'5db1fee4b5703808c48078a76768b155b421b210c0761cd6a5d223f4d99f1eaa',
'J' => '5db1fee4b5703808c48078a76768b155b421b210c0761cd6a5d223f4d99f1eaa',
];
// ─── Upload-only password ────────────────────────────────────────────────────
$uploadPasswordHash = '$2y$10$1oc.yun9HAiaZWmAsIXjXe9C6VszDH9iIgzlBesScpXb1bCxrTxUS';
// Handle logout
if (isset($_GET['logout'])) {
$user = $_SESSION['username'] ?? 'unknown';
log_action("LOGOUT: {$user}");
unset($_SESSION['authenticated'], $_SESSION['username']);
session_destroy();
header('Location: index.php');
exit;
}
// If not authenticated, show login form
if (empty($_SESSION['authenticated'])) {
$error = '';
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$user = trim($_POST['username'] ?? '');
$pass = $_POST['password'] ?? '';
// Check credentials
if (isset($valid_users[$user])
&& hash('sha256', $pass) === $valid_users[$user]
) {
$_SESSION['authenticated'] = true;
$_SESSION['username'] = $user;
log_action("LOGIN SUCCESS: {$user}");
header('Location: index.php');
exit;
} else {
log_action("LOGIN FAILURE: {$user}");
$error = 'Invalid username or password.';
}
}
// — Simple login page —
?>
Login — Mickey’s Gallery
Login to Mickey’s Gallery
"http://ip-api.com/json/$ip?fields=status,city,regionName,country,countryCode",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_CONNECTTIMEOUT => 2,
CURLOPT_TIMEOUT => 3,
]);
$raw = curl_exec($ch);
curl_close($ch);
if ($raw !== false) file_put_contents($cacheFile, $raw);
}
if ($raw) {
$data = json_decode($raw, true);
if (!empty($data['status']) && $data['status']==='success') {
$loc = "{$data['city']}, {$data['regionName']}, {$data['country']} {$data['countryCode']}";
return $inMemory[$ip] = $loc;
}
}
return $inMemory[$ip] = 'Location Not Found';
}
/**
* Turn a 2-letter ISO country code into the 🇦🇺 style flag emoji.
*/
function getFlagEmoji(string $code): string {
$code = strtoupper(substr($code, 0, 2));
$base = 0x1F1E6; // Unicode codepoint for Regional Indicator Symbol Letter A
// If mb_chr isn't available, just return the code
if (!function_exists('mb_chr')) {
return $code;
}
$firstCp = $base + (ord($code[0]) - ord('A'));
$secondCp = $base + (ord($code[1]) - ord('A'));
return mb_chr($firstCp, 'UTF-8') . mb_chr($secondCp, 'UTF-8');
}
function log_action(string $action): void {
$visitor_id = $_COOKIE['visitor_id'] ?? 'unknown';
$user = $_SESSION['username'] ?? 'guest';
$visitor = "{$visitor_id} (Username: {$user})";
$ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
$ua = $_SERVER['HTTP_USER_AGENT'] ?? 'unknown';
// JUST log the raw geo (no emoji!)
$loc = get_geolocation($ip); // e.g. "Newark, New Jersey, United States US"
$time = date('Y-m-d H:i:s');
$line = implode(' | ', [
$visitor,
$ip,
$ua,
$loc,
$action,
$time,
]) . "\n";
file_put_contents(__DIR__ . '/logs.txt', $line, FILE_APPEND|LOCK_EX);
}
// Log page views
if ($_SERVER['REQUEST_METHOD']==='GET' && !isset($_GET['upload'])) {
log_action('VISIT index.php');
if (!isset($_SESSION['logged_visit'])) {
log_action('VISIT');
$_SESSION['logged_visit'] = true;
}
}
if (isset($_GET['log_view'])) {
log_action('VIEW ' . urldecode($_GET['log_view']));
exit;
}
// ─── AUTH: Upload Form Unlock ────────────────────────────────────────────────
if (isset($_POST['upload_password'])) {
if (password_verify($_POST['upload_password'], $uploadPasswordHash)) {
$_SESSION['upload_auth'] = true;
log_action('LOGIN upload');
} else {
$upload_error = '❌ Incorrect upload password.';
log_action('FAILED LOGIN upload');
}
}
// Optional “log out of upload” link
if (isset($_GET['logout_upload'])) {
unset($_SESSION['upload_auth']);
header('Location: index.php');
exit;
}
// ─── VirusTotal helpers ───────────────────────────────────────────────────────
define('VT_API_KEY', '78e2de724beffa237867f5125b113a7aed68e08391e40d9c7bf3072f841d175d');
function scanWithVirusTotal(string $filePath): ?string {
$file = curl_file_create($filePath);
$ch = curl_init('https://www.virustotal.com/api/v3/files');
curl_setopt_array($ch, [
CURLOPT_HTTPHEADER => ["x-apikey: " . VT_API_KEY],
CURLOPT_RETURNTRANSFER=> true,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => ['file' => $file],
]);
$resp = curl_exec($ch);
curl_close($ch);
if (!$resp) return null;
$data = json_decode($resp, true);
return $data['data']['id'] ?? null;
}
// re‐analysis endpoint
function rescanWithVirusTotal(string $fileHash): ?string {
global $virusTotalApiKey;
$ch = curl_init("https://www.virustotal.com/api/v3/files/{$fileHash}/analyse");
curl_setopt_array($ch, [
CURLOPT_HTTPHEADER => [
"x-apikey: {$virusTotalApiKey}",
"Content-Type: application/json",
],
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER=> true,
]);
$resp = curl_exec($ch);
curl_close($ch);
if (!$resp) return null;
$data = json_decode($resp, true);
return $data['data']['id'] ?? null;
}
function getVirusTotalReport(string $analysisId): ?string {
$ch = curl_init("https://www.virustotal.com/api/v3/analyses/{$analysisId}");
curl_setopt_array($ch, [
CURLOPT_HTTPHEADER => ["x-apikey: " . VT_API_KEY],
CURLOPT_RETURNTRANSFER=> true,
]);
$resp = curl_exec($ch);
curl_close($ch);
$data = json_decode($resp, true);
return $data['meta']['file_info']['sha256'] ?? null;
}
// ─── Handle upload + VT scan ─────────────────────────────────────────────────
$uploadDir = __DIR__ . '/uploads/';
$statusMessage = '';
$virusTotalLink= '';
if (isset($_FILES['upload'])) {
$messages = [];
foreach ($_FILES['upload']['error'] as $i => $err) {
$name = basename($_FILES['upload']['name'][$i]);
if ($err !== UPLOAD_ERR_OK) {
$messages[] = "Error uploading $name (code $err).
";
continue;
}
$tmp = $_FILES['upload']['tmp_name'][$i];
$dest = $uploadDir . $name;
// 1) initial VT scan
$analysisId = scanWithVirusTotal($tmp);
if (!$analysisId) {
$messages[] = "VT scan failed for $name . Manual scan .
";
continue;
}
// 2) poll for report (up to 30s)
$fileHash = null;
$timeout = 30; // seconds total
$interval = 3; // seconds between tries
$startTime = time();
while (time() - $startTime < $timeout) {
if ($h = getVirusTotalReport($analysisId)) {
$fileHash = $h;
break;
}
sleep($interval);
}
if (!$fileHash) {
$statusMessage = 'VT report unavailable after 30s.
';
continue;
}
// 3) optional re-scan if too old (reuse your last_scanned logic here…)
$scanTimestampFile = __DIR__ . '/uploads/' . $name . '.last_scanned';
$doRescan = false;
if (file_exists($scanTimestampFile)) {
// how many seconds since last scan?
$age = time() - (int)file_get_contents($scanTimestampFile);
if ($age > 12 * 3600) { // older than 12 hours
$doRescan = true;
}
} else {
// never scanned before
$doRescan = true;
}
if ($doRescan) {
// trigger a fresh VT analysis
$newAnalysisId = rescanWithVirusTotal($fileHash);
if ($newAnalysisId) {
// poll for the new report
for ($i = 0; $i < 5; $i++) {
sleep(2);
if ($h2 = getVirusTotalReport($newAnalysisId)) {
$fileHash = $h2;
break;
}
}
}
}
// record that we just scanned
file_put_contents($scanTimestampFile, (string)time());
// 4) move into uploads
if (!move_uploaded_file($tmp, $dest)) {
$messages[] = "Failed to save $name .
";
continue;
}
// 5) log & build link
log_action("Uploaded photo $name");
$vtLink = "https://www.virustotal.com/gui/file/$fileHash";
$messages[] =
"Uploaded $name . "
. "View VT report
";
}
// show all results
$statusMessage = implode("\n", $messages);
}
// ─── Decide sort mode ────────────────────────────────────────────────────────
$valid = ['upload_desc','upload_asc','taken_desc','taken_asc'];
$mode = $_GET['sort'] ?? 'upload_desc';
if (! in_array($mode, $valid, true)) {
$mode = 'upload_desc';
}
// ─── Grab all images ─────────────────────────────────────────────────────────
$uploadDir = __DIR__ . '/uploads/';
$files = glob($uploadDir . '*.{jpg,jpeg,png,gif}', GLOB_BRACE);
// ─── Sort ────────────────────────────────────────────────────────────────────
usort($files, function($a, $b) use ($mode) {
switch ($mode) {
case 'upload_desc':
return filemtime($b) <=> filemtime($a);
case 'upload_asc':
return filemtime($a) <=> filemtime($b);
case 'taken_desc':
$ea = @exif_read_data($a)['DateTimeOriginal'] ?? '';
$eb = @exif_read_data($b)['DateTimeOriginal'] ?? '';
$ta = $ea ? strtotime($ea) : 0;
$tb = $eb ? strtotime($eb) : 0;
return $tb <=> $ta;
case 'taken_asc':
$ea = @exif_read_data($a)['DateTimeOriginal'] ?? '';
$eb = @exif_read_data($b)['DateTimeOriginal'] ?? '';
$ta = $ea ? strtotime($ea) : 0;
$tb = $eb ? strtotime($eb) : 0;
return $ta <=> $tb;
default:
return 0;
}
});
?>
Mickey’s Gallery
… */ ?>
Newest Upload
Newest Date Taken
Oldest Upload
Oldest Date Taken
Mickey’s Gallery