403Webshell
Server IP : 104.21.80.248  /  Your IP : 172.71.28.155
Web Server : Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
System : Windows NT WIN-ECQAAA40806 6.2 build 9200 (Windows Server 2012 Standard Edition) i586
User : SYSTEM ( 0)
PHP Version : 5.6.30
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  /Inetpub/www/myschool/paktho/modules/calendars/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /Inetpub/www/myschool/paktho/modules/calendars/editevent.php
<?
CheckUser($_SESSION['user_user'], $_SESSION['user_pwd']);
?>
<script type="text/javascript">
function myoffice(val, group_num)
{
if(val==true)
{
	document.getElementById("group"+group_num+"").style.display="";
}
else
{
	document.getElementById("group"+group_num+"").style.display="none";
}

}
</script>
<script language="JavaScript">

//******************************************
function checkregis() {
  
if(document.myform.chk1.checked == false && document.myform.chk2.checked == false && document.myform.chk3.checked == false  )   
{        
alert('คุณไม่ได้เลือกการปฏิบัติหน้าที่ ');       
return false;    
} 

//********************************************
}
</script>
<?
if($_GET[op] == "calendar_edit"){
	if(CheckLevelUser($_SESSION['user_user'],$_GET[op])){
		if (!$_POST[EventDate] OR !$_POST[subject] OR !$_POST[DETAIL]){
			echo "<script language='javascript'>" ;
			echo "alert('กรุณากรอกข้อมูลต่างๆให้ครบถ้วน')" ;
			echo "</script>" ;
			echo "<script language='javascript'>javascript:history.back()</script>";
			exit();
		}
		$db->connectdb(DB_NAME,DB_USERNAME,DB_PASSWORD);
		$db->update_db(TB_CALENDAR,array(
			"subject"=>"".$_POST[subject]."",
			"timeout"=>"".$_POST[times]."",
			"detail"=>"".$_POST[DETAIL]."",
			"person"=>"".$_POST[PERSON]."",
			"update_date"=>"".TIMESTAMP.""
		)," id='".$_POST[id]."' ");
		//Edit data
//		$Filename = "".$_POST[EventDate].".txt";
//		$txt_name = "calendardata/".$Filename."";
//		$txt_open = @fopen("$txt_name", "w");
//		@fwrite($txt_open, "".$_POST[DETAIL]."");
//		@fclose($txt_open);
		$ProcessOutput .= "<BR><BR>";
		$ProcessOutput .= "<CENTER><A HREF=\"?name=admin&file=main\"><IMG SRC=\"images/icon/login-welcome.gif\" BORDER=\"0\"></A><BR><BR>";
		$ProcessOutput .= "<FONT COLOR=\"#336600\"><B>ได้ทำการแก้ไข รายการปฏิทิน ใน $_POST[EventDate] เรียบร้อยแล้ว</B></FONT>";
		$ProcessOutput .= "<BR><BR>";
		$ProcessOutput .= "<BR><BR><INPUT TYPE=\"submit\" VALUE=\" ต้องการบันทึกกิจกรรมในวันเดียวกัน \" onclick=\"window.location='?name=calendars&file=addevent&dates=".$_POST[EventDate]."'\">";
		$ProcessOutput .= "</CENTER>";
		$ProcessOutput .= "<BR><BR>";
	}else{
		$ProcessOutput = $PermissionFalse ;
	}
}else{
	$db->connectdb(DB_NAME,DB_USERNAME,DB_PASSWORD);
	$res[event] = $db->select_query("SELECT * FROM ".TB_CALENDARS." WHERE id='".$_GET[id]."' ");
	$arr[event] = $db->fetch($res[event]);
	$db->closedb ();
	if (!$arr[event][id]){
		echo "<script language='javascript'>" ;
		echo "alert('ไม่มีรายการที่ต้องการแก้ไข')" ;
		echo "</script>" ;
		echo "<script language='javascript'>javascript:history.back()</script>";
		exit();
	}
	//อ่านค่าจากไฟล์ Text เพื่อแก้ไข
//	$FileEventTopic = "calendardata/".$arr[event][date_event].".txt";
//	$file_open = @fopen($FileEventTopic, "r");
//	$TextContent = @fread ($file_open, @filesize($FileEventTopic));
//	@fclose ($file_open);
	$TextContent = stripslashes($arr[event][detail]);
//$TextContent = $arr[event][detail];
}
?>
<script type="text/javascript" src="datepicker.js"></script>
	<TABLE cellSpacing=0 cellPadding=0 width=820 border=0>
      <TBODY>
        <TR>
          <TD  vAlign=top>
		  <!-- Admin -->
				<TABLE width="700" align=center cellSpacing=0 cellPadding=0 border=0>
				<TR>
					<TD>
					<BR><B>&nbsp;&nbsp;<IMG SRC="images/icon/calendar.gif" BORDER="0" ALIGN="absmiddle">&nbsp;&nbsp; แก้ไขรายการปฏิทิน</B>
					<BR>
<?
if(!$ProcessOutput){
?>
<form NAME="myform" METHOD=POST ACTION="?name=calendars&file=editevent&op=calendar_edit&id=<?=$_GET[id];?>">
	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type="checkbox"  onclick="myoffice(this.checked, '1')" />ผู้อำนวยการโรงเรียน
	<input type="checkbox"  onclick="myoffice(this.checked, '2')" />รองผู้อำนวยการโรงเรียน
<br>
<div id="group1" style="display:none;">
<?
$db->connectdb(DB_NAME,DB_USERNAME,DB_PASSWORD);
$res[user] = $db->select_query("SELECT * FROM ".TB_user." WHERE level='3' and status='1'ORDER BY id");
while ($arr[user] = $db->fetch($res[user])){
?>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type="radio" NAME="PERSON" id='rdo1' value="<?=$arr[user][id];?>"><b> <?=$arr[user][category_name];?></b>
<? } ?>
</div>
<div id="group2" style="display:none;">
<?
$db->connectdb(DB_NAME,DB_USERNAME,DB_PASSWORD);
$res[user] = $db->select_query("SELECT * FROM ".TB_user." WHERE level='4' and status='1'ORDER BY id");
while ($arr[user] = $db->fetch($res[user])){
?>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<input type="radio" NAME="PERSON" id='rdo1' value="<?=$arr[user][id];?>"><b> <?=$arr[user][category_name];?></b>
<? } ?>
</div>
&nbsp;&nbsp;&nbsp;<b>วันที่ :</b>
&nbsp;&nbsp;&nbsp;<input name="EventDate" value="<?=$arr[event][date_event];?>" readonly> 
<BR>
&nbsp;&nbsp;&nbsp;<b>เวลา :</b>
&nbsp;&nbsp;&nbsp;<INPUT TYPE="text" NAME="times" value="<?=$arr[event][timeout];?>" style="width=100"> ( ตัวอย่าง เช่น 09.00 - 12.00 )
<BR>
&nbsp;&nbsp;&nbsp;<b>เรื่อง :</b>
<BR>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<textarea cols="50" id="subject" rows="5" class="ckeditor"  name="subject" ><?=$arr[event][subject];?></textarea>
<BR><BR>
&nbsp;&nbsp;&nbsp;<b>สถานที่ :</b>
&nbsp;&nbsp;<INPUT TYPE="text" name="DETAIL" style="width=600" value="<?=$arr[event][detail];?>">
<INPUT TYPE="hidden" value="<?=$arr[event][id];?>" name=id>
<BR>
<div align=center><input type="submit" value=" แก้ไขรายการปฏิทิน " name="submit"></div>
</form>
<?
}else{
	echo $ProcessOutput ;
}
?>
						<BR><BR>
					</TD>
				</TR>
			</TABLE>
			<BR><BR>

Youez - 2016 - github.com/yon3zu
LinuXploit