diff --git a/config.php b/config.php new file mode 100644 index 0000000..96bf9a8 --- /dev/null +++ b/config.php @@ -0,0 +1,33 @@ +connect_error) { + die('Erreur connexion : ' . $mysqli->connect_error); +} + +$mysqli->set_charset('utf8mb4'); + +$mysqli->query(' + CREATE TABLE IF NOT EXISTS posts ( + id INT AUTO_INCREMENT PRIMARY KEY, + comment TEXT NOT NULL, + image_path VARCHAR(255), + poster_ip VARCHAR(45) NOT NULL, + created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP + ) +'); + +$mysqli->query(' + CREATE TABLE IF NOT EXISTS rate_limit ( + ip VARCHAR(45) PRIMARY KEY, + last_post_time BIGINT NOT NULL + ) +'); +?> diff --git a/index.php b/index.php new file mode 100644 index 0000000..5aaceea --- /dev/null +++ b/index.php @@ -0,0 +1,262 @@ +query("SELECT last_post_time FROM rate_limit WHERE ip = '" . $mysqli->real_escape_string($clientIp) . "'"); + if ($result && $result->num_rows > 0) { + $row = $result->fetch_assoc(); + if (time() - $row['last_post_time'] < 60) { + $error = 'Attendre ' . (60 - (time() - $row['last_post_time'])) . 's avant de poster.'; + } + } + + if (empty($error)) { + $comment = trim($_POST['comment'] ?? ''); + $imagePath = null; + + if (isset($_FILES['image']) && $_FILES['image']['error'] === UPLOAD_ERR_OK) { + $fileSize = $_FILES['image']['size']; + $fileName = $_FILES['image']['name']; + $fileExt = strtolower(pathinfo($fileName, PATHINFO_EXTENSION)); + + if ($fileSize < $minFileSize) { + $error = 'Min 2 Mo.'; + } elseif ($fileSize > $maxFileSize) { + $error = 'Max 5 Mo.'; + } elseif (!in_array($fileExt, $allowedExtensions)) { + $error = 'PNG/JPEG seulement.'; + } else { + $uploadDir = __DIR__ . '/uploads/'; + if (!is_dir($uploadDir)) { + mkdir($uploadDir, 0755, true); + } + + $newFileName = uniqid() . '.' . $fileExt; + $uploadPath = $uploadDir . $newFileName; + if (move_uploaded_file($_FILES['image']['tmp_name'], $uploadPath)) { + $imagePath = 'uploads/' . $newFileName; + } else { + $error = 'Erreur upload.'; + } + } + } + + if (empty($error) && !empty($comment)) { + $comment = htmlspecialchars($comment, ENT_QUOTES, 'UTF-8'); + $stmt = $mysqli->prepare('INSERT INTO posts (comment, image_path, poster_ip) VALUES (?, ?, ?)'); + $stmt->bind_param('sss', $comment, $imagePath, $clientIp); + + if ($stmt->execute()) { + $mysqli->query("INSERT INTO rate_limit (ip, last_post_time) VALUES ('" . $mysqli->real_escape_string($clientIp) . "', " . time() . ") ON DUPLICATE KEY UPDATE last_post_time = " . time()); + $success = 'Posté !'; + } + $stmt->close(); + } elseif (empty($error)) { + $error = 'Commentaire vide.'; + } + } + } +} + +$posts = []; +$result = $mysqli->query('SELECT id, comment, image_path, poster_ip, created_at FROM posts ORDER BY created_at DESC'); +if ($result) { + while ($row = $result->fetch_assoc()) { + $posts[] = $row; + } +} +?> + + + + + + Forum CTF + + + +
+ + +
+ +
+ + + +
+ + + +

Forum - Partagez vos commentaires

+ +
+ + +
+ + +
+ +
+ + +
+ + +
+ +
+

Commentaires récents

+ +

Aucun commentaire pour le moment.

+ + +
+
+ IP: + +
+
+ +
+ Image +
+ +
+ + +
+ + +

Connexion

+ + + + +

Flag

+
+

🚩 Vous êtes connecté !

+
+
+ +

Accès refusé

+

Veuillez vous connecter.

+ + +
+
+ + diff --git a/uploads/695d6d4fc65fe.png b/uploads/695d6d4fc65fe.png new file mode 100644 index 0000000..9320637 Binary files /dev/null and b/uploads/695d6d4fc65fe.png differ diff --git a/uploads/696000e5efc95.png b/uploads/696000e5efc95.png new file mode 100644 index 0000000..9320637 Binary files /dev/null and b/uploads/696000e5efc95.png differ diff --git a/uploads/69600b450eac8.jpg b/uploads/69600b450eac8.jpg new file mode 100644 index 0000000..96ffc0b Binary files /dev/null and b/uploads/69600b450eac8.jpg differ