Possible hack attempt! Lab name can not contain '..'."; exit(); } $labroot = "/home/www/html/research/labs/" . $LAB; // Include lab settings include ($labroot . "/setup.inc"); $labtitle = stripslashes ($labtitle); $backcolor = stripslashes ($backcolor); $foreground = stripslashes ($foreground); $barcolor = stripslashes ($barcolor); $scheme = stripslashes ($scheme); $menulocation = stripslashes ($menulocation); // Validate Lab PW if (md5($PW) != $pw) { echo "Password is not valid! " . md5($PW); exit(); } $options = array ( "Welcome", "General Setup", "About Us", "Members", "Objectives", "Director's Message", "Related Info", "Contact Info", "Protocols", "Images", "Publications" ); if ($FUNC == "PIC") { switch ($FUNC2) { case "Add": echo <<< EOF

Add a picture

File:
Caption:
Description:
EOF; exit (); break; case "UPLOAD": if ($imgfile != "none") { move_uploaded_file($imgfile, $labroot . "/photos/" . $imgfile_name); $fp = fopen ($labroot . "/text/photos.txt","a+"); fputs ($fp, "\"" . $imgfile_name . "\",\"" . addslashes($caption) . "\",\"" . addslashes($desc) . "\"\r\n"); fclose ($fp); header ("Location: edit.php?PAGE=8&LAB=" . rawurlencode ($LAB)); } break; case "Edit": $fp = fopen ($labroot . "/text/photos.txt","r"); while (($data = fgetcsv ($fp, 5000, ",")) ) { if ($data[0] == $s) break; } if (!$data) exit (); echo <<< EOF

Edit a picture

Caption:
Description:
EOF; exit (); break; case "SAVE": $imgs = array(); $fp = fopen ($labroot . "/text/photos.txt","r"); while (($data = fgetcsv ($fp, 5000, ",")) ) { if ($data[0] == $imgname) { $data[1] = $caption; $data[2] = $desc; } array_push($imgs, $data); } fclose ($fp); $fp = fopen ($labroot . "/text/photos.txt", "w"); reset ($imgs); while (list ($key, $val) = each ($imgs)) { fputs($fp, "\"$val[0]\",\"$val[1]\",\"$val[2]\"\r\n"); } fclose ($fp); header ("Location: edit.php?PAGE=8&LAB=" . rawurlencode ($LAB)); break; case "Remove": $imgs = array(); $fp = fopen ($labroot . "/text/photos.txt","r"); while (($data = fgetcsv ($fp, 5000, ",")) ) { if ($data[0] != $s) array_push($imgs, $data); else unlink ($labroot . "/photos/" . $data[0]); } fclose ($fp); $fp = fopen ($labroot . "/text/photos.txt", "w"); reset ($imgs); while (list ($key, $val) = each ($imgs)) { fputs($fp, "\"$val[0]\",\"$val[1]\",\"$val[2]\"\r\n"); } fclose ($fp); header ("Location: edit.php?PAGE=8&LAB=" . rawurlencode ($LAB)); break; } } if ($FUNC == "MEMBER") { switch ($FUNC2) { case "Add": echo <<< EOF

Add a lab member

Name:
Picture (optional):
Description/Bio (optional):
EOF; exit (); break; case "UPLOAD": $fp = fopen ($labroot . "/text/members.txt","a+"); if ($imgfile != "none") { move_uploaded_file($imgfile, $labroot . "/members/" . $imgfile_name); fputs ($fp, "\"" . $membername . "\",\"" . addslashes($desc) . "\",\"" . $imgfile_name . "\"\r\n"); } else fputs ($fp, "\"" . $membername . "\",\"" . addslashes($desc) . "\",\"\"\r\n"); fclose ($fp); header ("Location: edit.php?PAGE=3&LAB=" . rawurlencode ($LAB)); break; case "Edit": $fp = fopen ($labroot . "/text/members.txt","r"); while (($data = fgetcsv ($fp, 5000, ",")) ) { if ($data[0] == $s) break; } if (!$data) exit (); $olddesc = $data[1]; if (empty ($data[2])) $nopic = " Member currently has no picture"; echo <<< EOF

Edit a member - $data[0]

Picture:
Description/Bio:
$nopic"); if (!empty ($data[2])) { if ($data[2][0] != '.' && $data[2][0] != '/') $picloc = "/research/labs/" . $LAB . "/members/" . $data[2]; echo <<< EOF


EOF; } echo <<< EOF
EOF; exit (); break; case "SAVE": if ($imgfile != "none") { move_uploaded_file($imgfile, $labroot . "/members/" . $imgfile_name); } else $imgfile_name = $PIC; $imgs = array(); $fp = fopen ($labroot . "/text/members.txt","r"); while (($data = fgetcsv ($fp, 5000, ",")) ) { if ($data[0] == $membername) { // if remove button is hit, remove picture if (!empty ($PIC) || $PIC == "") { $data[2] = $imgfile_name; } else $data[2] = ""; $data[1] = addslashes(trim($desc)); } array_push($imgs, $data); } fclose ($fp); $fp = fopen ($labroot . "/text/members.txt", "w"); reset ($imgs); while (list ($key, $val) = each ($imgs)) { fputs($fp, "\"$val[0]\",\"$val[1]\",\"$val[2]\"\r\n"); } fclose ($fp); header ("Location: edit.php?PAGE=3&LAB=" . rawurlencode ($LAB)); break; case "Remove": $imgs = array(); $fp = fopen ($labroot . "/text/members.txt","r"); while (($data = fgetcsv ($fp, 5000, ",")) ) { if ($data[0] != $s) array_push($imgs, $data); else @unlink ($labroot . "/members/" . $data[2]); } fclose ($fp); $fp = fopen ($labroot . "/text/members.txt", "w"); reset ($imgs); while (list ($key, $val) = each ($imgs)) { fputs($fp, "\"$val[0]\",\"$val[1]\",\"$val[2]\"\r\n"); } fclose ($fp); header ("Location: edit.php?PAGE=3&LAB=" . rawurlencode ($LAB)); break; } } if ($FUNC == "Next >" || $FUNC == "< Previous") { switch ($PAGE) { case 1: $fp = fopen ($labroot . "/setup.inc", "wb"); fputs ($fp, "\r\n"); fclose ($fp); break; case 2: $fp = fopen ($labroot . "/text/overview.txt", "wb"); fwrite ($fp, stripcslashes($data)); fclose ($fp); break; case 4: $fp = fopen ($labroot . "/text/objectives.txt", "wb"); fwrite ($fp, stripcslashes($data)); fclose ($fp); break; case 5: $fp = fopen ($labroot . "/text/director.txt", "wb"); fwrite ($fp, stripcslashes($data)); fclose ($fp); break; case 6: $fp = fopen ($labroot . "/text/related.txt", "wb"); fwrite ($fp, stripcslashes($data)); fclose ($fp); break; case 7: $fp = fopen ($labroot . "/text/contact.txt", "wb"); fwrite ($fp, stripcslashes($data)); fclose ($fp); break; case 8: $fp = fopen ($labroot . "/text/protocols.txt", "wb"); fwrite ($fp, stripcslashes($data)); fclose ($fp); break; case 10: $fp = fopen ($labroot . "/text/publications.txt", "wb"); fwrite ($fp, stripcslashes($data)); fclose ($fp); break; } if($FUNC == "Next >" && $PAGE != count ($options)) $PAGE++; if($FUNC == "< Previous" && $PAGE != 0) $PAGE--; } ?>

$options[$i]
"; else echo "$options[$i]
"; } ?>
General Web site layout

The following options apply to your entire web site.

Web Site Title:
Color Scheme:
Menu Location:
Use Custom Header:
EOF; break; case 2: echo "
About Us

"; echo ""; echo "Enter the text that will appear on the About Us page. This page should include general information about your lab. This is the page that visitors to your web site will first see, so it should be informative, but brief.

"; echo ""; echo "
"; echo ""; echo "\">"; echo "
"; break; case 3: echo "Lab Members

"; echo "This page allows you to edit your lab members. Add to this list all the members of your lab and they will appear on your web site.

"; echo "
"; echo ""; // List all the photos $fp = fopen ($labroot . "/text/members.txt","r"); echo ""; fclose($fp); echo "
"; echo ""; echo ""; echo "
"; echo "
"; echo ""; echo "\">"; echo "
"; echo "
"; break; case 4: echo "
Objectives

"; echo ""; echo "Enter the text that will appear on the Objectives page. Use this page to describe in detail what objectives your lab hopes to accomplish. This normally will be detailed information about the research your lab is doing.

"; echo ""; echo "
"; echo ""; echo "\">"; echo "
"; break; case 5: echo "
Director's Message

"; echo ""; echo "Enter the text that will appear on the Director's Message page. This page contains a message that your lab PI may wish to post about your lab or web site. If your director does not want to place a message here you should put some generic message like \"Thank you for visiting our web site and for your interest in our research\".

"; echo ""; echo "
"; echo ""; echo "\">"; echo "
"; break; case 6: echo "
Related Info

"; echo ""; echo "Enter the text that will appear on the Related Info page. This page can contain references to other web sites, labs or publications that may be related to your lab's research.

"; echo ""; echo "
"; echo ""; echo "\">"; echo "
"; break; case 7: echo "
Contact Info

"; echo ""; echo "Enter the text that will appear on the Contact Info page. This should include phone numbers for the lab, E-mail addresses, and any other method people can contact your lab.

"; echo ""; echo "
"; echo ""; echo "\">"; echo "
"; break; case 8: echo "
Protocols

"; echo ""; echo "Enter the text that will appear on the Protocols page.

"; echo ""; echo "
"; echo ""; echo "\">"; echo "
"; break; case 9: echo "Images

"; echo "This site allows you to end pictures that will appear in your lab's image gallery. The image gallery allows your lab to put anything they would like up online. This could be pictures of current research or pictures of your lab's last party. It is up to you to decide.

"; echo ""; echo ""; echo ""; echo "
"; echo "
"; echo ""; // List all the images $fp = fopen ($labroot . "/text/photos.txt","r"); echo ""; fclose($fp); echo "
"; echo ""; echo ""; echo "
Image

"; echo ""; echo ""; echo "\">"; echo "
"; break; case 10: echo "
Publications

"; echo ""; echo "Enter the text that will appear on the Publications page.

"; echo ""; echo "
"; echo ""; echo "
"; break; default: echo <<< EOF Lab Web Site Wizard

Welcome to the lab web site wizard. This wizard will help guide you through the process of setting up your web site. You will be able to modify most aspects of your web site from this wizard.
To edit your lab calendar go to http://www.pathology.washington.edu/Calendar.
EOF; break; } ?>