403Webshell
Server IP : 210.245.233.93  /  Your IP : 216.73.216.226
Web Server : Apache/2.2.15 (CentOS)
System : Linux webserver2.onesolution.com.hk 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64
User : apache ( 48)
PHP Version : 5.3.3
Disable Function : exec, shell_exec, system, passthru, popen, proc_open, pcntl_exec
MySQL : ON  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/onesupportdemo.onesolution.hk/customerProfile/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/onesupportdemo.onesolution.hk/customerProfile//modify.php
<?php
global $dbh;

require_once('../inc/configure.php');
	//require_once('../inc/configure.php');
	//session_start();
	
	
			//var_dump(!empty($_POST["actionCode"]), $_GET, isGet(), $_POST, isPost());
			//throw new Exception("sql prepare statement failure: $sql");
			
			
	//Ajax Function
	if(!empty($_POST["actionCode"])){
		$nowdate = date("Y-m-d H:i:s");
		
		//Get a saved record from customerProfileOtherInfo 
		if ( $_POST["actionCode"] == "R" ) {
			$sql = "select * from customerProfileOtherInfo where profile_id = ? and status = 0";
			$result = tableInfo::recordData($sql, $_POST["profileId"], "Y");
			$idx = 0;
			foreach($result as $r){ 
				$r["login_pw"] = security::encrypt_decrypt('decrypt', $r["login_pw"]);
				$result[$idx] = $r;
				$idx++;
			}
			echo json_encode($result);
			exit;
		}
		//Save new record
		if ( $_POST["actionCode"] == "S" ) {
			$result = tableInfo::getColumns("customerProfileOtherInfo");
			
			foreach ($result as $column) {
				$column = $column['column_name'];
				if (isset($_POST[$column])) {
					$temp[$column] = $_POST[$column];
				}
			}
			
			$columns = array();
			$values = array();
			$parameters = array();		
			if ( $_POST["id"] == '0' ) {	
				foreach ($temp as $column => $value) {
					if ( $column == "login_pw" ) {
						$value = security::encrypt_decrypt('encrypt', $value);
					}
					$columns[] = $column;
					$parameters[] = !strlen($value) ? null : $value;
					$values[] = '?';
				}
				
				$columns = array_merge($columns, array('created_at', 'created_by'));
				$values = array_merge($values,  array('?', '?'));
				$parameters = array_merge($parameters, array($nowdate, $_SESSION['webadmin']['id']));
				
				$sql = "INSERT customerProfileOtherInfo (" . implode(', ', $columns) . ") VALUES (" . implode(', ', $values) . ")";	
			} else {
				var_dump($_POST);
				//$oAct = tableInfo::recordData("select * from customerProfileOtherInfo where id = ?", $_POST["id"])[0];
				$result = tableInfo::recordData("select * from customerProfileOtherInfo where id = ?", $_POST["id"], "N");
				$oAct = $result[0];
				foreach ($temp as $column => $value) {
					if ($column != 'id' && $column != 'profile_id') {
						switch ($column) {
							case 'loginpw': {
								if (!empty($value)) {
									$parameters[] = md5($value);
									$values[] = "`$column` = ?";
								}
								break;
							}
							case 'login_pw': {
								$value = security::encrypt_decrypt('encrypt', $value);
								$parameters[] = $value;
								$values[] = "`$column` = ?";
								break;
							}							
							default: {
								$parameters[] = !strlen($value) ? null : $value;
								$values[] = "`$column` = ?";
								break;
							}
						}
						
						$oldValue = $oAct[$column];		
						if ( $value != $oldValue ) {
							$changes[] = array("customerProfileOtherInfo", $column, $_POST["id"], $oldValue, $value);
						}
					}
				}		
				if ($_POST['profile_delete'] == "Y") { 
					$changes[] = array("customerProfileOtherInfo", "status", $_POST["id"], "0", "1");
					$values = array_merge($values,  array("`deleted_at` = ?", "`deleted_by` = ?", "`status` = ?"));
					$parameters = array_merge($parameters, array($nowdate, $_SESSION['webadmin']['id'], 1));					
				} else {
					$values = array_merge($values,  array("`updated_at` = ?", "`updated_by` = ?"));
					$parameters = array_merge($parameters, array($nowdate, $_SESSION['webadmin']['id']));
				}
				$sql = "UPDATE customerProfileOtherInfo SET " . implode(', ', $values) . " WHERE id = ?";
				$parameters[] = $_POST["id"];		
		
				if ( !is_null($changes) ) {
					//Do log changes here
					logChanges($changes);
				}
			}
			$result = tableInfo::updateRecord($sql, $parameters);				
		
			$outValue = $result;
			echo $outValue;
			exit;
		}	
	}
	
	
	if(!empty($_SESSION['webadmin'])){
		if (isPost()) {
			$cust_id = $_POST["cust_id"];
			$ids = $_POST["line_id"];
			$nowdate = date("Y-m-d H:i:s");
			$message = "";
			
			//var_dump($ids, "------", $_POST);
			//throw new Exception("sql prepare statement failure: $sql");
			
			
			$columns = tableInfo::getColumns("customerProfile");
			
			foreach($ids as $cId){
				unset($parameters);
				unset($values);
				unset($changes);

				//$ocp = tableInfo::recordData("select * from customerProfile where id = ?", $cId)[0];
				
				unset($ocp);
				
				$result = tableInfo::recordData("select * from customerProfile where id = ?", $cId, "N");
				$ocp = $result[0];
				
				//var_dump("Current id = $cId ---- select * from customerProfile where id = $cId");
				
				//if ($cId == "7") {
				//	var_dump($ocp, "__________");
				//}
		
		//var_dump("---", $ocp);
				
				foreach ($columns as $column) {
					$column = $column['column_name'];
					if (isset($_POST[$column])) {
						$cp[$column] = $_POST[$column][$cId];
						
						$abc = $_POST[$column][$cId];
						
						$value = $cp[$column];
						$oldValue = $ocp[$column];
						
						//if ( $column == "location" && $cId == "7" ) {
							//var_dump("(id)", $ids, "----Current", $cId, "----Name", $column, "----value", $cp[$column]);
							//var_dump($abc, $value, $oldValue);
							//var_dump(" ~~~~~~~~~~~~~~~~~~~~~~~~ ", $_POST[$column]["7"]);
						//}
						
						
						if ( $value != $oldValue ) {
							

						//var_dump("----Current", $cId, "----Name", $column, "----value", $value, "----old value", $oldValue, "select * from customerProfile where id = $cId");
						//throw new Exception("------");							
							
							$changes[] = array("customerProfile", $column, $cId, $oldValue, $value);
							
							
							$parameters[] = !strlen($value) ? null : $value;
							$values[] = "`$column` = ?";
							
							if ( $column == "status" ) {
								$updateColumn = $value == "1" ? "deleted_at" : "updated_at";
								$parameters[] = $nowdate;
								$values[] = "`$updateColumn` = ?";
							}
						}
					}
				}		
				
				if ( !is_null($changes) ) {
					if ($updateColumn == "deleted_at") { 
						$values = array_merge($values,  array("`deleted_at` = ?", "`deleted_by` = ?"));
						$parameters = array_merge($parameters, array($nowdate, $_SESSION['webadmin']['id']));					
					} else {
						$values = array_merge($values,  array("`updated_at` = ?", "`updated_by` = ?"));
						$parameters = array_merge($parameters, array($nowdate, $_SESSION['webadmin']['id']));
					}				
					//var_dump("Chanages = ", $changes);
					$message = $message . updateDatabase($cId, $parameters, $values, "Modify", $changes);
				}
			}
			
			//throw new Exception("------");
			
			if ($_POST["formAction"] == "Add") {
				unset($parameters);
				unset($values);
				$parameters[] = $cust_id;
				$parameters[] = $_SESSION['webadmin']['id'];
				$parameters[] = $nowdate;
				$values[] = "?";
				$values[] = "?";
				$values[] = "?";
				$message = $message . updateDatabase($cId, $parameters, $values, "Add", null);
			}
			
			
			
			header("Location: modifyform.php?id=" . $cust_id . "&message=" . ($message == "" ? "Update completed." : $message) );
		}

	}
	
	//-----------------------------------------------------------------------------
	// Return array parameters
	//-----------------------------------------------------------------------------
	return array(
		'customer' => $customer,
		'message' => $_GET['message'],
	);
	
	function updateDatabase($id, $inParameters, $inValues, $inAction, $inChanges) {
		$message = "";
		$sql = "update customerProfile set " . implode(', ', $inValues) . " where id = $id";
		
		if ($inAction == "Add") {
			$sql = "insert customerProfile ( customer_id, created_by, created_at ) values ( " . implode(', ', $inValues) . ")";
		}
		try {
			$result = tableInfo::updateRecord($sql, $inParameters);
		}
		catch(Exception $e) {
			$message = $message . $e->getMessage();
		}

		$message = $message . logChanges($inChanges);
		//foreach ($inChanges as $inChange) {
		//	$nowdate = date("Y-m-d H:i:s");
		//	$sql = "insert changeLog values (?, ?,?,?,?,?,?,?)";
		//	$par = array('0', $inChange[0], $inChange[1], $inChange[2], $inChange[3], $inChange[4], $_SESSION['webadmin']['id'], $nowdate );
		//	try {
		//		$result = tableInfo::updateRecord($sql, $par);
		//	}
		//	catch(Exception $e) {
		//		$message = $message . $e->getMessage();
		//	}
		//	unset($par);
		//}

		return $message;
	}
	
	function logChanges($inChanges) {
		$message = "";
		foreach ($inChanges as $inChange) {
			$nowdate = date("Y-m-d H:i:s");
			$sql = "insert changeLog values (?, ?,?,?,?,?,?,?)";
			$par = array('0', $inChange[0], $inChange[1], $inChange[2], $inChange[3], $inChange[4], $_SESSION['webadmin']['id'], $nowdate );
			try {
				$result = tableInfo::updateRecord($sql, $par);
			}
			catch(Exception $e) {
				$message = $message . $e->getMessage();
			}
			unset($par);
		}		
		return $message;
	}

Youez - 2016 - github.com/yon3zu
LinuXploit