forked from derrickyoo/expendable-news
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathpost.php
105 lines (96 loc) · 3.01 KB
/
post.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
<?php
session_start();
if (!isset($_SESSION['username']) || empty($_SESSION['username'])) {
die("You are not logged in. <a href='login.php'>Log In</a>");
}
if(isset($_SESSION['username']) && $_SESSION['superuser'] == 0) {
die("You do not have administrator access. <a href='index.php'>Back to Expendable News</a>");
}
// CSRF protection
$canary = sha1(rand());
$_SESSION['canary'] = $canary;
?>
<!DOCTYPE html>
<html lang='en'>
<head>
<meta charset='utf-8'>
<title>post.php</title>
<link rel='stylesheet' href='style.css' type='text/css'>
</head>
<body>
<div id='main-header'>
<table>
<tr>
<td id='main-logo'>
<a href='index.php'>Ex</a>
</td>
<td id='main-title'>
<a href='index.php'>•pend•a•ble News</a>
</td>
<td id="session-name">
<?php
if (isset($_SESSION['username']) || !empty($_SESSION['username'])) {
echo "Welcome, " . $_SESSION['username'] . "!";
}
?>
</td>
<td id='main-post-category'>
<?php
if (isset($_SESSION['username']) && $_SESSION['superuser'] == 1) {
echo "<img src='images/doc_plus_icon&16.png' width='10' height='10' alt='Doc Plus Icon&16'>" . "<a href='post.php'>" . " New Post" . "</a>";
}
?>
</td>
<td id='main-login'>
<?php
if (!isset($_SESSION['username']) || empty($_SESSION['username'])) {
echo "<img src='images/padlock_closed_icon&16.png' width='10' height='10' alt='Padlock Closed Icon&16'>" . "<a href='login.php'>" . " login" . "</a>";
}
else {
echo "<img src='images/padlock_open_icon&16.png' width='10' height='10' alt='Padlock Open Icon&16'>" . "<a href='logout.php'>" . " logout" . "</a>";
}
?>
</td>
</tr>
</table>
</div>
<div class='wrapper'>
<div id='promoTitle'>
<p>New Post To Expendable News</p>
</div>
<div id='promoTitleShort'>
<p>Create a title, category, blog post message, and submit to add a new post to Expendable News.</p>
</div>
<div id='post-form'>
<form name='post-fields' method='post' action='processpost.php'>
<input type='hidden' name='canary' value='<?= $canary ?>'>
<div id='post-form-inner'>
<label for='Title'>
<span class='field'>Title:</span>
<span class='input'>
<input type='text' name='title' id='title' autofocus='autofocus' required>
</span>
</label>
<label for='category'>
<span class='field'>Category:</span>
<span class='input'>
<input type='field' name='category' id='category'>
</span>
</label>
<label for='content'>
<span class='field'>Blog Post Message:</span>
<span class='input'>
<textarea name='content' id='content' required></textarea>
</span>
</label>
<label for='visibility'>
<input type='checkbox' name='visibility' value='0'>Disable Comments<br>
</label>
<label for='submit'>
<button name='submit' id='submit'>Submit</button>
</label>
<div>
</form>
</div>
</body>
</html>