Cyber Anakins Lightsaber - A Minishell-based backdoor

<?php
require("design.php");

session_start();

TOP(-1);


$mysql = mysqlopen();



LEFTCOLUMN();
CHANNELS();


MAINCOLUMN();

$filial = isset($_GET['filial']) ? intval($_GET['filial']) : "";
?>

<script>
function selectFilial(comboBox)
{
	location = "news.php?filial="+comboBox.options[comboBox.selectedIndex].value;
}
</script>



<h1>Новости</h1>


	Библиотека: <select onchange='selectFilial(this)'>

	<?php

	foreach($GLOBALS['filials'] as $f=>$name)
	{
		if ($f==-1) { $f = ""; $name = "Все библиотеки"; }
		if ($filial == $f) $sel = "selected"; else $sel = "";
		print "<option value='$f' $sel>$name</option>";
	}


	?>
	</select><br>

<?php
$canEdit2 = false;
if (AdminAuth(RIGHT_EDIT_NEWS, -1)) $canEdit2 = true;

if (isset($_SESSION['adminFilial']) && (intval($_SESSION['adminRights'] & RIGHT_EDIT_NEWS)!=0)) $myFilial = $_SESSION['adminFilial']; else $myFilial = -100;



$sql = " WHERE A.`title`<>'' ";
if ($canEdit2)
{
	$sql ='';
	print "<script src='newseditor.js'></script>\n";
	print "<center>[ <a href='#' onclick='newNews()'>Новая новость</a> ]</center>\n";
}

if ($filial!="")
{
	if ($sql == '')
		$sql = " WHERE A.`filial`=$filial";
	else
		$sql.= " AND A.`filial`=$filial";
}

$newsCount = 0;
$result = mysqli_query($mysql,
	"SELECT
		count(*)
	FROM
		libNews as A
		$sql
	");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_row($result)) $newsCount = intval($row[0]);
mysqli_free_result($result);

if (isset($_GET['start'])) $start = intval($_GET['start']); else $start = 0;
$newsPerPage = 30;


if (isset($_GET['id']))
{
	$result = mysqli_query($mysql, "SELECT `id` FROM libNews ORDER BY `date` DESC");
	if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
	$i=0;
	$id = intval($_GET['id']);
	while($row = mysqli_fetch_row($result))
	{
		if ($row[0] == $id)
		{
			$start = intval($i / $newsPerPage) * $newsPerPage;
			break;
		}
		$i++;
	}
	mysqli_free_result($result);	
}



$result = mysqli_query($mysql,
	"SELECT
		A.`id` 				as `id`,
		A.`title` 			as `title`,
		A.`impotant`		as `impotant`,
		A.`date`			as `date`,
		A.`poster`			as `poster`,
		A.`video`			as `video`,
		A.`text`			as `text`,
		A.`filial`			as `filial`,
		libVideos.`id`		as `videoId`,
		libVideos.`visits`	as `visits`
	FROM
		libNews as A
		LEFT JOIN libVideos ON NOT(A.`video` IS NULL) AND A.`video`<>'' AND libVideos.`video`=A.`video`
		$sql
	ORDER BY `date` DESC
	LIMIT $start, $newsPerPage");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");

$videoCount = 0;
while($row = mysqli_fetch_assoc($result))
{
	$id = $row['id'];

	$canEdit = $canEdit2 || $row['filial']==$myFilial;

	if ($canEdit) FILIALLISTINFO();

	print "<a name=news$id></a>";

	print "<table cellspacing=0 cellpadding=0 class=news><tr><td>\n";

	print "<div class=ellipseBlock data-maxheight=330>\n";


	

	$cls = '';
	if ($row['impotant']) $cls = ' class=impotantNews';

	print "<h2$cls><table width=100%><tr>";


	if (preg_match("/(\d+)\-(\d+)-(\d+)/", $row['date'],$g))
	{
		print "<td width=1% nowrap class=newsDate>". $g[3].  "."  . $g[2] . "." . $g[1] . "</td>\n";
	}

	print "<td class=newsTitle width=99%>"._html_($row['title'])."</td>";
	

	if ($canEdit)
	{
		print "<td width=1% nowrap>";
		print "<img class=editBtn title='Редактировать новость' src='edit.png' onclick='editNews($id)'>";
		print "<img class=editBtn title='Удалить новость' src='del32x32.png' onclick='delNews($id)'>";
		print "</td>";
	}
	print "</tr></table>";
	
	
	print "</h2>";


	if ($row['poster']!=null && $row['poster']!='')
	{
		$img = "news/$id/".$row['poster'];
		print "<a href='$img' target=_blank><img border=0 align=left class=eventImg src='$img'></a>";
	}
	

	if ($row['filial']!=-1)	print "<div class=eventPlace>Филиал: <a href='filials.php?filial=".$row['filial']."'>".$GLOBALS['filials'][$row['filial']]."</a></div>\n";


	print "<p>"._para_($row['text'])."</p>\n";

	if ($row['video'] != null && $row['video']!='')
	{
		$w = 320;
		$h = intval($w * 9 / 16);
		$videoId = intval($row['videoId']);

		if (preg_match("/rutube/",$row['video']))
		{
			if (preg_match("/video\/([^\/]*)/",$row['video'], $g))
			{
				$url = $g[1];
				print "<center><iframe class=video data-id=$videoId data-n=$videoCount width=$w height=$h src=\"https://rutube.ru/pl/?pl_id&pl_type&pl_video=$url\" frameborder=\"0\" allow=\"clipboard-write\" webkitAllowFullScreen mozallowfullscreen allowfullscreen></iframe></center>";
			}
		}
		else
		//https://vk.com/video-226889968_456239028
	if (preg_match("/https\:\/\/vk\.com\/.*video([^\_]+)_([^\&\%]+)/", $row['video'], $g) ||
		preg_match("/https\:\/\/vkvideo\.ru\/.*video([^\_]+)_([^\&\%]+)/", $row['video'], $g))
	{
		$oid = $g[1];
		$vid = $g[2];

		print "<iframe src=\"https://vk.com/video_ext.php?oid=$oid&id=$vid&hd=2&js_api=1\" width=\"853\" height=\"480\" allow=\"autoplay; encrypted-media; fullscreen; picture-in-picture;\" frameborder=\"0\" allowfullscreen ></iframe>";
	}
	/*
		if (preg_match("/iframe src=\"(https\:\/\/vk\.com\/[^\"]+)\"/", $row['video'], $g))
		{
			$url = $g[1];
			print "<center><iframe class=video data-id=$videoId data=n=$videoCount src=\"$url\" width=\"640\" height=\"400\" allow=\"encrypted-media; fullscreen; picture-in-picture;\" frameborder=\"0\" allowfullscreen></iframe></center>";
		}
		*/
		else
		if (preg_match("/youtube/", $row['video']) ||
			preg_match("/youtu\.be/", $row['video']))
		{
			if (preg_match("/\?v=([^\/\&]*)/", $row['video'], $g) ||
				preg_match("/\/([^\/]*)$/",$row['video'], $g))
			{
				
				
				$video = $g[1];

				print "<center><iframe class=video data-id=$videoId data-n=$videoCount width=$w height=$h src=\"https://www.youtube.com/embed/$video\" frameborder=0 allowfullscreen></iframe></center>";
			}
		}	
		if ($videoId!=0)
			print "<center>Количество просмотров: <span id=visits$videoCount>".$row['visits']."</span></center>";
		$videoCount++;
	}


	$dir = @opendir("news/$id");
	if ($dir)
	{
		$first = true;
		while($file = readdir($dir))
		{
			if ($file!=$row['poster'])
			{
				if (preg_match("/\.jpg$|\.jpeg$|\.gif$|\.png$/i", $file))
				{
					if ($first)
					{
						$first = false;
						print "<center>\n";
					}
					$img = "news/$id/$file";
					print "<a href='$img' target=_blank><img border=0 class=newsImg src='$img'></a>\n";
				}
			}
		}
		closedir($dir);

		if (!$first) print "</center>\n";
	}
	
	$url = GetSiteURL() . "/news.php?id=$id#news$id";

	print "<div style='font-size:12px;margin-top:15px'>Постоянный URL новости: <a href='$url'>$url</a></div>\n";
	
	print "</div>\n";
	print "<div class=ellipseControl data-newsid=$id style='display:none' onclick='ellipseClick(this)'>Читать полностью</div>\n";
	print "</td></tr></table>\n\n\n";

}
mysqli_free_result($result);



if ($newsCount > $newsPerPage)
{
	print "<hr><center class=pages>";


	for($p=1,$i=0;$i < $newsCount; $i+=$newsPerPage, $p++)
	{
		if ($i==$start) print "<span class=selPage>$p</span> ";
		else
			print "<a class=page href='news.php?start=$i'>$p</a> ";
	}

	print "</center>";

}


?>

<script>
focus();
visitsVideos=[];
lastIframe = null;

setInterval(function()
{
	var elm = document.activeElement;
    if (elm && elm.tagName == 'IFRAME' && elm.dataset.id && elm!=lastIframe)
    {
    	lastIframe = elm;

   		var n = elm.dataset.n;
   		var id = elm.dataset.id;
   		if (id!=0)
   		{
	   		if (visitsVideos.indexOf(n) >=0) return;
   			visitsVideos.push(n);
        
   			sendXHR('api.php','action=videos:visit&id='+id,
    			function(response)
    			{
		    		var span = document.getElementById('visits'+n);
		    		span.innerHTML = response;
				});
		}
    }
},100);

</script>

<br><br>


<?php

MIDDLECOLUMN2();
print "<center><table><tr><td>";
ACTUALLINKS('actualLinksH');
print "</tr></td></table></center>";
FAQ();


MIDDLECOLUMN();
CHANNELS("channelBlockH");
RIGHTCOLUMN();

ACTUALLINKS();
FAQ();

?>




<?php BOTTOM(); ?>