CVE-2015-2678 (PHP, published 2015-03-23T16:59Z)
Description: value: Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web script or HTML via the (1) cat parameter in the categories page to gxadmin/index.php or (2) page parameter to index.php.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/semplon/GeniXCMS
Files changed:
gxadmin/inc/categories.php
gxadmin/inc/menus.php
gxadmin/inc/menus_form.php
gxadmin/inc/menus_form_edit.php
gxadmin/inc/pages.php
gxadmin/inc/pages_form.php
gxadmin/inc/posts.php
gxadmin/inc/posts_form.php
gxadmin/inc/settings.php
gxadmin/inc/user.php
gxadmin/inc/user_form.php
inc/lib/Categories.class.php
inc/lib/Control.class.php
inc/lib/Control/Backend/categories.control.php
inc/lib/Control/Backend/menus.control.php
inc/lib/Control/Backend/pages.control.php
inc/lib/Control/Backend/posts.control.php
inc/lib/Control/Backend/settings.control.php
inc/lib/Control/Backend/users.control.php
inc/lib/Control/Error/db.control.php
inc/lib/Control/Error/unknown.control.php
inc/lib/Control/Frontend/cat.control.php
inc/lib/Control/Frontend/default.control.php
inc/lib/Control/Frontend/page.control.php
inc/lib/Control/Frontend/post.control.php
inc/lib/Control/Install/default.control.php
inc/lib/Db.class.php
inc/lib/GxMain.class.php
inc/lib/Install.class.php
inc/lib/Mail.class.php
inc/lib/Menus.class.php
inc/lib/Options.class.php
inc/lib/Posts.class.php
inc/lib/Rss.class.php
inc/lib/Site.class.php
inc/lib/System.class.php
inc/lib/Token.class.php
inc/lib/Upload.class.php
inc/lib/Url.class.php
Commit message: Security FIX, Bug FIX


Vulnerable code:
*/?>
                        if($c->parent == ""){
                                  <a href=\"?page=categories&act=del&id={$c->id}\" class=\"pull-right\"
                                        <form action=\"\" method=\"POST\" name=\"updatecat\">
                                            <a href=\"?page=categories&act=del&id={$c2->id}\" class=\"input-group-addon\"
                                    'parent' => '',
*/?>
                                              $data['parent'] = Menus::getParent('', $k);
    if(isset($data['alertgreen']) ) {
        echo "<div class=\"alert alert-success\">";
            foreach ($data['alertgreen'] as $alert) {
                echo "$alert"; 
            }
        echo "</div>"; }
                //print_r($data['parent']);
    if (isset($data['alertgreen'])) {
        echo "<div class=\"alert alert-success\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>";
        foreach ($data['alertgreen'] as $alert) {
            # code...
            echo "$alert\n";
        }
        echo "</div>";
    if (isset($data['alertred'])) {
        echo "<div class=\"alert alert-danger\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>";
        foreach ($data['alertred'] as $alert) {
            # code...
            echo "$alert\n";
        }
        echo "</div>";
        <div class="table-responsive">
            <table class="table table-hover">
                <thead>
                    <tr>
                        <th>ID</th>
                        <th>Title</th>
                        <th>Date</th>
                        <th>Edit/Delete</th>
                        <th>All <input type="checkbox" id="selectall"></th>
                    </tr>
                </thead>
                <tbody>
                    <?php
                        //print_r($data);
                    if($data['num'] > 0){
                        foreach ($data['posts'] as $p) {
                            # code...
                            //echo $p->id;
                            <tr>
                                <td>{$p->id}</td>
                                <td><a href=\"".Url::page($p->id)."\" target=\"_new\">{$p->title}</a></td>
                                <td>{$p->date}</td>
                                <td>
                                    <a href=\"index.php?page=pages&act=edit&id={$p->id}\" class=\"label label-success\">Edit</a> 
                                    <a href=\"index.php?page=pages&act=del&id={$p->id}\" class=\"label label-danger\" 
                                    onclick=\"return confirm('Are you sure you want to delete this item?');\">Delete</a>
                                </td>
                                    <input type=\"checkbox\" name=\"post_id[]\" value=\"{$p->id}\" id=\"select\">
                                </td>
                            </tr>
                            ";
                    }else{
                        echo "
                            <tr>
                                <td>
                                    No Pages Found 
                                </td>
                            </tr>";
                    }
                    ?>
                </tbody>
                <tfoot>
                    <th>ID</th>
                    <th>Title</th>
                    <th>Date</th>
                    <th>
                    <select name="action" class="form-control">
                        <option value="publish">Publish</option>
                        <option value="unpublish">UnPublish</option>
                        <option value="delete">Delete</option>
                    </select>
                    </th>
                    <th>
                        <button type="submit" name="doaction" class="btn btn-danger">
                            Submit
                        </button>
                    </th>
                </tfoot>
            </table>
        </div>
    if (isset($data['alertgreen'])) {
        echo "<div class=\"alert alert-success\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>
        ";
        foreach ($data['alertgreen'] as $alert) {
            # code...
            echo "$alert\n";
        }
        echo "</div>";
<form action="" method="post" role="form" class="">
                                <a href=\"index.php?page=posts&act=edit&id={$p->id}\" class=\"label label-success\">Edit</a> 
                                <a href=\"index.php?page=posts&act=del&id={$p->id}\" class=\"label label-danger\" 
    if (isset($data['alertgreen'])) {
        echo "<div class=\"alert alert-success\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>";
        foreach ($data['alertgreen'] as $alert) {
            # code...
            echo "$alert\n";
        }
        echo "</div>";
    if (isset($data['alertred'])) {
        echo "<div class=\"alert alert-danger\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>";
        foreach ($data['alertred'] as $alert) {
            # code...
            echo "$alert\n";
        }
        echo "</div>";
    if(isset($data['post'])) {
        foreach ($data['post'] as $p) {
            # code...
            $title = $p->title;
            $content = $p->content;
            $date = $p->date;
            $status = $p->status;
            $cat = $p->cat;
        }
        if($status == 1) {
            $pub = "SELECTED"; 
            $unpub = ""; 
        }elseif ($status == 0) {
            $pub = ""; 
            $unpub = "SELECTED";
        }
    }else{
        $title = "";
        $content = "";
        $date = "";
        $status = "";
        $cat = "";
        $pub = "";
        $unpub = "";
<form action="" method="post" role="form" class="">
        <h1><i class="fa fa-file-text-o"></i> New Post
*/?>
                          <input type="text" name="sitename" value="<?=Options::get('sitename');?>" class="form-control">
                          <input type="text" name="sitedomain" value="<?=Options::get('sitedomain');?>" class="form-control">
                          <input type="text" name="siteurl" value="<?=Options::get('siteurl');?>" class="form-control">
                          <input type="text" name="sitekeywords" value="<?=Options::get('sitekeywords');?>" class="form-control">
                          <textarea  name="sitedesc" class="form-control"><?=Options::get('sitedesc');?></textarea>
                                $logoimg = "<img src=\"".Options::get('siteurl').Options::get('logo')."\" class=\"clearfix\">";
                            <a href=\"index.php?page=users&act=edit&id={$p->id}\" class=\"label label-success\">Edit</a> 
                            <a href=\"index.php?page=users&act=del&id={$p->id}\" class=\"label label-danger\" 
                            onclick=\"return confirm('Are you sure you want to delete this item?');\">Delete</a>
                    <input type="password" name="email" class="form-control">
    if (isset($data['alertgreen'])) {
        echo "<div class=\"alert alert-success\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>
        <ul>";
        foreach ($data['alertgreen'] as $alert) {
            # code...
            echo "<li>$alert</li>\n";
        }
        echo "</ul></div>";
    }elseif (isset($data['alertred'])) {
        //print_r($data['alertred']);
        echo "<div class=\"alert alert-danger\" >
        <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
            <span aria-hidden=\"true\">&times;</span>
            <span class=\"sr-only\">Close</span>
        </button>
        <ul>";
        foreach ($data['alertred'] as $alert) {
            # code...
            echo "<li>$alert</li>\n";
        }
        echo "</ul></div>";
                if($c->parent == ''){
    public static function error ($vars="") {
            include(GX_PATH.'/inc/lib/Control/Error/404.control.php');
        $slug = Typo::slugify($_POST['cat']);
        $cat = Db::insert("INSERT INTO `cat` VALUES ('', '{$_POST['cat']}', '{$slug}', '{$_POST['parent']}', '' )");
        $vars = array(
                    'table' => 'cat',
                    'id' => $_POST['id'],
                    'key' => array(
                                'name' => $_POST['cat']
                            )
                );
        $cat = Db::update($vars);
    Categories::delete($_GET['id']);
                $menus = Options::get('menus');
                $menus = json_decode(Options::get('menus'), true);
                echo "<pre>"; print_r($menus); echo "</pre>";
                // $menu = array(
                //                 $_POST['id']  =>  array(
                //                             'name' => $menus[$_POST['id']]['name'],
                //                             'class' => $menus[$_POST['id']]['class'],
                //                             'menu' => array(
                //                                     'parent' => $_POST['parent'],
                //                                     'menuid' => $_POST['id'],
                //                                     'type' => $_POST['type'],
                //                                     'value' => $_POST[$_POST['type']]
                //                                 )
                //                         )
                //                 );
                
                // if(is_array($menus)){
                //     $menu = array_merge($menus, $menu);
                // }
                // echo "<pre>"; print_r($menu); echo "</pre>";
                //$menu = $menus;
                $menu[$_POST['id']]['menu'] = $menus[$_POST['id']]['menu'];
                $menu[$_POST['id']]['menu'][] = array(
                                                    'parent' => $_POST['parent'],
                                                    'menuid' => $_POST['id'],
                                                    'name' => $_POST['name'],
                                                    'type' => $_POST['type'],
                                                    'value' => $_POST[$_POST['type']],
                                                    'sub' => ''
                                                );
                 $menu = array(
                                $_POST['id']  =>  array(
                                            'name' => $menus[$_POST['id']]['name'],
                                            'class' => $menus[$_POST['id']]['class'],
                                            'menu' => $menu[$_POST['id']]['menu']    
                                        )
                                );
                if(is_array($menus)){
                    $menu = array_merge($menus, $menu);
                 echo "<pre>"; print_r($menu); echo "</pre>";
                $menu = json_encode($menu);
                echo "<pre>"; print_r($menu); echo "</pre>";
                //Options::update('menus', $menu);

                $vars = array(
                            'parent' => $_POST['parent'],
                            'menuid' => $_POST['id'],
                            'name' => $_POST['name'],
                            'class' => $_POST['class'],
                            'type' => $_POST['type'],
                            'value' => $_POST[$_POST['type']]
                        );
                Menus::insert($vars);
                $data['alertgreen'][] = 'Menu Added';
        $data['parent'] = Menus::getParent('', $menuid);
                
                $vars = array(
                            // 'parent' => $_POST['parent'],
                            'menuid' => $_POST['id'],
                            'name' => $_POST['name'],
                            'class' => $_POST['class'],
                            'type' => $_POST['type'],
                            'value' => $_POST[$_POST['type']]
                        );
                $vars = array(
                            'id' => $_GET['itemid'],
                            'key' => $vars
                        );
                Menus::update($vars);
                $data['alertgreen'][] = 'Menu Updated';
        $data['parent'] = Menus::getParent('', $menuid);
            Menus::delete($_GET['itemid']);
            $data['alertgreen'][] = 'Menu Deleted';
                $menu = array(
                                $_POST['id']  =>  array(
                                            'name' => $_POST['name'],
                                            'class' => $_POST['class'],
                                            'menu' => array()
                                        )
                                );
                $menus = json_decode(Options::get('menus'), true);
                if(is_array($menus)){
                    $menu = array_merge($menus, $menu);
                
                $menu = json_encode($menu);
                Options::update('menus', $menu);

                $vars = array(
                            'parent' => $_POST['parent'],
                            'menuid' => $_POST['id'],
                            'name' => $_POST['name'],
                            'class' => $_POST['class'],
                            'type' => $_POST['type'],
                            'value' => $_POST[$_POST['type']]
                        );
                Menus::insert($vars);
                $data['alertgreen'][] = 'Menu Item Added';

                Menus::updateMenuOrder($_POST['order']);
                $data['alertgreen'][] = 'Menu Order Changed';
                if (!isset($_POST['date']) || $_POST['date'] == "") {
                    # code...
                    $date = date("Y-m-d H:i:s");
                    $date = $_POST['date'];
                $vars = array(
                                'title' => Typo::cleanX($_POST['title']),
                                'content' => Typo::cleanX($_POST['content']),
                                'date' => $date,
                                'type' => 'page',
                                'author' => Session::val('username'),
                                'status' => $_POST['status'],
                            );
                //print_r($vars);
                Posts::insert($vars);
                $data['alertgreen'][] = "Page : {$_POST['title']} Added.";
                if (!isset($_POST['date']) || $_POST['date'] == "") {
                    # code...
                    $date = date("Y-m-d H:i:s");
                    $date = $_POST['date'];
                $moddate = date("Y-m-d H:i:s");
                $vars = array(
                                'title' => Typo::cleanX($_POST['title']),
                                'content' => Typo::cleanX($_POST['content']),
                                'modified' => $moddate,
                                'date' => $date,
                                'status' => $_POST['status'],
                            );
                //print_r($vars);
                Posts::update($vars);
                $data['alertgreen'][] = "Page : {$_POST['title']} Updated.";
                $del = Posts::delete($_GET['id']);
                foreach ($post_id as $id) {
                    # code...
                    Posts::publish($id);
                foreach ($post_id as $id) {
                    # code...
                    Posts::unpublish($id);
                foreach ($post_id as $id) {
                    # code...
                    Posts::delete($id);
                if (!isset($_POST['date']) || $_POST['date'] == "") {
                    # code...
                    $date = date("Y-m-d H:i:s");
                    $date = $_POST['date'];
                $vars = array(
                                'title' => Typo::cleanX($_POST['title']),
                                'cat' => $_POST['cat'],
                                'content' => Typo::cleanX($_POST['content']),
                                'date' => $date,
                                'type' => 'post',
                                'author' => Session::val('username'),
                                'status' => $_POST['status'],
                            );
                //print_r($vars);
                Posts::insert($vars);
                $data['alertgreen'][] = "Post : {$_POST['title']} Added.";
                $moddate = date("Y-m-d H:i:s");
                $vars = array(
                                'title' => Typo::cleanX($_POST['title']),
                                'cat' => $_POST['cat'],
                                'content' => Typo::cleanX($_POST['content']),
                                'modified' => $moddate,
                                'date' => $_POST['date'],
                                'status' => $_POST['status'],
                            );
                //print_r($vars);
                
                Posts::update($vars);
                $data['alertgreen'][] = "Post : <b>{$_POST['title']}</b> Updated.";
                $title = Posts::title($_GET['id']);
                $del = Posts::delete($_GET['id']);
                //echo $title['error'];
                if(isset($del['error'])){
                    $data['alertred'][] = $del['error'];
                    $data['alertgreen'][] = 'Post <b>'.$title.'</b> Removed';
                foreach ($post_id as $id) {
                    Posts::publish($id);
                foreach ($post_id as $id) {
                    Posts::unpublish($id);
                foreach ($post_id as $id) {
                    Posts::delete($id);

        $vars = array();
        if(isset($_FILES['logo']) && $_FILES['logo'] != ''){
            $path = "/assets/images/";
            $allowed = array('png', 'jpg', 'gif');
            $upload = Upload::go('logo', $path, $allowed );
            if(isset($upload['error']) != ''){
                echo $upload['error'];
                $vars['logo'] = $upload['path'];
        }else{
            unset($_POST['logo']);
        }
        
        
        //print_r($_POST);
        $flip = array_flip($_POST);
        $sql = "SELECT * FROM `options` WHERE `value` = 'on'";        
        $q = Db::result($sql);
        foreach($q as $ob) {
            if( isset( $flip[$ob->name] ) ) {
                $vars[$ob->name] = 'on';
                //echo $ob->name;
            }else{
                $vars[$ob->name] = 'off';
                //echo $ob->name;
        //print_r($ob);
        foreach ($_POST as $key => $val) {
            # code...
            $vars[$key] = $val;
        }
        unset($vars['change']);
        //print_r($vars);
        Options::update($vars);

System::inc('settings');
                User::delete($_GET['id']);
                $data['alertgreen'][] = "User : ".$user." Removed";
                // VALIDATE ALL
    Theme::theme('header');
Theme::theme('header');
                                    WHERE `id` = '%d' 
                                    OR `slug` = '%s' 
                                    $page
            Theme::theme('header');
                            WHERE `id` = '%d' AND `type` = 'post' LIMIT 1",
    Theme::theme('header');
            self::$mysqli = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
            return self::$mysqli;
                user_error("Query failed: ".self::$mysqli->error."<br />\n$vars"); 
                return false; 
                    printf("<div class=\"alert alert-danger\">Errormessage: %s</div>\n", self::$mysqli->error);
*/
                  `fname` varchar(32) COLLATE latin1_general_ci NOT NULL,
            (null, 'ppsign', '')";
    function __construct()
/*
*    GeniXCMS - Content Management System
*    ============================================================
*    Build          : 20140925
*    Version        : 0.0.1 pre
*    Developed By   : Puguh Wijayanto (www.metalgenix.com)
*    License        : MIT License
*    ------------------------------------------------------------
* filename : Menus.class.php
* version : 0.0.1 pre
* build : 20141007


    public static function getParent($parent='', $menuid = ''){
        $sql = sprintf("SELECT * FROM `menus` WHERE `parent` = '%s' %s", $parent, $where);
    public static function isHadSub($parent, $menuid =''){
        $sql = sprintf("SELECT * FROM `menus` WHERE `parent` = '%s' %s", $parent, $where);
                    $parent = self::getParent($m->id, $menuid);
                                    $parent = self::getParent($m2->id, $menuid);
                                                    $parent = self::getParent($m3->id, $menuid);
                                                                    $parent = self::getParent($m4->id, $menuid);
                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m->id}\" class=\"label label-primary pull-right\" >
                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m->id}\" class=\"label label-danger pull-right\" >
                    $parent = self::getParent($m->id, $menuid);
                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m2->id}\" class=\"label label-primary pull-right\" >
                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m2->id}\" class=\"label label-danger pull-right\" >
                                        $parent = self::getParent($m2->id, $menuid);
                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m3->id}\" class=\"label label-primary pull-right\" >
                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m3->id}\" class=\"label label-danger pull-right\" >
                                                        $parent = self::getParent($m3->id, $menuid);
                                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m4->id}\" class=\"label label-primary pull-right\" >
                                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m4->id}\" class=\"label label-primary pull-right\" >
            $sql = sprintf("SELECT * FROM `menus` WHERE `id` = '%d' ORDER BY `order` ASC", $id);
    //             'title' => '',
    //             'cat' => '',
    //             'content' => '',
    //             'date' => '',
    //             'author' => '',
    //             'type' => '',
    //             'status' => ''
            $slug = Typo::slugify($vars['title']);
            $vars = array_merge($vars, array('slug' => $slug));
            //print_r($vars);
                        'key' => $vars
            $post = Db::insert($ins);
        return $post;
        $sql = "SELECT * FROM `posts` WHERE `type` = '{$type}' ORDER BY `date` DESC LIMIT {$vars}";
            $where = "WHERE ";
                    <title>".Options::get('sitename')."</title>
                    <link>".Options::get('siteurl')."</link>
                    <description>".Options::get('sitedesc')."</description>
            $sitenamelength = strlen(Options::get('sitename'));
    <title>{$cont_title}".Options::get('sitename')."</title>
    <meta name=\"Keyword\" content=\"".Options::get('sitekeywords')."\">
    <link href=\"".Options::get('siteurl')."/assets/css/bootstrap.min.css\" rel=\"stylesheet\">\n";
            \t<script src=\"".Options::get('siteurl')."/assets/js/bootstrap.min.js\"></script>
            \t<script src=\"".Options::get('siteurl')."/assets/js/ie10-viewport-bug-workaround.js\"></script>";
            \t<link href=\"".Options::get('siteurl')."/assets/css/summernote.css\" rel=\"stylesheet\">
            \t<script src=\"".Options::get('siteurl')."/assets/js/summernote.min.js\"></script>
            \t<script src=\"".Options::get('siteurl')."/assets/js/plugins/summernote-ext-fontstyle.js\"></script>
            \t<script src=\"".Options::get('siteurl')."/assets/js/plugins/summernote-ext-hello.js\"></script>
            \t<script src=\"".Options::get('siteurl')."/assets/js/plugins/summernote-ext-video.js\"></script>
            \t<link href=\"".Options::get('siteurl')."/assets/css/bootstrapValidator.min.css\" rel=\"stylesheet\">
            \t<script src=\"".Options::get('siteurl')."/assets/js/bootstrapValidator.min.js\"></script>
            $desc = substr(strip_tags(htmlspecialchars_decode($vars).". ".Options::get('sitedesc')),0,150);
            $desc = substr(Options::get('sitedesc'),0,150);
            $logo = "<img src=\"".Options::get('siteurl').Options::get('logourl')."\"
            $logo = "<img src=\"".Options::get('siteurl').Options::get('logo')."\"

            self::lang(GX_LANG);
/* Location: ./inc/lib/system.class.php */
                    $result['fileurl'] = Options::get('siteurl').$path.$uniqfile.$filename;
                $url = Options::get('siteurl')."/".self::slug($vars)."/{$vars}";
                $url = Options::get('siteurl')."/index.php?post={$vars}";
                $url = Options::get('siteurl')."/".self::slug($vars).GX_URL_PREFIX;
                $url = Options::get('siteurl')."/index.php?page={$vars}";
                $url = Options::get('siteurl')."/".$vars."/".Typo::slugify(Categories::name($vars));
                $url = Options::get('siteurl')."/index.php?cat={$vars}";
                $url = Options::get('siteurl')."/sitemap".GX_URL_PREFIX;
                $url = Options::get('siteurl')."/index.php?page=sitemap";
                $url = Options::get('siteurl')."/rss".GX_URL_PREFIX;
                $url = Options::get('siteurl')."/index.php?rss";

Fixed code:
*/

if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertgreen'] as $alert) {
        # code...
        echo "$alert\n";
    }
    echo "</div>";
}
if (isset($data['alertred'])) {
    # code...
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "$alert\n";
    }
    echo "</div>";
}
?>
                        if($c->parent == "" || $c->parent == 0){
                                  <a href=\"?page=categories&act=del&id={$c->id}&token=".TOKEN."\" class=\"pull-right\"
                                        <form action=\"index.php?page=categories\" method=\"POST\" name=\"updatecat\">
                                            <a href=\"?page=categories&act=del&id={$c2->id}&token=".TOKEN."\" class=\"input-group-addon\"
                                            <input type=\"hidden\" name=\"token\" value=\"".TOKEN."\">
                                    'parent' => '0',
            <input type="hidden" name="token" value="<?=TOKEN;?>">
*/

if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertgreen'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}elseif (isset($data['alertred'])) {
    # code...
    //print_r($data['alertred']);
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}
?>
                                              $data['parent'] = Menus::isHadParent('', $k);
            <input type="hidden" name="token" value="<?=TOKEN;?>">
if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertgreen'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}elseif (isset($data['alertred'])) {
    # code...
    //print_r($data['alertred']);
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}

<input type="hidden" name="token" value="<?=TOKEN;?>">
    if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertgreen'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}elseif (isset($data['alertred'])) {
    # code...
    //print_r($data['alertred']);
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}
            
                //print_r($data['menus']);
<input type="hidden" name="token" value="<?=$_GET['token'];?>">
if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertgreen'] as $alert) {
        echo "$alert\n";
    echo "</div>";
}
if (isset($data['alertred'])) {
    # code...
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertred'] as $alert) {
        echo "$alert\n";
    echo "</div>";
}
        <form action="" method="post">
            <div class="table-responsive">
                <table class="table table-hover">
                    <thead>
                        <tr>
                            <th>ID</th>
                            <th>Title</th>
                            <th>Date</th>
                            <th>Status</th>
                            <th>Edit/Delete</th>
                            <th>All <input type="checkbox" id="selectall"></th>
                        </tr>
                    </thead>
                    <tbody>
                        <?php
                            //print_r($data);
                        if($data['num'] > 0){
                            foreach ($data['posts'] as $p) {
                                # code...
                                //echo $p->id;
                                if($p->status == '0'){
                                    $status = "UnPublished";
                                }else{
                                    $status = "Published";
                                }
                                echo "
                                <tr>
                                    <td>{$p->id}</td>
                                    <td><a href=\"".Url::page($p->id)."\" target=\"_new\">{$p->title}</a></td>
                                    <td>{$p->date}</td>
                                    <td>{$status}</td>
                                    <td>
                                        <a href=\"index.php?page=pages&act=edit&id={$p->id}&token=".TOKEN."\" class=\"label label-success\">Edit</a> 
                                        <a href=\"index.php?page=pages&act=del&id={$p->id}&token=".TOKEN."\" class=\"label label-danger\" 
                                        onclick=\"return confirm('Are you sure you want to delete this item?');\">Delete</a>
                                    </td>
                                        <td>
                                        <input type=\"checkbox\" name=\"post_id[]\" value=\"{$p->id}\" id=\"select\">
                                    </td>
                                </tr>
                                ";
                            }
                        }else{
                                <tr>
                                        No Pages Found 
                                    </td>
                                </tr>";
                        ?>
                    </tbody>
                    <tfoot>
                        <th>ID</th>
                        <th>Title</th>
                        <th>Date</th>
                        <th>Status</th>
                        <th>
                        <select name="action" class="form-control">
                            <option value="publish">Publish</option>
                            <option value="unpublish">UnPublish</option>
                            <option value="delete">Delete</option>
                        </select>
                        <input type="hidden" name="token" value="<?=TOKEN;?>">
                        </th>
                        <th>
                            <button type="submit" name="doaction" class="btn btn-danger">
                                Submit
                            </button>
                        </th>
                    </tfoot>
                </table>
            </div>
        </form>
        

isset($_GET['token'])? $token = $_GET['token']: $token = TOKEN;
($_GET['act'] == "edit")? $pagetitle = "Edit": $pagetitle = "New";
($_GET['act'] == "edit")? $act = "edit&id={$_GET['id']}&token={$_GET['token']}": $act = "add";

if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    ";
    foreach ($data['alertgreen'] as $alert) {
        echo "$alert\n";
    }
    echo "</div>";
}

if (isset($data['alertred'])) {
    # code...
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "$alert\n";
    echo "</div>";
}
<form action="index.php?page=pages&act=<?=$act?>" method="post" role="form" class="">
<input type="hidden" name="token" value="<?=$token;?>">
                <th>Status</th>
                        if($p->status == '0'){
                            $status = "UnPublished";
                        }else{
                            $status = "Published";
                        }
                            <td>{$status}</td>
                                <a href=\"index.php?page=posts&act=edit&id={$p->id}&token=".TOKEN."\" class=\"label label-success\">Edit</a> 
                                <a href=\"index.php?page=posts&act=del&id={$p->id}&token=".TOKEN."\" class=\"label label-danger\" 
            <th>Status</th>
            <input type="hidden" name="token" value="<?=TOKEN;?>">
isset($_GET['token'])? $token = $_GET['token']: $token = TOKEN;
($_GET['act'] == "edit")? $pagetitle = "Edit": $pagetitle = "New";
($_GET['act'] == "edit")? $act = "edit&id={$_GET['id']}&token={$_GET['token']}": $act = "add";
if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertgreen'] as $alert) {
        echo "$alert\n";
    echo "</div>";
}
if (isset($data['alertred'])) {
    # code...
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertred'] as $alert) {
        echo "$alert\n";
    echo "</div>";
}
if(isset($data['post'])) {
    foreach ($data['post'] as $p) {
        # code...
        $title = $p->title;
        $content = $p->content;
        $date = $p->date;
        $status = $p->status;
        $cat = $p->cat;
    }
    if($status == 1) {
        $pub = "SELECTED"; 
        $unpub = ""; 
    }elseif ($status == 0) {
        $pub = ""; 
        $unpub = "SELECTED";
}else{
    $title = "";
    $content = "";
    $date = "";
    $status = "";
    $cat = "";
    $pub = "";
    $unpub = "";
}
<form action="index.php?page=posts&act=<?=$act?>" method="post" role="form" class="">
        <h1><i class="fa fa-file-text-o"></i> <?=$pagetitle;?> Post
<input type="hidden" name="token" value="<?=$token;?>">
*/

if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    ";
    foreach ($data['alertgreen'] as $alert) {
        # code...
        echo "$alert\n";
    }
    echo "</div>";
}

if (isset($data['alertred'])) {
    # code...
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>";
    foreach ($data['alertred'] as $alert) {
        # code...
        echo "$alert\n";
    }
    echo "</div>";
}

?>
                          <input type="text" name="sitename" value="<?=Site::$name;?>" class="form-control">
                          <input type="text" name="sitedomain" value="<?=Site::$domain;?>" class="form-control">
                          <input type="text" name="siteurl" value="<?=Site::$url;?>" class="form-control">
                          <input type="text" name="sitekeywords" value="<?=Site::$key;?>" class="form-control">
                          <textarea  name="sitedesc" class="form-control"><?=Site::$desc;?></textarea>
                                $logoimg = "<img src=\"".Site::$url.Options::get('logo')."\" class=\"clearfix\">";
<input type="hidden" name="token" value="<?=TOKEN;?>">
                            <a href=\"index.php?page=users&act=edit&id={$p->id}&token=".TOKEN."\" class=\"label label-success\">Edit</a> 
                            <a href=\"index.php?page=users&act=del&id={$p->id}&token=".TOKEN."\" class=\"label label-danger\" 
                            onclick=\"return confirm('Are you sure you want to delete this?');\">Delete</a>
                    <input type="email" name="email" class="form-control">
          <input type="hidden" name="token" value="<?=TOKEN;?>">
if (isset($data['alertgreen'])) {
    # code...
    echo "<div class=\"alert alert-success\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertgreen'] as $alert) {
        echo "<li>$alert</li>\n";
    }
    echo "</ul></div>";
}elseif (isset($data['alertred'])) {
    # code...
    //print_r($data['alertred']);
    echo "<div class=\"alert alert-danger\" >
    <button type=\"button\" class=\"close\" data-dismiss=\"alert\">
        <span aria-hidden=\"true\">&times;</span>
        <span class=\"sr-only\">Close</span>
    </button>
    <ul>";
    foreach ($data['alertred'] as $alert) {
        echo "<li>$alert</li>\n";
    echo "</ul></div>";
}
<input type="hidden" name="token" value="<?=$_GET['token'];?>">
            }else{
                $sort = " ASC";
        //print_r($cat);
                if($c->parent == null || $c->parent == '0' ){
    public static function error ($vars="", $val='') {
            include(GX_PATH.'/inc/lib/Control/Error/unknown.control.php');
        if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
            // VALIDATE ALL
            $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
        }
        if(isset($alertred)){
            $data['alertred'] = $alertred;
        }else{
            $slug = Typo::slugify(Typo::cleanX($_POST['cat']));
            $cat = Typo::cleanX($_POST['cat']);
            $cat = Db::insert(
                        sprintf("INSERT INTO `cat` VALUES (null, '%s', '%s', '%d', '' )", 
                            $cat, $slug, $_POST['parent']
                        )
                    );
            //print_r($cat);
            $data['alertgreen'][] = "Category Added: ".$_POST['cat'];
        }
        if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
            // VALIDATE ALL
            $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
        }
        if(isset($alertred)){
            $data['alertred'] = $alertred;
        }else{
            $vars = array(
                        'table' => 'cat',
                        'id' => $_POST['id'],
                        'key' => array(
                                    'name' => Typo::cleanX($_POST['cat'])
                                )
                    );
            $cat = Db::update($vars);
            $data['alertgreen'][] = "Category Updated: ".$_POST['cat'];
        }
    if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
        // VALIDATE ALL
        $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
    }
    if(isset($alertred)){
        $data['alertred'] = $alertred;
    }else{
        Categories::delete($_GET['id']);
        $data['alertgreen'][] = "Category Removed";
    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    $menus = Options::get('menus');
                    $menus = json_decode(Options::get('menus'), true);
                   //echo "<pre>"; print_r($menus); echo "</pre>";
                    // $menu = array(
                    //                 $_POST['id']  =>  array(
                    //                             'name' => $menus[$_POST['id']]['name'],
                    //                             'class' => $menus[$_POST['id']]['class'],
                    //                             'menu' => array(
                    //                                     'parent' => $_POST['parent'],
                    //                                     'menuid' => $_POST['id'],
                    //                                     'type' => $_POST['type'],
                    //                                     'value' => $_POST[$_POST['type']]
                    //                                 )
                    //                         )
                    //                 );
                    
                    // if(is_array($menus)){
                    //     $menu = array_merge($menus, $menu);
                    // }
                    // echo "<pre>"; print_r($menu); echo "</pre>";
                    //$menu = $menus;
                    $menu[$_POST['id']]['menu'] = $menus[$_POST['id']]['menu'];
                    $menu[$_POST['id']]['menu'][] = array(
                                                        'parent' => $_POST['parent'],
                                                        'menuid' => $_POST['id'],
                                                        'name' => Typo::cleanX($_POST['name']),
                                                        'type' => $_POST['type'],
                                                        'value' => $_POST[$_POST['type']],
                                                        'sub' => ''
                                                    );
                     $menu = array(
                                    $_POST['id']  =>  array(
                                                'name' => $menus[$_POST['id']]['name'],
                                                'class' => $menus[$_POST['id']]['class'],
                                                'menu' => $menu[$_POST['id']]['menu']    
                                            )
                                    );
                    if(is_array($menus)){
                        $menu = array_merge($menus, $menu);
                    }
                    //echo "<pre>"; print_r($menu); echo "</pre>";
                    $menu = json_encode($menu);
                    //echo "<pre>"; print_r($menu); echo "</pre>";
                    //Options::update('menus', $menu);

                    $vars = array(
                                'parent' => $_POST['parent'],
                                'menuid' => $_POST['id'],
                                'name' => Typo::cleanX($_POST['name']),
                                'class' => Typo::cleanX($_POST['class']),
                                'type' => $_POST['type'],
                                'value' => $_POST[$_POST['type']]
                            );
                    Menus::insert($vars);
                    $data['alertgreen'][] = 'Menu Added';
        $data['parent'] = Menus::isHadParent('', $menuid);
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    $vars = array(
                                'parent' => $_POST['parent'],
                                'menuid' => $_POST['id'],
                                'name' => Typo::cleanX($_POST['name']),
                                'class' => Typo::cleanX($_POST['class']),
                                'type' => $_POST['type'],
                                'value' => $_POST[$_POST['type']]
                            );
                    $vars = array(
                                'id' => $_GET['itemid'],
                                'key' => $vars
                            );
                    Menus::update($vars);
                    $data['alertgreen'][] = 'Menu Updated';
                }
        $data['parent'] = Menus::isHadParent('', $menuid);
            if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
                // VALIDATE ALL
                $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
            }
            if(isset($alertred)){
                $data['alertred'] = $alertred;
            }else{
                Menus::delete($_GET['itemid']);
                $data['alertgreen'][] = 'Menu Deleted';
            }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    $menu = array(
                                    $_POST['id']  =>  array(
                                                'name' => Typo::cleanX($_POST['name']),
                                                'class' => Typo::cleanX($_POST['class']),
                                                'menu' => array()
                                            )
                                    );
                    $menus = json_decode(Options::get('menus'), true);
                    if(is_array($menus)){
                        $menu = array_merge($menus, $menu);
                    }
                    
                    $menu = json_encode($menu);
                    Options::update('menus', $menu);
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    $vars = array(
                                'parent' => $_POST['parent'],
                                'menuid' => $_POST['id'],
                                'name' => Typo::cleanX($_POST['name']),
                                'class' => Typo::cleanX($_POST['class']),
                                'type' => $_POST['type'],
                                'value' => $_POST[$_POST['type']]
                            );
                    Menus::insert($vars);
                    $data['alertgreen'][] = 'Menu Item Added';
                }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    Menus::updateMenuOrder($_POST['order']);
                    $data['alertgreen'][] = 'Menu Order Changed';
                }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                    if (!isset($_POST['date']) || $_POST['date'] == "") {
                        # code...
                        $date = date("Y-m-d H:i:s");
                    }else{
                        $date = $_POST['date'];
                    }
                    $vars = array(
                                    'title' => Typo::cleanX($_POST['title']),
                                    'content' => Typo::cleanX($_POST['content']),
                                    'date' => $date,
                                    'type' => 'page',
                                    'author' => Session::val('username'),
                                    'status' => $_POST['status'],
                                );
                    //print_r($vars);
                    Posts::insert($vars);
                    $data['alertgreen'][] = "Page : {$_POST['title']} Added.";
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                    if (!isset($_POST['date']) || $_POST['date'] == "") {
                        # code...
                        $date = date("Y-m-d H:i:s");
                    }else{
                        $date = $_POST['date'];
                    }
                    $moddate = date("Y-m-d H:i:s");
                    $vars = array(
                                    'title' => Typo::cleanX($_POST['title']),
                                    'content' => Typo::cleanX($_POST['content']),
                                    'modified' => $moddate,
                                    'date' => $date,
                                    'status' => $_POST['status'],
                                );
                    //print_r($vars);
                    Posts::update($vars);
                    $data['alertgreen'][] = "Page : {$_POST['title']} Updated.";
                if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    $del = Posts::delete($_GET['id']);
                }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::publish($id);
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::unpublish($id);
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::delete($id);
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if(isset($alertred)){
                    $data['alertred'] = $alertred;
                    if (!isset($_POST['date']) || $_POST['date'] == "") {
                        # code...
                        $date = date("Y-m-d H:i:s");
                    }else{
                        $date = $_POST['date'];
                    }
                    $vars = array(
                                    'title' => Typo::cleanX($_POST['title']),
                                    'cat' => $_POST['cat'],
                                    'content' => Typo::cleanX($_POST['content']),
                                    'date' => $date,
                                    'type' => 'post',
                                    'author' => Session::val('username'),
                                    'status' => $_POST['status'],
                                );
                    //print_r($vars);
                    Posts::insert($vars);
                    $data['alertgreen'][] = "Post : {$_POST['title']} Added.";
                    
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if (isset($alertred)) {
                    # code...
                    $data['alertred'] = $alertred;
                }else{
                    $moddate = date("Y-m-d H:i:s");
                    $vars = array(
                                    'title' => Typo::cleanX($_POST['title']),
                                    'cat' => $_POST['cat'],
                                    'content' => Typo::cleanX($_POST['content']),
                                    'modified' => $moddate,
                                    'date' => $_POST['date'],
                                    'status' => $_POST['status'],
                                );
                    //print_r($vars);
                    
                    Posts::update($vars);
                    $data['alertgreen'][] = "Post : <b>{$_POST['title']}</b> Updated.";
                }
                if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if (isset($alertred)) {
                    # code...
                    $data['alertred'] = $alertred;

                    $title = Posts::title($_GET['id']);
                    $del = Posts::delete($_GET['id']);
                    //echo $title['error'];
                    if(isset($del['error'])){
                        $data['alertred'][] = $del['error'];
                    }else{
                        $data['alertgreen'][] = 'Post <b>'.$title.'</b> Removed';
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if (isset($alertred)) {
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::publish($id);
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if (isset($alertred)) {
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::unpublish($id);
                    }
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                if (isset($alertred)) {
                    $data['alertred'] = $alertred;
                }else{
                    foreach ($post_id as $id) {
                        # code...
                        Posts::delete($id);
                    }
$data = "";
        if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
            // VALIDATE ALL
            $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
        }
        if(isset($alertred)){
            $data['alertred'] = $alertred;
        }else{
            $vars = array();
            if(isset($_FILES['logo']) && $_FILES['logo'] != ''){
                $path = "/assets/images/";
                $allowed = array('png', 'jpg', 'gif');
                $upload = Upload::go('logo', $path, $allowed );
                if(isset($upload['error']) != ''){
                    echo $upload['error'];
                }else{
                    $vars['logo'] = $upload['path'];
                }
                unset($_POST['logo']);
            
            
            //print_r($_POST);
            $flip = array_flip($_POST);
            $sql = "SELECT * FROM `options` WHERE `value` = 'on'";        
            $q = Db::result($sql);
            foreach($q as $ob) {
                if( isset( $flip[$ob->name] ) ) {
                    $vars[$ob->name] = 'on';
                    //echo $ob->name;
                }else{
                    $vars[$ob->name] = 'off';
                    //echo $ob->name;
                }
            //print_r($ob);
            foreach ($_POST as $key => $val) {
                # code...
                $vars[$key] = $val;
            }
            unset($vars['change']);
            //print_r($vars);
            Options::update($vars);
            $data['alertgreen'][] = "New Settings Saved.";
System::inc('settings',$data);
                //check token first 
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                
                
                if (!isset($_GET['token']) || !Token::isExist($_GET['token'])) {
                    // VALIDATE ALL
                    $data['alertred'][] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }else{
                    User::delete($_GET['id']);
                    $data['alertgreen'][] = "User : ".$user." Removed";
                }
                
                // CHECK TOKEN FIRST 
                //echo Token::isExist($_POST['token']);
                if (!isset($_POST['token']) || !Token::isExist($_POST['token'])) {
                    // VALIDATE ALL
                    $alertred[] = "Token not exist, or your time has expired. Please refresh your browser to get a new token.";
                }
                    Token::remove(TOKEN);

<h2>Database Error</h2>
Something went wrong with the database.<br />
<span style="border-radius: 7px; border: 3px solid #cc0000; line-height: 35px; 
height: 50px; background-color: #aa0000; color: #fff; padding: 5px;">
<?php
echo $val;
?>
</span>
<h2>Unknown Error Occured</h2>
<?php if(isset($val)) {?>
<div class="alert alert-danger">
<?=$val;?>
</div>

<?php
    }
    Site::footer();
?>
                            AND `status` = '1'
    Theme::theme('header',$data);
    exit;
    exit;
                            AND `status` = '1'
Theme::theme('header',$data);
        exit;
                                    WHERE (`id` = '%d' OR `slug` = '%s')
                                    AND `status` = '1'
                                    Typo::cleanX($page)
            Theme::theme('header',$data);
            exit;
            exit;
                            WHERE `id` = '%d' 
                            AND `type` = 'post'
                            AND `status` = '1' 
                            LIMIT 1",
    Theme::theme('header',$data);
    exit;
    exit;
                <br>
            try {
                self::$mysqli = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
                if (self::$mysqli->connect_error) {
                    Control::error('db', self::$mysqli->connect_error);
                    exit;
                }else{
                    return true;
                }
            } catch (exception $e) {
                Control::error('db', $e->getMessage() );
            }
            
            //return self::$mysqli;
                Control::error('db',"Query failed: ".self::$mysqli->error."<br />\n"); 
                    // printf("<div class=\"alert alert-danger\">Errormessage: %s</div>\n", self::$mysqli->error);
                    //Control::error('db',self::$mysqli->error);
            new Site();
            Token::create();
*/error_reporting(0);








// DON't REMOVE or EDIT THIS.
                  `fname` varchar(32) COLLATE latin1_general_ci NULL,
            (null, 'ppsign', ''),
            (null, 'tokens', '')";
    public function __construct()
/**
* GeniXCMS - Content Management System
* 
* PHP Based Content Management System and Framework
*
* @package GeniXCMS
* @since 0.0.1 build date 20141007
* @version 0.0.1
* @link https://github.com/semplon/GeniXCMS
* @author Puguh Wijayanto (www.metalgenix.com)
* @copyright 2014-2015 Puguh Wijayanto
* @license http://www.opensource.org/licenses/mit-license.php MIT
*
*/

/**
* Menus Class.
* This class is for managing the menu at the dasboard. 
*
* @author Puguh Wijayanto (www.metalgenix.com)
* @since 0.0.1
    /**
    * Menus Constructor.
    * Nothing to construct
    * @since 0.0.1
    *
    */

    /**
    * isHadParent Function
    * 
    * This function is to get the list of parent in certain conditions. There are 
    * two paramaters to be inserted. 
    * @param int $parent
    * @param string $menuid
    * 
    * @author Puguh Wijayanto (www.metalgenix.com)
    * @since 0.0.1
    */
    public static function isHadParent($parent='', $menuid = ''){
        if(isset($parent)){
            $parent = " `parent` = '{$parent}'";
        }else{
            $parent = '1';
        }
        $sql = sprintf("SELECT * FROM `menus` WHERE %s %s", $parent, $where);
    public static function getParent($id){
        $q = self::getId($id);
        return $q[0]->parent;
                    $parent = self::isHadParent($m->id, $menuid);
                                    $parent = self::isHadParent($m2->id, $menuid);
                                                    $parent = self::isHadParent($m3->id, $menuid);
                                                                    $parent = self::isHadParent($m4->id, $menuid);
                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m->id}&token=".TOKEN."\" class=\"label label-danger pull-right\" >
                    $parent = self::isHadParent($m->id, $menuid);
                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m2->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m2->id}&token=".TOKEN."\" class=\"label label-danger pull-right\" >
                                        $parent = self::isHadParent($m2->id, $menuid);
                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m3->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m3->id}&token=".TOKEN."\" class=\"label label-danger pull-right\" >
                                                        $parent = self::isHadParent($m3->id, $menuid);
                                                                                <a href=\"index.php?page=menus&act=edit&id={$menuid}&itemid={$m4->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
                                                                                <a href=\"index.php?page=menus&act=del&id={$menuid}&itemid={$m4->id}&token=".TOKEN."\" class=\"label label-primary pull-right\" >
            $sql = sprintf("SELECT * FROM `menus` WHERE `id` = '%d'", $id);
    //             'name' => '',
    //             'value' => ''
                        'name' => $vars['name'],
                        'value' => $vars['value']
            $opt = Db::insert($ins);
        }else{
            Control::error('unknown','Format not Found, please in array');
        return $opt;
        $sql = "SELECT * FROM `posts` WHERE `type` = '{$type}' AND `status` = '1' ORDER BY `date` DESC LIMIT {$vars}";
            $where = "WHERE `status` = '1' AND ";
                    <title>".Site::$name."</title>
                    <link>".Site::$url."</link>
                    <description>".Site::$desc."</description>
    static $url;
    static $domain;
    static $name;
    static $key;
    static $desc;
        self::$url = Options::get('siteurl');
        self::$domain = Options::get('sitedomain');
        self::$name = Options::get('sitename');
        self::$key = Options::get('sitekeywords');
        self::$desc = Options::get('sitedesc');
            $sitenamelength = strlen(self::$name);
    <title>{$cont_title}".self::$name."</title>
    <meta name=\"Keyword\" content=\"".self::$key."\">
    <link href=\"".self::$url."/assets/css/bootstrap.min.css\" rel=\"stylesheet\">\n";
            \t<script src=\"".self::$url."/assets/js/bootstrap.min.js\"></script>
            \t<script src=\"".self::$url."/assets/js/ie10-viewport-bug-workaround.js\"></script>";
            \t<link href=\"".self::$url."/assets/css/summernote.css\" rel=\"stylesheet\">
            \t<script src=\"".self::$url."/assets/js/summernote.min.js\"></script>
            \t<script src=\"".self::$url."/assets/js/plugins/summernote-ext-fontstyle.js\"></script>
            \t<script src=\"".self::$url."/assets/js/plugins/summernote-ext-hello.js\"></script>
            \t<script src=\"".self::$url."/assets/js/plugins/summernote-ext-video.js\"></script>
            \t<link href=\"".self::$url."/assets/css/bootstrapValidator.min.css\" rel=\"stylesheet\">
            \t<script src=\"".self::$url."/assets/js/bootstrapValidator.min.js\"></script>
            $desc = substr(strip_tags(htmlspecialchars_decode($vars).". ".self::$desc),0,150);
            $desc = substr(self::$desc,0,150);
            $logo = "<img src=\"".self::$url.Options::get('logourl')."\"
            $logo = "<img src=\"".self::$url.Options::get('logo')."\"
    /** 
    * GeniXCMS Version Variable 
    * @return double
    */

    /** 
    * GeniXCMS Version Release 
    * @return string
    */
    /**
    * System Constructor.
    * Initializing the system, check the config file, if exist run the config
    * loader. 
    * @author Puguh Wijayanto (www.metalgenix.com)
    * @since 0.0.1
    */
            self::lang(GX_LANG);            
    /**
    * System Library Loader.
    * This will include library which is called.
    * @author Puguh Wijayanto (www.metalgenix.com)
    * @since 0.0.1
    */
/* Location: ./inc/lib/system.class.php */
<?php
/**
* GeniXCMS - Content Management System
* 
* PHP Based Content Management System and Framework
*
* @package GeniXCMS
* @since 0.0.2 build date 20150309
* @version 0.0.2
* @link https://github.com/semplon/GeniXCMS
* @author Puguh Wijayanto (www.metalgenix.com)
* @copyright 2014-2015 Puguh Wijayanto
* @license http://www.opensource.org/licenses/mit-license.php MIT
*
*/


/**
* Token Class
*
* @author Puguh Wijayanto (www.metalgenix.com)
* @since 0.0.2
*/
class Token
{
    public function __construct () {

    }

    public static function create() {
        self::ridOld();
        $length = "80";
        $token = "";
        $codeAlphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
        $codeAlphabet.= "abcdefghijklmnopqrstuvwxyz";
        $codeAlphabet.= "0123456789";
        $codeAlphabet.= SECURITY;
        for($i=0;$i<$length;$i++){
            $token .= $codeAlphabet[Typo::crypto_rand_secure(0,strlen($codeAlphabet))];
        }
        $url = $_SERVER['REQUEST_URI'];
        $url = htmlspecialchars($url, ENT_QUOTES, 'UTF-8');
        $ip = $_SERVER['REMOTE_ADDR'];
        $time = time();
        define('TOKEN', $token);
        define('TOKEN_URL', $url);
        define('TOKEN_IP', $ip);
        define('TOKEN_TIME', $time);
        $json = self::json();
        Options::update('tokens',$json);
        return $token;
    }

    /**
    * Json Token Function
    *
    * $token = [{'time','ip','url',token'},]
    */
    public static function json() {
        $token = Options::get('tokens');
        $token = json_decode($token, true);
        $newtoken = array(
                        TOKEN => array(
                            'time' => TOKEN_TIME,
                            'ip' => TOKEN_IP,
                            'url' => TOKEN_URL
                            )
                    );
        if(is_array($token)){
            $newtoken = array_merge($token, $newtoken);
        }

        $newtoken = json_encode($newtoken);
        return $newtoken;
    }

    public static function isExist($token){
        $json = Options::get('tokens');
        $tokens = json_decode($json, true);
        if(array_key_exists($token, $tokens)){
            $call = true;
        }else{
            $call = false;
        }
        return $call;
    }

    public static function remove($token){
        $json = Options::get('tokens');
        $tokens = json_decode($json, true);
        unset($tokens[$token]);
        $tokens = json_encode($tokens);
        if(Options::update('tokens',$tokens)){
            return true;
        }else{
            return false;
        }
    }

    public static function ridOld() {
        $json = Options::get('tokens');
        $tokens = json_decode($json, true);
        $time = time();
        foreach ($tokens as $token => $value) {
            # code...
            //print_r($token);
            if ($time - $value['time'] > 600) {
                # code...
                unset($tokens[$token]);
            }
        }
        $tokens = json_encode($tokens);
        if(Options::update('tokens',$tokens)){
            return true;
        }else{
            return false;
        }
    }
}
                    $result['fileurl'] = Site::$url.$path.$uniqfile.$filename;
                $url = Site::$url."/".self::slug($vars)."/{$vars}";
                $url = Site::$url."/index.php?post={$vars}";
                $url = Site::$url."/".self::slug($vars).GX_URL_PREFIX;
                $url = Site::$url."/index.php?page={$vars}";
                $url = Site::$url."/".$vars."/".Typo::slugify(Categories::name($vars));
                $url = Site::$url."/index.php?cat={$vars}";
                $url = Site::$url."/sitemap".GX_URL_PREFIX;
                $url = Site::$url."/index.php?page=sitemap";
                $url = Site::$url."/rss".GX_URL_PREFIX;
                $url = Site::$url."/index.php?rss";