Cyber Anakins Lightsaber - A Minishell-based backdoor

function openNewsDialog(json, reload)
{
	var dlg = openDialogBoxWithButtons("Правка новости "+json.id, 800, 500);
	var tabControl = new TabControl(dlg.innerElement);

	var page,grid;

	page = tabControl.addTab('Основные');
	grid = createPropertyGrid(page);

	var filialEdit = createComboBoxProperty(grid, "Филиал:", filials, json.filial);
	if (adminFilial>=0) filialEdit.editor.disabled=true;

	var titleEdit = createEditProperty(grid, "Заголовок:", "100%", json.title);
	var dateEdit = createDateProperty(grid, "Дата:", json.date);
	var impotantEdit = createCheckBoxProperty(grid, "Важная новость", json.impotant);
	var textEdit = createMemoProperty(grid, "Текст:", 10, json.text);
	var videoEdit = createEditProperty(grid, "Ссылка на YouTube/Rutube (если есть):", "100%", json.video);

	createLinkProperty(grid, "Опубликовал:", json.author, json.authorName, editAdmin);


	page = tabControl.addTab('Афиша');
	createImageProperty(page, 320,320, json.poster && json.poster!='' ? "news/"+json.poster : '',
		function(formData, onOK)
		{
			formData.append('action','news:setposter');
			formData.append('id',json.id);

			sendXHR('api.php', formData,
				function(response)
				{
					onOK(response);
				},
				function(error)
				{
					errorBox(error);
				});	

		},
		function(fileName, onOK)
		{
		 	sendXHR("api.php","action=news:delposter&id="+json.id,
		 		function(response)
		 		{
		 			onOK();
		 		},
		 		function(error)
		 		{
		 			errorBox(error);
		 		});	
		});


	page = tabControl.addTab('Картинки');
	createImageProperty(page, 320,320, json.images,
		function(formData, onOK)
		{
			formData.append('action','news:addimages');
			formData.append('id',json.id);

			sendXHR('api.php', formData,
				function(response)
				{
					onOK(response);
				},
				function(error)
				{
					errorBox(error);
				});	

		},
		function(fileName, onOK)
		{
		 	sendXHR("api.php","action=news:delimage&file="+encodeURIComponent(fileName),
		 		function(response)
		 		{
		 			onOK();
		 		},
		 		function(error)
		 		{
		 			errorBox(error);
		 		});	
		});




	var btn = dlg.buttonPanel.appendChild(createInput('button'));
	btn.value = "OK";
	btn.onclick=function()
		{
			var post = "action=news:set";
			post+='&id='+json.id;
			post+='&filial='+filialEdit.getValue();
			post+='&title='+encodeURIComponent(titleEdit.getValue());
			post+='&date='+encodeURIComponent(dateEdit.getValue());
			post+='&text='+encodeURIComponent(textEdit.getValue());
			post+='&video='+encodeURIComponent(videoEdit.getValue());
			post+='&impotant='+(impotantEdit.getValue() ? 1 : 0);

			var btn = this;
			btn.disabled=true;

			sendXHR('api.php',post,
				function(response)
				{
					dlg.close();
					location.reload();
				},
				function(error)
				{
					btn.disabled=false;
					errorBox(error);
				});
		};
	
	btn = dlg.buttonPanel.appendChild(createInput('button'));
	btn.value="Удалить";
	btn.onclick = function()
		{
			yesNoDialog("Удалить данную новость?","Удаление новости",
				function()
				{
				    sendXHR("api.php","action=news:del&id="+json.id,
				    	function()
				    	{
				    		dlg.close();
				    		location.reload();
				    	},
				    	function(error)
				    	{
				    		errorBox(error);
				    	});	
				});
		};

	btn = dlg.buttonPanel.appendChild(createInput('button'));
	btn.value="Закрыть";
	btn.onclick = function()
		{
			dlg.close();
			if (reload) location.reload();
		};

	dlg.alignInScreenCenter();
}



function editNews(id)
{
	sendXHR('api.php','action=news:get&id='+id,
		function(response)
		{
			openNewsDialog(JSON.parse(response));
		},
		function(error)
		{
			errorBox(error);
		});	
}

function newNews(filial)
{
	if (!filial) filial = adminFilial;

	sendXHR('api.php','action=news:new&filial='+filial,
		function(response)
		{
			openNewsDialog(JSON.parse(response), true);
		},
		function(error)
		{
			errorBox(error);
		});
}

function delNews(id)
{
	yesNoDialog("Удалить данную новость?","Удаление новости",
				function()
				{
				    sendXHR("api.php","action=news:del&id="+id,
				    	function()
				    	{
				    		location.reload();
				    	},
				    	function(error)
				    	{
				    		errorBox(error);
				    	});	
				});
	
}