$val) { $_POST[$var] = is_array( $val ) ? array_map( 'stripslashes', $val ) : stripslashes( $val ); } foreach($_GET as $var => $val) { $_GET[$var] = is_array( $val ) ? array_map( 'stripslashes', $val ) : stripslashes( $val ); } } // Prevent possible XSS attacks via $_GET. foreach ($_GET as $v) { if(preg_match('@]*?>.*?@si', $v) || preg_match("'@]*?>.*?@si'", $v) || preg_match("'@]*?>.*?@si'", $v) || preg_match("'@]*?>.*?@si'", $v) || preg_match('@<[\/\!]*?[^<>]*?>@si', $v) || preg_match('@]*?>.*?@siU', $v) || preg_match('@@', $v)) { include("languages/en.php"); // no language set yet, so default to English. die (_POSSIBLEHACK); } } unset($v); if(!isset($_SESSION)) session_start(); // clear the global variables if register globals is on. if(ini_get('register_globals')) { $arrayList = array_merge($_SESSION, $_GET, $_POST, $_COOKIE); foreach($arrayList as $k => $v) { unset($GLOBALS[$k]); } } Header('Cache-Control: private, no-cache, must-revalidate, max_age=0, post-check=0, pre-check=0'); header ("Pragma: no-cache"); header ("Expires: 0"); header("Content-Type: text/html; charset="._CHARSET); // Locate config.php and set the basedir path $folder_level = ""; while (!file_exists($folder_level."header.php")) { $folder_level .= "../"; } if(!defined("_BASEDIR")) define("_BASEDIR", $folder_level); @ include_once(_BASEDIR."config.php"); if(empty($sitekey)) { header("Location: install/install.php"); exit( ); } if(isset($skin)) $globalskin = $skin; $settingsresults = dbquery("SELECT * FROM ".$settingsprefix."fanfiction_settings WHERE sitekey = '".$sitekey."'"); $settings = dbassoc($settingsresults); if(!defined("SITEKEY")) define("SITEKEY", $settings['sitekey']); unset($settings['sitekey']); if(!defined("TABLEPREFIX")) define("TABLEPREFIX", $settings['tableprefix']); unset($settings['tableprefix']); define("STORIESPATH", $settings['storiespath']); unset($settings['storiespath']); foreach($settings as $var => $val) { $$var = stripslashes($val); $settings[$var] = htmlspecialchars($val); } if(isset($_GET['debug'])) $debug = 1; if(!$displaycolumns) $displaycolumns = 1; // shouldn't happen, but just in case. if($words) $words = explode(", ", $words); else $words = array( ); // Fix for sites with 2.0 or 1.1 running as well as 3.0 with register_globals on. $defaultskin = $skin; if(isset($globalskin)) $skin = $globalskin; if(isset($_GET['action'])) $action = strip_tags($_GET['action']); else $action = false; if(file_exists(_BASEDIR."languages/{$language}.php")) include (_BASEDIR."languages/{$language}.php"); else include (_BASEDIR."languages/en.php"); include_once(_BASEDIR."includes/queries.php"); include_once(_BASEDIR."includes/corefunctions.php"); // Check and/or set some variables used at various points throughout the script if(isset($_GET['offset'])) $offset = $_GET['offset']; if(!isset($offset) || !isNumber($offset)) $offset = 0; if(isset($_REQUEST["sid"])) $sid = $_REQUEST["sid"]; if(isset($sid) && !isNumber($sid)) unset($sid); if(isset($_REQUEST['seriesid'])) $seriesid = $_REQUEST["seriesid"]; if(isset($seriesid) && !isNumber($seriesid)) unset($seriesid); if(isset($_REQUEST['uid'])) $uid = $_REQUEST["uid"]; if(isset($uid) && !isNumber($uid)) unset($uid); if(isset($_REQUEST['chapid'])) $chapid = $_REQUEST["chapid"]; if(isset($chapid) && !isNumber($chapid)) unset($chapid); $let = false; if(isset($_GET['let'])) $let = $_GET['let']; if(isset($let) && !in_array($let, $alphabet)) $let = false; $output = ""; // Cleans these two variables of possible XSS attacks. if(isset($_SERVER['PHP_SELF'])) $_SERVER['PHP_SELF'] = htmlspecialchars(descript($_SERVER['PHP_SELF']), ENT_QUOTES); if(isset($PHP_SELF)) $PHP_SELF = htmlspecialchars(descript($PHP_SELF), ENT_QUOTES); // Set these variables to start. $agecontsent = false; $viewed = false; require_once("includes/get_session_vars.php"); if(isset($_GET['skin'])) { $siteskin = $_GET['skin']; $_SESSION[SITEKEY."_skin"] = $siteskin; } $v = explode(".", $version); include("version.php"); $newV = explode(".", $version); //if($v[0] == $newV[0] && ($v[1] < $newV[1] || (isset($newV[2]) && $v[2] < $newV[2]))) { foreach($newV AS $k => $l) { if($newV[$k] > $v[$k] || (!empty($newV[$k]) && empty($v[$k]))) { if(isADMIN && basename($_SERVER['PHP_SELF']) != "update.php") { header("Location: update.php"); exit( ); } else if(!isADMIN && basename($_SERVER['PHP_SELF']) != "maintenance.php" && !(isset($_GET['action']) && $_GET['action'] == "login")) { header("Location: maintenance.php"); exit( ); } } } if(!empty($_SESSION[SITEKEY."_skin"])) $siteskin = $_SESSION[SITEKEY."_skin"]; if($maintenance && !isADMIN && basename($_SERVER['PHP_SELF']) != "maintenance.php" && !(isset($_GET['action']) && $_GET['action'] == "login")) { header("Location: maintenance.php"); exit( ); } $blockquery = dbquery("SELECT * FROM ".TABLEPREFIX."fanfiction_blocks"); while($block = dbassoc($blockquery)) { $blocks[$block['block_name']] = unserialize($block['block_variables']); $blocks[$block['block_name']]['title'] = $block['block_title']; $blocks[$block['block_name']]['file'] = $block['block_file']; $blocks[$block['block_name']]['status'] = $block['block_status']; } // This session variable is used to track the story views if(isset($_SESSION[SITEKEY."_viewed"])) $viewed = $_SESSION[SITEKEY."_viewed"]; if(isset($_GET['ageconsent'])) $_SESSION[SITEKEY."_ageconsent"] = 1; if(isset($_GET['warning'])) $_SESSION[SITEKEY."_warned"][$_GET['warning']] = 1; if(file_exists("languages/{$language}.php")) require_once ("languages/{$language}.php"); else require_once ("languages/en.php"); if(is_dir(_BASEDIR."skins/$siteskin")) $skindir = _BASEDIR."skins/$siteskin"; else if(is_dir(_BASEDIR."skins/".$settings['skin'])) $skindir = _BASEDIR."skins/".$defaultskin; else $skindir = _BASEDIR."default_tpls"; if(USERUID) { $prefs = dbquery("SELECT sortby, storyindex, tinyMCE FROM ".TABLEPREFIX."fanfiction_authorprefs WHERE uid = '".USERUID."'"); if(dbnumrows($prefs)) list($defaultsort, $displayindex, $tinyMCE) = dbrow($prefs); } if(isset($_REQUEST['sort'])) $defaultsort = $_REQUEST['sort'] == "update" ? 1 : 0; define("_ORDERBY", " ORDER BY ".($defaultsort == 1 ? "updated DESC" : "stories.title ASC")); if($current == "viewstory"){ if(isset($chapid)) { $squery = dbquery("SELECT sid, inorder FROM ".TABLEPREFIX."fanfiction_chapters WHERE chapid = ".$chapid." LIMIT 1"); list($sid, $chapter) = dbrow($squery); } $titlequery = dbquery("SELECT story.title, story.coauthors, "._PENNAMEFIELD." as penname, story.summary FROM ".TABLEPREFIX."fanfiction_stories as story, "._AUTHORTABLE." WHERE sid = '$sid' AND "._UIDFIELD." = story.uid LIMIT 1"); if($story = dbassoc($titlequery)) { $authlink[] = $story['penname']; if($story['coauthors']) { $coquery = dbquery("SELECT "._PENNAMEFIELD." as penname FROM "._AUTHORTABLE." LEFT JOIN ".TABLEPREFIX."fanfiction_coauthors as ca ON "._UIDFIELD." = ca.uid WHERE ca.sid = '$sid'"); while($co = dbassoc($coquery)) { $authlink[] = $co['penname']; } } $titleinfo = stripslashes($story['title'])." "._BY." ".implode(", ", $authlink); $metaDesc = htmlspecialchars(stripslashes($story['summary'])); $filename = basename($titleinfo.".html"); $ie = strpos("msie", strtolower($_SERVER['HTTP_USER_AGENT'])) !== false ? true : false; if ($ie) $filename = rawurlencode($filename); header("Content-Disposition: inline; filename=\"".$titleinfo."\""); } } if($current == "viewuser" && isNumber($uid)) { $author = dbquery("SELECT "._PENNAMEFIELD." as penname FROM "._AUTHORTABLE." WHERE "._UIDFIELD." = '".$uid."'"); list($penname) = dbrow($author); $titleinfo = "$sitename :: $penname"; } echo _DOCTYPE.""; if(!isset($titleinfo)) $titleinfo = "$sitename :: $slogan"; if(isset($metaDesc)) echo ""; echo " "; if(!isset($_GET['action']) || $_GET['action'] != "printable") { echo " "; if(!empty($tinyMCE)) { echo " "; } } if(isset($displayform) && $displayform == 1) { echo ""; echo ""; } if(file_exists("extra_header.php")) include_once("extra_header.php"); if(file_exists("$skindir/extra_header.php")) include_once("$skindir/extra_header.php"); if(!$displaycolumns) $displaycolumns = 1; $colwidth = floor(100/$displaycolumns); if(!empty($_GET['action']) && $_GET['action'] == "printable") { if(file_exists("$skindir/printable.css")) echo ""; else echo ""; echo ""; } else { echo " \n "; } echo ""; $headerSent = true; include (_BASEDIR."includes/class.TemplatePower.inc.php"); if($debug == 1) { @ error_reporting(E_ALL); echo "\n"; echo "\n"; echo "\n"; } ?>