kjack

<?php require_once('../Connections/connexion.php'); ?>

<?php

session_start();

$MM_authorizedUsers = "";

$MM_donotCheckaccess = "true";



// *** Restrict Access To Page: Grant or deny access to this page

function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) { 

  // For security, start by assuming the visitor is NOT authorized. 

  $isValid = False; 



  // When a visitor has logged into this site, the Session variable MM_Username set equal to their username. 

  // Therefore, we know that a user is NOT logged in if that Session variable is blank. 

  if (!empty($UserName)) { 

    // Besides being logged in, you may restrict access to only certain users based on an ID established when they login. 

    // Parse the strings into arrays. 

    $arrUsers = Explode(",", $strUsers); 

    $arrGroups = Explode(",", $strGroups); 

    if (in_array($UserName, $arrUsers)) { 

      $isValid = true; 

    } 

    // Or, you may restrict access to only certain users based on their username. 

    if (in_array($UserGroup, $arrGroups)) { 

      $isValid = true; 

    } 

    if (($strUsers == "") && true) { 

      $isValid = true; 

    } 

  } 

  return $isValid; 

}



$MM_restrictGoTo = "../login.php";

if (!((isset($_SESSION['MM_Username'])) && (isAuthorized("",$MM_authorizedUsers, $_SESSION['MM_Username'], $_SESSION['MM_UserGroup'])))) {   

  $MM_qsChar = "?";

  $MM_referrer = $_SERVER['PHP_SELF'];

  if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";

  if (isset($QUERY_STRING) && strlen($QUERY_STRING) > 0) 

  $MM_referrer .= "?" . $QUERY_STRING;

  $MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer);

  header("Location: ". $MM_restrictGoTo); 

  exit;

}

?>

<?php

mysql_select_db($database_connexion, $connexion);

$query_Recordset1 = "SELECT * FROM an_menu";

$Recordset1 = mysql_query($query_Recordset1, $connexion) or die(mysql_error());

$row_Recordset1 = mysql_fetch_assoc($Recordset1);

$totalRows_Recordset1 = mysql_num_rows($Recordset1);



$colname_Recordset2 = "-1";

if (isset($_GET['$UserName'])) {

  $colname_Recordset2 = (get_magic_quotes_gpc()) ? $_GET['$UserName'] : addslashes($_GET['$UserName']);

}

mysql_select_db($database_connexion, $connexion);

$query_Recordset2 = sprintf("SELECT idmembre, email, pseudo FROM an_membre WHERE email = '%s'", $colname_Recordset2);

$Recordset2 = mysql_query($query_Recordset2, $connexion) or die(mysql_error());

$row_Recordset2 = mysql_fetch_assoc($Recordset2);

$totalRows_Recordset2 = mysql_num_rows($Recordset2);



mysql_select_db($database_connexion, $connexion);

$query_Recordset3 = "SELECT mail, mvalm, mvala, valida, validm FROM an_config";

$Recordset3 = mysql_query($query_Recordset3, $connexion) or die(mysql_error());

$row_Recordset3 = mysql_fetch_assoc($Recordset3);

$totalRows_Recordset3 = mysql_num_rows($Recordset3);



$colname_Recordset2 = "1";

if (isset($_SESSION['$MM_Username'])) {

  $colname_Recordset2 = (get_magic_quotes_gpc()) ? $_SESSION['$MM_Username'] : addslashes($_SESSION['$MM_Username']);

}



$_POST['ajout'];

$ajout=$_POST['ajout'];

if ($ajout == "ok")

{



$sujet=htmlspecialchars($HTTP_POST_VARS["sujet"]);

$message=htmlspecialchars($HTTP_POST_VARS["message"]);



//je supprime les espaces vides

$sujet=trim($sujet);

$message=trim($message);



$date = date("d/m/Y");

if (isset ($file) && $HTTP_POST_FILES["file"]["error"]==0 && $HTTP_POST_VARS['MAX_FILE_SIZE']>=$HTTP_POST_FILES["file"]["size"])

// les vérifications d'usage (la variable existe, pas d'erreur et la taille est correcte )

{

$nom=$HTTP_POST_FILES["file"]["name"]; 

// récupération du nom du fichier

$point=strrpos($nom,"."); // on recherche le dernier point dans le nom du fichier

if (!$point) $ext=""; else $ext=strtolower(substr($nom,$point));

// pour récuperer l'extension du fichier

if (($ext==".jpg") || ($ext==".gif" )) // pour l'exemple je ne garde que ces 2 extensions valides

{

// pour la sécurité on choisit un nouveau nom de fichier ici on ajoute 1,2.. et une extension

$nombre=2;



$repertoire_upload="images/";



$nouveau_nom=$repertoire_upload.$nom."";// encore pour la secu, j'ajoute un .ttt comme seconde extension



while (file_exists($nouveau_nom))

{

$nombre++; // on incremente le nombre tant que le nom du fichier existe

$nouveau_nom=$repertoire_upload.$nom.$nombre.$ext.".ttt";

}// fin while

if (@move_uploaded_file($file,$nouveau_nom)) echo "<b>Téléchargement réussi</b>"; else echo " Echec du transfert";

// le point crucial qui tranfert le fichier temporaire en fichier permanent avec @ devant pour éviter un warning PHP en cas d'échec



}// fin if ext

else 

{

$erreur="le type de fichier est invalide ( seulement .jpg et .gif ).";

echo $erreur;

}// fin else ext

}// fin du premier if

else echo "";

mysql_select_db($database_connexion, $connexion);

$sql=("select idmembre from an_membre Where email='$MM_Username'");

$result=mysql_query($sql);

$rs=mysql_fetch_array($result);

$idmembre=$rs["idmembre"];



if($row_Recordset3['valida']=="y")

{

$vala="n";

}

if($row_Recordset3['valida']=="n")

{

$vala="y";

}

	function supprimeAccents($chaine){

 

      $tofind = "ÀÁÂÃÄÅàáâãäåÒÓÔÕÖØòóôõöøÈÉÊËèéêëÇçÌÍÎÏìíîïÙÚÛÜùúûüÿÑñ ";

 

      $replac = "AAAAAAaaaaaaOOOOOOooooooEEEEeeeeCcIIIIiiiiUUUUuuuuyNn_";

 

      return(strtr($chaine,$tofind,$replac));

 

 }$nouveau_nom=supprimeAccents($nouveau_nom);

//insert dans la base de donnée

  $insertSQL = "INSERT INTO an_annonce (sujet, message, `date`, photo,nomcat,email,pseudo,idmembre,vala) VALUES ('$sujet', '$message', '$date', '$nouveau_nom','$nomcat','$MM_Username','$pseudo','$idmembre','$vala')";

     

                       

  mysql_select_db($database_connexion, $connexion);

  $Result1 = mysql_query($insertSQL, $connexion) or die(mysql_error());

  ?>

 <? if($row_Recordset3['mail']=="rien"){

 echo " <meta http-equiv="Refresh" content="0; url=../compteur_novalide.php?nomcat=$nomcat">";exit;

 }?>

  <meta http-equiv="Refresh" content="0; url=../envoimailannonce.php?action=ajoutannonce&sujet=<? echo "$sujet";?>&cat=<? echo"$nomcat";?>&email=<? echo"$MM_Username";?>">

<?

   }

 ?>

<html>

<head>

<title>Document sans titre</title>

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">



<link href="../feuille.css" rel="stylesheet" type="text/css">

<script language="JavaScript" type="text/JavaScript">

<!--

function MM_findObj(n, d) { //v4.01

  var p,i,x;  if(!d) d=document; if((p=n.indexOf("?"))>0&&parent.frames.length) {

    d=parent.frames[n.substring(p+1)].document; n=n.substring(0,p);}

  if(!(x=d[n])&&d.all) x=d.all[n]; for (i=0;!x&&i<d.forms.length;i++) x=d.forms[i][n];

  for(i=0;!x&&d.layers&&i<d.layers.length;i++) x=MM_findObj(n,d.layers[i].document);

  if(!x && d.getElementById) x=d.getElementById(n); return x;

}



function MM_validateForm() { //v4.0

  var i,p,q,nm,test,num,min,max,errors='',args=MM_validateForm.arguments;

  for (i=0; i<(args.length-2); i+=3) { test=args[i+2]; val=MM_findObj(args[i]);

    if (val) { nm=val.name; if ((val=val.value)!="") {

      if (test.indexOf('isEmail')!=-1) { p=val.indexOf('@');

        if (p<1 || p==(val.length-1)) errors+='- '+nm+' must contain an e-mail address.n';

      } else if (test!='R') { num = parseFloat(val);

        if (isNaN(val)) errors+='- '+nm+' must contain a number.n';

        if (test.indexOf('inRange') != -1) { p=test.indexOf(':');

          min=test.substring(8,p); max=test.substring(p+1);

          if (num<min || max<num) errors+='- '+nm+' must contain a number between '+min+' and '+max+'.n';

    } } } else if (test.charAt(0) == 'R') errors += '- le champ '+nm+' est obligatoiren'; }

  } if (errors) alert('       ATTENTION !     nn'+errors);

  document.MM_returnValue = (errors == '');

}

//-->

</script>

</head>



<body>

<div align="center">

  <table width="100%"  border="0">

    <tr>

      <td><p>&nbsp;</p>

        <hr width="60%" color="#E0DFE3">

        <div align="center"><?php echo $row_Recordset2['idmembre']; ?>

          <p>&nbsp;</p>

          <p>

<A HREF="#" onClick="window.open('http://www.power-heberg.fr/espace_client/particip_renouv.php?login=trans69','_blank','toolbar=0, location=0, directories=0, status=0, scrollbars=0, resizable=0, copyhistory=0, menuBar=0, width=450, height=610');return(false)">Participez à l'hebergement de mon site</A>

            <br>

          </p>

        </div>

        <div align="center"> 

          <table width="50%"  border="0">

            <tr>

              <td height="283"><div align="center">

                <form action="<?php echo $editFormAction; ?>" method="post" enctype="multipart/form-data" name="form1">

                  <span class="Style1"><?php echo $nomcat ?></span>

                  <input name="MAX_FILE_SIZE" type="hidden" value="60000">

                  <table align="center">

                    <tr valign="baseline">

                      <td nowrap align="right">Sujet:</td>

                      <td><input name="sujet" type="text" value="" size="40" maxlength="45"></td>

                    </tr>

                    <tr valign="baseline">

                      <td nowrap align="right">Message:</td>

                      <td><textarea name="message" cols="40" rows="7"></textarea></td>

                    </tr>

                    <tr valign="baseline">

                      <td nowrap align="right">&nbsp;</td>

                      <td>Photo format gif ou jpg pas plus de 60ko </td>

                    </tr>

                    <tr valign="baseline">

                      <td nowrap align="right">Photo:</td>

                      <td><input name="file" type="file" id="file" size="35"></td>

                    </tr>

                    <tr valign="baseline">

                      <td nowrap align="right">&nbsp;</td>

                      <td><input type="submit" onClick="MM_validateForm('sujet','','R','message','','R');return document.MM_returnValue" value="Insérer l'enregistrement">

                        <input name="ajout" type="hidden" id="ajout" value="ok">                        </td>

                    </tr>

                  </table>

                  <input type="hidden" name="date" value="">

                  <input type="hidden" name="MM_insert" value="form1">

                  <input name="nomcat" type="hidden" id="nomcat" value="<?php echo $nomcat ?>">

                  <input name="pseudo" type="hidden" id="pseudo" value="<?php echo $row_Recordset2['pseudo']; ?>">

                </form>

                </div></td>

            </tr>

          </table>

          <?php if ($row_Recordset3['valida']=="y")

		   {

		   print "<center><b>Le webmaster valide toutes les annonces avant de les présenter sur le site</b></center>";

		   }

		   ?><br>

      </div></td>

      <td>&nbsp;</td>

    </tr>

  </table>

  <br>

  <hr width="60%">

  <br>

<a href="mailto:tarmo57@aol.com"><FONT size=3><tt>SCRIPT&copy; scriptHPascal</tt></FONT></a></div>

</body>

</html>

<?php

mysql_free_result($Recordset1);



mysql_free_result($Recordset2);



mysql_free_result($Recordset3);





?>