<?php
//initialize the session
session_start();

// ** Logout the current user. **
$logoutAction = $_SERVER['PHP_SELF']."?doLogout=true";
if ((isset($_SERVER['QUERY_STRING'])) && ($_SERVER['QUERY_STRING'] != "")){
  $logoutAction .="&". htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_GET['doLogout'])) &&($_GET['doLogout']=="true")){
  //to fully log out a visitor we need to clear the session varialbles
  session_unregister('MM_Username');
  session_unregister('MM_UserGroup');

  $logoutGoTo = "../index.php";
  if ($logoutGoTo) {
    header("Location: $logoutGoTo");
    exit;
  }
}
?>
<?php
session_start();
$MM_authorizedUsers = "admin";
$MM_donotCheckaccess = "false";

// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) { 
  // For security, start by assuming the visitor is NOT authorized. 
  $isValid = False; 

  // When a visitor has logged into this site, the Session variable MM_Username set equal to their username. 
  // Therefore, we know that a user is NOT logged in if that Session variable is blank. 
  if (!empty($UserName)) { 
    // Besides being logged in, you may restrict access to only certain users based on an ID established when they login. 
    // Parse the strings into arrays. 
    $arrUsers = Explode(",", $strUsers); 
    $arrGroups = Explode(",", $strGroups); 
    if (in_array($UserName, $arrUsers)) { 
      $isValid = true; 
    } 
    // Or, you may restrict access to only certain users based on their username. 
    if (in_array($UserGroup, $arrGroups)) { 
      $isValid = true; 
    } 
    if (($strUsers == "") && false) { 
      $isValid = true; 
    } 
  } 
  return $isValid; 
}

$MM_restrictGoTo = "../login.php?notLoggedIn=true";
if (!((isset($_SESSION['MM_Username'])) && (isAuthorized("",$MM_authorizedUsers, $_SESSION['MM_Username'], $_SESSION['MM_UserGroup'])))) {   
  $MM_qsChar = "?";
  $MM_referrer = $_SERVER['PHP_SELF'];
  if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
  if (isset($QUERY_STRING) && strlen($QUERY_STRING) > 0) 
  $MM_referrer .= "?" . $QUERY_STRING;
  $MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer);
  header("Location: ". $MM_restrictGoTo); 
  exit;
}
?>
<?php
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{
  $theValue = (!get_magic_quotes_gpc()) ? addslashes($theValue) : $theValue;

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;    
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}

$maxRows_rsTopics = 10;
$pageNum_rsTopics = 0;
if (isset($_GET['pageNum_rsTopics'])) {
  $pageNum_rsTopics = $_GET['pageNum_rsTopics'];
}
$startRow_rsTopics = $pageNum_rsTopics * $maxRows_rsTopics;

mysql_select_db($database_conBlog, $conBlog);
$query_rsTopics = "SELECT * FROM blg_topic_top ORDER BY id_top DESC";
$query_limit_rsTopics = sprintf("%s LIMIT %d, %d", $query_rsTopics, $startRow_rsTopics, $maxRows_rsTopics);
$rsTopics = mysql_query($query_limit_rsTopics, $conBlog) or die(mysql_error());
$row_rsTopics = mysql_fetch_assoc($rsTopics);

if (isset($_GET['totalRows_rsTopics'])) {
  $totalRows_rsTopics = $_GET['totalRows_rsTopics'];
} else {
  $all_rsTopics = mysql_query($query_rsTopics);
  $totalRows_rsTopics = mysql_num_rows($all_rsTopics);
}
$totalPages_rsTopics = ceil($totalRows_rsTopics/$maxRows_rsTopics)-1;

$colname_rsArticles = "2";
if (isset($_GET['id_art'])) {
  $colname_rsArticles = (get_magic_quotes_gpc()) ? $_GET['id_art'] : addslashes($_GET['id_art']);
}
mysql_select_db($database_conBlog, $conBlog);
$query_rsArticles = sprintf("SELECT * FROM blg_article_art  INNER JOIN blg_topic_top ON idtop_art=id_top WHERE id_art = %s ORDER BY date_art DESC", $colname_rsArticles);
$rsArticles = mysql_query($query_rsArticles, $conBlog) or die(mysql_error());
$row_rsArticles = mysql_fetch_assoc($rsArticles);
$totalRows_rsArticles = mysql_num_rows($rsArticles);

$colname_rsComments = "1";
if (isset($_GET['id_art'])) {
  $colname_rsComments = (get_magic_quotes_gpc()) ? $_GET['id_art'] : addslashes($_GET['id_art']);
}
mysql_select_db($database_conBlog, $conBlog);
$query_rsComments = sprintf("SELECT * FROM comment INNER JOIN blg_article_art ON commentMsgID = id_art WHERE commentMsgID = %s ORDER BY commentDate DESC", $colname_rsComments);
$rsComments = mysql_query($query_rsComments, $conBlog) or die(mysql_error());
$row_rsComments = mysql_fetch_assoc($rsComments);
$totalRows_rsComments = mysql_num_rows($rsComments);

mysql_select_db($database_conBlog, $conBlog);
$query_rsImages = "SELECT * FROM image";
$rsImages = mysql_query($query_rsImages, $conBlog) or die(mysql_error());
$row_rsImages = mysql_fetch_assoc($rsImages);
$totalRows_rsImages = mysql_num_rows($rsImages);

$userName = ($_SESSION['MM_Username']);
include('../inc/folderLogin.inc.php');
?>
<?php 
$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "frmImageUpload")) {
    $result_final = "";
    $images_dir = "images";
    $thumbs_dir = "thumbs";

    // List of our known photo types
    $known_photo_types = array( 
                        'image/pjpeg' => 'jpg',
                        'image/jpeg' => 'jpg',
                        'image/gif' => 'gif',
                        'image/bmp' => 'bmp',
                        'image/x-png' => 'png'
                    );

    // GD Function List
    $gd_function_suffix = array( 
                        'image/pjpeg' => 'JPEG',
                        'image/jpeg' => 'JPEG',
                        'image/gif' => 'GIF',
                        'image/bmp' => 'WBMP',
                        'image/x-png' => 'PNG'
                    );

  $imageNumber = ($totalRows_rsImages + 1);
  $imageName = $_POST['imageFName'];
  $filetype = $imageName['type'];
  $imageFileName = $imageNumber . $fileType;

            copy($imageFileName, $images_dir."/".$imageFileName);

                // Let's get the Thumbnail size
                $size = GetImageSize( $thumbs_dir."/".$imageFileName);
                if($size[0] > $size[1])
                {
                    $thumbnail_width = 165;
                    $thumbnail_height = (int)(100 * $size[1] / $size[0]);
                }
                else
                {
                    $thumbnail_width = (int)(100 * $size[0] / $size[1]);
                    $thumbnail_height = 131;
                }

                $function_suffix = $gd_function_suffix[$filetype];
                $function_to_read = 'ImageCreateFrom' . $function_suffix;
                $function_to_write = 'Image' . $function_suffix;

                // Read the source file
                $source_handle = $function_to_read($images_dir . '/' . $imageFileName);

                if ($source_handle) {
                 // Let's create a blank image for the thumbnail
                 $destination_handle =
                   ImageCreateTrueColor($thumbnail_width, $thumbnail_height);

                 // Now we resize it
                 ImageCopyResampled($destination_handle, $source_handle,
                   0, 0, 0, 0, $thumbnail_width, $thumbnail_height, $size[0], $size[1]);
                }

                // Let's save the thumbnail
                $function_to_write($destination_handle, $thumbs_dir . '/tb_' . $filename);

  $insertSQL = sprintf("INSERT INTO image (imageFName, imageTitle, imageDesc) VALUES (%s, %s, %s)",
                       GetSQLValueString($imageFileName, "text"),
                       GetSQLValueString($_POST['imageTitle'], "text"),
                       GetSQLValueString($_POST['imageDescription'], "text"));

  mysql_select_db($database_conBlog, $conBlog);
  $Result1 = mysql_query($insertSQL, $conBlog) or die(mysql_error());

  $insertGoTo = "../gallery.php";
  if (isset($_SERVER['QUERY_STRING'])) {
    $insertGoTo .= (strpos($insertGoTo, '?')) ? "&" : "?";
    $insertGoTo .= $_SERVER['QUERY_STRING'];
  }
  header(sprintf("Location: %s", $insertGoTo));
}

?>

  <form method="POST" name="frmImageUpload" class="post" enctype="multipart/form-data" action=<?php echo $editFormAction; ?>>
    <h2 class="commentRelated">Image Title : </h2>
      <input name="imageTitle" type="text" class="text" id="imageTitle" />
    <h2 class="commentRelated">Select File To Upload : </h2>
        <input name="imageFName" type="file" class="text" id="imageFName" size="50" />
        <h2 class="commentRelated">Image Details : </h2>
    <textarea name="imageDescription" rows="12" class="text" id="imageDescription" onchange="MM_validateForm('commentName','','R','commentText','','R');return document.MM_returnValue"></textarea>
    <input name="postImage" type="submit" class="button" id="postImage" value="Submit" />
    <input type="hidden" name="MM_insert" value="frmImageUpload">
  </form>