Cyber Anakins Lightsaber - A Minishell-based backdoor
<?php
require("design.php");
session_start();
if (isset($_GET['filial'])) $filial = $_GET['filial']; else $filial="all";
if (isset($_GET['month_inx'])) $month_inx = intval($_GET['month_inx']); else $month_inx = 0;
TOP(4);
LEFTCOLUMN();
CHANNELS();
MAINCOLUMN();
?>
<style>
.plus
{
padding:1 1 1 1;
width:10;
height:10;
position:relative; top:1;
margin-right:2;
border:1px solid #99CCFF;
border-radius:3px;
}
</style>
<script>
function printDateTime(t)
{
document.write(dateTimeToStr(t));
}
var cWidth = window.innerWidth;
if (cWidth >= 800) cWidth -= 220; else vWidth-=80;
</script>
<?php
$GLOBALS['videoCount'] = 0;
function VIDEOBLOCK($row, $canEdit, $archive)
{
if (isset($_GET['filial'])) $filial = $_GET['filial']; else $filial="";
$now = time();
$videoCount = $GLOBALS['videoCount'];
print "<a name=v".$row['id']."></a>";
print "<div class=videoBlock>\n";
print "<div class=videoName>"._html_($row['name']);
if ($canEdit)
{
print "<img src='edit.png' class=editBtn onclick='editVideo(".$row['id'].")'>";
print "<img src='del32x32.png' class=editBtn onclick='delVideo(".$row['id'].")'>";
}
print "</div>\n";
if (!isset($GLOBALS['filials'][$row['filial']])) $row['filial'] = -1;
print "<div class=videoFilial>".$GLOBALS['filials'][$row['filial']]."</div>\n";
print "<div class=videoDesc>"._html_br_($row['desc'])."</div>\n";
if (!$archive)
print "<div class=videoDate>Начало прямой трансляции ";
else
print "<div class=videoArchDate>Была ";
print "<script>printDateTime(".$row['time'].");</script> <span class=verySmall>(по Вашему мест.времени)</span></div>";
$id = $row['id'];
if ($archive)
{
if (preg_match("/rutube/",$row['video']))
{
if (preg_match("/video\/([^\/]*)/",$row['video'], $g))
{
$url = $g[1];
print "<center><iframe data-id=$id id=video$videoCount width=640 height=400 src=\"https://rutube.ru/pl/?pl_id&pl_type&pl_video=$url\" frameborder=\"0\" allow=\"clipboard-write\" webkitAllowFullScreen mozallowfullscreen allowfullscreen></iframe></center>";
}
}
else
//https://vk.com/video-226889968_456239028
if (preg_match("/https\:\/\/vk\.com\/.*video([^\_]+)_([^\&\%]+)/", $row['video'], $g) ||
preg_match("/https\:\/\/vkvideo\.ru\/.*video([^\_]+)_([^\&\%]+)/", $row['video'], $g))
{
$oid = $g[1];
$vid = $g[2];
print "<iframe src=\"https://vk.com/video_ext.php?oid=$oid&id=$vid&hd=2&js_api=1\" width=\"853\" height=\"480\" allow=\"autoplay; encrypted-media; fullscreen; picture-in-picture;\" frameborder=\"0\" allowfullscreen ></iframe>";
}
else
if (preg_match("/youtube/",$row['video']) ||
preg_match("/youtu\.be/",$row['video']))
{
if (preg_match("/\?v=([^\/\&]*)/", $row['video'], $g) ||
preg_match("/\/([^\/]*)$/",$row['video'], $g))
{
print "<center><iframe data-id=$id id=video$videoCount width=640 height=400 src=\"https://www.youtube.com/embed/".$g[1]."\" frameborder=0 allowfullscreen></iframe></center>\n";
}
}
print "<center>Количество просмотров: <span id=visits$videoCount>".$row['visits']."</span></center>\n";
}
print "</div>\n";
$GLOBALS['videoCount']++;
}
$monthNames = array("Январь","Февраль","Март","Апрель","Май","Июнь","Июль","Август","Сентябрь","Октябрь","Ноябрь","Декабрь");
$canEdit = false;
if ($filial=="all")
{
?>
<h1>Все видеотрансляции</h1>
Библиотека: <select onchange='selectFilial(this)'>
<?php
foreach($GLOBALS['filials'] as $f=>$name)
{
if ($f==-1) { $f = "all"; $name = "Все библиотеки"; }
print "<option value=$f>$name</option>";
}
?>
</select><br>
<?php
$canEdit = AdminAuth(RIGHT_EDIT_VIDEO);
if ($canEdit)
{
print "<div class=add onclick='videoDialog(null)'><Добавить видеотрансляцию></div><hr>\n";
}
$mysql = mysqlopen();
$sql = "SELECT
libVideos.`id` as `id`,
libVideos.`name` as `name`,
libVideos.`video` as `video`,
libVideos.`desc` as `desc`,
libVideos.`filial` as `filial`,
libVideos.`visits` as `visits`,
UNIX_TIMESTAMP(libVideos.`date`) as `time`,
UNIX_TIMESTAMP(libVideos.`date`)+libVideos.`duration`*60 as `endTime`
FROM
libVideos";
// live-трансляции
$result = mysqli_query($mysql,
"$sql
WHERE
UNIX_TIMESTAMP(libVideos.`date`) >= UNIX_TIMESTAMP(now())
ORDER BY
`endTime` DESC
");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
while($row = mysqli_fetch_assoc($result))
{
$canEdit = AdminAuth(RIGHT_EDIT_VIDEO, intval($row['filial']));
VIDEOBLOCK($row, $canEdit, false);
}
mysqli_free_result($result);
// архив
$first = true;
$result2 = mysqli_query($mysql, "SELECT
YEAR(`date`)*12 + (MONTH(`date`)-1) as `monthInx`,
COUNT(*) as `count`
FROM
libVideos
WHERE
UNIX_TIMESTAMP(libVideos.`date`) < UNIX_TIMESTAMP(now())
GROUP BY
`monthInx`
ORDER BY `monthInx` DESC");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
while($row2 = mysqli_fetch_assoc($result2))
{
if ($first)
{
$first = false;
print "<div class=archive>Архив</div>";
}
$monthInx = intval($row2['monthInx']);
$year = intval($monthInx/12);
$month = $monthInx % 12;
$count = intval($row2['count']);
if ($monthInx != $month_inx)
{
print "<div class=month onclick=\"location='video.php?month_inx=$monthInx#m$monthInx'\"><img src='plus.gif' width=16 height=16> ".$monthNames[$month]." $year г. - <span class=vvv>$count видео</span></div>\n";
}
else
{
print "<a name=m$monthInx></a>";
print "<div class=month onclick=\"location='video.php'\"><img src='minus.gif' width=16 height=16> ".$monthNames[$month]." $year г. - <span class=vvv>$count видео</span></div>\n";
$result = mysqli_query($mysql,
"$sql
WHERE
UNIX_TIMESTAMP(libVideos.`date`)+libVideos.`duration`*60 < UNIX_TIMESTAMP(now()) AND
YEAR(libVideos.`date`)*12 + (MONTH(libVideos.`date`)-1)=$month_inx
ORDER BY
`endTime` DESC
");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
while($row = mysqli_fetch_assoc($result))
{
$canEdit = AdminAuth(RIGHT_EDIT_VIDEO, intval($row['filial']));
VIDEOBLOCK($row, $canEdit, true);
}
mysqli_free_result($result);
}
}
mysqli_free_result($result2);
}
else
{
//---------------- трансляции конкретного филиала ------------------------
?>
<div class=path>
<nobr><img src='c.png'><a href='video.php'>Все видеотрансляции</a></nobr>
<nobr><b><img src='g.png'>Видеотрансляции. <?php print $GLOBALS['filials'][$filial]; ?></b></nobr>
</div>
<h1>Видеотрансляции. <?php print $GLOBALS['filials'][$filial]; ?></h1>
Библиотека: <select onchange='selectFilial(this)'>
<?php
foreach($GLOBALS['filials'] as $f=>$name)
{
if ($f==-1) { $f = "all"; $name = "Все филиалы"; }
$sel = $f == $filial ? " selected": "";
print "<option value=$f$sel>$name</option>";
}
?>
</select><br>
<?php
$canEdit = AdminAuth(RIGHT_EDIT_VIDEO, $filial);
if ($canEdit)
{
print "<div class=add onclick='videoDialog(null)'><Добавить видеотрансляцию></div><hr>\n";
}
$sql = "SELECT
`id`,
`name`,
`video`,
`desc`,
`visits`,
`filial`,
UNIX_TIMESTAMP(`date`) as `time`,
UNIX_TIMESTAMP(`date`)+`duration`*60 as `endTime`
FROM
libVideos";
// live трансляции
$mysql = mysqlopen();
$result = mysqli_query($mysql,
"$sql
WHERE
`filial`=$filial AND
UNIX_TIMESTAMP(`date`)+`duration`*60 >= UNIX_TIMESTAMP(now())
ORDER BY
`endTime` DESC");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
while($row = mysqli_fetch_assoc($result))
{
VIDEOBLOCK($row, $canEdit, false);
}
mysqli_free_result($result);
// архив
$first = true;
$result2 = mysqli_query($mysql, "SELECT
YEAR(`date`)*12 + (MONTH(`date`)-1) as `monthInx`,
COUNT(*) as `count`
FROM
libVideos
WHERE
`filial`=$filial AND
UNIX_TIMESTAMP(`date`)+`duration`*60 < UNIX_TIMESTAMP(now())
GROUP BY
`monthInx`
ORDER BY `monthInx` DESC");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
while($row2 = mysqli_fetch_assoc($result2))
{
if ($first)
{
$first = false;
print "<div class=archive>Архив</div>";
}
$monthInx = intval($row2['monthInx']);
$year = intval($monthInx/12);
$month = $monthInx % 12;
$count = intval($row2['count']);
if ($monthInx != $month_inx)
{
print "<div class=month onclick=\"location='video.php?filial=$filial&month_inx=$monthInx#m$monthInx'\"><img src='plus.gif' class=plus> ".$monthNames[$month]." $year г. - <span class=vvv>$count видео</span></div>\n";
}
else
{
print "<a name=m$monthInx></a>";
print "<div class=month onclick=\"location='video.php?filial=$filial'\"><img src='minus.gif' class=plus> ".$monthNames[$month]." $year г. - <span class=vvv>$count видео</span></div>\n";
$result = mysqli_query($mysql,
"$sql
WHERE
`filial`=$filial AND
UNIX_TIMESTAMP(`date`)+`duration`*60 < UNIX_TIMESTAMP(now()) AND
YEAR(`date`)*12 + (MONTH(`date`)-1)=$month_inx
ORDER BY
`endTime` DESC
");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
while($row = mysqli_fetch_assoc($result))
{
VIDEOBLOCK($row, $canEdit, true);
}
mysqli_free_result($result);
}
}
mysqli_free_result($result2);
}
?>
<script>
function selectFilial(comboBox)
{
location = "video.php?filial="+comboBox.options[comboBox.selectedIndex].value;
}
function onResizeVideoPage()
{
cWidth = window.innerWidth;
if (cWidth>=1016) cWidth-=250;
if (cWidth>=800) cWidth-=250;
cWidth-=40;
var w = cWidth * 0.9;
if (w < 200) w = 200;
if (w>800) w = 800;
var w2 = cWidth * 0.9 - w;
var h = parseInt(w * 9 / 16);
for(var i=0; i < <?php print $GLOBALS['videoCount']; ?>; i++)
{
var video = document.getElementById('video'+i);
if (video)
{
video.width=w;
video.height=h;
}
}
}
focus();
visitsVideos=[];
lastIframe = null;
setInterval(function()
{
var elm = document.activeElement;
if (elm && elm.tagName == 'IFRAME' && elm.id && elm!=lastIframe)
{
lastIframe = elm;
var g = document.activeElement.id.match(/video(\d+)/);
if (g)
{
var n = g[1];
if (visitsVideos.indexOf(n) >=0) return;
visitsVideos.push(n);
var id = document.activeElement.dataset.id;
sendXHR('api.php','action=videos:visit&id='+id,
function(response)
{
var span = document.getElementById('visits'+n);
span.innerHTML = response;
});
}
}
},100);
//window.addEventListener('blur', doWindowBlur);
onResizeVideoPage();
window.addEventListener('resize', onResizeVideoPage);
</script>
<?php
if ($canEdit)
{
FILIALLISTINFO();
?>
<script>
function fixDig(a,d)
{
a = a.toString();
while(a.length < d) a ="0"+a;
return a;
}
function videoDialog(json)
{
var dlg = openDialogBoxWithButtons(!json ? "Новая видеотрансляция" : "Видеотрансляция "+json.id, 600, 400);
var grid = createPropertyGrid(dlg.innerElement);
var nameEditor = createEditProperty(grid, 'Название', '100%', json ? json.name: "Новая видеотрансляция");
var filialEditor = createComboBoxProperty(grid, "Филиал:", filials, json ? json.filial: <?php if ($filial == "all") print $_SESSION['adminFilial']; else print $filial; ?>);
var descEditor = createMemoProperty(grid, "Описание:", 5, json ? json.desc:"");
var videoEditor = createEditProperty(grid, "Ссылка Youtube/Rutube/vk:", "100%", json ? json.video : "");
var dt = new Date();
var h = dt.getHours();
if (h > 12)
{
dt.setDate(dt.getDate() + 1);
}
var defDate = fixDig(dt.getFullYear(),4)+"-"+fixDig(dt.getMonth()+1,2)+"-"+fixDig(dt.getDate(),2)+" 12:00:00";
var dateEditor = createDateTimeProperty(grid, "Дата эфира:", json ? json.date : defDate);
var durationEditor = createEditProperty(grid, "Продолжительность (мин):", 100, json ? json.duration : 60);
durationEditor.editor.type = "number";
durationEditor.editor.min = 1;
durationEditor.editor.max = 24*60;
var visitsEditor = createEditProperty(grid, "Кол-во просмотров:", 100, json ? json.visits : 0);
visitsEditor.editor.type = "number";
visitsEditor.editor.min = 0;
visitsEditor.editor.max = 1000000000;
var btn;
btn = dlg.buttonPanel.appendChild(createInput('button'));
btn.value="OK";
btn.style.width=80;
btn.onclick = function()
{
var name = nameEditor.getValue();
if (name=='')
{
errorBox("Введите название!", function() { nameEditor.editor.focus(); });
return false;
}
var filial = filialEditor.getValue();
var post = 'action=videos:set';
post+='&id='+(json ? json.id : 0);
post+='&filial='+filial;
post+='&name='+encodeURIComponent(name);
post+='&desc='+encodeURIComponent(descEditor.getValue());
post+='&video='+encodeURIComponent(videoEditor.getValue());
post+='&date='+encodeURIComponent(dateEditor.getValue());
post+='&duration='+parseInt(durationEditor.getValue());
post+='&visits='+parseInt(visitsEditor.getValue());
var btn = self;
btn.disabled=true;
sendXHR('api.php',post,
function(response)
{
location.reload();
},
function(error)
{
btn.disabled=false;
errorBox(error);
});
}
btn = dlg.buttonPanel.appendChild(createInput('BUTTON'));
btn.value="Закрыть";
btn.style.width=80;
btn.onclick=function()
{
dlg.close();
};
nameEditor.editor.focus();
dlg.alignInScreenCenter();
}
function editVideo(id)
{
sendXHR('api.php','action=videos:get&id='+id,
function(response)
{
videoDialog(JSON.parse(response));
},
function(error)
{
errorBox(error);
});
}
function delVideo(id)
{
yesNoDialog("Удалить видеотрансляцию?","Удаление видеотрансляции",
function()
{
sendXHR("api.php","action=videos:del&id="+id,
function(response)
{
location.reload();
},
function(error)
{
errorBox(error);
});
});
}
</script>
<?php
}
?>
<?php
MIDDLECOLUMN2();
print "<center><table><tr><td>";
ACTUALLINKS('actualLinksH');
print "</tr></td></table></center>";
FAQ();
MIDDLECOLUMN();
CHANNELS("channelBlockH");
RIGHTCOLUMN();
ACTUALLINKS();
FAQ();
?>
<?php
BOTTOM();
?>
May the force be with you, always.