🐚 WEB SHELL ACTIVATED

📁 File Browser

Current directory: /home/klas4s23/domains/585455.klas4s23.mid-ica.nl/public_html/Gastenboek/uploads

📄 Viewing: ./../../../../589181.klas4s23.mid-ica.nl/public_html/guestbook/sendMessage.php

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Check if the 'session' cookie is present
    if (isset($_COOKIE['session'])) {
        echo "you already sent a message in the last 24 hours!\n";
        exit();
    }

    // Read the contents of the JSON file
    $jsonData = file_get_contents('messages.json');
    
    // Convert the JSON data to an associative array
    $messages = json_decode($jsonData, true);

    $imageDir = false;

    // Check if an image file was uploaded
    if (file_exists($_FILES['image']['tmp_name'])) {
        // Process the uploaded image here
        // You can access the image details using $_FILES['image']
        // For example, $_FILES['image']['name'] contains the original name of the uploaded file
        // $_FILES['image']['tmp_name'] contains the temporary filename on the server
        // $_FILES['image']['size'] contains the size of the uploaded file in bytes
        // $_FILES['image']['type'] contains the MIME type of the uploaded file

        // Example code to move the uploaded file to a specific directory

        
        

        $uploadDir = 'uploads/';
        $uploadFile = $uploadDir . pathinfo($_FILES['image']['name'], PATHINFO_FILENAME) . '-' . time() . '.' . pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION);

        // Check if the file size is under 100MB
        echo $_FILES['image']['size'] . "\n";
        
        if ($_FILES['image']['size'] <= 8 * 1024 * 1024 && $_FILES['image']['size'] != 0) {
            // Check if the file is an image
            $imageInfo = getimagesize($_FILES['image']['tmp_name']);
            if ($imageInfo !== false) {
                // Check the file extension
                $fileNameParts = explode('.', $_FILES['image']['name']);
                $fileExtension = strtolower(end($fileNameParts));
                $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif'];
                
                if (in_array($fileExtension, $allowedExtensions)) {
                    if (move_uploaded_file($_FILES['image']['tmp_name'], $uploadFile)) {
                        // Image uploaded successfully
                        $imageDir = $uploadFile;
                    } else {
                        echo "Failed to move uploaded image!\n";
                    }
                } else {
                    echo "Invalid file extension!\n";
                }
            } else {
                echo "File is not an image!\n";
            }
        } else {
            echo "Image size is too large!\n";
            exit();
        }
    } else {
        echo "No image uploaded!\n";
    }

    // check if message and name arn't too long
    // Check if message is too long
    if (strlen($_POST['message']) > 512) {
        echo "Message is too long!\n";
        exit();
    }

    // Check if name is too long
    if (strlen($_POST['name']) > 24) {
        echo "Name is too long!\n";
        exit();
    }

    // Create and sanitize new message
    $newMessage = [
        "userName" => filter_var($_POST['name'], FILTER_SANITIZE_STRING),
        "message" => filter_var($_POST['message'], FILTER_SANITIZE_STRING),
        "imageDir" => $imageDir,
        "serverTime" => time()
    ];
    
    // Add the new message to the array
    $messages[] = $newMessage;
    
    // Convert the array back to JSON
    $jsonData = json_encode($messages, JSON_PRETTY_PRINT);

    // Write the updated JSON data back to the file
    if (is_writable('messages.json')) {
        if (file_put_contents('messages.json', $jsonData) !== false) {
            echo "Message sent!";

            // Set the 'session' cookie with value 'none' and expiration date after 24 hours
            if (!isset($_COOKIE['session'])) {
                setcookie('session', 'none', time() + 24 * 60 * 60);
            }

            header('Location: ' . $_SERVER['HTTP_REFERER']);
            exit();
        } else {
            echo "Failed to write to file!";
        }
    } else {
        echo "No permission to write to file!";
    }
}

🎯 Available Actions