<!--#include file="conn.asp"-->
<%
	const ThisPage = "Admin_Editor.asp"
	strFilter="conn.asp,HtmlEdit.asp,const.asp,editor.asp,ProductList.asp,default.asp"				'指定不能编辑的文件
	strM_ID=Trim(Session("UserID"))
	
	strFile=GetQueryString("File")
	
	if Instr(strFile,"\")>0  Or Instr(strFile,"/")>0  Or Instr(strFile,"'")>0  Or Instr(strFile,"..")>0 then
		ShowMsg "错误的文件ID，无法编辑！　"
	end if
	
	if Instr(strFilter,strFile)>0 then
		ShowMsg "错误的文件ID，无法编辑！　"
	end if
	
	if Lcase( Trim(GetVariable("action")) ) = "update" then
		call SaveUpdate()
	end if
	
	'如果选择了下次直接进入布局模式
	if Lcase(GetVariable("Mode"))="true" then
		Session("EditMode")="2"
	end if
%>
<%
	sub SaveUpdate()

		dim FileID, content, DiyFolder, EditFile, fp

		FileID = Trim(GetVariable("File"))
		content = request("content")
		if content = "" then
			content = "暂时没有内容..."
		end if
		
		'禁止使用CreateObject
		if instr(Lcase(content),"createobject")>0 then
			ShowMsg "<strong><font color=red>保存文件失败！</font></strong><br>为了能更安全地为您服务，请不要在此使用服务器端的组件服务！"
		end if
		
		'禁止使用<object>创建组件
		if instr(Lcase(content),"runat=")>0 then
			ShowMsg "<strong><font color=red>保存文件失败！</font></strong><br>为了能更安全地为您服务，请不要在此使用服务器端的组件服务！"
		end if
		
		'禁止使用ASP代码
		if instr(content,"<" & chr(37) )>0 then
			ShowMsg "<strong><font color=red>保存文件失败！</font></strong><br>为了能更安全地为您服务，禁止插入服务器运行脚本代码！"
		end if
		
		'转换ASP代码
		content=aspEndReplace(content)
		
		Set fs = Server.CreateObject( Const_ScriptFileSystem )
			DiyFolder = "home/" & Trim(Session("UserName")) & "/"
			DiyFolder = Server.MapPath( DiyFolder )

			if fs.FolderExists( DiyFolder )=false then
				On Error Resume Next
				fs.CreateFolder( DiyFolder )
			end if


			EditFile = DiyFolder & "\" & FileID
			
			Dim BeforeBody,AfterBody,HtmlEditContent
			'==========================只替换Body部份===================================
			if fs.FileExists(EditFile) then
				Set fp = fs.OpenTextFile( EditFile,1,False )
					On Error Resume Next
					HtmlEditContent = fp.ReadAll
					fp.Close
					
			end if
					
			'只取Body部份的出来编辑
			pn=instr(HtmlEditContent,"BodyBegin>")
			if pn>0 then
				BeforeBody=left(HtmlEditContent,pn+9)
			end if
					
			pn=instr(HtmlEditContent,"</body>")
			if pn>0 then
				AfterBody=Right(HtmlEditContent,len(HtmlEditContent)-pn-6)
			end if

			'==========================只替换Body部份===================================
			content=BeforeBody & content & AfterBody
			
			Set fp = fs.CreateTextFile( EditFile )
				On Error Resume Next
				fp.Write content
			fp.close
		Set fs = nothing
		
		'保存到数据库做备份，必要时可以还原
		'content=Replace(content,"'","''")
		strSQL="select Top 1 * From EditFile Where m_id=" & strM_ID & " And e_file='" & strFile & "'"
		set rs=Server.CreateObject("ADODB.RecordSet")
		rs.open strSQL,conn,1,3
		if rs.recordcount <=0 then
			rs.addnew
			rs("m_id")=strM_ID
			rs("e_file")=strFile
			rs("e_html")=content
		Else
			rs("e_html")=content
			rs("e_edittime")=now
		End if
		rs.update
		rs.close
		Set rs=nothing
		
		strSaveMsg=" ----保存成功!!"
	end sub
%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>电子商务自助建站--您理想的助手</title>
<link href="common/styleMain.css" rel="stylesheet" type="text/css">
</head>
<body leftmargin="0" topmargin="0">
<table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
  <tr>
    <td align="center"><table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
        <tr> 
          <td height="0" align="center">
		  <!--#include file="common/Editortop.asp"-->
          </td>
        </tr>
        <tr> 
          <td height="100%" align="center">
		  <!--网页在线编辑器Begin-->
			<table border=0 cellpadding=0 cellspacing=0 class=table002>
			<tbody>
			  <tr>
				<td width="100%" valign="top" align="center">
				  <table bgcolor="#FFFFFF" border="0" cellspacing="0" cellpadding="0" width="98%">
				<tr>
				  <td><b>
				  <%
				  if GetVariable("title")="" then
				  	response.Write(GetVariable("File"))
				  else
				  	response.Write(GetVariable("title"))	
				  end if
				  %>
				  编辑</b>
					<b><font color="#FF0000"><%=strSaveMsg%></font></b> 
                          <hr size="1">
				  </td>
				<tr>
				<tr>
				  <td width="100%" valign="top">
				<%
					dim FileID, DiyFolder, EditFile, fp,strSaveMsg
			
					FileID = Trim(GetVariable("File"))
					if FileID="" then
						ShowMsg "错误的文件ID，无法编辑！　"
					end if
			
					Set fs = Server.CreateObject( Const_ScriptFileSystem )
					DiyFolder = "home/" & Trim(Session("UserName")) & "/"
					DiyFolder = Server.MapPath( DiyFolder )
			
					if fs.FolderExists( DiyFolder )=false then
						On Error Resume Next
						fs.CreateFolder( DiyFolder )
					end if
			
					EditFile = DiyFolder & "/" & FileID
					if fs.FileExists(EditFile)=false then
						Set fp = fs.CreateTextFile( EditFile )
							On Error Resume Next
							fp.Write " "
						fp.close
					else
						Set fp = fs.OpenTextFile( EditFile,1,False )
							On Error Resume Next
							HtmlEditContent = fp.ReadAll
						fp.Close
					end if
					Set fs = nothing
					
					'只取Body部份的出来编辑
					pn=instr(HtmlEditContent,"BodyBegin>")
					if pn>0 then
						HtmlEditContent=right(HtmlEditContent,len(HtmlEditContent)-pn-9)
					end if
					
					pn=instr(HtmlEditContent,"</body>")
					if pn>0 then
						HtmlEditContent=left(HtmlEditContent,pn-1)
					end if
					
					EditorHeight = 450
			
				'下面调用的 form 的内部名称：name="HtmlEditForm"，不能改，否则无法连接
				%>
			
				<form name="HtmlEditForm" action="?action=Update&File=<%=FileID%>" method=post onSubmit="GetHTML()">
                            <!--#Include File="HtmlEdit.asp"-->
			
				</form>
                <script language="JavaScript">
				function GetHTML(){
					//document.HtmlEditForm.content.value = document.frames.editor.frames.edit1.textEdit.document.body.innerHTML;
					if (document.frames.editor.frames.edit1.format == "ABC")
						document.HtmlEditForm.content.value = document.frames.editor.frames.edit1.textEdit.document.body.innerText;
					else
						document.HtmlEditForm.content.value = document.frames.editor.frames.edit1.textEdit.document.body.innerHTML;
				}
				</script>
				  </td>
				</tr>
				  </table>
				</td>
			  </tr>
			  </tbody>
			</table>
		  
            <!--网页在线编辑器END-->
          </td>
        </tr>
        <tr> 
          <td height="0" align="center">
		  <!--#include file="common/bottom.asp"-->
		  </td>
        </tr>
      </table></td>
  </tr>
</table>
</body>
</html>
