<?php

include("../../functions.php");
include("../../configuration.php");
include("../../dbhandle.php");
include("../../security.php");
include('../../../data/plugins/load.php');

if(isset($_GET['activateplugin'])) {
	$pluginname = $_GET['pluginname'];
	$pluginname = AntiXSS::setEncoding($pluginname, "UTF-8");
	$pluginname = str_replace('"','',$pluginname);
	$pluginname = str_replace("'","",$pluginname);
	$pluginname = str_replace(">","",$pluginname);
	$pluginname = str_replace("<","",$pluginname);
	$pluginname = str_replace("</","",$pluginname);
	$pluginname = str_replace("&%","",$pluginname);
	$pluginname = str_replace("script","",$pluginname);
	$pluginname = str_replace("(","",$pluginname);
	$pluginname = str_replace(")","",$pluginname);
	echo $pluginname . '<br>';
	$adminname = $_GET['adminname'];
	$adminname = AntiXSS::setEncoding($adminname, "UTF-8");
	$adminname = str_replace('"','',$adminname);
	$adminname = str_replace("'","",$adminname);
	$adminname = str_replace(">","",$adminname);
	$adminname = str_replace("<","",$adminname);
	$adminname = str_replace("</","",$adminname);
	$adminname = str_replace("&%","",$adminname);
	$adminname = str_replace("script","",$adminname);
	$adminname = str_replace("(","",$adminname);
	$adminname = str_replace(")","",$adminname);
	echo $adminname . '<br>';
	$adminpasswordmd5 = md5($_GET['adminpassword']);
	echo $adminpasswordmd5 . '<br>';
	$adminpin = $_GET['adminpin'];
	$adminpin = AntiXSS::setEncoding($adminpin, "UTF-8");
	$adminpin = str_replace('"','',$adminpin);
	$adminpin = str_replace("'","",$adminpin);
	$adminpin = str_replace(">","",$adminpin);
	$adminpin = str_replace("<","",$adminpin);
	$adminpin = str_replace("</","",$adminpin);
	$adminpin = str_replace("&%","",$adminpin);
	$adminpin = str_replace("script","",$adminpin);
	$adminpin = str_replace("(","",$adminpin);
	$adminpin = str_replace(")","",$adminpin);
	echo $adminpin . '<br>';
	$selecttype = mysql_query("SELECT * FROM Accounts_Premium_Admin WHERE username='$adminname' AND pincode='$adminpin'");
	$pubrows = mysql_num_rows($selecttype);
	if($pubrows!=0) {
		$acctype = 'admin';
	}
	// IF USERNAME AND PASSWORD WERE ENTERED 
	if ($adminname&&$adminpasswordmd5)
	{
	
	if(empty($acctype)) {
	// ACCOUNT WITH THIS USERNAME NOT FOUND
	 	die('Admin with this username, password or PIN was not found - 1');
	}
		$query = mysql_query("SELECT * FROM Accounts_Premium_Admin WHERE username='$adminname' AND pincode='$adminpin'");
		$numrows = mysql_num_rows($query);

			if ($numrows!=0)
			{
				 while ($row = mysql_fetch_assoc($query))
				  {
					     $dbusername = $row['username'];
					     $dbpassword = $row['password'];
				   }

					  // CHECK TO SEE IF THEY MATCH!
				  if ($adminname==$dbusername&&$adminpasswordmd5==$dbpassword)
				  {
						mysql_query("UPDATE Web_Plugins SET activated='1' WHERE directory='$pluginname'"); 
						die('Plugin '.$pluginname.' activated');
				  }
				  else  
				  // PASSWORD IS INCORECT
					  { 
					  		die('Admin with this username, password or PIN was not found');
					  }
 
			}else{
			  	die('Admin with this username, password or PIN was not found - 2');
			}
	}
}else if(isset($_GET['addplugin'])) {
	$pluginname = $_GET['pluginname'];
	$pluginname = AntiXSS::setEncoding($pluginname, "UTF-8");
	$pluginname = str_replace('"','',$pluginname);
	$pluginname = str_replace("'","",$pluginname);
	$pluginname = str_replace(">","",$pluginname);
	$pluginname = str_replace("<","",$pluginname);
	$pluginname = str_replace("</","",$pluginname);
	$pluginname = str_replace("&%","",$pluginname);
	$pluginname = str_replace("script","",$pluginname);
	$pluginname = str_replace("(","",$pluginname);
	$pluginname = str_replace(")","",$pluginname);
	echo $pluginname . '<br>';
	$plugindirectory = $_GET['plugindirectory'];
	$plugindirectory = AntiXSS::setEncoding($plugindirectory, "UTF-8");
	$plugindirectory = str_replace('"','',$plugindirectory);
	$plugindirectory = str_replace("'","",$plugindirectory);
	$plugindirectory = str_replace(">","",$plugindirectory);
	$plugindirectory = str_replace("<","",$plugindirectory);
	$plugindirectory = str_replace("</","",$plugindirectory);
	$plugindirectory = str_replace("&%","",$plugindirectory);
	$plugindirectory = str_replace("script","",$plugindirectory);
	$plugindirectory = str_replace("(","",$plugindirectory);
	$plugindirectory = str_replace(")","",$plugindirectory);
	echo $plugindirectory . '<br>';
	$pluginmasterfile = $_GET['pluginmasterfile'];
	$pluginmasterfile = AntiXSS::setEncoding($pluginmasterfile, "UTF-8");
	$pluginmasterfile = str_replace('"','',$pluginmasterfile);
	$pluginmasterfile = str_replace("'","",$pluginmasterfile);
	$pluginmasterfile = str_replace(">","",$pluginmasterfile);
	$pluginmasterfile = str_replace("<","",$pluginmasterfile);
	$pluginmasterfile = str_replace("</","",$pluginmasterfile);
	$pluginmasterfile = str_replace("&%","",$pluginmasterfile);
	$pluginmasterfile = str_replace("script","",$pluginmasterfile);
	$pluginmasterfile = str_replace("(","",$pluginmasterfile);
	$pluginmasterfile = str_replace(")","",$pluginmasterfile);
	echo $pluginmasterfile . '<br>';
	$adminname = $_GET['adminname'];
	$adminname = AntiXSS::setEncoding($adminname, "UTF-8");
	$adminname = str_replace('"','',$adminname);
	$adminname = str_replace("'","",$adminname);
	$adminname = str_replace(">","",$adminname);
	$adminname = str_replace("<","",$adminname);
	$adminname = str_replace("</","",$adminname);
	$adminname = str_replace("&%","",$adminname);
	$adminname = str_replace("script","",$adminname);
	$adminname = str_replace("(","",$adminname);
	$adminname = str_replace(")","",$adminname);
	echo $adminname . '<br>';
	$adminpasswordmd5 = md5($_GET['adminpassword']);
	echo $adminpasswordmd5 . '<br>';
	$adminpin = $_GET['adminpin'];
	$adminpin = AntiXSS::setEncoding($adminpin, "UTF-8");
	$adminpin = str_replace('"','',$adminpin);
	$adminpin = str_replace("'","",$adminpin);
	$adminpin = str_replace(">","",$adminpin);
	$adminpin = str_replace("<","",$adminpin);
	$adminpin = str_replace("</","",$adminpin);
	$adminpin = str_replace("&%","",$adminpin);
	$adminpin = str_replace("script","",$adminpin);
	$adminpin = str_replace("(","",$adminpin);
	$adminpin = str_replace(")","",$adminpin);
	echo $adminpin . '<br>';
	$data1 = $_GET['data1'];
	$data1 = AntiXSS::setEncoding($data1, "UTF-8");
	$data1 = str_replace('"','',$data1);
	$data1 = str_replace("'","",$data1);
	$data1 = str_replace(">","",$data1);
	$data1 = str_replace("<","",$data1);
	$data1 = str_replace("</","",$data1);
	$data1 = str_replace("&%","",$data1);
	$data1 = str_replace("script","",$data1);
	$data1 = str_replace("(","",$data1);
	$data1 = str_replace(")","",$data1);
	echo $data1 . '<br>';
	$data2 = $_GET['data2'];
	$data2 = AntiXSS::setEncoding($data2, "UTF-8");
	$data2 = str_replace('"','',$data2);
	$data2 = str_replace("'","",$data2);
	$data2 = str_replace(">","",$data2);
	$data2 = str_replace("<","",$data2);
	$data2 = str_replace("</","",$data2);
	$data2 = str_replace("&%","",$data2);
	$data2 = str_replace("script","",$data2);
	$data2 = str_replace("(","",$data2);
	$data2 = str_replace(")","",$data2);
	echo $data2 . '<br>';
	$data3 = $_GET['data3'];
	$data3 = AntiXSS::setEncoding($data3, "UTF-8");
	$data3 = str_replace('"','',$data3);
	$data3 = str_replace("'","",$data3);
	$data3 = str_replace(">","",$data3);
	$data3 = str_replace("<","",$data3);
	$data3 = str_replace("</","",$data3);
	$data3 = str_replace("&%","",$data3);
	$data3 = str_replace("script","",$data3);
	$data3 = str_replace("(","",$data3);
	$data3 = str_replace(")","",$data3);
	echo $data3 . '<br>';
	$data4 = $_GET['data4'];
	$data4 = AntiXSS::setEncoding($data4, "UTF-8");
	$data4 = str_replace('"','',$data4);
	$data4 = str_replace("'","",$data4);
	$data4 = str_replace(">","",$data4);
	$data4 = str_replace("<","",$data4);
	$data4 = str_replace("</","",$data4);
	$data4 = str_replace("&%","",$data4);
	$data4 = str_replace("script","",$data4);
	$data4 = str_replace("(","",$data4);
	$data4 = str_replace(")","",$data4);
	echo $data4 . '<br>';
	$data5 = $_GET['data5'];
	$data5 = AntiXSS::setEncoding($data5, "UTF-8");
	$data5 = str_replace('"','',$data5);
	$data5 = str_replace("'","",$data5);
	$data5 = str_replace(">","",$data5);
	$data5 = str_replace("<","",$data5);
	$data5 = str_replace("</","",$data5);
	$data5 = str_replace("&%","",$data5);
	$data5 = str_replace("script","",$data5);
	$data5 = str_replace("(","",$data5);
	$data5 = str_replace(")","",$data5);
	echo $data5 . '<br>';
	$data6 = $_GET['data6'];
	$data6 = AntiXSS::setEncoding($data6, "UTF-8");
	$data6 = str_replace('"','',$data6);
	$data6 = str_replace("'","",$data6);
	$data6 = str_replace(">","",$data6);
	$data6 = str_replace("<","",$data6);
	$data6 = str_replace("</","",$data6);
	$data6 = str_replace("&%","",$data6);
	$data6 = str_replace("script","",$data6);
	$data6 = str_replace("(","",$data6);
	$data6 = str_replace(")","",$data6);
	echo $data6 . '<br>';
	$data7 = $_GET['data7'];
	$data7 = AntiXSS::setEncoding($data7, "UTF-8");
	$data7 = str_replace('"','',$data7);
	$data7 = str_replace("'","",$data7);
	$data7 = str_replace(">","",$data7);
	$data7 = str_replace("<","",$data7);
	$data7 = str_replace("</","",$data7);
	$data7 = str_replace("&%","",$data7);
	$data7 = str_replace("script","",$data7);
	$data7 = str_replace("(","",$data7);
	$data7 = str_replace(")","",$data7);
	echo $data7 . '<br>';
	$data8 = $_GET['data8'];
	$data8 = AntiXSS::setEncoding($data8, "UTF-8");
	$data8 = str_replace('"','',$data8);
	$data8 = str_replace("'","",$data8);
	$data8 = str_replace(">","",$data8);
	$data8 = str_replace("<","",$data8);
	$data8 = str_replace("</","",$data8);
	$data8 = str_replace("&%","",$data8);
	$data8 = str_replace("script","",$data8);
	$data8 = str_replace("(","",$data8);
	$data8 = str_replace(")","",$data8);
	echo $data8 . '<br>';
	$data9 = $_GET['data9'];
	$data9 = AntiXSS::setEncoding($data9, "UTF-8");
	$data9 = str_replace('"','',$data9);
	$data9 = str_replace("'","",$data9);
	$data9 = str_replace(">","",$data9);
	$data9 = str_replace("<","",$data9);
	$data9 = str_replace("</","",$data9);
	$data9 = str_replace("&%","",$data9);
	$data9 = str_replace("script","",$data9);
	$data9 = str_replace("(","",$data9);
	$data9 = str_replace(")","",$data9);
	echo $data9 . '<br>';
	$data10 = $_GET['data10'];
	$data10 = AntiXSS::setEncoding($data10, "UTF-8");
	$data10 = str_replace('"','',$data10);
	$data10 = str_replace("'","",$data10);
	$data10 = str_replace(">","",$data10);
	$data10 = str_replace("<","",$data10);
	$data10 = str_replace("</","",$data10);
	$data10 = str_replace("&%","",$data10);
	$data10 = str_replace("script","",$data10);
	$data10 = str_replace("(","",$data10);
	$data10 = str_replace(")","",$data10);
	echo $data10 . '<br>';
	$selecttype = mysql_query("SELECT * FROM Accounts_Premium_Admin WHERE username='$adminname' AND pincode='$adminpin'");
	$pubrows = mysql_num_rows($selecttype);
	if($pubrows!=0) {
		$acctype = 'admin';
	}
	// IF USERNAME AND PASSWORD WERE ENTERED 
	if ($adminname&&$adminpasswordmd5)
	{
	
	if(empty($acctype)) {
	// ACCOUNT WITH THIS USERNAME NOT FOUND
	 	die('Admin with this username, password or PIN was not found - 1');
	}
		$query = mysql_query("SELECT * FROM Accounts_Premium_Admin WHERE username='$adminname' AND pincode='$adminpin'");
		$numrows = mysql_num_rows($query);

			if ($numrows!=0)
			{
				 while ($row = mysql_fetch_assoc($query))
				  {
					     $dbusername = $row['username'];
					     $dbpassword = $row['password'];
				   }

					  // CHECK TO SEE IF THEY MATCH!
				  if ($adminname==$dbusername&&$adminpasswordmd5==$dbpassword)
				  {
						mysql_query("INSERT INTO `Web_Plugins` (`name`, `activated`, `turnable`, `directory`, `version`, `masterfile`, `headername`, `backfile`, `data1`, `data2`, `data3`, `data4`, `data5`, `data6`, `data7`, `data8`, `data9`, `data10`) VALUES ('$pluginname', 1, 1, '$plugindirectory', 10000, '$pluginmasterfile', '', '', '$data1', '$data2', '$data3', '$data4', '$data5', '$data6', '$data7', '$data8', '$data9', '$data10');"); 
						die('Plugin '.$pluginname.' activated');
				  }
				  else  
				  // PASSWORD IS INCORECT
					  { 
					  		die('Admin with this username, password or PIN was not found');
					  }
 
			}else{
			  	die('Admin with this username, password or PIN was not found - 2');
			}
	}
}else {
	die ('Action not set');
}

?>