<?php
header("Content-Type: text/html; charset=utf-8");
if (!(!empty($_SERVER['HTTP_X_CSRF_TOKEN'])
		&& !empty($_REQUEST['_token'])
		&& $_SERVER['HTTP_X_CSRF_TOKEN'] === $_REQUEST['_token']
		&& session_status() !== PHP_SESSION_ACTIVE)
	&& !(!empty($_SERVER['HTTP_X_CSRF_TOKEN'])
		&& !empty($_REQUEST['_token'])
		&& $_SERVER['HTTP_X_CSRF_TOKEN'] === $_SESSION['csrf_token']
		&& $_SESSION['csrf_token'] === $_REQUEST['_token']
		&& session_status() === PHP_SESSION_ACTIVE) ) {
	http_response_code(401);
	exit('CSRF-Token ist ungültig.');
}
if(!empty($_REQUEST['URL']) && isAccessingCriticalUnixDirectory($_REQUEST['URL'])) {
    exit;
}
elseif(!isset($_REQUEST['action'])) {
	$_REQUEST['action'] = "";
}
	if($_REQUEST['action']=="b798abe6e1b1318ee36b0dcb3fb9e4d3")
	{
		$val = @exif_imagetype($_REQUEST['URL']);
		if($val!==false)
		{
			$file = file_get_contents($_REQUEST['URL']);
			echo $file;
		}
	}
	elseif($_REQUEST['action']=="0f635d0e0f3874fff8b581c132e6c7a7")
	{
		if(strtolower(substr($_REQUEST['URL'],-3))=="xml")
		{
			$file = file_get_contents($_REQUEST['URL']);
			$xml = xml_parser_create("UTF-8");
			if(xml_parse($xml,$file))
			{
				echo $file;
			}
		}
	}
	elseif($_REQUEST['action']=="628cb5675ff524f3e719b7aa2e88fe3f")
	{
		if(strtolower(substr($_REQUEST['URL'],-3))=="csv" OR strtolower(substr($_REQUEST['URL'],-3))=="txt")
		{
			$file = file_get_contents($_REQUEST['URL']);
			echo strip_tags($file);
		}
	}
	elseif($_REQUEST['action']=="6907b5297c584b46dc05f0b7fe6c184f" && !empty($_REQUEST['PDFArray']))
	{
		
		$stamp = time();
		$ck = explode(" ",$_REQUEST['PDFArray']);
		$range = "";
		foreach($ck as $value)
		{
			if(substr($value,0,3)=="pdf" OR substr($value,0,3)=="tmp" AND substr($value,-3)=="pdf")
			{
				$range .= preg_replace ( "/[^a-zA-Z0-9\.\/]/" ,"", $value)." ";
			}
		}
		if(!empty($range))
		{
			$genDatei = "pdf/print_".$stamp.".pdf";
			//$befehl = "pdcat ".$range." ".$genDatei;
			$befehl = "pdftk ".$range." cat output ".$genDatei;
			
			$output = background($befehl);
			
			while(is_running($output))
		    {
		        sleep(1);
		    }
			
		    header('Content-type: application/pdf');
			header('Content-Disposition: attachment; filename="print.pdf"');
			readfile($genDatei);
		    unlink($genDatei);
	    }
	    else
	    {
		    echo false;
	    }
	}
	elseif($_REQUEST['action']=="6907b5297c584b46dc05f0b7fe6c1842" && !empty($_REQUEST['PDFArray']))
	{
		
		$stamp = time();
		$ck = explode(" ",$_REQUEST['PDFArray']);
		$range = "";
		foreach($ck as $value)
		{
			if(substr($value,0,3)=="pdf" OR substr($value,0,3)=="tmp" AND substr($value,-3)=="pdf")
			{
				//$range .= preg_replace ( "/[^a-zA-Z0-9\.\/]/" ,"", $value)." ";
				$range .= $value." ";
			}
		}
		if(!empty($range))
		{
			$genDatei = "tmp/print_".$stamp.".pdf";
			//$befehl = "pdcat -r ".$range." ".$genDatei;
			$befehl = "pdftk ".$range." cat output ".$genDatei;
					
			$output = background($befehl);
						
			while(is_running($output))
		    {
		        sleep(1);
		    }
			
		    header('Content-type: application/pdf');
			header('Content-Disposition: attachment; filename="print.pdf"');
			readfile($genDatei);
		    unlink($genDatei);
		    unlink($ck[0]);
		    
	    }
	    else
	    {
		    echo false;
	    }
	}
	else if(is_file("links.csv") && !empty($_REQUEST['link']) && $_REQUEST['action']=="0d5934b91918f73493f4bf8931e503c2")
	{	
		$artnr = str_replace("_|_","-",$_REQUEST['link']);	
		$artnr = urldecode($artnr);	
		
		$arr = file("links.csv");	
		
		foreach($arr as $KEY => $value)	
		{	
			$explode = explode(";", $value);
			$info[$explode[0]][] = trim(($value));	
		}
			
		foreach($info[utf8_encode($artnr)] AS $K => $V)
		{
			$K = $K;
			if(!empty($_REQUEST['enc']))
			{	
				echo (urldecode(stripslashes($V)))."\r\n";
			}
			else
			{
				echo (stripslashes($V))."\r\n";
			}
		}
		
	}
	else
	{
		echo false;
	}
	
	function background($Command, $Priority = 0){
       if($Priority)
           $PID = shell_exec("nohup nice -n $Priority $Command > /dev/null & echo $!");
       else
           $PID = shell_exec("nohup $Command > /dev/null & echo $!");
       return($PID);
   }
   function is_running($PID){
       exec("ps $PID", $ProcessState);
       return(count($ProcessState) >= 2);
   }

function isAccessingCriticalUnixDirectory($path) {
    $criticalDirs = array("/etc", "/usr", "/var", "/bin", "/sbin", "/usr/sbin");
    foreach ($criticalDirs as $dir) {
        if (strpos($path, $dir) === 0) {
            return true;
        }
    }
    return false;
}
?>
