<!--#include file="conn.asp"-->
<%
	const ThisPage = "Admin_Editor.asp"
	strFilter="conn.asp,HtmlEdit.asp,const.asp,editor.asp,ProductList.asp,default.asp"				'指定不能编辑的文件
	strM_ID=Trim(Session("UserID"))
	
	strFile=GetQueryString("File")
	
	if Instr(strFile,"\")>0  Or Instr(strFile,"/")>0  Or Instr(strFile,"'")>0  Or Instr(strFile,"..")>0 then
		ShowMsg "错误的文件ID，无法编辑！　"
	end if
	
	if Instr(strFilter,strFile)>0 then
		ShowMsg "错误的文件ID，无法编辑！　"
	end if
	
	if Lcase( Trim(GetVariable("action")) ) = "update" then
		call SaveUpdate()
	end if
	
	'如果选择了下次直接进入布局模式
	if Lcase(GetVariable("Mode"))="true" then
		Session("EditMode")="2"
	end if
%>
<%
	sub SaveUpdate()

		dim FileID, content, DiyFolder, EditFile, fp

		FileID = Trim(GetVariable("File"))
		content = request("content")
		if content = "" then
			content = "暂时没有内容..."
		end if
		
		'禁止使用CreateObject
		if instr(Lcase(content),"createobject")>0 then
			ShowMsg "<strong><font color=red>保存文件失败！</font></strong><br>为了能更安全地为您服务，请不要在此使用服务器端的组件服务！"
		end if
		
		'禁止使用<object>创建组件
		if instr(Lcase(content),"runat=")>0 then
			ShowMsg "<strong><font color=red>保存文件失败！</font></strong><br>为了能更安全地为您服务，请不要在此使用服务器端的组件服务！"
		end if
		
		'禁止使用ASP代码
		if instr(content,"<" & chr(37) )>0 then
			ShowMsg "<strong><font color=red>保存文件失败！</font></strong><br>为了能更安全地为您服务，禁止插入服务器运行脚本代码！"
		end if
		
		'转换ASP代码
		content=aspEndReplace(content)
		
		Set fs = Server.CreateObject( Const_ScriptFileSystem )
			DiyFolder = "home/" & Trim(Session("UserName")) & "/"
			DiyFolder = Server.MapPath( DiyFolder )

			if fs.FolderExists( DiyFolder )=false then
				On Error Resume Next
				fs.CreateFolder( DiyFolder )
			end if


			EditFile = DiyFolder & "\" & FileID
			
			Dim BeforeBody,AfterBody,HtmlEditContent
			'==========================只替换Body部份===================================
			if fs.FileExists(EditFile) then
				Set fp = fs.OpenTextFile( EditFile,1,False )
					On Error Resume Next
					HtmlEditContent = fp.ReadAll
					fp.Close
					
			end if
					
			'只取Body部份的出来编辑
			pn=instr(HtmlEditContent,"BodyBegin>")
			if pn>0 then
				BeforeBody=left(HtmlEditContent,pn+9)
			end if
					
			pn=instr(HtmlEditContent,"</body>")
			if pn>0 then
				AfterBody=Right(HtmlEditContent,len(HtmlEditContent)-pn-6)
			end if

			'==========================只替换Body部份===================================
			content=BeforeBody & content & AfterBody
			
			Set fp = fs.CreateTextFile( EditFile )
				On Error Resume Next
				fp.Write content
			fp.close
		Set fs = nothing
		
		'保存到数据库做备份，必要时可以还原
		'content=Replace(content,"'","''")
		strSQL="select Top 1 * From EditFile Where m_id=" & strM_ID & " And e_file='" & strFile & "'"
		set rs=Server.CreateObject("ADODB.RecordSet")
		rs.open strSQL,conn,1,3
		if rs.recordcount <=0 then
			rs.addnew
			rs("m_id")=strM_ID
			rs("e_file")=strFile
			rs("e_html")=content
		Else
			rs("e_html")=content
			rs("e_edittime")=now
		End if
		rs.update
		rs.close
		Set rs=nothing
		
		strSaveMsg=" ----保存成功!!"
	end sub
%>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<title>电子商务自助建站--您理想的助手</title>
<link href="common/styleMain.css" rel="stylesheet" type="text/css">
</head>
<body leftmargin="0" topmargin="0">
<table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
  <tr>
    <td align="center"><table width="100%" height="100%" border="0" cellpadding="0" cellspacing="0">
        <tr> 
          <td height="0" align="center">
		  <!--#include file="common/Editortop.asp"-->
          </td>
        </tr>
        <tr> 
          <td height="100%" align="center">
		  <!--网页在线编辑器Begin-->
			<table border=0 cellpadding=0 cellspacing=0 class=table002>
			<tbody>
			  <tr>
				<td width="100%" valign="top" align="center">
				  <table bgcolor="#FFFFFF" border="0" cellspacing="0" cellpadding="0" width="98%">
				<tr>
				  <td><b>
				  <%
				  if GetVariable("title")="" then
				  	response.Write(GetVariable("File"))
				  else
				  	response.Write(GetVariable("title"))	
				  end if
				  %>
				  编辑</b>
					<b><font color="#FF0000"><%=strSaveMsg%></font></b> 
                          <hr size="1">
				  </td>
				<tr>
				<tr>
				        <td width="100%" valign="top"> 
                          <%
					dim FileID, DiyFolder, EditFile, fp,strSaveMsg
			
					FileID = Trim(GetVariable("File"))
					if FileID="" then
						ShowMsg "错误的文件ID，无法编辑！　"
					end if
			
					Set fs = Server.CreateObject( Const_ScriptFileSystem )
					DiyFolder = "home/" & Trim(Session("UserName")) & "/"
					DiyFolder = Server.MapPath( DiyFolder )
			
					if fs.FolderExists( DiyFolder )=false then
						On Error Resume Next
						fs.CreateFolder( DiyFolder )
					end if
			
					EditFile = DiyFolder & "/" & FileID
					if fs.FileExists(EditFile)=false then
						Set fp = fs.CreateTextFile( EditFile )
							On Error Resume Next
							fp.Write " "
						fp.close
					else
						Set fp = fs.OpenTextFile( EditFile,1,False )
							On Error Resume Next
							HtmlEditContent = fp.ReadAll
						fp.Close
					end if
					Set fs = nothing
					
					'只取Body部份的出来编辑
					pn=instr(HtmlEditContent,"BodyBegin>")
					if pn>0 then
						HtmlEditContent=right(HtmlEditContent,len(HtmlEditContent)-pn-9)
					end if
					
					pn=instr(HtmlEditContent,"</body>")
					if pn>0 then
						HtmlEditContent=left(HtmlEditContent,pn-1)
					end if
					
					EditorHeight = 450
			
				'下面调用的 form 的内部名称：name="HtmlEditForm"，不能改，否则无法连接
				%>
                          <%
		'if HtmlEditContent<>"" then
			'HtmlEditContent = replace( HtmlEditContent,"<", "&lt;" )
			'HtmlEditContent = replace( HtmlEditContent, ">", "&gt;" )
		'end if
		
		'转换ASP代码
		HtmlEditContent=aspStartReplace(HtmlEditContent)

		HtmlEditContent=Server.HTMLEncode(HtmlEditContent)
		%>
                          <table width="100%" border="0" cellpadding="1" cellspacing="1" align="center" bgcolor="aaaaaa">
                            <form name=a1 method="post" action="?action=Update&File=<%=FileID%>">
	<input type=hidden name=Handle value="<%=intHandle%>"> 
                              <tr bgcolor="ffffff" valign="middle"> 
                                <td width="25" align="center"> <textarea name="content" style="display:none"><%=HtmlEditContent%></textarea> 
                                  <iframe ID="eWebEditor1" src="/editor/ewebeditor.asp?id=content&style=standard" frameborder="0" scrolling="no" width="100%" HEIGHT="420"></iframe></td>
                              </tr>
                              <tr bgcolor="#FFFFFF" height="25"> 
                                <td align="center" valign="middle"><input type="submit" name="Submit1" value=" 提 交 " id="Submit1"> 
                                  &nbsp; <input type="reset" name="Submit2" value=" 清 除 "></td>
                              </tr>
                            </form>
                          </table> 
                        </td>
				</tr>
				  </table>
				</td>
			  </tr>
			  </tbody>
			</table>

            <!--网页在线编辑器END-->
          </td>
        </tr>
        <tr> 
          <td height="0" align="center">
		  <!--#include file="common/bottom.asp"-->
		  </td>
        </tr>
      </table></td>
  </tr>
</table>
<%

'--------------------------------------------转换ASP代码-----------------------------------------------
	Dim intHandle		'本次操作把柄
	Function aspStartReplace(strContent)
		'生成操作号
		Randomize 									'初始化随机数生成器。
		intHandle = Int((100000000 * Rnd))			' 产生随机数。
		
		Dim i,sPn,ePn
		i=0
		'开始循环替换ASP代码并记录到数据库
		sPn=Instr(strContent,"<" & chr(37))
		Do While sPn>0
			ePn=Instr(strContent,chr(37) & ">")
			i=i+1
			strReplace="⑨ASP代码" & i & "⑨"
			strASPCode=Mid(strContent, sPn, ePn+2-sPn)
			'替换成代号
			strContent=Replace(strContent,strASPCode,strReplace)
			'记录到数据库
			strASPCode=Replace(strASPCode,"'","''")
			strSQL="Insert Into aspcode(m_id,a_handle,a_index,a_aspcode) Values(" & strM_ID & "," & intHandle & "," &  i & ",'" & strASPCode & "')"
			conn.execute strSQl,0,1
			
			'为下次循环准备
			sPn=Instr(strContent,"<" & chr(37))
		loop
		
		'替换include file=top.asp
		strContent=Replace(strContent,"<!--" & chr(35) & "include file=""top.asp""-->","⑨Include⑨")
		
		'返回替换后结果
		aspStartReplace=strContent
	End Function
	
	Function aspEndReplace(strContent)

		strSQL="Select * From aspcode Where a_handle=" & GetFormVariable("Handle") & " And m_id=" & strM_ID & " Order by a_index"
		Set rsSub=Server.CreateObject("ADODB.RecordSet")

		rsSub.open strSQL,conn,1,1
		for i=1 to rsSub.recordcount
			strContent=replace(strContent,"⑨ASP代码" & rsSub("a_index") & "⑨",Trim(rsSub("a_aspcode")))
			rsSub.movenext
		next
		rsSub.close
		set rsSub=nothing
		
		'替换include file=top.asp
		strContent=Replace(strContent,"⑨Include⑨","<!--" & chr(35) & "include file=""top.asp""-->")
		
		aspEndReplace=strContent
	End Function
'--------------------------------------------转换ASP代码-----------------------------------------------
	
%>
</body>
</html>
