<?php
// создание нового правила
if(!defined('ANTIBOT')) die('access denied');

$bad_symbol = array('\'', '"', '\\');

$title = abTranslate('Create rule');

if (isset($_POST['newrule_submit'])) {
$_POST['priority'] = isset($_POST['priority']) ? (int)trim(preg_replace("/[^0-9]/","", $_POST['priority'])) : 100;
$_POST['type'] = isset($_POST['type']) ? trim(preg_replace("/[^a-z0-9_]/","", $_POST['type'])) : die('type');
$_POST['data'] = isset($_POST['data']) ? trim(strip_tags($_POST['data'])) : '';
$_POST['rule'] = isset($_POST['rule']) ? trim(preg_replace("/[^a-z]/","", $_POST['rule'])) : die('rule');
$_POST['comment'] = isset($_POST['comment']) ? trim(strip_tags($_POST['comment'])) : '';
$_POST['expires'] = isset($_POST['expires']) ? trim(strip_tags($_POST['expires'])) : '';

if (is_numeric($_POST['expires'])) {
$_POST['expires'] = $_POST['expires'] * 86400 + $ab_config['time'];
} else {
$_POST['expires'] = 9999999999;
}

if ($_POST['type'] == 'ipv4') {
$testip = explode('/', $_POST['data']);
if (filter_var($testip[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) AND isset($testip[1]) AND is_numeric($testip[1])) {
// норм подсеть:
$AbIpRange = AbIpRange($_POST['data']);
$_POST['data'] = $antibot_db->escapeString($_POST['data']);
if ($_POST['comment'] == '') {$_POST['comment'] = $AbIpRange[0].' - '.$AbIpRange[1];}
$_POST['comment'] = $antibot_db->escapeString($_POST['comment']);
$add = @$antibot_db->exec("INSERT INTO ipv4rules (priority, search, ip1, ip2, rule, comment, expires) VALUES ('".$_POST['priority']."', '".$_POST['data']."', '".AbIp2num($AbIpRange[0])."', '".AbIp2num($AbIpRange[1])."', '".$_POST['rule']."', '".$_POST['comment']."', '".$_POST['expires']."');");
if ($antibot_db->lastErrorMsg() == 'not an error') {
$id = (int)$antibot_db->lastInsertRowID();
} else {
$id = 0;
}
echo '<script>document.location.href="?'.$abw.$abp.'=rules#ipv4rules_'.$id.'";</script>';
die();
} elseif (filter_var($_POST['data'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
// норм отдельный ип:
$_POST['data'] = $antibot_db->escapeString($_POST['data']);
$_POST['comment'] = $antibot_db->escapeString($_POST['comment']);
$add = @$antibot_db->exec("INSERT INTO ipv4rules (priority, search, ip1, ip2, rule, comment, expires) VALUES ('".$_POST['priority']."', '".$_POST['data']."', '".AbIp2num($_POST['data'])."', '".AbIp2num($_POST['data'])."', '".$_POST['rule']."', '".$_POST['comment']."', '".$_POST['expires']."');");
if ($antibot_db->lastErrorMsg() == 'not an error') {
$id = (int)$antibot_db->lastInsertRowID();
} else {
$id = 0;
}
echo '<script>document.location.href="?'.$abw.$abp.'=rules#ipv4rules_'.$id.'";</script>';
die();
} else {
$content .= '<div class="alert alert-danger" role="alert">
'.abTranslate('It\'s not IPv4. <a href="#" onclick="history.back();">Go back</a>.').'
</div>';
}
} elseif ($_POST['type'] == 'ipv6') {
$testip = explode('/', $_POST['data']);
if (filter_var($testip[0], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) AND isset($testip[1]) AND is_numeric($testip[1])) {
// норм подсеть:
$AbIpRange = AbIpRange($_POST['data']);
$_POST['data'] = abExpand($testip[0]).'/'.$testip[1];
$_POST['data'] = $antibot_db->escapeString($_POST['data']);
$AbIpRange[0] = abExpand($AbIpRange[0]);
if ($_POST['comment'] == '') {$_POST['comment'] = $AbIpRange[0].' - '.$AbIpRange[1];}
$_POST['comment'] = $antibot_db->escapeString($_POST['comment']);
$add = @$antibot_db->exec("INSERT INTO ipv6rules (priority, search, ip1, ip2, rule, comment, expires) VALUES ('".$_POST['priority']."', '".$_POST['data']."', '".AbIp2num($AbIpRange[0])."', '".AbIp2num($AbIpRange[1])."', '".$_POST['rule']."', '".$_POST['comment']."', '".$_POST['expires']."');");
if ($antibot_db->lastErrorMsg() == 'not an error') {
$id = (int)$antibot_db->lastInsertRowID();
} else {
$id = 0;
}
echo '<script>document.location.href="?'.$abw.$abp.'=rules#ipv6rules_'.$id.'";</script>';
die();
} elseif (filter_var($_POST['data'], FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
//норм ип:
$_POST['data'] = $antibot_db->escapeString(abExpand($_POST['data']));
$_POST['comment'] = $antibot_db->escapeString($_POST['comment']);
$add = @$antibot_db->exec("INSERT INTO ipv6rules (priority, search, ip1, ip2, rule, comment, expires) VALUES ('".$_POST['priority']."', '".$_POST['data']."', '".AbIp2num($_POST['data'])."', '".AbIp2num($_POST['data'])."', '".$_POST['rule']."', '".$_POST['comment']."', '".$_POST['expires']."');");
if ($antibot_db->lastErrorMsg() == 'not an error') {
$id = (int)$antibot_db->lastInsertRowID();
} else {
$id = 0;
}
echo '<script>document.location.href="?'.$abw.$abp.'=rules#ipv6rules_'.$id.'";</script>';
die();
} else {
$content .= '<div class="alert alert-danger" role="alert">
'.abTranslate('It\'s not IPv6. <a href="#" onclick="history.back();">Go back</a>.').'
</div>';
}
} elseif ($_POST['type'] == 'ab_se') {
$_POST['search'] = isset($_POST['search']) ? trim(strip_tags($_POST['search'])) : die('search');
$_POST['search'] = str_ireplace($bad_symbol, '', $_POST['search']);
$_POST['data'] = isset($_POST['data']) ? trim(preg_replace("/[^A-Za-z0-9\ \-\.\:]/","", $_POST['data'])) : die('data');
$_POST['comment'] = $antibot_db->escapeString($_POST['comment']);
$add = @$antibot_db->exec("INSERT INTO ab_se (priority, search, data, rule, comment) VALUES ('".$_POST['priority']."', '".$_POST['search']."', '".$_POST['data']."', '".$_POST['rule']."', '".$_POST['comment']."');");
if ($antibot_db->lastErrorMsg() == 'not an error') {
$id = (int)$antibot_db->lastInsertRowID();
} else {
$id = 0;
}
$ab_se_rules = $antibot_db->query("SELECT rowid, * FROM ab_se ORDER BY priority ASC;"); 
$save = '<?php
';
while ($echo = $ab_se_rules->fetchArray(SQLITE3_ASSOC)) {
$save .= '$ab_rule[\''.$echo['search'].'\'] = \''.$echo['rule'].'\';
';
if ($echo['data'] == '') {
$echo['data'] = '\'.\'';
} else {
$echo['data'] = '\''.str_replace(' ', '\', \'', $echo['data']).'\'';
}
$save .= '$ab_se[\''.$echo['search'].'\'] = array('.$echo['data'].');
';
}
file_put_contents(__DIR__.'/../data/se.php', $save, LOCK_EX);
echo '<script>document.location.href="?'.$abw.$abp.'=rules#ab_se_'.$id.'";</script>';
die();
} elseif ($_POST['type'] == 'ab_path') {
$_POST['search'] = isset($_POST['search']) ? trim(strip_tags($_POST['search'])) : die('search');
$_POST['search'] = str_ireplace($bad_symbol, '', $_POST['search']);

$_POST['comment'] = $antibot_db->escapeString($_POST['comment']);
$add = @$antibot_db->exec("INSERT INTO ab_path (priority, search, rule, comment) VALUES ('".$_POST['priority']."', '".$_POST['search']."', '".$_POST['rule']."', '".$_POST['comment']."');");
if ($antibot_db->lastErrorMsg() == 'not an error') {
$id = (int)$antibot_db->lastInsertRowID();
} else {
$id = 0;
}
$ab_se_path = $antibot_db->query("SELECT rowid, * FROM ab_path ORDER BY priority ASC;"); 
$save = '<?php
';
while ($echo = $ab_se_path->fetchArray(SQLITE3_ASSOC)) {
$save .= '$ab_path[\''.$echo['search'].'\'] = \''.$echo['rule'].'\';
';
}
file_put_contents(__DIR__.'/../data/path.php', $save, LOCK_EX);
echo '<script>document.location.href="?'.$abw.$abp.'=rules#ab_path_'.$id.'";</script>';
die();
} else {
// основные правила:
$_POST['search'] = $antibot_db->escapeString($_POST['type'].'='.$_POST['data']);
$_POST['data'] = $antibot_db->escapeString($_POST['data']);
$_POST['comment'] = $antibot_db->escapeString($_POST['comment']);
$add = @$antibot_db->exec("INSERT INTO rules (priority, type, data, search, rule, comment, expires) VALUES ('".$_POST['priority']."', '".$_POST['type']."', '".$_POST['data']."', '".$_POST['search']."', '".$_POST['rule']."', '".$_POST['comment']."', '".$_POST['expires']."');");
if ($antibot_db->lastErrorMsg() == 'not an error') {
$id = (int)$antibot_db->lastInsertRowID();
} else {
$id = 0;
}
echo '<script>document.location.href="?'.$abw.$abp.'=rules#rules_'.$id.'";</script>';
die();
}
}

