<?
$changesection="main";
$view=$_GET["view"];
if ($_SESSION["id"])
{
$id=$_SESSION["id"];
$users=mysql_query("select * from users where id='$id'",$db);
$user=mysql_fetch_array($users);
$accesslevel=$user[4];
}
else
{
$accesslevel=0;
}
if (($accesslevel==255) && (!$view))
{
$insert=$_POST["insert"];
$delete=$_GET["delete"];
if ($insert)
{
$tmpname=$_FILES["uploadfile"]["tmp_name"];
$filename=$_FILES["uploadfile"]["name"];
$mimetype=$_FILES["uploadfile"]["type"];
$filesize=$_FILES["uploadfile"]["size"];
if (($filesize>0) && (!file_exists("files/".$filename)))
{
move_uploaded_file($tmpname,"files/".$filename);
mysql_query("insert into downloads (filename,mimetype,filesize) values ('$filename','$mimetype','$filesize')",$db);
$changes[$changesection].='File <b>'.$filename.'</b> has been uploaded<br>';
}
}
if ($delete)
{
$downloads=mysql_query("select * from downloads where id='$delete'",$db);
$download=mysql_fetch_array($downloads);
mysql_query("delete from downloads where id='$delete'",$db);
unlink("files/".$download[1]);
$changes[$changesection].='File <b>'.$download[1].'</b> has been deleted<br>';
}
$changes[$changesection].='<form method="post" action="index.php?subsite=downloads.php'.$sessionparm_link.'" enctype="multipart/form-data">';
$changes[$changesection].='<input type="file" name="uploadfile">';
$changes[$changesection].='<input type="submit" name="insert" value="Upload File">';
$changes[$changesection].='</form>';
$changes[$changesection].='<table class="vistable" border="1">';
$changes[$changesection].='<tr><th>Filename</th><th>Size</th><th>Action</th></tr>';
$downloads=mysql_query("select * from downloads order by filename",$db);
while ($download=mysql_fetch_row($downloads))
{
$changes[$changesection].='<tr><td>'.$download[1].'</td><td>'.$download[3].'</td>';
$changes[$changesection].='<td><a href="index.php?subsite=downloads.php&delete='.$download[0].$sessionparm_link.'">Delete</a></td>';
$changes[$changesection].='</tr>';
}
$changes[$changesection].='</table>';
}
else
{
$changes[$changesection].='<table class="vistable" border="1">';
$changes[$changesection].='<tr><th>Filename</th><th>Size</th></tr>';
$downloads=mysql_query("select * from downloads order by filename",$db);
while ($download=mysql_fetch_row($downloads))
{
$changes[$changesection].='<tr>';
$changes[$changesection].='<td><a href="getfile.php?file='.$download[0].'">'.$download[1].'</a></td>';
$changes[$changesection].='<td>'.$download[3].'</td></tr>';
}
$changes[$changesection].='</table>';
}
?>