut
320 $s = mysqli_query($db, "insert into " . MAIN_TABLE_NAME . "_" . "parameters(name, value) values('subtitle','" . DEFAULT_SUBTITLE . "')");
321}
322
323$db->close();
324
325
326?>
327
328<!DOCTYPE html>
329<html lang="fr">
330<head>
331 <title><?php echo ((trim($title)!='')?addslashes($title):addslashes(TITLE)); ?></title>
332 <meta charset="ISO-8859-1"/>
333 <meta name="viewport" content="width=device-width, initial-scale=1"/>
334 <link rel="stylesheet" href="http://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css">
335 <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.12.2/jquery.min.js"></script>
336 <script src="http://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js"></script>
337
338 <!--<script src="//code.jquery.com/jquery-1.10.2.js"></script>-->
339 <script src="//code.jquery.com/ui/1.11.4/jquery-ui.js"></script>
340
341</head>
342<body>
343
344<div class="container">
345 <div class="jumbotron">
346 <center>
347 <h3><?php echo ((trim($title)!='')?addslashes($title):addslashes(DEFAULT_TITLE)); ?><br/><?php echo ((trim($title2)!='')?addslashes($title2):addslashes(DEFAULT_TITLE2)); ?></h3>
348 <p><?php echo ((trim($subtitle)!='')?addslashes($subtitle):addslashes(DEFAULT_SUBTITLE)); ?></p>
349 </center>
350 </div>
351
352<?php
353
354$db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
355if ($db->connect_errno) {
356 $db->close();
357 exit;
358}
359
360$r = mysqli_query($db, "select * from " . MAIN_TABLE_NAME . " order by id desc");
361
362if ($allowed == true){
363 echo '<center>Il y a actuellement ' . $r->num_rows . ' articles enregistrés dans notre base.</center><br/>';
364}
365
366echo '<center>';
367
368echo '<div id="contenu" style="background-color:#e4e5e5;width:50%;overflow:auto">';
369
370if ($r->num_rows > 0) {
371 while($row = $r->fetch_assoc()) {
372 echo '<br/>';
373 //echo '(' . $row["id"]. ') ' . '<a href="' . $row["url"] . '">' . $row["titre"] . '</a> - ' . $row["description"] . '<br/>';
374 if ($allowed==true){
375 echo 'Titre : ';
376 }
377 echo '<b>' . $row["titre"] . '</b><br/>';
378 echo $row["contenu"] . '<br/>';
379 if ($allowed){
380 echo ' - ' . $row["id"];
381 echo ' <a href="?delete_article&id=' . $row["id"] . '">delete</a>';
382 echo '<br/>';
383 }
384 echo '<br/>';
385 }
386} else {
387 //echo "0 results";
388}
389
390echo '</div>';
391
392echo '</center>';
393
394
395//echo $site['url'];
396
397$db->close();
398
399?>
400
401<br/><br/><br/>
402
403<?php
404
405if ($allowed == true){
406
407 echo '<center><b>Ajoutez votre article :</b><br/><br/>';
408 echo "<form action='" . $_POST['current_file_name'] . "' method='post'>";
409 echo '<table>';
410 echo ' <tr><td>Titre de l\'article: </td><td><input type="text" id="titre" name="titre" value="" size=64><br/></td></tr>';
411 echo ' <tr><td>Contenu de l\'article: </td><td><input type="text" id="contenu" name="contenu" value="" size=64></td></tr>';
412 echo ' <input type="hidden" type="text" name="login" value="' . $_SESSION['login'] . '">';
413 echo ' <input type="hidden" type="text" name="passwordhash" value="' . $_SESSION['passwordhash'] . '">';
414 echo '<br/>';
415 echo ' <tr> <td></td><td><input id="btnsubmitarticle" type="submit" value="Submit"></td></tr>';
416 echo '</table>';
417 echo '</form></center>';
418 echo '<br/><br/>';
419
420}
421
422if ($allowed == false){
423
424 echo '<center><b>Authentification :</b><br/><br/>';
425 echo "<form action='" . $_POST['current_file_name'] . "' method='post'>";
426 echo '<table>';
427 echo ' <tr><td>Login: </td><td><input type="text" id="login" name="login" value="" size=16><br/></td></tr>';
428 echo ' <tr><td>Password: </td><td><input type="text" id="password" name="password" value="" size=16></td></tr>';
429 echo ' <tr><td> </td><td><input type="submit" value="Connect"></td></tr>';
430 echo '</table>';
431 echo '</form></center>';
432 echo '<br/><br/>';
433
434}
435
436$db = new mysqli(MYSQL_SERVER, MYSQL_USER, MYSQL_PASSWORD, MYSQL_DB);
437if ($db->connect_errno) {
438 $db->close();
439 exit;
440}
441$r = mysqli_query($db, "select * from " . MAIN_TABLE_NAME . "_" . "user where trim(lower(username))='admin'");
442if ($r->num_rows == 0) {
443 //echo 'r num_rows = ' . $r->num_rows;
444 echo '<center><b>First connection - Create admin account</b><br/><br/>';
445 echo "<form action='" . $_POST['current_file_name'] . "' method='post'>";
446 echo ' Set Admin Password: <input type="text" id="password" name="password" value="" size=16>';
447 echo ' Confirm Admin Password: <input type="text" id="confirmpassword" name="confirmpassword" value="" size=16>';
448 echo ' <input type="submit" value="Connect">';
449 echo '</form></center>';
450 echo '<br/><br/>';
451}
452
453$db->close();
454
455
456?>
457
458
459<div id="footer" style="background-color:#acacac;height:125px;width:100%;overflow:auto"></div>
460
461<br/>
462
463<?php
464if ($allowed == true){
465?>
466
467<br/><br/><br/><br/><br/><br/>
468
469<?php
470}
471?>
472
473
474<script>
475
476$( document ).ready(functiocn() {
477 $( "a" ).click(function( event ) {
478 event.preventDefault();
479
480 var href = $(this).attr('href');
481 //console.log(href);
482
483 if (href.indexOf('delete_article') != -1)Il
484 {
485 var login="<?php echo $_POST["login"] ?>";
486 var password="<?php echo $_POST["password"] ?>";
487
488 //console.log(login);
489 //console.log(password);
490
491 $.post
492 ( "",
493 { adminfunction : href,
494 login : login,
495 password : password
496 },
497 function(data)
498 {
499 //console.log( data);
500 $("#titre").val("");
501 $("#contenu").val("");
502
503 $("#btnsubmitarticle" ).click();
504 }
505 );
506 }
507
508 });
509});
510
511
512
513</script>
514
515</body>
516</html>