+ $path_priv="/home/lace/priv/";
+ $getget=isset($_REQUEST["_getget"]);
+ $wherename=($getget ? "_getget" : "_postget");
+ $where=$_REQUEST[$wherename];
+ unset($_REQUEST[$wherename]);
+
+ foreach ($_REQUEST as $key=>$val) {
+ if (ereg("^_priv_(postget.*)\$",$val,$matched)) {
+ $permit=array("127.0.0.1"=>1,"::1"=>1,"192.168.192.1"=>1,"192.168.90.11"=>1,"192.168.90.12"=>1);
+ if (!$permit[$_SERVER["REMOTE_ADDR"]])
+ print("Forbidden:"
+ ." REMOTE_ADDR=".htmlspecialchars($_SERVER["REMOTE_ADDR"])
+ .",key=".htmlspecialchars($key)
+ .",val=".htmlspecialchars($val)
+ ."<br />"
+ );
+ elseif ($matched[1]=="postget.time()") {
+ // At least 2 - time slip?
+ $_REQUEST[$key]=time()-131-60;
+ }
+ else
+ $_REQUEST[$key]=chop(join(" ",file($path_priv.$matched[1],false/*use_include_path*/)));
+ }
+ }
+
+ if ($getget) {
+ $first='?';
+ foreach ($_REQUEST as $key=>$val) {
+ $where.="${first}".urlencode($key)."=".urlencode($val);
+ $first='&';
+ }
+ header("Location: $where");
+ }