purgeCache(); echo 'Cache purged. Proceed'; exit(0); } else { echo 'You must be logged as admin to purge cache'; exit(0); } } //since this config.php is used on every main pages of the main section //and also in the ./radio subsection //and even in ./script.php <- hu, this .php script no longer exists now ! Don't worry for him. //and also in the "Fan network" ./network chat optionnal module //it's a good entry point to start thinking about the .htaccess thing //since each and every sensitive data is protected by such a file //and if its not honored //sensitive informations such as Paypal email adress to route donation (if enabled) //shadowed (encrypted) Admin password //and many things alike (IP address of current listeners of the radio) //and (worst) if .htaccess is not active and Fan Network enable, fan users could //possibly forge a RCE attack by including General error: Site administrators, please edit ./admin/config.php to configure username and password of your administrator account then browse <yourserver.tld/(path/to/crero)/admin> for changes to take effect. '; exit(0); } //then we check that server.txt is set and we also won't die() if the user is in admin (allong him/her to set server.txt) else if (!file_exists('./d/server.txt')&&strpos($_SERVER['PHP_SELF'], '/admin/index.php')!==strlen($_SERVER['PHP_SELF'])-strlen('/admin/index.php')){ echo 'General error: Site administrators, please log in the admin panel at <yourserver.tld/(path/to/crero)/admin> and set up the "server" option'; exit(0); } if (file_get_contents('./d/server.txt')===false){ echo 'General error: ./d/server.txt is not readable. Please check the permission of your www user on your www files. '; exit(0); } //useful data starting from now $server=trim(file_get_contents('./d/server.txt')); $proto='http'; if (isset($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!==''){ $proto='https'; } //then we check the consistency of server.tx and also won't die() if the user is admin at the admin panel if (file_exists('./d/server.txt')&&strpos($_SERVER['PHP_SELF'], '/admin/index.php')!==strlen($_SERVER['PHP_SELF'])-strlen('/admin/index.php')){ $page=file_get_contents($proto.'://'.$server.'/?no-infinite-loop-please=1'); if (!$page==false){ echo 'General error: get content replied false, the site is currently unavailable. Some cases are probable '; exit(0); } } if (file_get_contents($proto.'://'.$server.'/?no-infinite-loop-please=1')!==false&&!strstr($http_response_header[0], ' 200 OK')){ echo 'General error: http response was not 200 OK, he site is currently unavailable. Some cases are probable '; exit(0); } //Main thing now, check the .htaccess is honored if (strpos($_SERVER['PHP_SELF'], '/admin/index.php')!==strlen($_SERVER['PHP_SELF'])-strlen('/admin/index.php')&&file_get_contents($proto.'://'.$server.'/admin/d/fields.txt')!==false&&strstr($http_response_header[0], ' 200 OK')&&file_get_contents($proto.'://'.$server.'/admin/d/fields.txt')===file_get_contents('./admin/d/fields.txt')){ echo 'General error: Site administrators, you MUST enable .htaccess directives respect in your webserver configuration. Please refer to README.me.'; exit(0); } //all stages passed ok //create the wizard_completed mark file to skip these checks next time touch('./d/wizard_completed.txt'); }//if wizard } } else if (!file_exists('./d/wizard_completed.txt')){ //in case we are in crero-yp-api, we are doing the full range of testing, and if anything fails, output a "0" api response, which is //the special code for API calls, which are meant to start by a call to the "version" API action //and real version list of supported API version starts with version 1 //while version -1 is here to indicate to the client that it is blacklisted //and version 0 is a reserved code to indicate an unavailability of the API header( 'Content-Type: text/plain; charset=utf-8'); //here we go //firstly we check the existence of the shadowed password if (!file_exists('./admin/d/pwd.dat')&&strpos($_SERVER['PHP_SELF'], '/admin/index.php')!=strlen($_SERVER['PHP_SELF'])-strlen('/admin/index.php')){ exit('0'); } //then we check that server.txt is set and we also won't die() if the user is in admin (allong him/her to set server.txt) else if (!file_exists('./d/server.txt')&&strpos($_SERVER['PHP_SELF'], '/admin/index.php')!=strlen($_SERVER['PHP_SELF'])-strlen('/admin/index.php')){ exit('0'); } if (!file_get_contents('./d/server.txt')!==false){ exit('0'); } //useful data starting from now $server=trim(file_get_contents('./d/server.txt')); $proto='http'; if (isset($_SERVER['HTTPS'])&&$_SERVER['HTTPS']!==''){ $proto='https'; } //then we check the consistency of server.tx and also won't die() if the user is admin at the admin panel if (file_exists('./d/server.txt')&&strpos($_SERVER['PHP_SELF'], '/admin/index.php')!=strlen($_SERVER['PHP_SELF'])-strlen('/admin/index.php')){ $page=file_get_contents($proto.'://'.$server.'/?no-infinite-loop-please=1'); if (!$page==false){ exit('0'); } } if (file_get_contents($proto.'://'.$server.'/?no-infinite-loop-please=1')!==false&&!strstr($http_response_header[0], ' 200 OK')){ exit('0'); } //Main thing now, check the .htaccess is honored if (strpos($_SERVER['PHP_SELF'], '/admin/index.php')!==strlen($_SERVER['PHP_SELF'])-strlen('/admin/index.php')&&file_get_contents($proto.'://'.$server.'/admin/d/fields.txt')!==false&&strstr($http_response_header[0], ' 200 OK')&&file_get_contents($proto.'://'.$server.'/admin/d/fields.txt')===file_get_contents('./admin/d/fields.txt')){ exit('0'); } //all stages passed ok //create the wizard_completed mark file to skip these checks next time touch('./d/wizard_completed.txt'); }//end of basic configuration testing for crero-yp-api specifically //you come here, you're seen. If you're seen once, you must have hit the font then, human ! If you hadn't, you won't see us. if (!isset($_allow_bots) && in_array('seen', array_keys($_SESSION)) && !in_array('font', array_keys($_SESSION)) && strpos($_SERVER['PHP_SELF'], '/webchat/index.php')!==strlen($_SERVER['PHP_SELF'])-strlen('/webchat/index.php')){ http_response_code(403); echo (' Error page

We are quite sorry, but this website is only available for browsers that download remote fonts and honor a no-cache cache-control directive for them

…This is our DIY way to prevent aggresive, rude -read, pretending they are humans- scanner/scrapper so-called "clients" to use our web server ressources heavily enough to make it unusuable for human visitors.

If you are an human seeing this, it is probably because you kept an open tab for days, while your funny browser did not honnor the cache-control requested as it should have done.

Just start a new navigation journey here, and it should solve the issue. Another option is to start from a new browser session (like a newly created private browsing one) or, yet a last one, to clear cookies for this website.

'); die(); } //antiscrapper, level 2. Idea originated from Tercence Eden, thank him $soapboxDir = __DIR__ . '/soapbox'; $currentIp = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0'; $banDuration = 14400; // 14 400 secondes if (is_dir($soapboxDir)) { $datFiles = glob($soapboxDir . '/*.dat'); if ($datFiles) { $now = microtime(true); foreach ($datFiles as $file) { $ipInFile = trim(file_get_contents($file)); $filenameOnly = basename($file, '.dat'); $parts = explode('-', $filenameOnly); $banTimestamp = (float)($parts[0] ?? $now); if ($banTimestamp+14400 403 Error

Forbidden (403)

The requester's IP addres was banned seconds ago and is so for more seconds.

/audio subdir * same basename for each video file, in the folowing formats * (none of them being mandatory) : avi, mpg, ogv, mp4, webm * basename.description.txt * basename.album.txt * basename.title.txt * basename.artist.txt * in the same dir, will be used to categorize your vids * you can set a downgraded version of any format, that will be * provided instead of the original for streaming purpose, by adding * an extra .basename.format file <- not working anymore currently * also note that non ASCII will fail. * ** How to sell physical items * * OUDATED - LOOK at the online help in the admin panel ->Please look at the example "material_*.txt' files * in the d/ subdir. That's with theses files that you'll define * your physical copies product line * (remember Windows/Mac users, this is UNIX-style end of lines !) * * please note that your paypal payment adress will be publicly available * * * TODO : the script.js has several server url that are harcoded in it * that you will have to manually replace to reflect your actual * installation. It should move to a dynamic php file sooner or * later. <- this is **** done for years * * * */ if (!file_exists('./favicon.png')){ file_put_contents('./favicon.png', file_get_contents('./media/favicon.png')); } $favicon = 'favicon.png' ; $description = trim(file_get_contents('./d/description.txt')); $title=trim(file_get_contents('./d/title.txt')); if (!isset($server)){ $server=trim(file_get_contents('./d/server.txt')); //change this to your server's domain name } $sitename=trim(file_get_contents('./d/sitename.txt')); $serverapi='http://'.$server.'/api.php'; //don't change this for typical install if (file_exists('./d/clewnapiurl.txt')&&file_get_contents('./d/clewnapiurl.txt')!==false){ $clewnapiurl=trim(file_get_contents('./d/clewnapiurl.txt')); } else { $clewnapiurl=false;//sorry for the news, newbies, but we have to plan for the future } //you may change this to http:///whatever/path/to/free/audio/api.php $clewnaudiourl=trim(file_get_contents('./d/clewnaudiourl.txt')); //and this to http:///whatever/path/to/free/audio/audio/ ; otherwise you can upload your free audio to clewn and use it as free audio media server tier if (file_exists('./d/videoapiurl.txt')){ $videoapiurl=trim(file_get_contents('./d/videoapiurl.txt')); } else $videoapiurl=false; //same applies for video, with the difference that Clewn Video doesn't currently support public upload $videourl=trim(file_get_contents('./d/videourl.txt')); // //OUTDATED NEVER USE //whatever message you want to display if the HTTP GET message is set to this value, e.g. for advertising campaign or whatever $message['show_youtube']=' '; //will be displayed for http://yourserver.com/?message=show_youtube $footerhtmlcode=trim(file_get_contents('./d/footerhtmlcode.txt')); $activateaccountcreation=boolval(trim(file_get_contents('./d/activateaccountcreation.txt'))); //there's no true account management for now //only a quick way to subscribe to label news //without any kind of mailing list management //just indicate your contact email adress in d/mailing-list-owner.txt (use an .htaccess if you don't want it to be web-accessible) //and set this option to true //then any email address entered in the "subscribe to label blah blah" field will cause a message to be sent to your address //with the subscriber address in it //and you can start spamming manually //good luck $activatechat=boolval(trim(file_get_contents('./d/activatechat.txt'))); //if set to any other value than false, including null, will enable the chat widget at the bottom of every page //IMPORTANT : if you enable the chat feature, you'll have to create and *protect from outside access* //(with (as example with Apache) an .htaccess restriction file with directive set to deny access from all) // two directories in /network/ : ./d/ and ./e/ //that's were sensitive data, sur as (if provided by the user) geolocation will be stored //and you don't want the outside world to access them $activatestats=boolval(trim(file_get_contents('./d/activatestats.txt'))); //if set to any other value than false, including null, will enable the chat widget at the bottom of every page //IMPORTANT : if you enable the chat feature, you'll have to create and *protect from outside access* //(with (as example with Apache) an .htaccess restriction file with directive set to deny access from all) // two directories in /admin/ : ./d/ and ./d/stats //that's were sensitive data will be stored //and you don't want the outside world to access them $ismaterialnameyourprice=boolval(trim(file_get_contents('./d/isMaterialNameYourPrice.txt'))); //Caution : if set to 0 material shop will be a commercial one, with fixed price for items. If set to 1 people will name //their price for whatever order they may make with no minimum required $hasradio=boolval(trim(file_get_contents('./d/hasRadio.txt'))); //Do you want a radio station ? $radiodescription=trim(file_get_contents('./d/radioDescription.txt')); $radioname=trim(file_get_contents('./d/radioName.txt')); $radiohasyp=boolval(trim(file_get_contents('./d/radioHasYp.txt'))); $labelgenres=explode (' ', trim(file_get_contents('./d/labelGenres.txt'))); //do we accept donations ? $acceptdonations=boolval(trim(file_get_contents('./d/allowDonations.txt'))); //set this to 1 to accept donations $donationpaypaladdress=trim(file_get_contents('./d/donationPaypal.txt')); //the email address of the paypal account where donations will go $materialnameyourpricenotice=trim(file_get_contents('./d/materialNameYourPriceNotice.txt')); //this can be used as a disclaimer for name your price physical release //as "we reserve the right to refuse to complete any ordrer. No garantee" //things like this $materialmenu=trim(file_get_contents('./d/materialmenu.txt')); $materialreleasessalesagreement=trim(file_get_contents('./d/materialreleasessalesagreement.txt')); //what will be displayed at the bottom of the shop page if the material release eshop is enabled $socialmediaicons=Array(); //facebook twitter youtube links, things like that if (file_exists('./d/social_media_icons.txt')){ $socdata=trim(file_get_contents('./d/social_media_icons.txt')); $soctokens=explode("\n", $socdata); for ($p=0;$p2 && is_numeric($abtc[1])){ $LightningBTCDonationAddress = $abtc; } } ?>