404Forbiden

✏️ Editing: email_template.php

<?
require_once "../include/user.inc.php";
require_once "../include/video.inc.php";
require_once "../include/video_folder.inc.php";
require "checkWebVideoUser.inc.php";	//for checking iWebVideo user

$code = $_REQUEST['code'];
$v = Video::LoadByCode($code);

if (!isset($v) || $v===FALSE)
	$error = "Sorry, video not found.";

if ($v->userid != $user->id)
	$error = "Access denied.";

if (isset($error))
	die("<h3>$error</h3>");

//Getting final temaplte content
$templateContent = $_POST['templateText'];

if($_GET['action'] == "preview")
{
	echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
		<html xmlns="http://www.w3.org/1999/xhtml">
		<body style="margin:0; padding:0;">';
	echo $templateContent;
	echo '</body></html>';
}

if($_GET['action'] == "save_template")
{
	$templateContent = replace_between($templateContent,'<span id="embed_code">','</span>', '<<EMBED_CODE>>');
	$old_template = DbQuery("select * from email_templates where templateId=".$_POST['templateId']);
	$template->templateName = $_POST['new_template_name'];
	$template->templateText = $templateContent;
	$template->image = $old_template[0]['image'];
	$template->user_id = $user->id;
	
	if($_POST['new_template_id'] != "") 
	{
		$template->templateId = $_POST['new_template_id'];
		ObjectSqlUpdate1($template, "email_templates","templateId");
		$template->id = $_POST['new_template_id'];
	}  else
		ObjectSqlInsert($template, "email_templates");
	
	$redirect_url = "email_template_edit.php?v=".$v->code."&template_save=Y&new=Y&templateId=".$template->id;
	?>
    <script type="text/javascript">		window.location = '<?php echo $redirect_url; ?>';	</script>
    <?php
}

if($_GET['action'] == "save_to_video")
{
	$v->template_title = $_POST['template_title'];;
	$v->Save();

$video_email->video_code = $v->code;
	$video_email->email_template_id = $_POST['templateId'];
	$video_email->email_content = $templateContent;
	
	$res = DbQuery("select * from video_emails where video_code = '".$v->code."' and email_template_id = '".$_POST['templateId']."'");
	if($res) {
		ObjectSqlUpdate1($video_email, "video_emails","id");
		$video_email->id = $res[0]['id'];
	}
	else
		ObjectSqlInsert($video_email, "video_emails");
	
	$video_email->email_content = str_replace($SITE.'email_video.php?v='.$code, $SITE.'email_video.php?v='.$code.'&id='.$video_email->id, $video_email->email_content);
	ObjectSqlUpdate1($video_email, "video_emails","id");
	
	$redirect_url = "deliver_email.php?v=".$v->code."&id=".$video_email->id;
	?>
    <script type="text/javascript">		window.location = '<?php echo $redirect_url; ?>';	</script>
    <?php
}

if($_GET['action'] == "delete")
{
	DbQuery("delete from email_templates where user_id=".$user->id." and templateId=".$_GET['templateId']);
	header("Location:email_template_list.php?v=".$v->code);
}

function replace_between($string, $start_str, $end_str, $replace)
{
	$start_pos = strpos($string, $start_str)+strlen($start_str);
	$end_pos = strpos($string, $end_str, $start_pos);
	$sub_string = substr($string, $start_pos, $end_pos-$start_pos);
	
	return str_replace($sub_string, $replace, $string);
}

Sid Gifari From Gifari Industries - BD Cyber Security Team