| Server IP : 104.21.21.239 / Your IP : 216.73.216.76 Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.5 System : Linux ip-172-31-69-123.ec2.internal 6.1.176-223.369.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jul 24 13:34:27 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.23 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /home/mitzvahm/wwwdev/wp-content/plugins/ |
Upload File : |
<?php
session_start();
require_once($_SERVER['DOCUMENT_ROOT'].'/wp-config.php');
$GLOBALS['con'] = mysqli_connect(DB_HOST,DB_USER,DB_PASSWORD,DB_NAME);
if (!$con) :
die('Could not connect!');
else :
mysqli_set_charset($con, "UTF8");
$sql_tz = "SET time_zone = 'America/New_York'";
mysqli_query($GLOBALS['con'], $sql_tz);
endif;
switch ($_GET['func']) :
case 'vendor_autocomplete' :
if (strlen(trim($_GET['search'])) >= 3) :
$sql = "SELECT * FROM wp_proxi_vendors WHERE post_title LIKE '%".mysqli_real_escape_string($GLOBALS['con'], trim($_GET['search']))."%' ORDER BY post_title LIMIT 20 ";
$result = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result) > 0) :
while ($row = mysqli_fetch_object($result)) :
//echo '<div class="autocomplete_item" onclick="$(\'#'.$_GET['fid'].'\').val(\''.strip_tags($row->post_title).'\')">';
$clean_fid = str_replace('__', '', $_GET['fid']);
echo '<div class="autocomplete_item" onclick="vendor_autocomplete_populate(\''.$clean_fid.'\', \''.$row->ID.'\');">';
echo strip_tags($row->post_title).'<br />';
echo '</div>';
endwhile;
else :
echo 'No matching vendors...';
endif;
endif;
break;
case 'vendor_load' :
$sql = "SELECT * FROM wp_proxi_vendors WHERE ID = ".mysqli_real_escape_string($GLOBALS['con'], intval(trim($_GET['vendor_id'])))." ";
$result = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result) > 0) :
$row = mysqli_fetch_object($result);
echo json_encode(array(
'mm_vendor_id' => strip_tags($row->ID),
'name' => strip_tags($row->post_title),
'url' => strip_tags($row->website),
'email' => strip_tags($row->email),
'phone' => strip_tags($row->phone),
'address' => strip_tags($row->address),
'city' => strip_tags($row->city),
'state' => strip_tags($row->state),
'zip' => strip_tags($row->postalcode),
));
endif;
break;
case 'spotlight_format_load' :
$sql = "SELECT * FROM wp_lcs_family_spotlights WHERE id = ".mysqli_real_escape_string($GLOBALS['con'], intval(trim($_GET['id'])))." ";
$result = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result) > 0) :
$row = mysqli_fetch_object($result);
$sql_vendors = "SELECT v.*, vc.name AS cat_name, vcs.name AS subcat_name FROM wp_lcs_family_spotlights_vendors v ".
"LEFT OUTER JOIN wp_proxi_vendor_category vc ON (v.cat = vc.id) LEFT OUTER JOIN wp_proxi_vendor_category_sub vcs ON (v.subcat = vcs.id) ".
"WHERE v.spotlight_id = ".mysqli_real_escape_string($GLOBALS['con'], intval(trim($_GET['id'])))." ";
$result_vendors = mysqli_query($GLOBALS['con'], $sql_vendors) or die('Database Error!');
$sql_photos = "SELECT p.*, v.name AS vendor_name FROM wp_lcs_family_spotlights_photos p LEFT OUTER JOIN wp_lcs_family_spotlights_vendors v ON (p.spotlight_vendor_id = v.id) ".
"WHERE p.spotlight_id = ".mysqli_real_escape_string($GLOBALS['con'], intval(trim($_GET['id'])))." ";
$result_photos = mysqli_query($GLOBALS['con'], $sql_photos) or die('Database Error!');
?>
<table>
<tr>
<td width="300">Bar/Bat Mitzvah Date</td>
<td><?php echo $row->mitzvah_date; ?></td>
</tr>
<tr>
<td>Child first/last/birthdate</td>
<td><?php echo $row->child_first_name.' '.$row->child_last_name.' '.$row->child_birthdate; ?></td>
</tr>
<tr>
<td>Parent 1 first/last</td>
<td><?php echo $row->parent1_first_name.' '.$row->parent1_last_name; ?></td>
</tr>
<tr>
<td>Parent 2 first/last</td>
<td><?php echo $row->parent2_first_name.' '.$row->parent2_last_name; ?></td>
</tr>
<tr>
<td>Sibling 1 first/last/birthdate</td>
<td><?php echo $row->sibling1_first_name.' '.$row->sibling1_last_name.' '.$row->sibling1_birthdate; ?></td>
</tr>
<tr>
<td>Sibling 2 first/last/birthdate</td>
<td><?php echo $row->sibling2_first_name.' '.$row->sibling2_last_name.' '.$row->sibling2_birthdate; ?></td>
</tr>
<tr>
<td>Sibling 3 first/last/birthdate</td>
<td><?php echo $row->sibling3_first_name.' '.$row->sibling3_last_name.' '.$row->sibling3_birthdate; ?></td>
</tr>
<tr>
<td>City/State/Zip</td>
<td><?php echo $row->city.' '.$row->state.' '.$row->zip; ?></td>
</tr>
<tr>
<td>Country</td>
<td><?php echo $row->country; ?></td>
</tr>
<tr>
<td>Email</td>
<td><?php echo $row->email; ?></td>
</tr>
<tr>
<td>Phone</td>
<td><?php echo $row->phone; ?></td>
</tr>
<tr>
<td>Party type / time</td>
<td><?php echo $row->party_type_bbb.' / '.$row->party_type_time; ?></td>
</tr>
<tr>
<td>Party Description</td>
<td><?php echo nl2br($row->party_description); ?></td>
</tr>
<tr>
<td>Mom-to-Mom Advice</td>
<td><?php echo nl2br($row->mom_advice); ?></td>
</tr>
<tr>
<td>Mitzvah Project Description</td>
<td><?php echo nl2br($row->project_description); ?></td>
</tr>
<tr>
<td>Comments</td>
<td><?php echo nl2br($row->comments); ?></td>
</tr>
<tr>
<td>Testimonial</td>
<td><?php echo nl2br($row->testimonial); ?></td>
</tr>
<?php
if (mysqli_num_rows($result_vendors) > 0) :
?>
<tr>
<td colspan="2" align="center" style="font-weight:bold;"> ******* VENDORS ******* </td>
</tr>
<?php
while ($row_vendors = mysqli_fetch_object($result_vendors)) :
?>
<tr>
<td>Vendor Name</td>
<td><?php echo $row_vendors->name; ?></td>
</tr>
<tr>
<td>  Already in directory?</td>
<td><?php if ($row_vendors->mm_vendor_id > 0) : echo 'Yes'; else : echo 'No'; endif; ?> ** at the time spotlight data was submitted.</td>
</tr>
<tr>
<td>  Category / Subcategory / Other</td>
<td><?php echo $row_vendors->cat_name.' / '.$row_vendors->subcat_name.' / '.$row_vendors->cat_other; ?></td>
</tr>
<tr>
<td>  URL</td>
<td><?php echo $row_vendors->url; ?></td>
</tr>
<tr>
<td>  Email</td>
<td><?php echo $row_vendors->email; ?></td>
</tr>
<tr>
<td>  Phone</td>
<td><?php echo $row_vendors->phone; ?></td>
</tr>
<tr>
<td>  Address</td>
<td><?php echo $row_vendors->address; ?></td>
</tr>
<tr>
<td>  City / State / Zip</td>
<td><?php echo $row_vendors->city.' / '.$row_vendors->state.' / '.$row_vendors->zip; ?></td>
</tr>
<tr>
<td>  Contact Name</td>
<td><?php echo $row_vendors->contact; ?></td>
</tr>
<tr>
<td>  Formatted for editorial</td>
<?php
$vendor_formatted = '';
if ($row_vendors->cat_other > '') :
$vendor_formatted .= '<b>'.$row_vendors->cat_other.':</b> ';
elseif ($row_vendors->subcat_name > '') :
$vendor_formatted .= '<b>'.$row_vendors->subcat_name.':</b> ';
elseif ($row_vendors->cat_name > '') :
$vendor_formatted .= '<b>'.$row_vendors->cat_name.':</b> ';
endif;
if ($row_vendors->url > '') :
$vendor_formatted .= '<a href="'.lcs_fix_http($row_vendors->url).'">'.$row_vendors->name.'</a>';
else :
$vendor_formatted .= $row_vendors->name;
endif;
if ($row_vendors->phone > '') :
$vendor_formatted .= ', '.$row_vendors->phone.' ';
endif;
/*
*/
?>
<td><?php echo $vendor_formatted; ?></td>
</tr>
<?php
endwhile;
endif;
?>
<?php
if (mysqli_num_rows($result_photos) > 0) :
?>
<tr>
<td colspan="2" align="center" style="font-weight:bold;"> ******* PHOTOS ******* </td>
</tr>
<?php
while ($row_photos = mysqli_fetch_object($result_photos)) :
?>
<tr>
<td>Image</td>
<td><img src="<?php echo plugins_url().'/lcs-family-spotlights/uploads/'.$row_photos->file_id; ?>" style="max-width:425px;" /></td>
</tr>
<tr>
<td> </td>
<td>
<input type="button" style="cursor:pointer;" value="Add to media" onclick="lcs_upload('<?php echo plugins_url().'/lcs-family-spotlights/uploads/'.$row_photos->file_id; ?>', <?php echo $row_photos->id; ?>);">
 <span id="lcs_img_format_url_<?php echo $row_photos->id; ?>"></span>
</td>
</tr>
<tr>
<td>  Caption</td>
<td><?php echo $row_photos->caption; ?></td>
</tr>
<tr>
<td>  Party Idea Category</td>
<td><?php echo $row_photos->category; ?></td>
</tr>
<tr>
<td>  Related Vendor</td>
<td><?php echo $row_photos->vendor_name; ?></td>
</tr>
<?php
endwhile;
endif;
?>
</table>
<?php
echo '<table>';
echo '<tr>';
echo '<td></td>';
echo '</tr>';
echo '</table>';
endif;
break;
case 'verify_captcha' :
if (isset($_GET['captcha'])) :
$captcha = strtolower($_GET['captcha']);
else :
$captcha = '';
endif;
if (isset($_SESSION['captcha_key'])) :
$captcha_key = strtolower($_SESSION['captcha_key']);
else :
$captcha_key = 'fdsdjas125sdudklsafjdfjfjsffflf';
endif;
if ($captcha_key != md5($captcha)):
$captcha_check = false;
else :
$captcha_check = true;
endif;
echo json_encode(array(
'captcha_check' => $captcha_check,
));
break;
case 'upload_progress' :
$key = ini_get("session.upload_progress.prefix") . 'lcs_form_progress';
if (!empty($_SESSION[$key])) :
$current = $_SESSION[$key]["bytes_processed"];
$total = $_SESSION[$key]["content_length"];
echo ($current < $total ? ceil($current / $total * 100) : 100) . '%';
//echo ' key '.$key.' '.date('H:i:s');
elseif (!empty($_SESSION['lcs_upload_progress'])) :
echo $_SESSION['lcs_upload_progress'];
//echo ' session '.date('H:i:s');
else :
echo '100%';
endif;
break;
case 'autosave_main' :
$result = '';
if (!empty($_COOKIE['family_spotlight_form'])) :
$sql = "SELECT * FROM wp_lcs_family_spotlights_autosave WHERE uuid = '".mysqli_real_escape_string($GLOBALS['con'], $_COOKIE['family_spotlight_form'])."' ";
$result = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result) > 0) :
$rec_mode = 'edit';
else :
$rec_mode = 'add';
endif;
$set = "submitted_date_time = '".date('Y-m-d H:i:s')."',".
"submitted_ip = '".get_client_ip()."',".
"city = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['city']))."',".
"state = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['state']))."',".
"zip = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['zip']))."',".
"country = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['country']))."',".
"email = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['email']))."',".
"phone = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['phone']))."',".
"mitzvah_date = ".nzdate($_POST['mitzvah_date']).",".
"child_first_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['child_first_name']))."',".
"child_last_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['child_last_name']))."',".
"child_birthdate = ".nzdate($_POST['child_birthdate']).",".
"parent1_first_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['parent1_first_name']))."',".
"parent1_last_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['parent1_last_name']))."',".
"parent2_first_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['parent2_first_name']))."',".
"parent2_last_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['parent2_last_name']))."',".
"sibling1_first_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['sibling1_first_name']))."',".
"sibling1_last_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['sibling1_last_name']))."',".
"sibling1_birthdate = ".nzdate($_POST['sibling1_birthdate']).",".
"sibling2_first_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['sibling2_first_name']))."',".
"sibling2_last_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['sibling2_last_name']))."',".
"sibling2_birthdate = ".nzdate($_POST['sibling2_birthdate']).",".
"sibling3_first_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['sibling3_first_name']))."',".
"sibling3_last_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['sibling3_last_name']))."',".
"sibling3_birthdate = ".nzdate($_POST['sibling3_birthdate']).",".
"party_type_bbb = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['party_type_bbb']))."',".
"party_type_time = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['party_type_time']))."',".
"party_description = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['party_description']))."',".
"mom_advice = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['mom_advice']))."',".
"project_description = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['project_description']))."', ".
"comments = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['comments']))."', ".
"testimonial = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['testimonial']))."', ".
"status = 'draft' ";
if ($rec_mode == 'add') :
//$form_code = bin2hex(openssl_random_pseudo_bytes(12));
$sql = "INSERT INTO wp_lcs_family_spotlights_autosave SET ".
"uuid = '".mysqli_real_escape_string($GLOBALS['con'], $_COOKIE['family_spotlight_form'])."', ".
$set;
//mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
mysqli_query($GLOBALS['con'], $sql) or die(json_encode(array('result' => 'Database Error: '.mysqli_error($GLOBALS['con']),)));
$spotlight_id = lcs_last_id();
elseif ($rec_mode == 'edit') :
//$form_code = trim($_REQUEST['uuid']);
$sql = "UPDATE wp_lcs_family_spotlights_autosave SET ".
$set.
" WHERE uuid = '".mysqli_real_escape_string($GLOBALS['con'], $_COOKIE['family_spotlight_form'])."' ";
//mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
mysqli_query($GLOBALS['con'], $sql) or die(json_encode(array('result' => 'Database Error: '.mysqli_error($GLOBALS['con']),)));
$spotlight_id = $row_uuid->id;
else :
die('Error: Invalid mode!');
endif;
$result = 'success';
else :
$result = 'error';
endif;
echo json_encode(array(
'result' => $result,
));
break;
case 'autosave_vendor' :
$result = '';
$i = intval($_GET['ix']);
if (isset($_POST['__ven__'.$i.'__name'])) :
$sql = "SELECT * FROM wp_lcs_family_spotlights_autosave WHERE uuid = '".mysqli_real_escape_string($GLOBALS['con'], $_COOKIE['family_spotlight_form'])."' ";
$result_uuid = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result_uuid) > 0) :
$row_uuid = mysqli_fetch_object($result_uuid);
$spotlight_id = $row_uuid->id;
else :
//die(json_encode(array('result' => 'Database Error: - Spotlight Autosave not found. '.mysqli_error($GLOBALS['con']),)));
die('Database Error! - Spotlight Autosave not found.');
endif;
//echo 'SPOTLIGHT ID: '.$spotlight_id;
$ar_cat = explode('-', $_POST['__ven__'.$i.'__category']);
$cat = $ar_cat[0];
$subcat = $ar_cat[1];
$set = "mm_vendor_id = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__mm_vendor_id'])), '0').",".
"name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__name']))."',".
"cat = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($cat)), '0').",".
"subcat = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($subcat)), '0').",".
"cat_other = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__cat_other']))."',".
"url = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__url']))."',".
"email = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__email']))."',".
"phone = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__phone']))."',".
"address = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__address']))."',".
"city = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__city']))."',".
"state = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__state']))."',".
"zip = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__zip']))."',".
"contact = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__contact']))."', ".
"ix = ".nz($i, '0')." ";
$sql = "SELECT * FROM wp_lcs_family_spotlights_vendors_autosave ".
"WHERE ix = ".nz($i, '0')." AND spotlight_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($spotlight_id));
//echo " === ".$sql." === ";
//$result = $sql;
$result_vendor_check = mysqli_query($GLOBALS['con'], $sql) or die('Database Error! (vendor check)');
//$result_vendor_check = mysqli_query($GLOBALS['con'], $sql) or die(json_encode(array('result' => 'Database Error: '.mysqli_error($GLOBALS['con']),)));
if (mysqli_num_rows($result_vendor_check) > 0) :
$row_vendor_check = mysqli_fetch_object($result_vendor_check);
$sql = "UPDATE wp_lcs_family_spotlights_vendors_autosave SET ".$set." ".
"WHERE id = ".nz(mysqli_real_escape_string($GLOBALS['con'], trim($row_vendor_check->id)), '0')." AND spotlight_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($spotlight_id));
//$result = $sql;
//echo " Updating === ".$sql." === ";
mysqli_query($GLOBALS['con'], $sql) or die('Database Error! (vendor update)');
//mysqli_query($GLOBALS['con'], $sql) or die(json_encode(array('result' => 'Database Error: '.mysqli_error($GLOBALS['con']),)));
//$vendor_id = $row_vendor_check->id;
else :
$sql = "INSERT INTO wp_lcs_family_spotlights_vendors_autosave SET "."spotlight_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($spotlight_id)).",".$set;
//echo " Inserting === ".$sql." === ";
mysqli_query($GLOBALS['con'], $sql) or die('Database Error! (vendor insert)');
//$vendor_id = lcs_last_id();
endif;
$result = 'success';
//$ar_vendors[mysqli_real_escape_string($GLOBALS['con'], trim($_POST['__ven__'.$i.'__name']))] = $vendor_id;
endif;
/*
*/
echo json_encode(array(
'result' => $result,
));
break;
case 'autosave_vendor_delete' :
$result = '';
$i = intval($_GET['ix']);
$sql = "SELECT * FROM wp_lcs_family_spotlights_autosave WHERE uuid = '".mysqli_real_escape_string($GLOBALS['con'], $_COOKIE['family_spotlight_form'])."' ";
$result_uuid = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result_uuid) > 0) :
$row_uuid = mysqli_fetch_object($result_uuid);
$spotlight_id = $row_uuid->id;
else :
//die(json_encode(array('result' => 'Database Error: - Spotlight Autosave not found. '.mysqli_error($GLOBALS['con']),)));
die('Database Error! - Spotlight Autosave not found.');
endif;
$sql = "DELETE FROM wp_lcs_family_spotlights_vendors_autosave ".
"WHERE ix = ".nz($i, '0')." AND spotlight_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($spotlight_id));
//echo " === ".$sql." === ";
//$result = $sql;
mysqli_query($GLOBALS['con'], $sql) or die('Database Error! (vendor delete)');
$sql = "UPDATE wp_lcs_family_spotlights_vendors_autosave SET ix = ix - 1 ".
"WHERE ix > ".nz($i, '0')." AND spotlight_id = ".mysqli_real_escape_string($GLOBALS['con'], trim($spotlight_id));
//echo " === ".$sql." === ";
//$result = $sql;
mysqli_query($GLOBALS['con'], $sql) or die('Database Error! (vendor delete)');
//$result_vendor_delete = mysqli_query($GLOBALS['con'], $sql) or die(json_encode(array('result' => 'Database Error: '.mysqli_error($GLOBALS['con']),)));
$result = 'success';
echo json_encode(array(
'result' => $result,
));
break;
default :
echo 'Invalid function!';
endswitch;
?>