<?php
session_start();
header("Content-Security-Policy: default-src 'self'");
header("X-Frame-Options: DENY");
// Configuration
define('MAX_FILE_SIZE', 2 * 1024 * 1024); // 2MB
define('ALLOWED_TYPES', ['image/jpeg', 'image/png', 'image/gif']);
$templates = [
'basic' => '
<div class="template-basic">
{header}
<div class="content-block">{content}</div>
{footer}
</div>
',
'newsletter' => '
<div class="newsletter-template">
<header class="newsletter-header">{header}</header>
<div class="grid-layout">{content}</div>
{footer}
</div>
',
'custom' => '
<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<style>
#content-desk-mobile { display: block; }
#content-mozilla { display: none; }
@supports not ( -moz-appearance:none ) {
#content-desk-mobile { display: none; }
#content-mozilla { display: block; }
}
</style>
</head>
<body>
<center>
<div><h2 style="background:{bg_color}; color:{text_color}">{subject}</h2></div>
{content}
<img style="width:0px;height:0px;display:none;" src="http://[placeholder1]/track/[open]"/>
</center>
</body>
</html>
'
];
// Process form submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$response = handleSubmission();
}
function handleSubmission() {
global $templates; // Add global declaration
$data = [
'subject' => filter_input(INPUT_POST, 'subject', FILTER_SANITIZE_SPECIAL_CHARS),
'template' => filter_input(INPUT_POST, 'template', FILTER_SANITIZE_SPECIAL_CHARS),
'bg_color' => filter_input(INPUT_POST, 'bg_color', FILTER_SANITIZE_SPECIAL_CHARS),
'text_color' => filter_input(INPUT_POST, 'text_color', FILTER_SANITIZE_SPECIAL_CHARS),
'domain' => filter_input(INPUT_POST, 'domain', FILTER_SANITIZE_URL),
'offer_image' => filter_input(INPUT_POST, 'offer_image', FILTER_SANITIZE_URL),
'unsubscribe_image' => filter_input(INPUT_POST, 'unsubscribe_image', FILTER_SANITIZE_URL),
'images' => [],
'links' => []
];
// Process image URLs
foreach ($_POST['links'] ?? [] as $link) { // Handle undefined links
if (filter_var($link, FILTER_VALIDATE_URL)) {
$data['links'][] = htmlspecialchars($link);
}
}
// Process file uploads
if (!empty($_FILES['uploads'])) {
foreach ($_FILES['uploads']['tmp_name'] as $key => $tmpName) {
if ($_FILES['uploads']['error'][$key] === UPLOAD_ERR_OK) {
$fileInfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($fileInfo, $tmpName);
if (in_array($mime, ALLOWED_TYPES) && $_FILES['uploads']['size'][$key] <= MAX_FILE_SIZE) {
$filename = uniqid() . '_' . basename($_FILES['uploads']['name'][$key]);
move_uploaded_file($tmpName, "uploads/" . $filename);
$data['images'][] = 'uploads/' . $filename;
}
}
}
}
return generateTemplate($data);
}
function generateTemplate($data) {
global $templates; // Access global templates
$web_version = htmlspecialchars($_POST['web_version'] ?? '');
$unsubscribe = htmlspecialchars($_POST['unsubscribe'] ?? '');
if ($data['template'] === 'custom') {
return str_replace(
['{subject}', '{bg_color}', '{text_color}', '{content}'],
[
$data['subject'],
$data['bg_color'],
$data['text_color'],
'<div id="content-mozilla">
<img src="'.htmlspecialchars($data['offer_image'] ?? '').'" style="border: 3px solid #fffff;" usemap="#eAPz" />
<map name="eAPz">
<area href="http://'.htmlspecialchars($data['domain'] ?? '').'/[click]" shape="rect" coords="0,{offer_height},{offer_width},0" />
</map><br>
<img src="'.htmlspecialchars($data['unsubscribe_image'] ?? '').'" style="border: 3px solid #fffff;" usemap="#l0Lb" />
<map name="l0Lb">
<area href="http://'.htmlspecialchars($data['domain'] ?? '').'/[unsb]" shape="rect" coords="0,{unsub_height},{unsub_width},0" />
</map>
</div>'
],
$templates['custom'] ?? ''
);
}
$content = '';
foreach (array_merge($data['links'], $data['images']) as $media) {
$content .= '<img src="'.htmlspecialchars($media).'" class="responsive-image" alt="Content image">';
}
$template = $templates[$data['template'] ?? 'basic'] ?? $templates['basic'];
return str_replace(
['{content}', '{header}', '{footer}'],
[
$content,
'<header class="email-header"><h1>'.$data['subject'].'</h1></header>',
'<footer class="email-footer"><p>© '.date('Y').' Company Name | '.
'<a href="'.$web_version.'">Web Version</a> | '.
'<a href="'.$unsubscribe.'">Unsubscribe</a></p></footer>'
],
$template
);
}
?>
<!DOCTYPE html>
<html lang="en">
<!-- REST OF THE HTML REMAINS THE SAME -->