| Server IP : 210.245.233.93 / Your IP : 216.73.216.226 Web Server : Apache/2.2.15 (CentOS) System : Linux webserver2.onesolution.com.hk 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64 User : apache ( 48) PHP Version : 5.3.3 Disable Function : exec, shell_exec, system, passthru, popen, proc_open, pcntl_exec MySQL : ON | cURL : ON | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : ON Directory : /var/www/hkosl.com/m.musiccircle/ |
Upload File : |
<?php
include('_init.php');
require_once 'webadmin/function_auth.php';
if ($_SESSION["is_tutor"] != 1) {
header("Location: index.php");
exit;
}
require_once("webadmin/mime_type_lib.php");
$nowdate = date("Y-m-d H:i:s");
$message = "";
//print_r($cms_user_info);
if ($_POST["id"]) {
$row = get_teacher((int)$_POST["id"]);
}
if (!$row['id']) {
if (!$_POST["email"]) {
$message .= _lang("請輸入你的電郵") . "\\n\\n";
} else {
//checkEmail
$sql = "SELECT count(*) as count FROM tutor_main WHERE email=? AND deleted = 0";
$parameters = array($_POST['email']);
$record_email = bind_pdo($sql, $parameters, "selectone");
if ($record_email['count'] > 0) {
$message .= _lang("你的電郵已有人使用") . "\\n\\n";
}
}
if (!$_POST["password"]) {
$message .= _lang("請輸入你的密碼") . "\\n\\n";
} else {
if (strlen($_POST["password"]) < 8) {
$message .= _lang("必須輸入最少8位字元的密碼") . "\\n\\n";
} elseif ($_POST["password"] != $_POST["repassword"]) {
$message .= _lang("你輸入的密碼不一致") . "\\n\\n";
}
}
}else{
if ($_POST["password"]) {
if (strlen($_POST["password"]) < 8) {
$message .= _lang("必須輸入最少8位字元的密碼") . "\\n\\n";
} elseif ($_POST["password"] != $_POST["repassword"]) {
$message .= _lang("你輸入的密碼不一致") . "\\n\\n";
}
}
}
if (!empty($message)) {
echo "<script>alert('" . $message . "'); history.back();</script>";
exit;
}
if ($row) {
$id = intval($_POST['id']);
if ($_POST["password"]) {
$data['cmsloginpw'] = Password::hash($_POST['password']);
$sql = mysql_install($data, 'sys_cms_login', 'edit', 'cmsloginid');
$data['cmsloginid'] = $row{'cmsloginid'};
$arraykey = array_keys($data);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $data[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
unset($data);
}
} else {
//CMS Login
$sql = "select max(cmsloginid) as maxid from sys_cms_login ";
$parameters = array();
$row2 = bind_pdo($sql, $parameters, "selectone");
$cmsloginid = $row2{"maxid"} + 1;
$data['cmsloginid'] = $cmsloginid;
$data['cmsusername'] = aes_crypt($_POST['email'], 1);
$data['cmsloginname'] = aes_crypt($_POST['email'], 1);
$data['cmsloginpw'] = Password::hash($_POST['password']);
$data['cmsrole'] = 'user';
$data['cmsstatus'] = '1';
$data['createdate'] = $nowdate;
$data['createby'] = '';
$data['lastupdate'] = $nowdate;
$data['lastupby'] = '';
$data['password_expirydate'] = '2047-07-01';
$data['deleted'] = 0;
$data['is_tutor'] = 1;
$data['is_student'] = 0;
$sql = mysql_install($data, 'sys_cms_login', 'add');
$arraykey = array_keys($data);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $data[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
//
unset($data);
$data['deleted'] = 0;
$data['profile_id'] = 3;
$data['user_id'] = $cmsloginid;
$sql = mysql_install($data, 'profile_user', 'add');
$arraykey = array_keys($data);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $data[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
unset($data);
//
$sql = "select max(id) as maxid from tutor_main ";
$parameters = array();
$row2 = bind_pdo($sql, $parameters, "selectone");
$id = $row2{"maxid"} + 1;
$data['tutor_no'] = gettutorNo($id);
$data['status'] = 4;
$data['approved'] = 1;
$data['approved_date'] = $nowdate;
$data['approved_by'] = $_SESSION['cmsloginid'];
$data['createdate'] = $nowdate;
$data['lastupdate'] = $nowdate;
$data['id'] = $id;
$data['cmsloginid'] = $cmsloginid;
$data['email'] = aes_crypt($_POST['email'], 1);
$data['isemailverified'] = 1;
$data['isphoneverified'] = 1;
}
if ($_POST['mobno']) {
$data['mobno'] = aes_crypt($_POST['mobno'], 1);
}
$data['nickname'] = $_POST['nickname'];
$data['name_en'] = $_POST['name_en'];
$data['name_cn'] = $_POST['name_cn'];
if (!$_POST["profilephoto_path_on"]) {
$data['profilephoto_path'] = '';
}
if (!empty($_POST["base64_profilephoto_path"])) {
$base64_string = $_POST["base64_profilephoto_path"];
$file_data = explode(',', $base64_string);
if (strpos($file_data[0], "image/jpeg") !== false || strpos($file_data[0], "image/png") !== false) {
if (strpos($file_data[0], "image/jpeg") !== false) {
$file_ext = ".jpg";
} else if (strpos($file_data[0], "image/png") !== false) {
$file_ext = ".png";
}
$newfilename = random_string(10) . "_tutor_profilephoto_path_" . $id . $file_ext; // default length 8
$output_file = "file/teacher/" . $newfilename;
$ifp = fopen($output_file, "wb");
fwrite($ifp, base64_decode($file_data[1]));
fclose($ifp);
image_fix_orientation("file/teacher/" . $newfilename);
$data['profilephoto_path'] = $newfilename;
//copy file to production
$auth_code = aes_crypt(date("Ymd") . "imusiccircle", 1);
$url = $site_info["url"] . "copy_files.php";
$postData = array("auth_code" => $auth_code, "app_file_full_path" => $site_info["app_url"] . "file/teacher/" . $newfilename, "app_file_path" => "file/teacher/" . $newfilename);
$copy_files = call_curl($url, $postData, 1);
$sql = "update tutor_main set copy_files = ? where id = ?";
$parameters = array($copy_files, $id);
bind_pdo($sql, $parameters);
}
}
$data['idno'] = aes_crypt($_POST['idno'], 1);
$data['hometelno'] = aes_crypt($_POST['hometelno'], 1);
$data['gender'] = $_POST['gender'];
$data['dob_mon'] = $_POST['dob_mon'];
$data['dob_year'] = $_POST['dob_year'];
$data['mas_residencecode'] = $_POST['mas_residencecode'];
$data['mas_teachexp'] = $_POST['mas_teachexp'];
$data['self_describemyself'] = $_POST['self_describemyself'];
$data['self_intro'] = $_POST['self_intro'];
$data['youtube_url'] = $_POST['youtube_url'];
$data['studentagerange_expected'] = $_POST['studentagerange_expected'];
$data['cansupplyinstrument'] = $_POST['cansupplyinstrument'];
$data['canaccompany'] = $_POST['canaccompany'];
$sql = "select profile_id from `profile_user` as tb where user_id = ? and deleted = ? LIMIT 1";
$parameters = array($_SESSION['cmsloginid'], 0);
$row_profile = bind_pdo($sql, $parameters, "selectone");
if ($row_profile['profile_id'] == 1 || $row_profile['profile_id'] == 2) {
$data['recommend'] = (int)$_POST['recommend'];
$data['youtube'] = $_POST['youtube'];
}
if ($row_profile['profile_id'] == 3) {
$data['approved'] = 0;
$data['approved_date'] = $nowdate;
$data['approved_by'] = $_SESSION['cmsloginid'];
insert_approval_list('TUTOR', 'tutor_main', $id);
}
$data['lastupby'] = $_SESSION['cmsloginid'];
$data['lastupdate'] = $nowdate;
$data['deleted'] = 0;
if ($row) {
$sql = mysql_install($data, 'tutor_main', 'edit', 'id', $id);
$data['id'] = $id;
} else {
$sql = mysql_install($data, 'tutor_main', 'add');
}
$arraykey = array_keys($data);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $data[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
// 授課場地
unset($tmpdata);
$sql = "DELETE FROM `tutor_teachvenus` WHERE tutormain_id=?;";
$parameters = array($id);
bind_pdo($sql, $parameters);
foreach ($_POST['teachvenus_id'] as $value) {
$tmpdata['tutormain_id'] = $id;
$tmpdata['mas_teachvenus'] = $value;
$tmpdata['lastupby'] = $nowdate;
$tmpdata['lastupdate'] = $_SESSION['cmsloginid'];
$tmpdata['deleted'] = 0;
$sql = mysql_install($tmpdata, 'tutor_teachvenus', 'add');
$arraykey = array_keys($tmpdata);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $tmpdata[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
}
// 授課模式
unset($tmpdata);
$sql = "DELETE FROM `tutor_teachmode` WHERE tutormain_id=?;";
$parameters = array($id);
bind_pdo($sql, $parameters);
if (is_array($_POST['teachmode_id'])) {
foreach ($_POST['teachmode_id'] as $value) {
$tmpdata['tutormain_id'] = $id;
$tmpdata['mas_teachmode'] = $value;
$tmpdata['lastupby'] = $nowdate;
$tmpdata['lastupdate'] = $_SESSION['cmsloginid'];
$tmpdata['deleted'] = 0;
$sql = mysql_install($tmpdata, 'tutor_teachmode', 'add');
$arraykey = array_keys($tmpdata);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $tmpdata[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
}
}
// 樂器履歷
unset($tmpdata);
$sql = "instrumentquali";
$sql = "DELETE FROM `tutor_instrumentquali` WHERE tutormain_id=?;";
$post = formatPostData($_POST['instrumentquali']);
$parameters = array($id);
bind_pdo($sql, $parameters);
if (is_array($post)) {
foreach ($post as $value) {
$tmpdata['tutormain_id'] = $id;
$tmpdata['mas_instrument'] = $value['mas_instrument'];
$tmpdata['grade'] = $value['grade'];
$tmpdata['year'] = $value['year'];
$tmpdata['lastupby'] = $nowdate;
$tmpdata['lastupdate'] = $_SESSION['cmsloginid'];
$tmpdata['deleted'] = 0;
$sql = mysql_install($tmpdata, 'tutor_instrumentquali', 'add');
$arraykey = array_keys($tmpdata);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $tmpdata[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
}
}
//上載音樂証書
unset($tmpdata);
if (is_array($_POST['tutor_cert']['id'])) {
$sql = "DELETE FROM `tutor_cert` WHERE tutormain_id=? and id not in (" . implode(',', $_POST['tutor_cert']['id']) . ");";
} else {
$sql = "DELETE FROM `tutor_cert` WHERE tutormain_id=?;";
}
$file = formatPostData($_FILES['tutor_cert']);
$parameters = array($id);
bind_pdo($sql, $parameters);
if (is_array($file)) {
for ($i = 0; $i < count($file['file']['name']); $i++) {
if ($file['file']['name'][$i]) {
//check if image type is valid or not
$mime = get_file_mime_type($file['file']['tmp_name'][$i]);
if (($mime == "image/jpeg") || ($mime == "image/png") || ($mime == "application/pdf")) {
$filename = $file['file']['name'][$i];
preg_match("/\.([^\.]+)$/", $filename, $file_ext);
$newfilename = random_string(10) . "_teacher_refid_" . $id . "." . $file_ext[1]; // default length 8
move_uploaded_file($file['file']['tmp_name'][$i], "file/teacher/" . $newfilename) or die ("Could not copy the file");
image_fix_orientation("file/teacher/" . $newfilename);
$photo = $newfilename;
//copy file to production
$auth_code = aes_crypt(date("Ymd") . "imusiccircle", 1);
$url = $site_info["url"] . "copy_files.php";
$postData = array("auth_code" => $auth_code, "app_file_full_path" => $site_info["app_url"] . "file/teacher/" . $newfilename, "app_file_path" => "file/teacher/" . $newfilename);
$copy_files = call_curl($url, $postData, 1);
} else {
$invalid_upload_file_format = true;
}
/*if ($invalid_upload_file_format) {
echo '<script>alert("' . _lang("Invalid file format.") . '"); history.back();</script>';
exit;
}*/
//check if image type is valid or not
/*$filename = $file['file']['name'][$i];
preg_match("/\.([^\.]+)$/", $filename, $file_ext);
$newfilename = random_string(10) . "_cert_refid_" . $id . "." . $file_ext[1]; // default length 8
move_uploaded_file($file['file']['tmp_name'][$i], "file/teacher/" . $newfilename) or die ("Could not copy the file");
$photo = $newfilename;*/
$tmpdata['tutormain_id'] = $id;
$tmpdata['cert_path'] = $photo;
$tmpdata['lastupby'] = $nowdate;
$tmpdata['lastupdate'] = $_SESSION['cmsloginid'];
$tmpdata['deleted'] = 0;
if ($_POST['tutor_cert']['id'][$i]) {
$sql = mysql_install($tmpdata, 'tutor_cert', 'edit', 'id');
$tmpdata['id'] = $_POST['tutor_cert']['id'][$i];
$arraykey = array_keys($tmpdata);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $tmpdata[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
} else {
$sql = mysql_install($tmpdata, 'tutor_cert', 'add');
$arraykey = array_keys($tmpdata);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $tmpdata[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
}
}
}
}
// 期望學生年齡
unset($tmpdata);
$sql = "DELETE FROM `tutor_expstudentage` WHERE tutormain_id=?;";
$parameters = array($id);
bind_pdo($sql, $parameters);
if (is_array($_POST['expstudentage_id'])) {
foreach ($_POST['expstudentage_id'] as $value) {
$tmpdata['tutormain_id'] = $id;
$tmpdata['mas_expstudentage'] = $value;
$tmpdata['lastupby'] = $_SESSION['cmsloginid'];
$tmpdata['lastupdate'] = $nowdate;
$tmpdata['deleted'] = 0;
$sql = mysql_install($tmpdata, 'tutor_expstudentage', 'add');
$arraykey = array_keys($tmpdata);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $tmpdata[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
}
}
//授課地區
$sql = "DELETE FROM `tutor_teachareacode` WHERE tutormain_id=?;";
$parameters = array($id);
bind_pdo($sql, $parameters);
$sql = "select * from master_type_code where typeid = ? and deleted = ?";
$parameters = array('TEACH_AREACODE', 0);
$rows_area = bind_pdo($sql, $parameters, "selectall");
foreach ($rows_area as $row_area) {
unset($studenhome_addcharge);
foreach ($_POST['studenhome_addcharge' . $row_area['id']] as $value) {
if ($value) {
$studenhome_addcharge[] = $value;
}
}
foreach ($_POST['area' . $row_area['id']] as $index => $value) {
unset($tmpdata);
echo $row_area['id'] . $index . '<br>';
$tmpdata['tutormain_id'] = $id;
$tmpdata['mas_teachareacode'] = $value;
$tmpdata['studenhome_addcharge'] = $studenhome_addcharge[$index] ? $studenhome_addcharge[$index] : 0;
$tmpdata['lastupdate'] = $nowdate;
$tmpdata['deleted'] = 0;
$sql = mysql_install($tmpdata, 'tutor_teachareacode', 'add');
$arraykey = array_keys($tmpdata);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $tmpdata[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
}
}
//選擇任教樂器
$sql = "select id from tutor_charge where tutormain_id = ?";
$parameters = array($id);
$rows_charge = bind_pdo($sql, $parameters, "selectall");
foreach ($rows_charge as $row_charge) {
$sql = "DELETE FROM `tutor_expectcharge` WHERE charge_id = ?;";
$parameters = array($row_charge['id']);
bind_pdo($sql, $parameters);
}
$sql = "DELETE FROM `tutor_charge` WHERE tutormain_id=?;";
$parameters = array($id);
bind_pdo($sql, $parameters);
if (is_array($_POST['tutor_expectcharge'])) {
//print_r($_POST['tutor_expectcharge']);
for ($q = 1; $q <= 6; $q++) {
if ($_POST['tutor_expectcharge']['mas_instrument' . $q]) {
unset($tmpdata);
$sql = "select max(id) as maxid from tutor_charge ";
$parameters = array();
$row2 = bind_pdo($sql, $parameters, "selectone");
$charge_id = $row2{"maxid"} + 1;
$tmpdata['id'] = $charge_id;
$tmpdata['tutormain_id'] = $id;
$tmpdata['instrument_no'] = $q;
$tmpdata['mas_instrument'] = $_POST['tutor_expectcharge']['mas_instrument' . $q];
$tmpdata['lastupdate'] = $nowdate;
$tmpdata['deleted'] = 0;
$sql = mysql_install($tmpdata, 'tutor_charge', 'add');
$arraykey = array_keys($tmpdata);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $tmpdata[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
for ($a = 1; $a <= 9; $a++) {
if ($_POST['tutor_expectcharge']['charge_30min' . $q . '_' . $a] || $_POST['tutor_expectcharge']['charge_45min' . $q . '_' . $a] || $_POST['tutor_expectcharge']['charge_60min' . $q . '_' . $a]) {
unset($tmpdata);
$tmpdata['charge_id'] = $charge_id;
$tmpdata['type'] = 'fee';
$tmpdata['grade'] = $a;
$tmpdata['charge_30min'] = $_POST['tutor_expectcharge']['charge_30min' . $q . '_' . $a];
$tmpdata['charge_45min'] = $_POST['tutor_expectcharge']['charge_45min' . $q . '_' . $a];
$tmpdata['charge_60min'] = $_POST['tutor_expectcharge']['charge_60min' . $q . '_' . $a];
$tmpdata['lastupdate'] = $nowdate;
$tmpdata['deleted'] = 0;
$sql = mysql_install($tmpdata, 'tutor_expectcharge', 'add');
$arraykey = array_keys($tmpdata);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $tmpdata[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
}
}
for ($a = 1; $a <= 3; $a++) {
if ($_POST['tutor_expectcharge']['t_charge_30min' . $q . '_' . $a] || $_POST['tutor_expectcharge']['t_charge_45min' . $q . '_' . $a] || $_POST['tutor_expectcharge']['t_charge_60min' . $q . '_' . $a]) {
unset($tmpdata);
$tmpdata['charge_id'] = $charge_id;
$tmpdata['type'] = 'tfee';
$tmpdata['grade'] = $a;
$tmpdata['charge_30min'] = $_POST['tutor_expectcharge']['t_charge_30min' . $q . '_' . $a];
$tmpdata['charge_45min'] = $_POST['tutor_expectcharge']['t_charge_45min' . $q . '_' . $a];
$tmpdata['charge_60min'] = $_POST['tutor_expectcharge']['t_charge_60min' . $q . '_' . $a];
$tmpdata['lastupdate'] = $nowdate;
$tmpdata['deleted'] = 0;
$sql = mysql_install($tmpdata, 'tutor_expectcharge', 'add');
$arraykey = array_keys($tmpdata);
unset($parameters);
for ($i = 0; $i < count($arraykey); $i++) {
$parameters[$i] = $tmpdata[$arraykey[$i]];
}
bind_pdo($sql, $parameters);
}
}
}
}
}
$row = get_teacher((int)$id);
if ($row['status'] > 2) {
$status = 2;
} else if ($row['status'] <= 2) {
$status = 1;
}
if ($invalid_upload_file_format) {
echo '<script>alert("' . _lang("部份音樂証書格式不正確。請重新上載。") . '"); history.back();</script>';
exit;
}else{
//header("Location: tutor_profile.php?update=1");
header("Location: index.php");
}