🐚 WEB SHELL ACTIVATED

📁 File Browser

Current directory: /home/klas4s23/domains/585455.klas4s23.mid-ica.nl/public_html/Gastenboek/uploads

📄 Viewing: ./../../../../587164.klas4s23.mid-ica.nl/public_html/gastenboek/send_message.php

<?php
session_start();

require_once 'testconnect.php';

// Check if the session is set for this user
if (!isset($_SESSION['posted']) || time() - $_SESSION['posted'] > 7200) { // Check if 2 hours have passed
    
    if ($_SERVER['REQUEST_METHOD'] == "POST") {
        // Get form data
        $name = isset($_POST['name']) ? trim($_POST['name']) : '';
        $message = isset($_POST['text']) ? trim($_POST['text']) : '';
        $imagePath = "";
        $errors = [];

        // Validate required fields
        if (empty($name)) {
            $errors[] = "Naam is verplicht";
        }
        if (empty($message)) {
            $errors[] = "Bericht is verplicht";
        }

        // Check if image file is uploaded
        if (isset($_FILES["fileToUpload"]["tmp_name"]) && !empty($_FILES["fileToUpload"]["tmp_name"])) {
            $target_dir = "uploads/";
            
            // Create uploads directory if it doesn't exist
            if (!file_exists($target_dir)) {
                mkdir($target_dir, 0755, true);
            }
            
            $uniqueFilename = uniqid() . '_' . basename($_FILES["fileToUpload"]["name"]);
            $target_file = $target_dir . $uniqueFilename;
            $uploadOk = 1;
            $imageFileType = strtolower(pathinfo($target_file, PATHINFO_EXTENSION));

            // Check if image file is a actual image
            $check = getimagesize($_FILES["fileToUpload"]["tmp_name"]);
            if ($check === false) {
                $errors[] = "Bestand is geen afbeelding";
                $uploadOk = 0;
            }

            // Check file size (5MB max)
            if ($_FILES["fileToUpload"]["size"] > 5000000) {
                $errors[] = "Bestand is te groot (max 5MB)";
                $uploadOk = 0;
            }

            // Allow certain file formats
            if (!in_array($imageFileType, ['jpg', 'jpeg', 'png', 'gif'])) {
                $errors[] = "Alleen JPG, JPEG, PNG & GIF bestanden zijn toegestaan";
                $uploadOk = 0;
            }

            // Try to upload file if no errors
            if ($uploadOk == 1) {
                if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $target_file)) {
                    $imagePath = $target_file;
                } else {
                    $errors[] = "Fout bij uploaden van bestand";
                }
            }
        }

        // If no errors, insert message into database
        if (empty($errors)) {
            $stmt = $conn->prepare('INSERT INTO `messages` (`name`, `message`, `imagePath`) VALUES (?, ?, ?)');
            $stmt->bindParam(1, $name);
            $stmt->bindParam(2, $message);
            $stmt->bindParam(3, $imagePath);
            
            if ($stmt->execute()) {
                // Set session variable to mark that the user has posted
                $_SESSION['posted'] = time();
                // Redirect to index page after successful submission
                header('Location: index.php?success=1');
                exit;
            } else {
                // Redirect with error
                header('Location: message.php?error=db');
                exit;
            }
        } else {
            // Store errors in session and redirect back to form
            $_SESSION['errors'] = $errors;
            $_SESSION['form_data'] = ['name' => $name, 'text' => $message];
            header('Location: message.php');
            exit;
        }
    }
} else {
    // User has already posted within 2 hours
    header('Location: index.php?error=cooldown');
    exit; 
}
?>

🎯 Available Actions