CVE-2012-10011: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the function hd_add_media/hd_update_media of the file functions.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 34d66b9f3231a0e2dc0e536a6fe615d736e863f7. It is recommended to upgrade the affected component. VDB-225350 is the identifier assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-04-09T22:15Z
Repository: https://github.com/wp-plugins/contus-hd-flv-player
Language: PHP
Files changed: configXML.php, functions.php, hdflv-config.php, hdflvplayer/css/jquery.ui.all.css, hdflvplayer/css/jquery.ui.theme.css, hdflvplayer/xml-nouse/config.xml, hdflvplayer/xml-nouse/playlist.xml, hdflvplayer/youtubeurl.php, hdflvplugin.php, install.php, js/hdflvscript.js, manage.php, myextractXML.php, process-sortable.php, readme.txt, uploadVideo.php
Commit date: 2012-07-24 08:31:46 +0000
Commit message: vulnerabilities issues fixed in trunk folder

git-svn-id: https://plugins.svn.wordpress.org/contus-hd-flv-player/trunk@576511 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/configXML.php b/configXML.php
index f01eecd..656d42c 100644
--- a/configXML.php
+++ b/configXML.php
@@ -1,17 +1,18 @@
 <?php
-/*
- *
- * Purpose : Player Configuration Settings
- * Path:/wp-content/plugins/contus-hd-flv-player/configXML.php
- * Edited by : kranthi kumar
- * Version: 1.7
- * Email : kranthikumar@contus.in
- * Date:9/12/11
- *
- */
-
+/**
+ * @name          : Player Configuration Settings
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Player Configuration Settings
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
 
 header("content-type:text/xml;charset=utf-8");
 require_once( dirname(__FILE__) . '/hdflv-config.php');
 global $wpdb;
 global $site_url;
diff --git a/functions.php b/functions.php
index da5b0e9..eee05e3 100644
--- a/functions.php
+++ b/functions.php
@@ -1,13 +1,21 @@
 <?php
-ob_start();
-/* Purpose : Common functions needed throughout the plugin
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Path:/wp-content/plugins/contus-hd-flv-player/function.php
- * Date:9/12/11
- */
+/**
+ * @name          : Common functions needed throughout the plugin
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Common functions needed throughout the plugin
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
+ob_start(); 
+
 require_once( dirname(__FILE__) . '/hdflv-config.php');
 
 $name = filter_input(INPUT_GET,'name');
 $media = filter_input(INPUT_GET,'media');
 if(isset($name)){
@@ -199,11 +207,12 @@ function hd_add_media($wptfile_abspath, $wp_urlpath) {
     
 
 // Get input informations from POST
     $sorder = $_POST['sorder'];
 
-    $act_name = trim($_POST['name']);
+    $act_name = strip_tags(trim($_POST['name']));
+    $act_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $act_name);
 
     if ($_POST['youtube-value'] != '') {
 
         $act_filepath = addslashes(trim($_POST['youtube-value']));
     } else {
@@ -287,11 +296,11 @@ function hd_add_media($wptfile_abspath, $wp_urlpath) {
 function hd_update_thumb($wptfile_abspath,$showPath,$updateID) {
 
     global $wpdb;
     $uploadPath = $wpdb->get_col("SELECT upload_path FROM " . $wpdb->prefix . "hdflv_settings");
     $uPath = $uploadPath[0];
-    //echo "<pre>"; print_r($_POST); echo "</pre>";
+    $uploadStatus = '';
     
     if($uPath != ''){
         $wp_urlpath = $wptfile_abspath.$uPath.'/';
     }else{
         $wp_urlpath = $wptfile_abspath.'/';
@@ -301,30 +310,36 @@ function hd_update_thumb($wptfile_abspath,$showPath,$updateID) {
                     $cname = $_FILES["edit_thumb"]["name"];
                     $tname =  $_FILES["edit_thumb"]["tmp_name"];
                     $random_digit = rand(0000,9999);
                     $new_file_name=$random_digit.'_'.$cname;
                     if(move_uploaded_file($tname ,$wp_urlpath . $new_file_name)){
+                    $uploadStatus = true;
                     $updated_thumb=$new_file_name;
                     }
+                }else{
+                $uploadStatus = false;
+                render_error(__('Invalid File Format Uploaded', 'hdflv'));
                 }
 if($uPath != ''){
         $wp_showPath = $showPath.$uPath.'/';
     }else{
         $wp_showPath = $showPath.'/';
     }
+    if($uploadStatus == '1'){
    $updated_thumb_value = $wp_showPath.$updated_thumb;
    $wpdb->query(" UPDATE " . $wpdb->prefix . "hdflv SET image= '$updated_thumb_value' WHERE vid = '$updateID'");
    render_message(__('Image Update Successfully', 'hdflv'));
     return;
+    }
 }
 //Function for updating preview image
 function hd_update_preview($wptfile_abspath,$showPath,$updateID) {
 
      global $wpdb;
     $uploadPath = $wpdb->get_col("SELECT upload_path FROM " . $wpdb->prefix . "hdflv_settings");
     $uPath = $uploadPath[0];
-    //echo "<pre>"; print_r($_POST); echo "</pre>";
+    $uploadStatus = '';
     
     if($uPath != ''){
         $wp_urlpath = $wptfile_abspath.$uPath.'/';
     }else{
         $wp_urlpath = $wptfile_abspath.'/';
@@ -335,22 +350,28 @@ function hd_update_preview($wptfile_abspath,$showPath,$updateID) {
                     $cname = $_FILES["edit_preview"]["name"];
                     $tname =  $_FILES["edit_preview"]["tmp_name"];
                     $random_digit = rand(0000,9999);
                     $new_file_name=$random_digit.'_'.$cname;
                     if(move_uploaded_file($tname ,$wp_urlpath . $new_file_name)){
+                    $uploadStatus = true;
                     $updated_preview = $new_file_name;
                     }
+                }else{
+                $uploadStatus = false;
+                render_error(__('Invalid File Format Uploaded', 'hdflv'));
                 }
 if($uPath != ''){
         $wp_showPath = $showPath.$uPath.'/';
     }else{
         $wp_showPath = $showPath.'/';
     }
+   if($uploadStatus == '1'){
    $updated_preview_value = $wp_showPath.$updated_preview;
    $wpdb->query(" UPDATE " . $wpdb->prefix . "hdflv SET opimage= '$updated_preview_value' WHERE vid = '$updateID'");
    render_message(__('Image Update Successfully', 'hdflv'));
     return;
+   }
 }
 //Function used for retrieving YOUTUBE url
 function youtubeurl() {
     $act_filepath = addslashes(trim($_POST['filepath']));
     if (!empty($act_filepath)) {
@@ -374,11 +395,12 @@ function youtubeurl() {
 //Function used for updating media data(File path,name,etc..)
 function hd_update_media($media_id) {
     global $wpdb;
     $pieces = explode(",", $_POST['hid']);
     $sorder = $_POST['sorder'];
-    $act_name = addslashes(trim($_POST['act_name']));
+    $act_name = strip_tags(trim($_POST['act_name']));    
+    $act_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $act_name);    
     $act_filepath = addslashes(trim($_POST['act_filepath']));
     $act_image = addslashes(trim($_POST['act_image']));
     $act_hdpath = addslashes(trim($_POST['act_hdpath']));
     $act_link = addslashes(trim($_POST['act_link']));
     $act_opimg = addslashes(trim($_POST['act_opimg']));
@@ -507,12 +529,13 @@ function hd_ajax_add_playlist($name,$media) {
 //Function used to add playlist
 function hd_add_playlist() {
     global $wpdb;
    
     // Get input informations from POST
-    $p_name = addslashes(trim($_POST['p_name']));
-    $p_description = addslashes(trim($_POST['p_description']));
+    $p_name = strip_tags(trim($_POST['p_name']));
+    $p_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $p_name);
+    $p_description = strip_tags(trim($_POST['p_description']));
     $p_playlistorder = $_POST['sortorder'];
     if (empty($p_playlistorder))
         $p_playlistorder = "ASC";
 
     $playlistname1 = "select playlist_name from " . $wpdb->prefix . "hdflv_playlist where playlist_name='" . $p_name . "'";
@@ -539,13 +562,13 @@ function hd_add_playlist() {
 function hd_update_playlist() {
     global $wpdb;
 
     // Get input informations from POST
     $p_id = (int) ($_POST['p_id']);
-    $p_name = addslashes(trim($_POST['p_name']));
-    		 
-    $p_description = addslashes(trim($_POST['p_description']));
+    $p_name = strip_tags(trim($_POST['p_name']));
+    $p_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $p_name);		 
+    $p_description = strip_tags(trim($_POST['p_description']));
     $p_playlistorder = $_POST['sortorder'];
 
 //echo $siteUrl = $_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF'].'?page='.$_GET['page'].'&mode='.$_GET['mode'];
 $siteUrl = 'admin.php?page=hdflvplaylist'.$_GET['page'].'&mode='.$_GET['mode'].'&sus=1';
     if (!empty($p_name)) {
diff --git a/hdflv-config.php b/hdflv-config.php
index 019fcc3..9e85a1a 100644
--- a/hdflv-config.php
+++ b/hdflv-config.php
@@ -1,15 +1,19 @@
 <?php
-/*
- * version : 1.6
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Purpose : configuration of plugin
- * Path:/wp-content/plugins/contus-hd-flv-player/hdflv-config.php
- * Date:9/12/11
- *
- */
+/**
+ * @name          : configuration of plugin
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : configuration of plugin
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 /**
  * Bootstrap file for getting the ABSPATH constant to wp-load.php
  * This is requried when a plugin requires access not via the admin screen.
  *
  * If the wp-load.php file is not found, then an error will be displayed 
diff --git a/hdflvplayer/css/jquery.ui.all.css b/hdflvplayer/css/jquery.ui.all.css
index 79cb59d..13db229 100644
--- a/hdflvplayer/css/jquery.ui.all.css
+++ b/hdflvplayer/css/jquery.ui.all.css
@@ -7,12 +7,5 @@
  *
  * http://docs.jquery.com/UI/Theming
  */
 @import "jquery.ui.base.css";
 @import "jquery.ui.theme.css";
- .column { width: 500px; float: left; padding-bottom: 20px; }
-        .portlet { margin: 0 1em 1em 0; }
-        .portlet-header { margin: 0.3em; padding-bottom: 4px; padding-left: 10px;padding-top: 4px;font-size:12px; }
-        .portlet-header .ui-icon { float: right; }
-        .portlet-content { padding: 0.4em; font-size:12px;}
-        .ui-sortable-placeholder { border: 1px dotted black; visibility: visible !important; height: 50px !important; }
-        .ui-sortable-placeholder * { visibility: hidden; }
\ No newline at end of file
diff --git a/hdflvplayer/css/jquery.ui.theme.css b/hdflvplayer/css/jquery.ui.theme.css
index 0a26d61..1ee9bf4 100644
--- a/hdflvplayer/css/jquery.ui.theme.css
+++ b/hdflvplayer/css/jquery.ui.theme.css
@@ -14,11 +14,11 @@
 /* Component containers
 ----------------------------------*/
 .ui-widget { font-family: Verdana,Arial,sans-serif/*{ffDefault}*/; font-size: 1.1em/*{fsDefault}*/; }
 .ui-widget .ui-widget { font-size: 1em; }
 .ui-widget input, .ui-widget select, .ui-widget textarea, .ui-widget button { font-family: Verdana,Arial,sans-serif/*{ffDefault}*/; font-size: 1em; }
-.ui-widget-content { border: 1px solid #aaaaaa/*{borderColorContent}*/; background: #ffffff/*{bgColorContent}*/ /*{bgImgUrlContent}*/ 50%/*{bgContentXPos}*/ 50%/*{bgContentYPos}*/ repeat-x/*{bgContentRepeat}*/; color: #222222/*{fcContent}*/; }
+.ui-widget-content { border: 1px solid #aaaaaa/*{borderColorContent}*/; background: #ffffff/*{bgColorContent}*/ url(images/ui-bg_flat_75_ffffff_40x100.png)/*{bgImgUrlContent}*/ 50%/*{bgContentXPos}*/ 50%/*{bgContentYPos}*/ repeat-x/*{bgContentRepeat}*/; color: #222222/*{fcContent}*/; }
 .ui-widget-content a { color: #222222/*{fcContent}*/; }
 .ui-widget-header { border: 1px solid #aaaaaa/*{borderColorHeader}*/; background: #cccccc/*{bgColorHeader}*/ url(images/ui-bg_highlight-soft_75_cccccc_1x100.png)/*{bgImgUrlHeader}*/ 50%/*{bgHeaderXPos}*/ 50%/*{bgHeaderYPos}*/ repeat-x/*{bgHeaderRepeat}*/; color: #222222/*{fcHeader}*/; font-weight: bold; }
 .ui-widget-header a { color: #222222/*{fcHeader}*/; }
 
 /* Interaction states
diff --git a/hdflvplayer/xml-nouse/config.xml b/hdflvplayer/xml-nouse/config.xml
new file mode 100644
index 0000000..7b49423
--- /dev/null
+++ b/hdflvplayer/xml-nouse/config.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8"?>
+<config 
+license="Key provided for commercial version"
+stagecolor="0x000000" 
+autoplay="true" 
+buffer="3"
+Volume="false" 
+fullscreenscale="0" 
+normalscale="0" 
+logopath="hdflvplayer/images/platoon.png"
+logoalpha="50" 
+logoalign="TR" 
+Download="false"
+logo_target="http://www.hdflvplayer.net/"
+skin="hdflvplayer/skin/skin_black/skin_black.swf"
+skin_autohide="false"
+language = "English"
+playlistXML="hdflvplayer/xml/playlist.xml"
+playlist_open="false" 
+showPlaylist ="true"
+HD_default="false" 
+vast="false"
+vast_partnerid=""
+streamer=""
+embed_visible="true"
+UseYouTubeApi="flash"
+debug="true">
+<timer>true</timer>
+<zoom>true</zoom>
+<email>true</email>
+<fullscreen>true</fullscreen>
+</config>
\ No newline at end of file
diff --git a/hdflvplayer/xml-nouse/playlist.xml b/hdflvplayer/xml-nouse/playlist.xml
new file mode 100644
index 0000000..bd13ce4
--- /dev/null
+++ b/hdflvplayer/xml-nouse/playlist.xml
@@ -0,0 +1,23 @@
+﻿<?xml version="1.0" encoding="utf-8"?>
+<playlist autoplay="false" random="false">
+
+  <mainvideo url="http://www.hdflvplayer.net/videos/300.mp4" 
+             hdpath="http://www.hdflvplayer.net/videos/300.mp4"
+             id="100"
+             thu_image=""                                                                                
+             Preview="" 
+             preroll="true" 
+             midroll="true" 
+             postroll="true" 
+             allow_download="true"
+             streamer=""
+             isLive="false" > 
+             <title><![CDATA[Welcome]]></title> 
+             <!--Optional--> 
+             <tagline targeturl="https://mydomain.com"><![CDATA[<span class='heading'>Tagline - </span> <b>Your short description  goes here for Videos.</b> ]]></tagline>        
+  </mainvideo>
+
+
+
+
+</playlist>
diff --git a/hdflvplayer/youtubeurl.php b/hdflvplayer/youtubeurl.php
index ef97e4b..716f35e 100644
--- a/hdflvplayer/youtubeurl.php
+++ b/hdflvplayer/youtubeurl.php
@@ -1,6 +1,7 @@
 <?php
+
 /*
  * version : 1.6
  * Edited by : John THomas
  * Email : johnthomas@contus.in
  * Purpose : Common functions needed throughout the plugin
diff --git a/hdflvplugin.php b/hdflvplugin.php
index e091c97..2a5787f 100644
--- a/hdflvplugin.php
+++ b/hdflvplugin.php
@@ -1,17 +1,16 @@
 <?php
 /*
  * Plugin Name: Contus HDFLVPlayer Plugin
- * Version: 1.7
+ * Version: 1.8
  * Author: Apptha
  * Plugin URI: http://www.apptha.com/category/extension/Wordpress/HD-FLV-Player-Plugin/
  * Author URI: http://www.apptha.com/
  * Description: Contus HD FLV Player simplifies the process of adding high definition videos to the Wordpress blog. The plugin efficiently plays your Videos with high quality video and audio output.  
  * Path :wp-content\plugins\contus-hd-flv-player\hdflvplugin.php
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * date:09/12/11
+ * Creation Date : Dec 09, 2011
+ * Modified Date : Jul 23, 2012
  * Purpose : Main plugin file to configure
  */
 session_start();
 $videoid = 0;
 $site_url = $siteUrl = get_option('siteurl');
diff --git a/images/Thumbs.db b/images/Thumbs.db
index 35f53c2..dbf397f 100644
Binary files a/images/Thumbs.db and b/images/Thumbs.db differ
diff --git a/install.php b/install.php
index 8dc8a34..3c364cf 100644
--- a/install.php
+++ b/install.php
@@ -1,12 +1,19 @@
 <?php
-/* 
- * Purpose : Used for installing player plugin (Creating tables)
- * Edited By : kranthi kumar
- * Version: 1.7
- * Email : kranthikumar@contus.in
-*/
+/**
+ * @name          : Used for installing player plugin (Creating tables)
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Used for installing player plugin (Creating tables)
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 /****************************************************************/
 /* Install routine for hdflvplayer
 /****************************************************************/
 function contusHdInstalling()
 {
diff --git a/js/hdflvscript.js b/js/hdflvscript.js
index 5682883..3d89b44 100644
--- a/js/hdflvscript.js
+++ b/js/hdflvscript.js
@@ -1,215 +1,273 @@
+/**
+ * @name          : Script for Hd Flv Player
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : For Validation and Sortable Process
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 var xmlhttp;
 var myarray = [];
 var myarray1;
-function showUser(str,order)
-{
-xmlhttp=GetXmlHttpObject();
-if (xmlhttp==null)
-  {
-  alert ("Browser does not support HTTP Request");
-  return;
-  }
-var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
-url=url+"?"+order;
-url=url+"&playid="+str;
-url=url+"&sid="+Math.random();
-xmlhttp.onreadystatechange=stateChanged;
-xmlhttp.open("GET",url,true);
-xmlhttp.send(null);
+function showUser(str, order) {
+	xmlhttp = GetXmlHttpObject();
+	if (xmlhttp == null) {
+		alert("Browser does not support HTTP Request");
+		return;
+	}
+	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
+	url = url + "?" + order;
+	url = url + "&playid=" + str;
+	url = url + "&sid=" + Math.random();
+	xmlhttp.onreadystatechange = stateChanged;
+	xmlhttp.open("GET", url, true);
+	xmlhttp.send(null);
 }
 
-function stateChanged()
-{
-if (xmlhttp.readyState==4)
-{
-     myarray = xmlhttp.responseText;
-       myarray1 = myarray.split(",");
-        var length1 = myarray1.length-1;
-        var i=0;
-        for(i=0;i<=length1;i++ )
-        {
-            document.getElementById('txtHint['+myarray1[i]+']').innerHTML=i;
-        }
-    
-}
+function stateChanged() {
+	if (xmlhttp.readyState == 4) {
+		myarray = xmlhttp.responseText;
+		myarray1 = myarray.split(",");
+		var length1 = myarray1.length - 1;
+		var i = 0;
+		for (i = 0; i <= length1; i++) {
+			document.getElementById('txtHint[' + myarray1[i] + ']').innerHTML = i;
+		}
+
+	}
 }
 
-function GetXmlHttpObject()
-{
-if (window.XMLHttpRequest)
-  {
-  // code for IE7+, Firefox, Chrome, Opera, Safari
-  return new XMLHttpRequest();
-  }
-if (window.ActiveXObject)
-  {
-  // code for IE6, IE5
-  return new ActiveXObject("Microsoft.XMLHTTP");
-  }
-return null;
+function GetXmlHttpObject() {
+	if (window.XMLHttpRequest) {
+		// code for IE7+, Firefox, Chrome, Opera, Safari
+		return new XMLHttpRequest();
+	}
+	if (window.ActiveXObject) {
+		// code for IE6, IE5
+		return new ActiveXObject("Microsoft.XMLHTTP");
+	}
+	return null;
 }
 
+// this function is useful to show or display the  HDFLVPlayer Options div when u click on - or + buttons
+function hideContentDives(divIdIs, id) {
 
- // this function is useful to show or display the  HDFLVPlayer Options div when u click on - or + buttons
-function hideContentDives(divIdIs , id)
-{
-   
-    var status = document.getElementById(divIdIs).style.display;
-  //  alert(status);
-    if(status == 'none')
-    {
-    	document.getElementById(divIdIs).style.display = 'block';
-    	divStyleDisplaySet(divIdIs ,0);
-    	document.getElementById(id).className = 'ui-icon ui-icon-minusthick';
-    }
-    else{
-    	document.getElementById(divIdIs).style.display = 'none';
-    	divStyleDisplaySet(divIdIs ,1 );
-    	document.getElementById(id).className  = 'ui-icon ui-icon-plusthick';
-        }
+	var status = document.getElementById(divIdIs).style.display;
+	//  alert(status);
+	if (status == 'none') {
+		document.getElementById(divIdIs).style.display = 'block';
+		divStyleDisplaySet(divIdIs, 0);
+		document.getElementById(id).className = 'ui-icon ui-icon-minusthick';
+	} else {
+		document.getElementById(divIdIs).style.display = 'none';
+		divStyleDisplaySet(divIdIs, 1);
+		document.getElementById(id).className = 'ui-icon ui-icon-plusthick';
+	}
 }
 
-function divStyleDisplaySet(IdValue , setValue)
-{
-var xmlhttp;
-var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
-if (IdValue.length==0)
-  { 
-  
-  return;
-  }
-if (window.XMLHttpRequest)
-  {// code for IE7+, Firefox, Chrome, Opera, Safari
-  xmlhttp=new XMLHttpRequest();
-  }
-else
-  {// code for IE6, IE5
-  xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
-  }
-xmlhttp.onreadystatechange=function()
-  {
-  if (xmlhttp.readyState==4 && xmlhttp.status==200)
-    {
-	//  alert(xmlhttp.responseText);
-    //document.getElementById("txtHint").innerHTML=xmlhttp.responseText;
-    }
-  }
-
-xmlhttp.open("GET", url+'?updatedisplay=1&IdValue='+IdValue+'&setValue='+setValue  ,true);
-xmlhttp.send();
+function divStyleDisplaySet(IdValue, setValue) {
+	var xmlhttp;
+	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
+	if (IdValue.length == 0) {
+
+		return;
+	}
+	if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari
+		xmlhttp = new XMLHttpRequest();
+	} else {// code for IE6, IE5
+		xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
+	}
+	xmlhttp.onreadystatechange = function() {
+		if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
+			//  alert(xmlhttp.responseText);
+			//document.getElementById("txtHint").innerHTML=xmlhttp.responseText;
+		}
+	}
+
+	xmlhttp.open("GET", url + '?updatedisplay=1&IdValue=' + IdValue
+			+ '&setValue=' + setValue, true);
+	xmlhttp.send();
 }
 
-function  setVideoStatusOff(videoId , status ,flag )  //click on status image then it exe
+function setVideoStatusOff(videoId, status, flag) //click on status image then it exe
 {
 	//if flag is set 1 then it is playlist status else video status
 
 	var xmlhttp;
-	var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
+	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
 	//var statusImgPath = document.getElementById('imagepath').value;
-	if (window.XMLHttpRequest)
-	  {// code for IE7+, Firefox, Chrome, Opera, Safari
-	  xmlhttp=new XMLHttpRequest();
-	  }
-	else
-	  {// code for IE6, IE5
-	  xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
-	  }
-	xmlhttp.onreadystatechange=function()
-	  {
-	  if (xmlhttp.readyState==4 && xmlhttp.status==200)
-	    {
-		 imgName  = (xmlhttp.responseText);
-				
-		  //alert(imgName);
-		 // alert(  document.getElementById('status'+videoId).innerHTML);
-		 
-	    document.getElementById('status'+videoId).innerHTML= imgName;
-	    }
-	  }
-	if(flag){
-	//	alert( url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status);
-		xmlhttp.open("GET", url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status  ,true);//for playlist status
-	}
-	else{
-		xmlhttp.open("GET", url+'?changeVideoStatus=1&videoId='+videoId+'&status='+status  ,true); //for video status
-	}	
-	
-	
+	if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari
+		xmlhttp = new XMLHttpRequest();
+	} else {// code for IE6, IE5
+		xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
+	}
+	xmlhttp.onreadystatechange = function() {
+		if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
+			imgName = (xmlhttp.responseText);
+
+			//alert(imgName);
+			// alert(  document.getElementById('status'+videoId).innerHTML);
+
+			document.getElementById('status' + videoId).innerHTML = imgName;
+		}
+	}
+	if (flag) {
+		//	alert( url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status);
+		xmlhttp.open("GET", url + '?changeplaylistStatus=1&videoId=' + videoId
+				+ '&status=' + status, true);//for playlist status
+	} else {
+		xmlhttp.open("GET", url + '?changeVideoStatus=1&videoId=' + videoId
+				+ '&status=' + status, true); //for video status
+	}
+
 	xmlhttp.send();
 } //status fun end hear
 
-
 /*   manage.php  script                                  */
 
-function savePlaylist(playlistName , mediaId){
-    var name = playlistName.value;
-    var pluginUrl =  document.getElementById('pluginUrl').value;
-    
-    $.ajax({
-        type: "GET",
-        url: pluginUrl+"/functions.php",
-        data: "name="+name+"&media="+mediaId,
-        success: function(msg){
-            var response = msg.split('##');
-          //  alert(msg);
-           document.getElementById('playlistchecklist').innerHTML = msg;
-        }
-    });
+function savePlaylist(playlistName, mediaId) {
+	var name = playlistName.value;
+	var pluginUrl = document.getElementById('pluginUrl').value;
+
+	$.ajax({
+		type : "GET",
+		url : pluginUrl + "/functions.php",
+		data : "name=" + name + "&media=" + mediaId,
+		success : function(msg) {
+			var response = msg.split('##');
+			//  alert(msg);
+			document.getElementById('playlistchecklist').innerHTML = msg;
+		}
+	});
 }
 
-function validateInput(){
+/**
+ * function to validate during adding video files
+ * 
+ */
+
+function validateInput() {
+	document.getElementById('message').style.display = '';
 	var YouTubeUrl = document.getElementById('filepath1').value;
-    var CustomUrl = document.getElementById('filepath2').value;
-   	var HdUrl = document.getElementById('filepath3').value;
-   	var ThumbUrl = document.getElementById('filepath4').value;
-   	var ThumbPreviewUrl = document.getElementById('filepath5').value;
-   	var tomatch = /http:\/\/[A-Za-z0-9\.-]{3,}\.[A-Za-z]{3}/
-   		if (!tomatch.test(CustomUrl)&&(CustomUrl!=''))
-  	     {
-  			 document.getElementById('message').innerHTML = 'Please enter valid URL';
-  	         return false;
-  	     }
-   		else if (!tomatch.test(HdUrl)&&(HdUrl!=''))
-	     {
-			 document.getElementById('message').innerHTML = 'Please enter valid Hd Url';
-	         return false;
-	     }
-   		
-   		else if (!tomatch.test(ThumbUrl)&&(ThumbUrl!=''))
-    	 {
-		 	document.getElementById('message').innerHTML = 'Please enter valid Thumb Image Url';
-         	return false;
-    	  }
-   		else if (!tomatch.test(ThumbPreviewUrl)&&(ThumbPreviewUrl!=''))
-    	 {
-		      document.getElementById('message').innerHTML = 'Please enter Preview Image  Url';
-              return false;
-    	 }
-		else if (!tomatch.test(YouTubeUrl)&&(YouTubeUrl!=''))
-           {
-		 			document.getElementById('message').innerHTML = 'Please enter valid You Tube Url';
-       			return false;
-           }
-    if(document.getElementById('btn2').checked == true && document.getElementById('filepath1').value == ''){
-        document.getElementById('message').innerHTML = 'Enter Youtube URL';
-        return false;
-    }
-    if(document.getElementById('btn1').checked == true && document.getElementById('f1-upload-form').style.display != 'none'){
-        document.getElementById('message').innerHTML = 'Upload Video';
-        return false;
-    }
-    if(document.getElementById('btn3').checked == true && document.getElementById('filepath2').value == ''){
-        document.getElementById('message').innerHTML = 'Enter Video URl';
-        return false;
-    }   
-    var titlename = document.getElementById('name').value;
-    titlename = titlename.trim();
-   if(titlename == ''){
-	   document.getElementById('Errormsgname').innerHTML = 'Please enter the title for video ';
-	   document.getElementById('name').focus();
-	   return false;      
-      }
+	var CustomUrl = document.getElementById('filepath2').value;
+	var HdUrl = document.getElementById('filepath3').value;
+	var ThumbUrl = document.getElementById('filepath4').value;
+	var ThumbPreviewUrl = document.getElementById('filepath5').value;
+	var tomatch = /http:\/\/[A-Za-z0-9\.-]{3,}\.[A-Za-z]{3}/;
+	if (!tomatch.test(CustomUrl) && (CustomUrl != '')) {
+		document.getElementById('message').innerHTML = 'Please enter valid URL';
+		return false;
+	} else if (!tomatch.test(HdUrl) && (HdUrl != '')) {
+		document.getElementById('message').innerHTML = 'Please enter valid Hd Url';
+		return false;
+	}
 
+	else if (!tomatch.test(ThumbUrl) && (ThumbUrl != '')) {
+		document.getElementById('message').innerHTML = 'Please enter valid Thumb Image Url';
+		return false;
+	} else if (!tomatch.test(ThumbPreviewUrl) && (ThumbPreviewUrl != '')) {
+		document.getElementById('message').innerHTML = 'Please enter Preview Image  Url';
+		return false;
+	} else if (!tomatch.test(YouTubeUrl) && (YouTubeUrl != '')) {
+		document.getElementById('message').innerHTML = 'Please enter valid You Tube Url';
+		return false;
+	}
+	if (document.getElementById('btn2').checked == true
+			&& document.getElementById('filepath1').value == '') {
+		document.getElementById('message').innerHTML = 'Enter Youtube URL';
+		return false;
+	}
+	if (document.getElementById('btn1').checked == true
+			&& document.getElementById('f1-upload-form').style.display != 'none') {
+		document.getElementById('message').innerHTML = 'Upload Video';
+		return false;
+	}
+	if (document.getElementById('btn3').checked == true
+			&& document.getElementById('filepath2').value == '') {
+		document.getElementById('message').innerHTML = 'Enter Video URl';
+		return false;
+	}
+	var titlename = document.getElementById('name').value;
+	titlename = titlename.trim();
+	if (titlename == '') {
+		document.getElementById('Errormsgname').innerHTML = 'Please enter the title for video ';
+		document.getElementById('name').focus();
+		return false;
+	}
 }
 
+/**
+ * function to validate during editing video files
+ * 
+ */
 
+function edtValidate() {
+	
+	var edtVideoTitle = document.getElementById('act_name').value;
+	var videoUrl = document.getElementById('act_filepath').value;
+	var hdUrl = document.getElementById('act_hdpath').value;
+	var thumbimgUrl = document.getElementById('act_image').value;
+	var previewimgUrl = document.getElementById('act_opimg').value;
+	var linkUrl = document.getElementById('act_link').value;
+	
+	var regexp = /^(((ht|f){1}((tp|tps):[/][/]){1}))[-a-zA-Z0-9@:%_\+.~#!?&//=]+$/;
+	
+	if (edtVideoTitle.trim() == '') {
+		document.getElementById('alert_title').innerHTML = 'Please Enter Video Title';
+		return false;
+	}else if (videoUrl.trim() == '') {
+		document.getElementById('alert_VUrl').innerHTML = 'Please Enter Video URL';
+		return false;
+	}else if(videoUrl != '' && regexp.test(videoUrl)== false){
+		document.getElementById('alert_VUrl').innerHTML = 'Please Enter Valid Video URL';
+		return false;
+	}else if(hdUrl != '' && regexp.test(hdUrl)== false){ 	 
+		document.getElementById('alert_HDURL').innerHTML = 'Please Enter Valid HD Url';
+		return false;
+	}else if (thumbimgUrl == '') {
+		document.getElementById('errmsg_thumbimg').style.display = '';
+		document.getElementById('errmsg_thumbimg').innerHTML = 'Please Enter Thumb Image/Url';
+		return false;
+	}else if (previewimgUrl == '') {
+		document.getElementById('errmsg_previewimg').style.display = '';
+		document.getElementById('errmsg_previewimg').innerHTML = 'Please Enter Preview Image/Url';
+		return false;
+	}else if(linkUrl != '' && regexp.test(linkUrl)== false) {
+		document.getElementById('alert_linkURL').innerHTML = 'Please Enter Valid Link Url';
+		return false;
+	}
+}
+
+/**
+ * function to validate during edit upload video files
+ * 
+ */
+
+function validateFileExt() {
+	var previewImg = document.getElementById('edit_preview').value;
+	var thumbImg = document.getElementById('edit_thumb').value;
+
+	if(thumbImg != ''){
+		var filext = thumbImg.substring(thumbImg.lastIndexOf(".")+1);					
+	}
+	
+	if(previewImg != ''){
+		var filext = previewImg.substring(previewImg.lastIndexOf(".")+1);
+	}
+	
+	filext = filext.toLowerCase();	
+	
+	if (filext == 'jpg' || filext == 'png' || filext == 'jpeg' || filext == 'gif'){
+		return true;
+	}else{
+		alert("Invalid File Format Selected");
+		document.getElementById('edit_preview').value = "";
+		document.getElementById('edit_thumb').value = "";
+		return false;
+	}
+}
diff --git a/manage.php b/manage.php
index 365c157..28dd391 100644
--- a/manage.php
+++ b/manage.php
@@ -1,14 +1,19 @@
 <?php
-/* 
- * Purpose : Common functions needed throughout the plugin
- * Path:/wp-content/plugins/contus-hd-flv-player/manage.php
- * Version: 1.7
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Date:9/12/11
- */
+/**
+ * @name          : Common functions needed throughout the plugin
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Common functions needed throughout the plugin
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 $contus = dirname(plugin_basename(__FILE__));
 $siteUrl = get_option('siteurl');
 define('SITEURL',$siteUrl);
 define('PLUGINNAME',$contus);
 $jsDirPaht = $siteUrl.'/wp-content/plugins/'.PLUGINNAME.'/js';
@@ -101,17 +106,17 @@ cursor: default;
         if (statuscode == 0)
             document.getElementById(form_handler+"-value").value = outfile;
         setStatus(form_handler,statuscode);
         uploadqueue.shift();
         processQueue();
-
     }
 
     function submitUploadForm(form_handle)
     {
+        var token = '<?php echo md5(DB_NAME);?>';
         document.forms[form_handle].target = "uploadvideo_target";
-        document.forms[form_handle].action = "../wp-content/plugins/contus-hd-flv-player/uploadVideo.php?processing=1";
+        document.forms[form_handle].action = "../wp-content/plugins/contus-hd-flv-player/uploadVideo.php?processing=1&token="+token;
         document.forms[form_handle].submit();
     }
     function setStatus(form_handle,status)
     {
         switch(form_handle)
@@ -763,76 +768,43 @@ class HDFLVManage {
                                 <br /><?php _e('Enter the URL to HD video file', 'hdflv') ?><?php if($act_hdpath != ''): ?><br /> <span id="alert_HDURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?></td>
                         </tr>
                         <tr valign="top">
                             <th scope="row"><?php _e('Thumbnail URL', 'hdflv') ?></th>
                             <td><input type="text" size="80"  name="act_image" value="<?php echo $act_image ?>" id="act_image"/>
-                                <br /><?php _e('Enter the URL to show a thumbnail of the video file or upload a image', 'hdflv') ?><?php if($act_image != ''): ?><br /><span id="alert_IMGURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?>
-                                <br />
+                                <br/><?php _e('Enter the URL to show a thumbnail of the video file or upload a image', 'hdflv') ?><?php if($act_image != ''): ?><br /><span id="alert_IMGURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?>
+                                <br/>
                                 <form name="edit_thumb_form" method="post" enctype="multipart/form-data">
-                                <input type="file" name="edit_thumb">
-                                <input type="submit" name="thumb-update" value="upload" class="button-secondary">
+                                <input type="file" name="edit_thumb" id="edit_thumb">
+                                <input type="submit" name="thumb-update" value="Upload" class="button-secondary" onclick ="return validateFileExt();">
                                 </form>
-                                </td>
+                                <br />
+                                <span id="errmsg_thumbimg" style="color:red;font-size:12px;font-weight:bold;display: none;"></span>
+                             </td>
                         </tr>
                         <tr valign="top">
                             <th scope="row"><?php _e('Preview Image URL', 'hdflv') ?></th>
                             <td><input type="text" size="80"  name="act_opimg" value="<?php echo $act_opimg ?>" id="act_opimg"/>
                                 <br /><?php _e('Enter the URL to show a preview of the video file or upload a image', 'hdflv') ?><?php if($act_opimg != ''): ?><br /> <span id="alert_prIMGURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?>
                                 <br />
-                                <form name="edit_preview_form" method="post" enctype="multipart/form-data">
-                                <input type="file" name="edit_preview">
-                                <input type="submit" name="preview-update" value="upload" class="button-secondary">
+                                <form name="edit_preview_form" method="post" enctype="multipart/form-data" onSubmit ="return validateFileExt();">
+                                <input type="file" name="edit_preview" id="edit_preview">
+                                <input type="submit" name="preview-update" value="Upload" class="button-secondary">
                                 </form>
-                                </td>
+                                <br />
+                                <span id="errmsg_previewimg" style="color:red;font-size:12px;font-weight:bold;display: none;"></span>
+                             </td>
                         </tr>
                         <tr valign="top">
                             <th scope="row"><?php _e('Link URL', 'hdflv') ?></th>
                             <td><input type="text" size="80" name="act_link" value="<?php echo $act_link ?>" id="act_link"/>
                                 <br /><?php _e('Enter the URL to the page/file, if you click on the player', 'hdflv') ?><?php if($act_link != ''): ?><br /> <span id="alert_linkURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?></td>
                         </tr>
                     </table>
                 </div>
                 <script type="text/javascript">
                 
-                function edtValidate(){
-                	var edtVideoTitle = document.getElementById('act_name').value;
-                	var videoUrl = document.getElementById('act_filepath').value;
-                	var hdUrl = document.getElementById('act_hdpath').value;
-                	var thumbimgUrl = document.getElementById('act_image').value;
-                	var previewimgUrl = document.getElementById('act_opimg').value;
-                	var linkUrl = document.getElementById('act_link').value;
-                    if(edtVideoTitle.trim() == '' ){
-                		document.getElementById('alert_title').innerHTML = 'Please Enter Video Title';
-                  	   return false;      
-                        }
-                	
-                   		if (videoUrl.trim() == '' )
-                  	     {
-                  			 document.getElementById('alert_VUrl').innerHTML = 'Please Enter Video URL';
-                  	         return false;
-                  	     }
-                   		else if (hdUrl.trim() == '' )
-                	     {
-                			// document.getElementById('alert_HDURL').innerHTML = 'Please Enter HD Url';
-                	        // return false;
-                	     }
-                   		
-                   		else if (thumbimgUrl.trim() == '' )
-                    	{
-                		 document.getElementById('alert_IMGURL').innerHTML = 'Please Enter Thumb Image Url';
-                         return false;
-                    	}
-                   		else if (previewimgUrl.trim() == '' )
-                    {
-                		 document.getElementById('alert_prIMGURL').innerHTML = 'Please Enter Preview Image  Url';
-                        return false;
-                    }	else if (linkUrl.trim() == '' )
-                    {
-               		 document.getElementById('alert_linkURL').innerHTML = 'Please Enter valid Link Url';
-                       return false;
-                   }
-                 }
+               
                          
                  </script>
                 <p>
                     <input type="submit" class="button-primary" name="edit_update" value="<?php _e('Update'); ?>" class="button button-highlighted" />
                     <input type="submit" class="button-secondary" name="edit_cancel" value="<?php _e('Cancel'); ?>" class="button" />
@@ -861,22 +833,24 @@ class HDFLVManage {
 ?>						               <div class="wrap">
                                         <script type="text/javascript">
 
                                             function t1(t2)
                                             {
-                                                if(t2.value == "y" )
-                                                {
-                                                    document.getElementById('upload2').style.display = "block"
+                                                if(t2.value == "y" ){
+                                                	document.getElementById('message').style.display = "none";
+                                                    document.getElementById('upload2').style.display = "block";
                                                     document.getElementById('youtube').style.display = "none";
                                                     document.getElementById('customurl').style.display = "none";
                                                 }
                                                 if(t2.value == "c" ){
+                                                	document.getElementById('message').style.display = "none";
                                                     document.getElementById('youtube').style.display = "block";
                                                     document.getElementById('upload2').style.display = "none";
                                                     document.getElementById('customurl').style.display = "none";
                                                 }
                                                 if(t2.value == "url" ){
+                                                	document.getElementById('message').style.display = "none";
                                                     document.getElementById('customurl').style.display = "block";
                                                     document.getElementById('youtube').style.display = "none";
                                                     document.getElementById('upload2').style.display = "none";
                                                 }
                                             }
@@ -1217,11 +1191,11 @@ if($isTable){ //yes already in DB so add fields only
                                                 echo "<tr>\n";
                                             }
                                             echo "<th style='padding-left: 2%;' scope=\"row\">$table->pid</th>\n";
                                             echo "<td><a onclick=\"submitplay($table->pid)\" href=\"#\" >" . stripslashes($table->playlist_name) . "</td>\n";
                                             echo "<td><a href=?page=hdflvplaylist&pid=$table->pid class=\"edit\">" . __('Edit') . "</a> |
-                                                      <a href=?page=hdflvplaylist&pname=$table->playlist_name&did=$table->pid class=\"delete\" onclick=\"javascript:check=confirm( '" . __("Delete this file ?", 'hdflv') . "');if(check==false) return false;\">" . __('Delete') . "</a></td>\n";
+                                                      <a href='?page=hdflvplaylist&pname=$table->playlist_name&did=$table->pid' class=\"delete\" onclick=\"javascript:check=confirm( '" . __("Delete this file ?", 'hdflv') . "');if(check==false) return false;\">" . __('Delete') . "</a></td>\n";
                                             echo "<td></td>";
 				                            if($table->is_pactive){
 				                            	
 				                            	 echo "<td  style = 'padding-left: 2%;' id='status$table->pid'><img  title='deactive' style='cursor:pointer;' onclick='setVideoStatusOff($table->pid,0,1)'  src=$pluginDirPath/hdflv_active.png /></td>\n";  
 				
diff --git a/myextractXML.php b/myextractXML.php
index c34058f..9e2dc35 100644
--- a/myextractXML.php
+++ b/myextractXML.php
@@ -1,15 +1,19 @@
 <?php
-/*
- * version : 1.7
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Purpose : Create playlist for player
- * Path:/wp-content/plugins/contus-hd-flv-player/myextractXML.php
- * Date:09/12/11
- *
- */
+/**
+ * @name          : Common functions needed throughout the plugin
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Common functions needed throughout the plugin
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 /* Used to import plugin configuration */
 require_once( dirname(__FILE__) . '/hdflv-config.php');
 
 // get the path url from querystring
 
@@ -63,11 +67,10 @@ if ($playlist_id != '' && $video_id != '') {//Condition if both playlist id  &&
 
  $settingsRecord = $autoPlay = $wpdb->get_col("SELECT autoplay , download FROM " . $wpdb->prefix . "hdflv_settings");
 ($autoPlay[0] == 1)? $ap = 'true' : $ap = 'false';
 
 // Create XML output of playlist
-//ob_start();ob_end_flush();ob_end_clean();
 
 header("content-type:text/xml;charset = utf-8"); //mime type
 echo '<?xml version = "1.0" encoding = "utf-8"?>';
 echo "<playlist autoplay = '$ap' random = 'false'>";
 $defaultVideoImg = get_option('siteurl') . '/wp-content/plugins/' . dirname(plugin_basename(__FILE__)) . '/images/hdflv.jpg';
diff --git a/process-sortable.php b/process-sortable.php
index 957a34c..600cac6 100644
--- a/process-sortable.php
+++ b/process-sortable.php
@@ -1,15 +1,19 @@
 <?php
-/*
- * version : 1.6
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Purpose : functions used to sort the playlist
- * Path:/wp-content/plugins/contus-hd-flv-player/process-sortable.php
- * Date:09/12/11
- *
- */
+/**
+ * @name          : Common functions needed throughout the plugin
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : Common functions needed throughout the plugin
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
+
 
 /* Used to import plugin configuration */
 require_once( dirname(__FILE__) . '/hdflv-config.php');
 
 global $wpdb;
diff --git a/readme.txt b/readme.txt
index 9aecffc..a2262c5 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,11 +1,11 @@
 === FLASH VIDEO PLAYER PLUGIN ===
 Contributors: Contus Support
 Tags: Video Player plugin, video, flash player, flv player, flash Video Player, flv player wordpress, hd flv player, youtube plugin, youtube Video Player, high definition Video Player, flash, play flv wordpress, player, Video Plugin, wp flv player, wp flv plugin, flv player 2009, Wp flash Video Player, wp flv, wordpress flv plugin, wp hd flv player, flv player plugin, wordpress flv player
 Requires at least: 2.8
 Tested up to: 2.8.6
-Stable tag: 1.7
+Stable tag: 1.8
 
 Get the most exciting FLV player in the internet, designed and modified to suit your Wordpress websites.  Installing this Video Plugin is real easy and if you have any difficulty in installation, contact our Video Player support team and quickly resolve your issue.  You can either download this Video Plugin directly from our website or through Wordpress plugins page itself.  This Flash Video Player has many advanced features that you cannot find elsewhere, such as that you can play youtube videos directly through this player, and it can also aptly be called as a youtube player.
 
 == Description ==
 
diff --git a/uploadVideo.php b/uploadVideo.php
index e98128a..66b1648 100644
--- a/uploadVideo.php
+++ b/uploadVideo.php
@@ -1,18 +1,28 @@
 <?php
-/* 
- * Purpose : functions used to upload video
- * Path:/wp-content/plugins/contus-hd-flv-player/upload1.php
- * Version: 1.7
- * Edited by : kranthi kumar
- * Email : kranthikumar@contus.in
- * Date:9/12/11
- *
- */
+/**
+ * @name          : functions used to upload video
+ * @version	  	  : 1.8
+ * @package       : apptha
+ * @subpackage    : contus-hd-flv-player
+ * @author        : Apptha - http://www.apptha.com
+ * @copyright     : Copyright (C) 2011 Powered by Apptha
+ * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
+ * @Purpose       : functions used to upload video
+ * @Creation Date : Dec 09, 2011
+ * @Modified Date : Jul 23, 2012
+ * */
 
 /*		This file is use to validate uploadvideos  in Add a new video file first tab upload file option	*/
+require_once('../../../wp-load.php');
 
+$dbtoken = md5(DB_NAME);
+$token = trim($_REQUEST["token"]);
+
+if($dbtoken != $token ){
+    die("You are not authorized to access this file");
+}
 require_once( dirname(__FILE__) . '/hdflv-config.php');
 			
 $errormsg = array();
 $file_name = '';
 $error = "";

Vulnerable code: /*
 *
 * Purpose : Player Configuration Settings
 * Path:/wp-content/plugins/contus-hd-flv-player/configXML.php
 * Edited by : kranthi kumar
 * Version: 1.7
 * Email : kranthikumar@contus.in
 * Date:9/12/11
 *
 */

ob_start();
/* Purpose : Common functions needed throughout the plugin
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Path:/wp-content/plugins/contus-hd-flv-player/function.php
 * Date:9/12/11
 */
    $act_name = trim($_POST['name']);
    //echo "<pre>"; print_r($_POST); echo "</pre>";
    //echo "<pre>"; print_r($_POST); echo "</pre>";
    $act_name = addslashes(trim($_POST['act_name']));
    $p_name = addslashes(trim($_POST['p_name']));
    $p_description = addslashes(trim($_POST['p_description']));
    $p_name = addslashes(trim($_POST['p_name']));
    		 
    $p_description = addslashes(trim($_POST['p_description']));
/*
 * version : 1.6
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Purpose : configuration of plugin
 * Path:/wp-content/plugins/contus-hd-flv-player/hdflv-config.php
 * Date:9/12/11
 *
 */
 .column { width: 500px; float: left; padding-bottom: 20px; }
        .portlet { margin: 0 1em 1em 0; }
        .portlet-header { margin: 0.3em; padding-bottom: 4px; padding-left: 10px;padding-top: 4px;font-size:12px; }
        .portlet-header .ui-icon { float: right; }
        .portlet-content { padding: 0.4em; font-size:12px;}
        .ui-sortable-placeholder { border: 1px dotted black; visibility: visible !important; height: 50px !important; }
        .ui-sortable-placeholder * { visibility: hidden; }
.ui-widget-content { border: 1px solid #aaaaaa/*{borderColorContent}*/; background: #ffffff/*{bgColorContent}*/ /*{bgImgUrlContent}*/ 50%/*{bgContentXPos}*/ 50%/*{bgContentYPos}*/ repeat-x/*{bgContentRepeat}*/; color: #222222/*{fcContent}*/; }
 * Version: 1.7
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * date:09/12/11
/* 
 * Purpose : Used for installing player plugin (Creating tables)
 * Edited By : kranthi kumar
 * Version: 1.7
 * Email : kranthikumar@contus.in
*/
function showUser(str,order)
{
xmlhttp=GetXmlHttpObject();
if (xmlhttp==null)
  {
  alert ("Browser does not support HTTP Request");
  return;
  }
var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
url=url+"?"+order;
url=url+"&playid="+str;
url=url+"&sid="+Math.random();
xmlhttp.onreadystatechange=stateChanged;
xmlhttp.open("GET",url,true);
xmlhttp.send(null);
function stateChanged()
{
if (xmlhttp.readyState==4)
{
     myarray = xmlhttp.responseText;
       myarray1 = myarray.split(",");
        var length1 = myarray1.length-1;
        var i=0;
        for(i=0;i<=length1;i++ )
        {
            document.getElementById('txtHint['+myarray1[i]+']').innerHTML=i;
        }
    
}
function GetXmlHttpObject()
{
if (window.XMLHttpRequest)
  {
  // code for IE7+, Firefox, Chrome, Opera, Safari
  return new XMLHttpRequest();
  }
if (window.ActiveXObject)
  {
  // code for IE6, IE5
  return new ActiveXObject("Microsoft.XMLHTTP");
  }
return null;
 // this function is useful to show or display the  HDFLVPlayer Options div when u click on - or + buttons
function hideContentDives(divIdIs , id)
{
   
    var status = document.getElementById(divIdIs).style.display;
  //  alert(status);
    if(status == 'none')
    {
    	document.getElementById(divIdIs).style.display = 'block';
    	divStyleDisplaySet(divIdIs ,0);
    	document.getElementById(id).className = 'ui-icon ui-icon-minusthick';
    }
    else{
    	document.getElementById(divIdIs).style.display = 'none';
    	divStyleDisplaySet(divIdIs ,1 );
    	document.getElementById(id).className  = 'ui-icon ui-icon-plusthick';
        }
function divStyleDisplaySet(IdValue , setValue)
{
var xmlhttp;
var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
if (IdValue.length==0)
  { 
  
  return;
  }
if (window.XMLHttpRequest)
  {// code for IE7+, Firefox, Chrome, Opera, Safari
  xmlhttp=new XMLHttpRequest();
  }
else
  {// code for IE6, IE5
  xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
  }
xmlhttp.onreadystatechange=function()
  {
  if (xmlhttp.readyState==4 && xmlhttp.status==200)
    {
	//  alert(xmlhttp.responseText);
    //document.getElementById("txtHint").innerHTML=xmlhttp.responseText;
    }
  }

xmlhttp.open("GET", url+'?updatedisplay=1&IdValue='+IdValue+'&setValue='+setValue  ,true);
xmlhttp.send();
function  setVideoStatusOff(videoId , status ,flag )  //click on status image then it exe
	var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
	if (window.XMLHttpRequest)
	  {// code for IE7+, Firefox, Chrome, Opera, Safari
	  xmlhttp=new XMLHttpRequest();
	  }
	else
	  {// code for IE6, IE5
	  xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
	  }
	xmlhttp.onreadystatechange=function()
	  {
	  if (xmlhttp.readyState==4 && xmlhttp.status==200)
	    {
		 imgName  = (xmlhttp.responseText);
				
		  //alert(imgName);
		 // alert(  document.getElementById('status'+videoId).innerHTML);
		 
	    document.getElementById('status'+videoId).innerHTML= imgName;
	    }
	  }
	if(flag){
	//	alert( url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status);
		xmlhttp.open("GET", url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status  ,true);//for playlist status
	}
	else{
		xmlhttp.open("GET", url+'?changeVideoStatus=1&videoId='+videoId+'&status='+status  ,true); //for video status
	}	
	
	

function savePlaylist(playlistName , mediaId){
    var name = playlistName.value;
    var pluginUrl =  document.getElementById('pluginUrl').value;
    
    $.ajax({
        type: "GET",
        url: pluginUrl+"/functions.php",
        data: "name="+name+"&media="+mediaId,
        success: function(msg){
            var response = msg.split('##');
          //  alert(msg);
           document.getElementById('playlistchecklist').innerHTML = msg;
        }
    });
function validateInput(){
    var CustomUrl = document.getElementById('filepath2').value;
   	var HdUrl = document.getElementById('filepath3').value;
   	var ThumbUrl = document.getElementById('filepath4').value;
   	var ThumbPreviewUrl = document.getElementById('filepath5').value;
   	var tomatch = /http:\/\/[A-Za-z0-9\.-]{3,}\.[A-Za-z]{3}/
   		if (!tomatch.test(CustomUrl)&&(CustomUrl!=''))
  	     {
  			 document.getElementById('message').innerHTML = 'Please enter valid URL';
  	         return false;
  	     }
   		else if (!tomatch.test(HdUrl)&&(HdUrl!=''))
	     {
			 document.getElementById('message').innerHTML = 'Please enter valid Hd Url';
	         return false;
	     }
   		
   		else if (!tomatch.test(ThumbUrl)&&(ThumbUrl!=''))
    	 {
		 	document.getElementById('message').innerHTML = 'Please enter valid Thumb Image Url';
         	return false;
    	  }
   		else if (!tomatch.test(ThumbPreviewUrl)&&(ThumbPreviewUrl!=''))
    	 {
		      document.getElementById('message').innerHTML = 'Please enter Preview Image  Url';
              return false;
    	 }
		else if (!tomatch.test(YouTubeUrl)&&(YouTubeUrl!=''))
           {
		 			document.getElementById('message').innerHTML = 'Please enter valid You Tube Url';
       			return false;
           }
    if(document.getElementById('btn2').checked == true && document.getElementById('filepath1').value == ''){
        document.getElementById('message').innerHTML = 'Enter Youtube URL';
        return false;
    }
    if(document.getElementById('btn1').checked == true && document.getElementById('f1-upload-form').style.display != 'none'){
        document.getElementById('message').innerHTML = 'Upload Video';
        return false;
    }
    if(document.getElementById('btn3').checked == true && document.getElementById('filepath2').value == ''){
        document.getElementById('message').innerHTML = 'Enter Video URl';
        return false;
    }   
    var titlename = document.getElementById('name').value;
    titlename = titlename.trim();
   if(titlename == ''){
	   document.getElementById('Errormsgname').innerHTML = 'Please enter the title for video ';
	   document.getElementById('name').focus();
	   return false;      
      }
/* 
 * Purpose : Common functions needed throughout the plugin
 * Path:/wp-content/plugins/contus-hd-flv-player/manage.php
 * Version: 1.7
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Date:9/12/11
 */

        document.forms[form_handle].action = "../wp-content/plugins/contus-hd-flv-player/uploadVideo.php?processing=1";
                                <br /><?php _e('Enter the URL to show a thumbnail of the video file or upload a image', 'hdflv') ?><?php if($act_image != ''): ?><br /><span id="alert_IMGURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?>
                                <br />
                                <input type="file" name="edit_thumb">
                                <input type="submit" name="thumb-update" value="upload" class="button-secondary">
                                </td>
                                <form name="edit_preview_form" method="post" enctype="multipart/form-data">
                                <input type="file" name="edit_preview">
                                <input type="submit" name="preview-update" value="upload" class="button-secondary">
                                </td>
                function edtValidate(){
                	var edtVideoTitle = document.getElementById('act_name').value;
                	var videoUrl = document.getElementById('act_filepath').value;
                	var hdUrl = document.getElementById('act_hdpath').value;
                	var thumbimgUrl = document.getElementById('act_image').value;
                	var previewimgUrl = document.getElementById('act_opimg').value;
                	var linkUrl = document.getElementById('act_link').value;
                    if(edtVideoTitle.trim() == '' ){
                		document.getElementById('alert_title').innerHTML = 'Please Enter Video Title';
                  	   return false;      
                        }
                	
                   		if (videoUrl.trim() == '' )
                  	     {
                  			 document.getElementById('alert_VUrl').innerHTML = 'Please Enter Video URL';
                  	         return false;
                  	     }
                   		else if (hdUrl.trim() == '' )
                	     {
                			// document.getElementById('alert_HDURL').innerHTML = 'Please Enter HD Url';
                	        // return false;
                	     }
                   		
                   		else if (thumbimgUrl.trim() == '' )
                    	{
                		 document.getElementById('alert_IMGURL').innerHTML = 'Please Enter Thumb Image Url';
                         return false;
                    	}
                   		else if (previewimgUrl.trim() == '' )
                    {
                		 document.getElementById('alert_prIMGURL').innerHTML = 'Please Enter Preview Image  Url';
                        return false;
                    }	else if (linkUrl.trim() == '' )
                    {
               		 document.getElementById('alert_linkURL').innerHTML = 'Please Enter valid Link Url';
                       return false;
                   }
                 }
                                                if(t2.value == "y" )
                                                {
                                                    document.getElementById('upload2').style.display = "block"
                                                      <a href=?page=hdflvplaylist&pname=$table->playlist_name&did=$table->pid class=\"delete\" onclick=\"javascript:check=confirm( '" . __("Delete this file ?", 'hdflv') . "');if(check==false) return false;\">" . __('Delete') . "</a></td>\n";
/*
 * version : 1.7
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Purpose : Create playlist for player
 * Path:/wp-content/plugins/contus-hd-flv-player/myextractXML.php
 * Date:09/12/11
 *
 */
//ob_start();ob_end_flush();ob_end_clean();
/*
 * version : 1.6
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Purpose : functions used to sort the playlist
 * Path:/wp-content/plugins/contus-hd-flv-player/process-sortable.php
 * Date:09/12/11
 *
 */
Stable tag: 1.7
/* 
 * Purpose : functions used to upload video
 * Path:/wp-content/plugins/contus-hd-flv-player/upload1.php
 * Version: 1.7
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Date:9/12/11
 *
 */
Fixed code: /**
 * @name          : Player Configuration Settings
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Player Configuration Settings
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */
/**
 * @name          : Common functions needed throughout the plugin
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Common functions needed throughout the plugin
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

ob_start(); 

    $act_name = strip_tags(trim($_POST['name']));
    $act_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $act_name);
    $uploadStatus = '';
                    $uploadStatus = true;
                }else{
                $uploadStatus = false;
                render_error(__('Invalid File Format Uploaded', 'hdflv'));
    if($uploadStatus == '1'){
    }
    $uploadStatus = '';
                    $uploadStatus = true;
                }else{
                $uploadStatus = false;
                render_error(__('Invalid File Format Uploaded', 'hdflv'));
   if($uploadStatus == '1'){
   }
    $act_name = strip_tags(trim($_POST['act_name']));    
    $act_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $act_name);    
    $p_name = strip_tags(trim($_POST['p_name']));
    $p_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $p_name);
    $p_description = strip_tags(trim($_POST['p_description']));
    $p_name = strip_tags(trim($_POST['p_name']));
    $p_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $p_name);		 
    $p_description = strip_tags(trim($_POST['p_description']));
/**
 * @name          : configuration of plugin
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : configuration of plugin
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

.ui-widget-content { border: 1px solid #aaaaaa/*{borderColorContent}*/; background: #ffffff/*{bgColorContent}*/ url(images/ui-bg_flat_75_ffffff_40x100.png)/*{bgImgUrlContent}*/ 50%/*{bgContentXPos}*/ 50%/*{bgContentYPos}*/ repeat-x/*{bgContentRepeat}*/; color: #222222/*{fcContent}*/; }
<?xml version="1.0" encoding="utf-8"?>
<config 
license="Key provided for commercial version"
stagecolor="0x000000" 
autoplay="true" 
buffer="3"
Volume="false" 
fullscreenscale="0" 
normalscale="0" 
logopath="hdflvplayer/images/platoon.png"
logoalpha="50" 
logoalign="TR" 
Download="false"
logo_target="http://www.hdflvplayer.net/"
skin="hdflvplayer/skin/skin_black/skin_black.swf"
skin_autohide="false"
language = "English"
playlistXML="hdflvplayer/xml/playlist.xml"
playlist_open="false" 
showPlaylist ="true"
HD_default="false" 
vast="false"
vast_partnerid=""
streamer=""
embed_visible="true"
UseYouTubeApi="flash"
debug="true">
<timer>true</timer>
<zoom>true</zoom>
<email>true</email>
<fullscreen>true</fullscreen>
</config>
﻿<?xml version="1.0" encoding="utf-8"?>
<playlist autoplay="false" random="false">

  <mainvideo url="http://www.hdflvplayer.net/videos/300.mp4" 
             hdpath="http://www.hdflvplayer.net/videos/300.mp4"
             id="100"
             thu_image=""                                                                                
             Preview="" 
             preroll="true" 
             midroll="true" 
             postroll="true" 
             allow_download="true"
             streamer=""
             isLive="false" > 
             <title><![CDATA[Welcome]]></title> 
             <!--Optional--> 
             <tagline targeturl="https://mydomain.com"><![CDATA[<span class='heading'>Tagline - </span> <b>Your short description  goes here for Videos.</b> ]]></tagline>        
  </mainvideo>




</playlist>

 * Version: 1.8
 * Creation Date : Dec 09, 2011
 * Modified Date : Jul 23, 2012
/**
 * @name          : Used for installing player plugin (Creating tables)
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Used for installing player plugin (Creating tables)
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

/**
 * @name          : Script for Hd Flv Player
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : For Validation and Sortable Process
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

function showUser(str, order) {
	xmlhttp = GetXmlHttpObject();
	if (xmlhttp == null) {
		alert("Browser does not support HTTP Request");
		return;
	}
	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
	url = url + "?" + order;
	url = url + "&playid=" + str;
	url = url + "&sid=" + Math.random();
	xmlhttp.onreadystatechange = stateChanged;
	xmlhttp.open("GET", url, true);
	xmlhttp.send(null);
function stateChanged() {
	if (xmlhttp.readyState == 4) {
		myarray = xmlhttp.responseText;
		myarray1 = myarray.split(",");
		var length1 = myarray1.length - 1;
		var i = 0;
		for (i = 0; i <= length1; i++) {
			document.getElementById('txtHint[' + myarray1[i] + ']').innerHTML = i;
		}

	}
function GetXmlHttpObject() {
	if (window.XMLHttpRequest) {
		// code for IE7+, Firefox, Chrome, Opera, Safari
		return new XMLHttpRequest();
	}
	if (window.ActiveXObject) {
		// code for IE6, IE5
		return new ActiveXObject("Microsoft.XMLHTTP");
	}
	return null;
// this function is useful to show or display the  HDFLVPlayer Options div when u click on - or + buttons
function hideContentDives(divIdIs, id) {
	var status = document.getElementById(divIdIs).style.display;
	//  alert(status);
	if (status == 'none') {
		document.getElementById(divIdIs).style.display = 'block';
		divStyleDisplaySet(divIdIs, 0);
		document.getElementById(id).className = 'ui-icon ui-icon-minusthick';
	} else {
		document.getElementById(divIdIs).style.display = 'none';
		divStyleDisplaySet(divIdIs, 1);
		document.getElementById(id).className = 'ui-icon ui-icon-plusthick';
	}
function divStyleDisplaySet(IdValue, setValue) {
	var xmlhttp;
	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
	if (IdValue.length == 0) {

		return;
	}
	if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari
		xmlhttp = new XMLHttpRequest();
	} else {// code for IE6, IE5
		xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
	}
	xmlhttp.onreadystatechange = function() {
		if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
			//  alert(xmlhttp.responseText);
			//document.getElementById("txtHint").innerHTML=xmlhttp.responseText;
		}
	}

	xmlhttp.open("GET", url + '?updatedisplay=1&IdValue=' + IdValue
			+ '&setValue=' + setValue, true);
	xmlhttp.send();
function setVideoStatusOff(videoId, status, flag) //click on status image then it exe
	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
	if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari
		xmlhttp = new XMLHttpRequest();
	} else {// code for IE6, IE5
		xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
	}
	xmlhttp.onreadystatechange = function() {
		if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
			imgName = (xmlhttp.responseText);

			//alert(imgName);
			// alert(  document.getElementById('status'+videoId).innerHTML);

			document.getElementById('status' + videoId).innerHTML = imgName;
		}
	}
	if (flag) {
		//	alert( url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status);
		xmlhttp.open("GET", url + '?changeplaylistStatus=1&videoId=' + videoId
				+ '&status=' + status, true);//for playlist status
	} else {
		xmlhttp.open("GET", url + '?changeVideoStatus=1&videoId=' + videoId
				+ '&status=' + status, true); //for video status
	}

function savePlaylist(playlistName, mediaId) {
	var name = playlistName.value;
	var pluginUrl = document.getElementById('pluginUrl').value;

	$.ajax({
		type : "GET",
		url : pluginUrl + "/functions.php",
		data : "name=" + name + "&media=" + mediaId,
		success : function(msg) {
			var response = msg.split('##');
			//  alert(msg);
			document.getElementById('playlistchecklist').innerHTML = msg;
		}
	});
/**
 * function to validate during adding video files
 * 
 */

function validateInput() {
	document.getElementById('message').style.display = '';
	var CustomUrl = document.getElementById('filepath2').value;
	var HdUrl = document.getElementById('filepath3').value;
	var ThumbUrl = document.getElementById('filepath4').value;
	var ThumbPreviewUrl = document.getElementById('filepath5').value;
	var tomatch = /http:\/\/[A-Za-z0-9\.-]{3,}\.[A-Za-z]{3}/;
	if (!tomatch.test(CustomUrl) && (CustomUrl != '')) {
		document.getElementById('message').innerHTML = 'Please enter valid URL';
		return false;
	} else if (!tomatch.test(HdUrl) && (HdUrl != '')) {
		document.getElementById('message').innerHTML = 'Please enter valid Hd Url';
		return false;
	}
	else if (!tomatch.test(ThumbUrl) && (ThumbUrl != '')) {
		document.getElementById('message').innerHTML = 'Please enter valid Thumb Image Url';
		return false;
	} else if (!tomatch.test(ThumbPreviewUrl) && (ThumbPreviewUrl != '')) {
		document.getElementById('message').innerHTML = 'Please enter Preview Image  Url';
		return false;
	} else if (!tomatch.test(YouTubeUrl) && (YouTubeUrl != '')) {
		document.getElementById('message').innerHTML = 'Please enter valid You Tube Url';
		return false;
	}
	if (document.getElementById('btn2').checked == true
			&& document.getElementById('filepath1').value == '') {
		document.getElementById('message').innerHTML = 'Enter Youtube URL';
		return false;
	}
	if (document.getElementById('btn1').checked == true
			&& document.getElementById('f1-upload-form').style.display != 'none') {
		document.getElementById('message').innerHTML = 'Upload Video';
		return false;
	}
	if (document.getElementById('btn3').checked == true
			&& document.getElementById('filepath2').value == '') {
		document.getElementById('message').innerHTML = 'Enter Video URl';
		return false;
	}
	var titlename = document.getElementById('name').value;
	titlename = titlename.trim();
	if (titlename == '') {
		document.getElementById('Errormsgname').innerHTML = 'Please enter the title for video ';
		document.getElementById('name').focus();
		return false;
	}
/**
 * function to validate during editing video files
 * 
 */
function edtValidate() {
	
	var edtVideoTitle = document.getElementById('act_name').value;
	var videoUrl = document.getElementById('act_filepath').value;
	var hdUrl = document.getElementById('act_hdpath').value;
	var thumbimgUrl = document.getElementById('act_image').value;
	var previewimgUrl = document.getElementById('act_opimg').value;
	var linkUrl = document.getElementById('act_link').value;
	
	var regexp = /^(((ht|f){1}((tp|tps):[/][/]){1}))[-a-zA-Z0-9@:%_\+.~#!?&//=]+$/;
	
	if (edtVideoTitle.trim() == '') {
		document.getElementById('alert_title').innerHTML = 'Please Enter Video Title';
		return false;
	}else if (videoUrl.trim() == '') {
		document.getElementById('alert_VUrl').innerHTML = 'Please Enter Video URL';
		return false;
	}else if(videoUrl != '' && regexp.test(videoUrl)== false){
		document.getElementById('alert_VUrl').innerHTML = 'Please Enter Valid Video URL';
		return false;
	}else if(hdUrl != '' && regexp.test(hdUrl)== false){ 	 
		document.getElementById('alert_HDURL').innerHTML = 'Please Enter Valid HD Url';
		return false;
	}else if (thumbimgUrl == '') {
		document.getElementById('errmsg_thumbimg').style.display = '';
		document.getElementById('errmsg_thumbimg').innerHTML = 'Please Enter Thumb Image/Url';
		return false;
	}else if (previewimgUrl == '') {
		document.getElementById('errmsg_previewimg').style.display = '';
		document.getElementById('errmsg_previewimg').innerHTML = 'Please Enter Preview Image/Url';
		return false;
	}else if(linkUrl != '' && regexp.test(linkUrl)== false) {
		document.getElementById('alert_linkURL').innerHTML = 'Please Enter Valid Link Url';
		return false;
	}
}

/**
 * function to validate during edit upload video files
 * 
 */

function validateFileExt() {
	var previewImg = document.getElementById('edit_preview').value;
	var thumbImg = document.getElementById('edit_thumb').value;

	if(thumbImg != ''){
		var filext = thumbImg.substring(thumbImg.lastIndexOf(".")+1);					
	}
	
	if(previewImg != ''){
		var filext = previewImg.substring(previewImg.lastIndexOf(".")+1);
	}
	
	filext = filext.toLowerCase();	
	
	if (filext == 'jpg' || filext == 'png' || filext == 'jpeg' || filext == 'gif'){
		return true;
	}else{
		alert("Invalid File Format Selected");
		document.getElementById('edit_preview').value = "";
		document.getElementById('edit_thumb').value = "";
		return false;
	}
}
/**
 * @name          : Common functions needed throughout the plugin
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Common functions needed throughout the plugin
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

        var token = '<?php echo md5(DB_NAME);?>';
        document.forms[form_handle].action = "../wp-content/plugins/contus-hd-flv-player/uploadVideo.php?processing=1&token="+token;
                                <br/><?php _e('Enter the URL to show a thumbnail of the video file or upload a image', 'hdflv') ?><?php if($act_image != ''): ?><br /><span id="alert_IMGURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?>
                                <br/>
                                <input type="file" name="edit_thumb" id="edit_thumb">
                                <input type="submit" name="thumb-update" value="Upload" class="button-secondary" onclick ="return validateFileExt();">
                                <br />
                                <span id="errmsg_thumbimg" style="color:red;font-size:12px;font-weight:bold;display: none;"></span>
                             </td>
                                <form name="edit_preview_form" method="post" enctype="multipart/form-data" onSubmit ="return validateFileExt();">
                                <input type="file" name="edit_preview" id="edit_preview">
                                <input type="submit" name="preview-update" value="Upload" class="button-secondary">
                                <br />
                                <span id="errmsg_previewimg" style="color:red;font-size:12px;font-weight:bold;display: none;"></span>
                             </td>
               
                                                if(t2.value == "y" ){
                                                	document.getElementById('message').style.display = "none";
                                                    document.getElementById('upload2').style.display = "block";
                                                	document.getElementById('message').style.display = "none";
                                                	document.getElementById('message').style.display = "none";
                                                      <a href='?page=hdflvplaylist&pname=$table->playlist_name&did=$table->pid' class=\"delete\" onclick=\"javascript:check=confirm( '" . __("Delete this file ?", 'hdflv') . "');if(check==false) return false;\">" . __('Delete') . "</a></td>\n";
/**
 * @name          : Common functions needed throughout the plugin
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Common functions needed throughout the plugin
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

/**
 * @name          : Common functions needed throughout the plugin
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Common functions needed throughout the plugin
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

Stable tag: 1.8
/**
 * @name          : functions used to upload video
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : functions used to upload video
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */
require_once('../../../wp-load.php');
$dbtoken = md5(DB_NAME);
$token = trim($_REQUEST["token"]);

if($dbtoken != $token ){
    die("You are not authorized to access this file");
}