CVE-2012-10011 (PHP, published 2023-04-09T22:15Z)
Description: value: A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the function hd_add_media/hd_update_media of the file functions.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely. Upgrading to version 1.8 is able to address this issue. The patch is identified as 34d66b9f3231a0e2dc0e536a6fe615d736e863f7. It is recommended to upgrade the affected component. VDB-225350 is the identifier assigned to this vulnerability.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/wp-plugins/contus-hd-flv-player
Files changed:
configXML.php
functions.php
hdflv-config.php
hdflvplayer/css/jquery.ui.all.css
hdflvplayer/css/jquery.ui.theme.css
hdflvplayer/xml-nouse/config.xml
hdflvplayer/xml-nouse/playlist.xml
hdflvplayer/youtubeurl.php
hdflvplugin.php
install.php
js/hdflvscript.js
manage.php
myextractXML.php
process-sortable.php
readme.txt
uploadVideo.php
Commit message: vulnerabilities issues fixed in trunk folder

git-svn-id: https://plugins.svn.wordpress.org/contus-hd-flv-player/trunk@576511 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
/*
 *
 * Purpose : Player Configuration Settings
 * Path:/wp-content/plugins/contus-hd-flv-player/configXML.php
 * Edited by : kranthi kumar
 * Version: 1.7
 * Email : kranthikumar@contus.in
 * Date:9/12/11
 *
 */

ob_start();
/* Purpose : Common functions needed throughout the plugin
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Path:/wp-content/plugins/contus-hd-flv-player/function.php
 * Date:9/12/11
 */
    $act_name = trim($_POST['name']);
    //echo "<pre>"; print_r($_POST); echo "</pre>";
    //echo "<pre>"; print_r($_POST); echo "</pre>";
    $act_name = addslashes(trim($_POST['act_name']));
    $p_name = addslashes(trim($_POST['p_name']));
    $p_description = addslashes(trim($_POST['p_description']));
    $p_name = addslashes(trim($_POST['p_name']));
    		 
    $p_description = addslashes(trim($_POST['p_description']));
/*
 * version : 1.6
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Purpose : configuration of plugin
 * Path:/wp-content/plugins/contus-hd-flv-player/hdflv-config.php
 * Date:9/12/11
 *
 */
 .column { width: 500px; float: left; padding-bottom: 20px; }
        .portlet { margin: 0 1em 1em 0; }
        .portlet-header { margin: 0.3em; padding-bottom: 4px; padding-left: 10px;padding-top: 4px;font-size:12px; }
        .portlet-header .ui-icon { float: right; }
        .portlet-content { padding: 0.4em; font-size:12px;}
        .ui-sortable-placeholder { border: 1px dotted black; visibility: visible !important; height: 50px !important; }
        .ui-sortable-placeholder * { visibility: hidden; }
.ui-widget-content { border: 1px solid #aaaaaa/*{borderColorContent}*/; background: #ffffff/*{bgColorContent}*/ /*{bgImgUrlContent}*/ 50%/*{bgContentXPos}*/ 50%/*{bgContentYPos}*/ repeat-x/*{bgContentRepeat}*/; color: #222222/*{fcContent}*/; }
 * Version: 1.7
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * date:09/12/11
/* 
 * Purpose : Used for installing player plugin (Creating tables)
 * Edited By : kranthi kumar
 * Version: 1.7
 * Email : kranthikumar@contus.in
*/
function showUser(str,order)
{
xmlhttp=GetXmlHttpObject();
if (xmlhttp==null)
  {
  alert ("Browser does not support HTTP Request");
  return;
  }
var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
url=url+"?"+order;
url=url+"&playid="+str;
url=url+"&sid="+Math.random();
xmlhttp.onreadystatechange=stateChanged;
xmlhttp.open("GET",url,true);
xmlhttp.send(null);
function stateChanged()
{
if (xmlhttp.readyState==4)
{
     myarray = xmlhttp.responseText;
       myarray1 = myarray.split(",");
        var length1 = myarray1.length-1;
        var i=0;
        for(i=0;i<=length1;i++ )
        {
            document.getElementById('txtHint['+myarray1[i]+']').innerHTML=i;
        }
    
}
function GetXmlHttpObject()
{
if (window.XMLHttpRequest)
  {
  // code for IE7+, Firefox, Chrome, Opera, Safari
  return new XMLHttpRequest();
  }
if (window.ActiveXObject)
  {
  // code for IE6, IE5
  return new ActiveXObject("Microsoft.XMLHTTP");
  }
return null;
 // this function is useful to show or display the  HDFLVPlayer Options div when u click on - or + buttons
function hideContentDives(divIdIs , id)
{
   
    var status = document.getElementById(divIdIs).style.display;
  //  alert(status);
    if(status == 'none')
    {
    	document.getElementById(divIdIs).style.display = 'block';
    	divStyleDisplaySet(divIdIs ,0);
    	document.getElementById(id).className = 'ui-icon ui-icon-minusthick';
    }
    else{
    	document.getElementById(divIdIs).style.display = 'none';
    	divStyleDisplaySet(divIdIs ,1 );
    	document.getElementById(id).className  = 'ui-icon ui-icon-plusthick';
        }
function divStyleDisplaySet(IdValue , setValue)
{
var xmlhttp;
var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
if (IdValue.length==0)
  { 
  
  return;
  }
if (window.XMLHttpRequest)
  {// code for IE7+, Firefox, Chrome, Opera, Safari
  xmlhttp=new XMLHttpRequest();
  }
else
  {// code for IE6, IE5
  xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
  }
xmlhttp.onreadystatechange=function()
  {
  if (xmlhttp.readyState==4 && xmlhttp.status==200)
    {
	//  alert(xmlhttp.responseText);
    //document.getElementById("txtHint").innerHTML=xmlhttp.responseText;
    }
  }

xmlhttp.open("GET", url+'?updatedisplay=1&IdValue='+IdValue+'&setValue='+setValue  ,true);
xmlhttp.send();
function  setVideoStatusOff(videoId , status ,flag )  //click on status image then it exe
	var url="../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
	if (window.XMLHttpRequest)
	  {// code for IE7+, Firefox, Chrome, Opera, Safari
	  xmlhttp=new XMLHttpRequest();
	  }
	else
	  {// code for IE6, IE5
	  xmlhttp=new ActiveXObject("Microsoft.XMLHTTP");
	  }
	xmlhttp.onreadystatechange=function()
	  {
	  if (xmlhttp.readyState==4 && xmlhttp.status==200)
	    {
		 imgName  = (xmlhttp.responseText);
				
		  //alert(imgName);
		 // alert(  document.getElementById('status'+videoId).innerHTML);
		 
	    document.getElementById('status'+videoId).innerHTML= imgName;
	    }
	  }
	if(flag){
	//	alert( url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status);
		xmlhttp.open("GET", url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status  ,true);//for playlist status
	}
	else{
		xmlhttp.open("GET", url+'?changeVideoStatus=1&videoId='+videoId+'&status='+status  ,true); //for video status
	}	
	
	

function savePlaylist(playlistName , mediaId){
    var name = playlistName.value;
    var pluginUrl =  document.getElementById('pluginUrl').value;
    
    $.ajax({
        type: "GET",
        url: pluginUrl+"/functions.php",
        data: "name="+name+"&media="+mediaId,
        success: function(msg){
            var response = msg.split('##');
          //  alert(msg);
           document.getElementById('playlistchecklist').innerHTML = msg;
        }
    });
function validateInput(){
    var CustomUrl = document.getElementById('filepath2').value;
   	var HdUrl = document.getElementById('filepath3').value;
   	var ThumbUrl = document.getElementById('filepath4').value;
   	var ThumbPreviewUrl = document.getElementById('filepath5').value;
   	var tomatch = /http:\/\/[A-Za-z0-9\.-]{3,}\.[A-Za-z]{3}/
   		if (!tomatch.test(CustomUrl)&&(CustomUrl!=''))
  	     {
  			 document.getElementById('message').innerHTML = 'Please enter valid URL';
  	         return false;
  	     }
   		else if (!tomatch.test(HdUrl)&&(HdUrl!=''))
	     {
			 document.getElementById('message').innerHTML = 'Please enter valid Hd Url';
	         return false;
	     }
   		
   		else if (!tomatch.test(ThumbUrl)&&(ThumbUrl!=''))
    	 {
		 	document.getElementById('message').innerHTML = 'Please enter valid Thumb Image Url';
         	return false;
    	  }
   		else if (!tomatch.test(ThumbPreviewUrl)&&(ThumbPreviewUrl!=''))
    	 {
		      document.getElementById('message').innerHTML = 'Please enter Preview Image  Url';
              return false;
    	 }
		else if (!tomatch.test(YouTubeUrl)&&(YouTubeUrl!=''))
           {
		 			document.getElementById('message').innerHTML = 'Please enter valid You Tube Url';
       			return false;
           }
    if(document.getElementById('btn2').checked == true && document.getElementById('filepath1').value == ''){
        document.getElementById('message').innerHTML = 'Enter Youtube URL';
        return false;
    }
    if(document.getElementById('btn1').checked == true && document.getElementById('f1-upload-form').style.display != 'none'){
        document.getElementById('message').innerHTML = 'Upload Video';
        return false;
    }
    if(document.getElementById('btn3').checked == true && document.getElementById('filepath2').value == ''){
        document.getElementById('message').innerHTML = 'Enter Video URl';
        return false;
    }   
    var titlename = document.getElementById('name').value;
    titlename = titlename.trim();
   if(titlename == ''){
	   document.getElementById('Errormsgname').innerHTML = 'Please enter the title for video ';
	   document.getElementById('name').focus();
	   return false;      
      }
/* 
 * Purpose : Common functions needed throughout the plugin
 * Path:/wp-content/plugins/contus-hd-flv-player/manage.php
 * Version: 1.7
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Date:9/12/11
 */

        document.forms[form_handle].action = "../wp-content/plugins/contus-hd-flv-player/uploadVideo.php?processing=1";
                                <br /><?php _e('Enter the URL to show a thumbnail of the video file or upload a image', 'hdflv') ?><?php if($act_image != ''): ?><br /><span id="alert_IMGURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?>
                                <br />
                                <input type="file" name="edit_thumb">
                                <input type="submit" name="thumb-update" value="upload" class="button-secondary">
                                </td>
                                <form name="edit_preview_form" method="post" enctype="multipart/form-data">
                                <input type="file" name="edit_preview">
                                <input type="submit" name="preview-update" value="upload" class="button-secondary">
                                </td>
                function edtValidate(){
                	var edtVideoTitle = document.getElementById('act_name').value;
                	var videoUrl = document.getElementById('act_filepath').value;
                	var hdUrl = document.getElementById('act_hdpath').value;
                	var thumbimgUrl = document.getElementById('act_image').value;
                	var previewimgUrl = document.getElementById('act_opimg').value;
                	var linkUrl = document.getElementById('act_link').value;
                    if(edtVideoTitle.trim() == '' ){
                		document.getElementById('alert_title').innerHTML = 'Please Enter Video Title';
                  	   return false;      
                        }
                	
                   		if (videoUrl.trim() == '' )
                  	     {
                  			 document.getElementById('alert_VUrl').innerHTML = 'Please Enter Video URL';
                  	         return false;
                  	     }
                   		else if (hdUrl.trim() == '' )
                	     {
                			// document.getElementById('alert_HDURL').innerHTML = 'Please Enter HD Url';
                	        // return false;
                	     }
                   		
                   		else if (thumbimgUrl.trim() == '' )
                    	{
                		 document.getElementById('alert_IMGURL').innerHTML = 'Please Enter Thumb Image Url';
                         return false;
                    	}
                   		else if (previewimgUrl.trim() == '' )
                    {
                		 document.getElementById('alert_prIMGURL').innerHTML = 'Please Enter Preview Image  Url';
                        return false;
                    }	else if (linkUrl.trim() == '' )
                    {
               		 document.getElementById('alert_linkURL').innerHTML = 'Please Enter valid Link Url';
                       return false;
                   }
                 }
                                                if(t2.value == "y" )
                                                {
                                                    document.getElementById('upload2').style.display = "block"
                                                      <a href=?page=hdflvplaylist&pname=$table->playlist_name&did=$table->pid class=\"delete\" onclick=\"javascript:check=confirm( '" . __("Delete this file ?", 'hdflv') . "');if(check==false) return false;\">" . __('Delete') . "</a></td>\n";
/*
 * version : 1.7
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Purpose : Create playlist for player
 * Path:/wp-content/plugins/contus-hd-flv-player/myextractXML.php
 * Date:09/12/11
 *
 */
//ob_start();ob_end_flush();ob_end_clean();
/*
 * version : 1.6
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Purpose : functions used to sort the playlist
 * Path:/wp-content/plugins/contus-hd-flv-player/process-sortable.php
 * Date:09/12/11
 *
 */
Stable tag: 1.7
/* 
 * Purpose : functions used to upload video
 * Path:/wp-content/plugins/contus-hd-flv-player/upload1.php
 * Version: 1.7
 * Edited by : kranthi kumar
 * Email : kranthikumar@contus.in
 * Date:9/12/11
 *
 */

Fixed code:
/**
 * @name          : Player Configuration Settings
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Player Configuration Settings
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */
/**
 * @name          : Common functions needed throughout the plugin
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Common functions needed throughout the plugin
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

ob_start(); 

    $act_name = strip_tags(trim($_POST['name']));
    $act_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $act_name);
    $uploadStatus = '';
                    $uploadStatus = true;
                }else{
                $uploadStatus = false;
                render_error(__('Invalid File Format Uploaded', 'hdflv'));
    if($uploadStatus == '1'){
    }
    $uploadStatus = '';
                    $uploadStatus = true;
                }else{
                $uploadStatus = false;
                render_error(__('Invalid File Format Uploaded', 'hdflv'));
   if($uploadStatus == '1'){
   }
    $act_name = strip_tags(trim($_POST['act_name']));    
    $act_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $act_name);    
    $p_name = strip_tags(trim($_POST['p_name']));
    $p_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $p_name);
    $p_description = strip_tags(trim($_POST['p_description']));
    $p_name = strip_tags(trim($_POST['p_name']));
    $p_name = preg_replace("/[^a-zA-Z0-9\/_-\s]/", '', $p_name);		 
    $p_description = strip_tags(trim($_POST['p_description']));
/**
 * @name          : configuration of plugin
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : configuration of plugin
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

.ui-widget-content { border: 1px solid #aaaaaa/*{borderColorContent}*/; background: #ffffff/*{bgColorContent}*/ url(images/ui-bg_flat_75_ffffff_40x100.png)/*{bgImgUrlContent}*/ 50%/*{bgContentXPos}*/ 50%/*{bgContentYPos}*/ repeat-x/*{bgContentRepeat}*/; color: #222222/*{fcContent}*/; }
<?xml version="1.0" encoding="utf-8"?>
<config 
license="Key provided for commercial version"
stagecolor="0x000000" 
autoplay="true" 
buffer="3"
Volume="false" 
fullscreenscale="0" 
normalscale="0" 
logopath="hdflvplayer/images/platoon.png"
logoalpha="50" 
logoalign="TR" 
Download="false"
logo_target="http://www.hdflvplayer.net/"
skin="hdflvplayer/skin/skin_black/skin_black.swf"
skin_autohide="false"
language = "English"
playlistXML="hdflvplayer/xml/playlist.xml"
playlist_open="false" 
showPlaylist ="true"
HD_default="false" 
vast="false"
vast_partnerid=""
streamer=""
embed_visible="true"
UseYouTubeApi="flash"
debug="true">
<timer>true</timer>
<zoom>true</zoom>
<email>true</email>
<fullscreen>true</fullscreen>
</config>
﻿<?xml version="1.0" encoding="utf-8"?>
<playlist autoplay="false" random="false">

  <mainvideo url="http://www.hdflvplayer.net/videos/300.mp4" 
             hdpath="http://www.hdflvplayer.net/videos/300.mp4"
             id="100"
             thu_image=""                                                                                
             Preview="" 
             preroll="true" 
             midroll="true" 
             postroll="true" 
             allow_download="true"
             streamer=""
             isLive="false" > 
             <title><![CDATA[Welcome]]></title> 
             <!--Optional--> 
             <tagline targeturl="https://mydomain.com"><![CDATA[<span class='heading'>Tagline - </span> <b>Your short description  goes here for Videos.</b> ]]></tagline>        
  </mainvideo>




</playlist>

 * Version: 1.8
 * Creation Date : Dec 09, 2011
 * Modified Date : Jul 23, 2012
/**
 * @name          : Used for installing player plugin (Creating tables)
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Used for installing player plugin (Creating tables)
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

/**
 * @name          : Script for Hd Flv Player
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : For Validation and Sortable Process
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

function showUser(str, order) {
	xmlhttp = GetXmlHttpObject();
	if (xmlhttp == null) {
		alert("Browser does not support HTTP Request");
		return;
	}
	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
	url = url + "?" + order;
	url = url + "&playid=" + str;
	url = url + "&sid=" + Math.random();
	xmlhttp.onreadystatechange = stateChanged;
	xmlhttp.open("GET", url, true);
	xmlhttp.send(null);
function stateChanged() {
	if (xmlhttp.readyState == 4) {
		myarray = xmlhttp.responseText;
		myarray1 = myarray.split(",");
		var length1 = myarray1.length - 1;
		var i = 0;
		for (i = 0; i <= length1; i++) {
			document.getElementById('txtHint[' + myarray1[i] + ']').innerHTML = i;
		}

	}
function GetXmlHttpObject() {
	if (window.XMLHttpRequest) {
		// code for IE7+, Firefox, Chrome, Opera, Safari
		return new XMLHttpRequest();
	}
	if (window.ActiveXObject) {
		// code for IE6, IE5
		return new ActiveXObject("Microsoft.XMLHTTP");
	}
	return null;
// this function is useful to show or display the  HDFLVPlayer Options div when u click on - or + buttons
function hideContentDives(divIdIs, id) {
	var status = document.getElementById(divIdIs).style.display;
	//  alert(status);
	if (status == 'none') {
		document.getElementById(divIdIs).style.display = 'block';
		divStyleDisplaySet(divIdIs, 0);
		document.getElementById(id).className = 'ui-icon ui-icon-minusthick';
	} else {
		document.getElementById(divIdIs).style.display = 'none';
		divStyleDisplaySet(divIdIs, 1);
		document.getElementById(id).className = 'ui-icon ui-icon-plusthick';
	}
function divStyleDisplaySet(IdValue, setValue) {
	var xmlhttp;
	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
	if (IdValue.length == 0) {

		return;
	}
	if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari
		xmlhttp = new XMLHttpRequest();
	} else {// code for IE6, IE5
		xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
	}
	xmlhttp.onreadystatechange = function() {
		if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
			//  alert(xmlhttp.responseText);
			//document.getElementById("txtHint").innerHTML=xmlhttp.responseText;
		}
	}

	xmlhttp.open("GET", url + '?updatedisplay=1&IdValue=' + IdValue
			+ '&setValue=' + setValue, true);
	xmlhttp.send();
function setVideoStatusOff(videoId, status, flag) //click on status image then it exe
	var url = "../wp-content/plugins/contus-hd-flv-player/process-sortable.php";
	if (window.XMLHttpRequest) {// code for IE7+, Firefox, Chrome, Opera, Safari
		xmlhttp = new XMLHttpRequest();
	} else {// code for IE6, IE5
		xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
	}
	xmlhttp.onreadystatechange = function() {
		if (xmlhttp.readyState == 4 && xmlhttp.status == 200) {
			imgName = (xmlhttp.responseText);

			//alert(imgName);
			// alert(  document.getElementById('status'+videoId).innerHTML);

			document.getElementById('status' + videoId).innerHTML = imgName;
		}
	}
	if (flag) {
		//	alert( url+'?changeplaylistStatus=1&videoId='+videoId+'&status='+status);
		xmlhttp.open("GET", url + '?changeplaylistStatus=1&videoId=' + videoId
				+ '&status=' + status, true);//for playlist status
	} else {
		xmlhttp.open("GET", url + '?changeVideoStatus=1&videoId=' + videoId
				+ '&status=' + status, true); //for video status
	}

function savePlaylist(playlistName, mediaId) {
	var name = playlistName.value;
	var pluginUrl = document.getElementById('pluginUrl').value;

	$.ajax({
		type : "GET",
		url : pluginUrl + "/functions.php",
		data : "name=" + name + "&media=" + mediaId,
		success : function(msg) {
			var response = msg.split('##');
			//  alert(msg);
			document.getElementById('playlistchecklist').innerHTML = msg;
		}
	});
/**
 * function to validate during adding video files
 * 
 */

function validateInput() {
	document.getElementById('message').style.display = '';
	var CustomUrl = document.getElementById('filepath2').value;
	var HdUrl = document.getElementById('filepath3').value;
	var ThumbUrl = document.getElementById('filepath4').value;
	var ThumbPreviewUrl = document.getElementById('filepath5').value;
	var tomatch = /http:\/\/[A-Za-z0-9\.-]{3,}\.[A-Za-z]{3}/;
	if (!tomatch.test(CustomUrl) && (CustomUrl != '')) {
		document.getElementById('message').innerHTML = 'Please enter valid URL';
		return false;
	} else if (!tomatch.test(HdUrl) && (HdUrl != '')) {
		document.getElementById('message').innerHTML = 'Please enter valid Hd Url';
		return false;
	}
	else if (!tomatch.test(ThumbUrl) && (ThumbUrl != '')) {
		document.getElementById('message').innerHTML = 'Please enter valid Thumb Image Url';
		return false;
	} else if (!tomatch.test(ThumbPreviewUrl) && (ThumbPreviewUrl != '')) {
		document.getElementById('message').innerHTML = 'Please enter Preview Image  Url';
		return false;
	} else if (!tomatch.test(YouTubeUrl) && (YouTubeUrl != '')) {
		document.getElementById('message').innerHTML = 'Please enter valid You Tube Url';
		return false;
	}
	if (document.getElementById('btn2').checked == true
			&& document.getElementById('filepath1').value == '') {
		document.getElementById('message').innerHTML = 'Enter Youtube URL';
		return false;
	}
	if (document.getElementById('btn1').checked == true
			&& document.getElementById('f1-upload-form').style.display != 'none') {
		document.getElementById('message').innerHTML = 'Upload Video';
		return false;
	}
	if (document.getElementById('btn3').checked == true
			&& document.getElementById('filepath2').value == '') {
		document.getElementById('message').innerHTML = 'Enter Video URl';
		return false;
	}
	var titlename = document.getElementById('name').value;
	titlename = titlename.trim();
	if (titlename == '') {
		document.getElementById('Errormsgname').innerHTML = 'Please enter the title for video ';
		document.getElementById('name').focus();
		return false;
	}
/**
 * function to validate during editing video files
 * 
 */
function edtValidate() {
	
	var edtVideoTitle = document.getElementById('act_name').value;
	var videoUrl = document.getElementById('act_filepath').value;
	var hdUrl = document.getElementById('act_hdpath').value;
	var thumbimgUrl = document.getElementById('act_image').value;
	var previewimgUrl = document.getElementById('act_opimg').value;
	var linkUrl = document.getElementById('act_link').value;
	
	var regexp = /^(((ht|f){1}((tp|tps):[/][/]){1}))[-a-zA-Z0-9@:%_\+.~#!?&//=]+$/;
	
	if (edtVideoTitle.trim() == '') {
		document.getElementById('alert_title').innerHTML = 'Please Enter Video Title';
		return false;
	}else if (videoUrl.trim() == '') {
		document.getElementById('alert_VUrl').innerHTML = 'Please Enter Video URL';
		return false;
	}else if(videoUrl != '' && regexp.test(videoUrl)== false){
		document.getElementById('alert_VUrl').innerHTML = 'Please Enter Valid Video URL';
		return false;
	}else if(hdUrl != '' && regexp.test(hdUrl)== false){ 	 
		document.getElementById('alert_HDURL').innerHTML = 'Please Enter Valid HD Url';
		return false;
	}else if (thumbimgUrl == '') {
		document.getElementById('errmsg_thumbimg').style.display = '';
		document.getElementById('errmsg_thumbimg').innerHTML = 'Please Enter Thumb Image/Url';
		return false;
	}else if (previewimgUrl == '') {
		document.getElementById('errmsg_previewimg').style.display = '';
		document.getElementById('errmsg_previewimg').innerHTML = 'Please Enter Preview Image/Url';
		return false;
	}else if(linkUrl != '' && regexp.test(linkUrl)== false) {
		document.getElementById('alert_linkURL').innerHTML = 'Please Enter Valid Link Url';
		return false;
	}
}

/**
 * function to validate during edit upload video files
 * 
 */

function validateFileExt() {
	var previewImg = document.getElementById('edit_preview').value;
	var thumbImg = document.getElementById('edit_thumb').value;

	if(thumbImg != ''){
		var filext = thumbImg.substring(thumbImg.lastIndexOf(".")+1);					
	}
	
	if(previewImg != ''){
		var filext = previewImg.substring(previewImg.lastIndexOf(".")+1);
	}
	
	filext = filext.toLowerCase();	
	
	if (filext == 'jpg' || filext == 'png' || filext == 'jpeg' || filext == 'gif'){
		return true;
	}else{
		alert("Invalid File Format Selected");
		document.getElementById('edit_preview').value = "";
		document.getElementById('edit_thumb').value = "";
		return false;
	}
}
/**
 * @name          : Common functions needed throughout the plugin
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Common functions needed throughout the plugin
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

        var token = '<?php echo md5(DB_NAME);?>';
        document.forms[form_handle].action = "../wp-content/plugins/contus-hd-flv-player/uploadVideo.php?processing=1&token="+token;
                                <br/><?php _e('Enter the URL to show a thumbnail of the video file or upload a image', 'hdflv') ?><?php if($act_image != ''): ?><br /><span id="alert_IMGURL" style="color:red;font-size:12px;font-weight:bold;"></span><?php endif; ?>
                                <br/>
                                <input type="file" name="edit_thumb" id="edit_thumb">
                                <input type="submit" name="thumb-update" value="Upload" class="button-secondary" onclick ="return validateFileExt();">
                                <br />
                                <span id="errmsg_thumbimg" style="color:red;font-size:12px;font-weight:bold;display: none;"></span>
                             </td>
                                <form name="edit_preview_form" method="post" enctype="multipart/form-data" onSubmit ="return validateFileExt();">
                                <input type="file" name="edit_preview" id="edit_preview">
                                <input type="submit" name="preview-update" value="Upload" class="button-secondary">
                                <br />
                                <span id="errmsg_previewimg" style="color:red;font-size:12px;font-weight:bold;display: none;"></span>
                             </td>
               
                                                if(t2.value == "y" ){
                                                	document.getElementById('message').style.display = "none";
                                                    document.getElementById('upload2').style.display = "block";
                                                	document.getElementById('message').style.display = "none";
                                                	document.getElementById('message').style.display = "none";
                                                      <a href='?page=hdflvplaylist&pname=$table->playlist_name&did=$table->pid' class=\"delete\" onclick=\"javascript:check=confirm( '" . __("Delete this file ?", 'hdflv') . "');if(check==false) return false;\">" . __('Delete') . "</a></td>\n";
/**
 * @name          : Common functions needed throughout the plugin
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Common functions needed throughout the plugin
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

/**
 * @name          : Common functions needed throughout the plugin
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : Common functions needed throughout the plugin
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */

Stable tag: 1.8
/**
 * @name          : functions used to upload video
 * @version	  	  : 1.8
 * @package       : apptha
 * @subpackage    : contus-hd-flv-player
 * @author        : Apptha - http://www.apptha.com
 * @copyright     : Copyright (C) 2011 Powered by Apptha
 * @license	      : GNU General Public License version 2 or later; see LICENSE.txt
 * @Purpose       : functions used to upload video
 * @Creation Date : Dec 09, 2011
 * @Modified Date : Jul 23, 2012
 * */
require_once('../../../wp-load.php');
$dbtoken = md5(DB_NAME);
$token = trim($_REQUEST["token"]);

if($dbtoken != $token ){
    die("You are not authorized to access this file");
}