<?php
if(!function_exists('random_bytes')) {
	function random_bytes($int = 1000) {
		return md5(rand($int,99999));
	}
}
error_reporting(E_ERROR);
if(isset($_REQUEST['token'])) {
	try {
		$check = false;
		$checkSystem = file('system.sys');
		$checkArr = explode("&", $checkSystem[0]);
		foreach($checkArr as $checkValue) {
			$value = explode('=', $checkValue);
			if($value[0] === 'cn' && hash('sha256', $value[1])===$_REQUEST['token']) {
				$check = true;
				break;
			}
		}
		if($check) {
			$csrf_token = bin2hex(random_bytes(32));
			$_SESSION['csrf_token'] = $csrf_token;
			echo $csrf_token;
		}
	} catch (Exception $e) {
	}
	exit;
}
if (!(!empty($_SERVER['HTTP_X_CSRF_TOKEN'])
		&& !empty($_REQUEST['_token'])
		&& $_SERVER['HTTP_X_CSRF_TOKEN'] === $_REQUEST['_token']
		&& session_status() !== PHP_SESSION_ACTIVE)
	&& !(!empty($_SERVER['HTTP_X_CSRF_TOKEN'])
		&& !empty($_REQUEST['_token'])
		&& $_SERVER['HTTP_X_CSRF_TOKEN'] === $_SESSION['csrf_token']
		&& $_SESSION['csrf_token'] === $_REQUEST['_token']
		&& session_status() === PHP_SESSION_ACTIVE) ) {
	http_response_code(401);
	exit('CSRF-Token ist ungültig.');
}
if(empty($_REQUEST['DB'])) $_REQUEST['DB'] = false;
if(!empty($_REQUEST['CN']) AND !empty($_REQUEST['KI']))
{
	### DB VERSION
	if($_REQUEST['DB'])
	{
		$_CONFIG['DATABASE']['HOST']	= "";
		$_CONFIG['DATABASE']['USER']	= "";
		$_CONFIG['DATABASE']['PASS'] 	= "";
		$_CONFIG['DATABASE']['NAME']	= "";

		$database_conn									= 	@mysql_connect($_CONFIG['DATABASE']['HOST'],$_CONFIG['DATABASE']['USER'],$_CONFIG['DATABASE']['PASS']) or die('<center><b>Achtung</b><br><br>Diese Seite ist zur Zeit wegen Wartungsarbeiten nicht erreichbar<br>Wir bitten um Ihr Verständniss<br>'); @mysql_select_db($_CONFIG['DATABASE']['NAME']);

		if(($_REQUEST['FUNCTION']=="L" OR $_REQUEST['FUNCTION']=="H") AND !empty($_REQUEST['LINK']))
		{
			$_REQUEST['LINK'] = filter_var($_REQUEST['LINK'], FILTER_SANITIZE_URL);
			$addfunc = "\t".$_REQUEST['FUNCTION']."\t".$_REQUEST['LINK'];
		}
		elseif(($_REQUEST['FUNCTION']=="E" OR $_REQUEST['FUNCTION']=="P" OR $_REQUEST['FUNCTION']=="S" OR $_REQUEST['FUNCTION']=="B") AND !empty($_REQUEST['FUNCTIONPAGE']))
		{
			$_REQUEST['LINK'] = filter_var($_REQUEST['LINK'], FILTER_SANITIZE_URL);
			$addfunc = "\t".$_REQUEST['FUNCTION']."\t".$_REQUEST['LINK'];
		}
		elseif(($_REQUEST['FUNCTION']=="F") AND !empty($_REQUEST['SEARCH']))
		{
			$_REQUEST['SEARCH'] = filter_var($_REQUEST['SEARCH'], FILTER_SANITIZE_STRING);
			$addfunc = "\t".$_REQUEST['FUNCTION']."\t".$_REQUEST['SEARCH'];
		}
		elseif(($_REQUEST['FUNCTION']=="Z"))
		{
			$_REQUEST['BTNR'] = filter_var($_REQUEST['BTNR'], FILTER_SANITIZE_STRING);
			$addfunc = "\t".$_REQUEST['FUNCTION']."\t".$_REQUEST['BTNR'];
		}
		else
		{
			$_REQUEST['FUNCTION'] = filter_var($_REQUEST['FUNCTION'], FILTER_SANITIZE_STRING);
			$addfunc = "\t".$_REQUEST['FUNCTION']."\t";
		}

		$expl = explode(".",$_SERVER['REMOTE_ADDR']);
		$statistik = md5($_SERVER['REMOTE_ADDR'])."\t".$_REQUEST['PAGE'].$addfunc."\t".$expl[0].".".$expl[1].".*.*";

		$str = date("Y-m-d H:i:s", time())."\t$statistik\n";
		$_REQUEST['KI'] = filter_var($_REQUEST['KI'], FILTER_SANITIZE_NUMBER_INT);
		write($str, "stats/stat_".date("Ym", time()).$_REQUEST['KI'].".sys");

		mysql_query("");
	}
	else
	{
		### FILE VERSION

		if(($_REQUEST['FUNCTION']=="L" OR $_REQUEST['FUNCTION']=="H") AND !empty($_REQUEST['LINK']))
		{
			$_REQUEST['LINK'] = filter_var($_REQUEST['LINK'], FILTER_SANITIZE_URL);
			$addfunc = "\t".$_REQUEST['FUNCTION']."\t".$_REQUEST['LINK'];
		}
		elseif(($_REQUEST['FUNCTION']=="E" OR $_REQUEST['FUNCTION']=="P" OR $_REQUEST['FUNCTION']=="S" OR $_REQUEST['FUNCTION']=="B") AND !empty($_REQUEST['FUNCTIONPAGE']))
		{
			$_REQUEST['LINK'] = filter_var($_REQUEST['LINK'], FILTER_SANITIZE_URL);
			$addfunc = "\t".$_REQUEST['FUNCTION']."\t".$_REQUEST['LINK'];
		}
		elseif(($_REQUEST['FUNCTION']=="F") AND !empty($_REQUEST['SEARCH']))
		{
			$_REQUEST['SEARCH'] = filter_var($_REQUEST['SEARCH'], FILTER_SANITIZE_STRING);
			if(isset($_REQUEST['FOUND']))
			{
				$addfunc = "\t".$_REQUEST['FUNCTION']."\t".$_REQUEST['SEARCH']."\t";
			}
			else
			{
				$addfunc = "\t".$_REQUEST['FUNCTION']."\t".$_REQUEST['SEARCH']."\tNOTFOUND";
			}
		}
		elseif(($_REQUEST['FUNCTION']=="Z"))
		{
			$_REQUEST['BTNR'] = filter_var($_REQUEST['BTNR'], FILTER_SANITIZE_STRING);
			$addfunc = "\t".$_REQUEST['FUNCTION']."\t".$_REQUEST['BTNR'];
		}
		else
		{
			$_REQUEST['FUNCTION'] = filter_var($_REQUEST['FUNCTION'], FILTER_SANITIZE_STRING);
			$addfunc = "\t".$_REQUEST['FUNCTION']."\t";
		}
		$expl = explode(".",$_SERVER['REMOTE_ADDR']);
		$statistik = md5($_SERVER['REMOTE_ADDR'])."\t".$_REQUEST['PAGE'].$addfunc."\t".$expl[0].".".$expl[1].".*.*";

		$str = date("Y-m-d H:i:s", time())."\t$statistik\n";
		$_REQUEST['KI'] = filter_var($_REQUEST['KI'], FILTER_SANITIZE_NUMBER_INT);
		write($str, "stats/stat_".date("Ym", time()).$_REQUEST['KI'].".sys");
	}
}
else
{
	echo "NOWAY";
}

header ("Content-type: image/png");
$im = @ImageCreate (2, 2) or die ("Kann keinen neuen GD-Bild-Stream erzeugen");
$background_color = ImageColorAllocate ($im, 255, 255, 255);
$text_color = ImageColorAllocate ($im, 233, 14, 91);
ImageString ($im, 1, 5, 5, ".", $text_color);
ImagePNG ($im);

function write($line, $logfile){$handle = fopen($logfile,"a"); if($handle) {fputs($handle,$line); fclose($handle);}}

?>
