<?php
	
	/************************************************************************\
	|* Load in the library modules
	\************************************************************************/
    require_once("../lib/dbase.php");
	require_once("/www/lib/modules/dynamicFirewall.php");
	
	/************************************************************************\
	|* Connect to the database
	\************************************************************************/
 	$db = DBconnect();
	DBselect($db);

	/************************************************************************\
	|* If we're passed a non-numeric image-id, cry havoc and let slip the 
	|* dogs of war
	\************************************************************************/
        $img = $_GET["img"];
	if ($img == "")
		exit;

	if (!is_numeric($img))
		{
		$df  = new DynamicFirewall();
		$why = "Access to /img/show.html with an illegal image reference";
		
		ob_start();
		echo "_SERVER:\n";
		print_r($_SERVER);
		echo "\n\n_REQUEST:\n";
		print_r($_REQUEST);
		$info = ob_get_clean();
		
		$status = $df->pendingBlock($_SERVER["REMOTE_ADDR"], $why, $info, $_SERVER);
		
		if ($status["state"] == TRUE)
			{
			Header("Location: http://www.fire-walled.net/incisive.html?s=".
				   urlencode($status["text"])."&why=".urlencode($why));
			Header("Window-target: _blank");
			exit;
			}
		else
			echo $status["text"];
			
		exit;
		}

	/************************************************************************\
	|* Find the image
	\************************************************************************/
 	$sql = "SELECT name,mime FROM data WHERE id=$img";
    if (!($result = mysql_query($sql)))
        {
        echo "Sorry. Cannot perform '$sql'";
        exit;
        }
	$row = mysql_fetch_array($result);
    
	/************************************************************************\
	|* And send it off
	\************************************************************************/
 	Header("Content-Type: $row[mime]");
    readfile("/www/net/db.riskwaters.com/data/".$row["name"]);