shell bypass 403

Cubjrnet7 Shell


name : admin-status.php
<?php
include('login-status.php');
include("global.inc.php");
include("connection.inc.php");
global $db;

date_default_timezone_set("Asia/Kolkata");

$lastmonth = mktime(0, 0, 0, date("m")-1, date("d"),   date("Y"));
$currentmonth = mktime(0, 0, 0, date("m"), date("d"),   date("Y"));

$start_date = isset($_REQUEST['start_date'])?date("d-M-y",strtotime($_REQUEST['start_date'])):date("d-M-y",$lastmonth);
$end_date = isset($_REQUEST['end_date'])?date("d-M-y",strtotime($_REQUEST['end_date'])):date("d-M-y",$currentmonth);
$action = (isset($_REQUEST['action'])?$_REQUEST['action']:'');
if(isset($_REQUEST['status']))
{
 $_SESSION['status'] = $_REQUEST['status'];
}/*else
{
 $_SESSION['status'] = array_keys($status_arr);
}*/
$status = isset($_SESSION['status'])?$_SESSION['status']:array_keys($status_arr);


 
# For sorting a list
$order_type = (isset($_REQUEST['order']))?$_REQUEST['order']:'DESC';
$order_field = (isset($_REQUEST['field']))?$_REQUEST['field']:'order_id';
if($order_field == 'date')
{
 $order_field_for_query = "TIMESTAMP(order_datetime)";
}else
{
 $order_field_for_query = $order_field; 
} 
if(isset($_REQUEST['order']) AND $order_type == "ASC")
{
$order = "DESC";
}
else
{
$order ="ASC";
}

 $first = date("Y-m-d",strtotime($start_date));
 $last = date("Y-m-d",strtotime( $end_date));
 $list_details_arr = array();
 $is_valid = 1;
 $error_msg='';


	 
if(check_validate($start_date,$end_date,$error_msg))
{
  $strStatus = '';					 
  if(count($status)>0)
  {
  	$strStatus = implode(", ", $status);
  }

	$sql_list =	"SELECT order_id, order_cust_id, CASE order_from WHEN 0 THEN '".FROM_PITARA."' WHEN 1 THEN '".FROM_CHAKMAK."' WHEN 2 THEN '".FROM_Baadalonkemahal."' END AS order_from, cust_name, cust_surname, cust_phone, DATE_FORMAT(order_datetime, '%d-%b-%Y <br />%h:%i %p') AS order_datetime, ".
										" order_is_order_open, order_shipto_name, DATE_FORMAT( order_datetime,  '%d-%b-%y' ) AS orderdt, ".
										" CASE order_is_payment_online WHEN 1 THEN '".ONLINE."' WHEN 0 THEN '".OFFLINE."' WHEN 2 THEN '".ONLINEFAIL."' END AS payment_mode, ".
										" order_status AS order_status_code, order_special_instructions, ".
        				"CASE order_status ".
                "WHEN  ".ORDER_CREATED_CODE." ".
                "THEN  '".ORDER_CREATED_TEXT."' ".
                "WHEN  ".ORDER_PENDING_CODE." ".
                "THEN  '".ORDER_PENDING_TEXT."' ".
                "WHEN  ".PAYMENT_FAILURE_CODE." ".
                "THEN  '".PAYMENT_FAILURE_TEXT."' ".
                "WHEN  ".MATERIAL_DISPATCHED_CODE." ".
                "THEN  '".MATERIAL_DISPATCHED_TEXT."' ".
                "WHEN  ".ORDER_COMPLETE_CODE." ".
                "THEN  '".ORDER_COMPLETE_TEXT."' ".
				"WHEN  ".FAKE_ORDER_CODE." ".
                "THEN  '".FAKE_ORDER_TEXT."' ".
				"WHEN  ".CANCEL_ORDER_CODE." ".
                "THEN  '".CANCEL_ORDER_TEXT."' ".
                "END AS order_status, order_total, order_paid_amount ".
                "FROM customer AS C ".
                "LEFT JOIN customer_order AS CO ON C.cust_id = CO.order_cust_id ".
                "WHERE DATE_FORMAT(order_datetime, '%Y-%m-%d') >=  '".$first."' ".
                "AND DATE_FORMAT(order_datetime, '%Y-%m-%d') <=  '".$last."' ";
								if(strlen($strStatus)>0)	$sql_list .=	" AND order_status IN ($strStatus)";
  $sql_list .=	"ORDER BY $order_field_for_query $order_type ";
							 
							 
				
								
			if(!$result_list = mysqli_query($db, $sql_list)) die(mysqli_error());
			while($row = mysqli_fetch_assoc($result_list))	
			{
				$list_details_arr[] = array("o_id"=>$row['order_id'],
											"o_from"=>$row['order_from'],
											"o_date"=>$row['order_datetime'], 												 
											"c_name"=>$row['cust_name'],
											"c_sname"=>$row['cust_surname'],
											"contact"=>$row['cust_phone'],
											"o_custid"=>$row['order_cust_id'],
											"o_shipto_nm"=>$row['order_shipto_name'], 
											"o_status"=>$row['order_status'], 
											"o_status_code"=>$row['order_status_code'], 
											"payment_mode"=>$row['payment_mode'], 
											"order_total"=>$row['order_total'], 
											"order_paid_amount"=>$row['order_paid_amount'], 
											"order_is_order_open"=>$row['order_is_order_open'], 
											"o_note"=>$row['order_special_instructions']
								);
			}	
}
pageHeaderOne("Eklavya Publications List of orders");
adminPageHeaderTwo();
?>
<script language="JavaScript" type="text/javascript" src="include/JSCal/src/js/jscal2.js"></script>
<script language="JavaScript" type="text/javascript" src="include/JSCal/src/js/lang/en.js"></script>
<script  language="JavaScript" type='text/javascript' src="order-details.js"></script>
<link type="text/css" rel="stylesheet" href="include/JSCal/src/css/jscal2.css" />
<script type="text/javascript">
  var _gaq = _gaq || [];
  _gaq.push(['_setAccount', 'UA-36950695-1']);
  _gaq.push(['_trackPageview']);
  (function() {
    var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
    ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
    var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
  })();
</script>
<style type="text/css">
<!--
select{padding:0;margin:0;}
-->
</style>

<?php
adminPageHeaderThree();
?>
<div id="content_box" style="width:980px;">
<h2 style="margin-bottom:0;">List of orders</h2>
<?php 
			if(strlen($error_msg) > 0)
			{
				echo '<div style="border:1px solid red;background-color:#999966;color:#ffffff;width:400px;text-align:center;margin:auto;">'.$error_msg.'</div>';
			}
 ?>
 <br>
<fieldset style="width:95%;">
<legend>Search</legend> 
<form action="admin-status.php" name=""  method="GET" onsubmit="">
<div style="float:left;text-align:center;">
<div style="width:200px;text-align:left;float:left;padding:.5em;">

		<b>From:</b> <br />
<input type="text" name="start_date" id="start_date" size="11"  maxlength="11" value="<?php echo $start_date; ?>">
					<button type="button" id="dpb1">&nbsp;...&nbsp;</button>
  						<script type="text/javascript">
     						new Calendar
  							(
  								{
     								inputField: "start_date",
     								dateFormat: "%d-%b-%Y",
     								trigger: "dpb1",
     								bottomBar: false,
     								onSelect: function() 
  									{
     									var date = Calendar.intToDate(this.selection.get());
     									this.hide();
     								}
     							}
  							);
     					</script>
<br />

		<b>To: </b><br />
<input type="text" name="end_date" id="end_date" size="11"  maxlength="11" value="<?php echo  $end_date; ?>">
				<button type="button" id="dpb2">&nbsp;...&nbsp;</button>
  						<script type="text/javascript">
     						new Calendar
  							(
  								{
     								inputField: "end_date",
     								dateFormat: "%d-%b-%Y",
     								trigger: "dpb2",
     								bottomBar: false,
     								onSelect: function() 
  									{
     									var date = Calendar.intToDate(this.selection.get());
     									this.hide();
     								}
     							}
  							);
     					</script>
</div>
<div style="width:180px;text-align:left;float:left;padding:.5em;"><b>Order Status: </b><br />

							<?php
							$i=1; 
							foreach($status_arr AS $key => $val)
							{
							 $checked = in_array($key, $status)?' checked="checked"':'';
							 echo ' <input type="checkbox" name="status[]" id="chkStatus'.$key.'" value="'.$key.'" '.$checked.'/> <label for="chkStatus'.$key.'">'.$val.'</label>';
							 echo '<br />';							
							}
							?>
</div>
<div style="float:left;width:70px;"><input type="submit" name="action" value="Search" style="margin-top:3em;"></div>
</div>									
<div style="float:left;width:420px;text-align:left;padding:.5em;border-left:solid 1px;" ><b>Note: </b>Click on an order number to view order details. 
					Click on amount paid to edit it (For offline payment mode only).
					Click on status to change the status. Closed orders are shown in light gray color. 
					To print address labels select 
					orders using checkboxes and then click "Print Address Labels" button. Checkbox in table header will toggle the selection.
					<br /><br />
		<table class="clearTable" style="width:300px; height:100px;">
			<tr>
				<td colspan="2">Online payment column: possible values</td>
			</tr>
			<tr>
				<td>  </td>
				<td>Offline payment </td>
			</tr>
			<tr>
				<td> <img src="images/tick.png" alt="Paid online" title="Online payment successful" /> </td>
				<td>Online payment successful </td>
			</tr>
			<tr>
				<td> <img src="images/yellow_dot.png" alt="Paid online" title="Online payment cancelled/aborted" /> </td>
				<td>Online payment cancelled/aborted </td>
			</tr>
			<tr>
				<td> <img src="images/red_dot.png" alt="Paid online" title="Online payment failed" /> </td>
				<td>Online payment failed </td>
			</tr>
		</table>
	</div>
<div style="clear:both;"></div>
																
</form>
</fieldset>
<br />
<?php
		  if(count($list_details_arr) > 0)
			{
	
	
?>
			<form action="print-address-labels.php" name="FrmPrintAddressLables" method="POST" onsubmit="return validateSelectionofCheckboxes(<?php echo count($list_details_arr); ?>)"> 
				<table class="clearTable">
					<tr>
						<td colspan="10" style="vertical-align:middle;">
							<input type="submit" name="printLables" value="Print Address Labels" />
							<input type="submit" name="downloadList" value="Export address to file" />
							<div style="display:inline;padding-right:1em;float:right;">No. of records: <?php echo count($list_details_arr);?></div> 
						</td>
					</tr>		 
					<tr>
						<th style="width:30px;"><input type="checkbox" name="checkAll" id="checkAll" title="Toggle the selection" alt="Toggle the selection" value="1" onclick="toggleCheckboxes(<?php echo count($list_details_arr); ?>)"/></th>	
						<th style="width:100px;">
						<a href="admin-status.php?start_date=<?php echo $first ?>&end_date=<?php echo $last ?>&action=<?php echo $action ?>&order=<?php echo $order ?>&field=<?php echo 'date' ?>">
						Date
						</a>
						<?php  
						if($order_field == 'date' AND isset($_REQUEST['order']))
  					{
  						if($order == 'ASC')
  							{echo '<img src="images/arrow-up.gif">';}
  						else
  							{echo '<img src="images/arrow-down.gif">';}
  					}
					
					 	?>
						</th>	
						<th style="width:50px;">
							<a href="admin-status.php?start_date=<?php echo $first ?>&end_date=<?php echo $last ?>&action=<?php echo $action ?>&order=<?php echo $order ?>&field=<?php echo 'order_id' ?>">
								Order#
							</a>
								<?php  if($order_field == 'order_id' AND isset($_REQUEST['order']))
									{
										if($order == 'ASC')
											{echo '<img src="images/arrow-up.gif">';}
										else
											{echo '<img src="images/arrow-down.gif">';}
									}
					
					 			?>
						</th>
						<th style="width:250px;">
						<a href="admin-status.php?start_date=<?php echo $first ?>&end_date=<?php echo $last ?>&action=<?php echo $action ?>&order=<?php echo $order ?>&field=<?php echo 'cust_name' ?>">
								Customer
							</a>
							<?php  if($order_field == 'cust_name' AND isset($_REQUEST['order']))
									{
										if($order == 'ASC')
											{echo '<img src="images/arrow-up.gif">';}
										else
											{echo '<img src="images/arrow-down.gif">';}
									}
					
					 			?>
						</th>
						<th style="width:100px;">Contact</th>
						<th style="width:60px;">Order <br />Total</th>
						<th>Online payment</th>
						<th>Order From</th>
						<th style="width:100px;">Amount <br />Paid</th>
						<th style="width:200px;padding:0;">
              <a href="admin-status.php?start_date=<?php echo $first ?>&end_date=<?php echo $last ?>&action=<?php echo $action ?>&order=<?php echo $order ?>&field=<?php echo 'order_status' ?>">
              Order Status
              </a>
              <?php  
							if($order_field == 'order_status' AND isset($_REQUEST['order']))
              {
              if($order == 'ASC')
                {echo '<img src="images/arrow-up.gif">';}
              else
                {echo '<img src="images/arrow-down.gif">';}
              }
              ?>
						</th>
					</tr>
				
<?php
				for($i=0;$i<count($list_details_arr);$i++)
				{
				 $order_id = $list_details_arr[$i]['o_id'];
?>				<tr id="tr<?php echo $i; ?>" <?php if($list_details_arr[$i]['order_is_order_open'] == ORDER_CLOSE){ ?>class="orderClosed"<?php } ?>>
					<td><input type="checkbox" name="o[]" id="o<?php echo $i ?>" value="<?php echo $order_id; ?>" /></td>
					<td><?php echo $list_details_arr[$i]['o_date']; ?></td>
					<td style="text-align:center;" <?php if(strlen($list_details_arr[$i]['o_note'])>0)echo 'title="'.$list_details_arr[$i]['o_note'].'"'; ?>><?php echo '<a href="order-details.php?i='.$order_id.'">'.$order_id.'</a>'; ?></td>
					<td><?php echo $list_details_arr[$i]['c_name']." ".$list_details_arr[$i]['c_sname'];?></td>
					<td><?php echo $list_details_arr[$i]['contact']; ?></td>
					<td style="text-align:right;"><?php echo $list_details_arr[$i]['order_total']; ?></td><!--span class="smallNote"><br />(Paid online)</span-->
					<?php 
						$imgWithTitle = '';
						if($list_details_arr[$i]['payment_mode'] == ONLINE && $list_details_arr[$i]['o_status'] != CANCEL_ORDER_TEXT)
							$imgWithTitle = '<img id="img'.$i.'" src="images/tick.png" alt="Paid online" title="Paid online" />';
						else if($list_details_arr[$i]['payment_mode'] == ONLINEFAIL && $list_details_arr[$i]['o_status'] != CANCEL_ORDER_TEXT)
							$imgWithTitle = '<img id="img'.$i.'" src="images/red_dot.png" alt="Online payment failed" title="Online payment failed" />';
						else if(($list_details_arr[$i]['payment_mode'] == ONLINE && $list_details_arr[$i]['o_status'] == CANCEL_ORDER_TEXT) || ($list_details_arr[$i]['payment_mode'] == ONLINEFAIL && $list_details_arr[$i]['o_status'] == CANCEL_ORDER_TEXT) )
							$imgWithTitle = '<img id="img'.$i.'" src="images/yellow_dot.png" alt="Online payment cancelled" title="Online payment cancelled" />';
					?>
					<td style="text-align:center;"><?php echo $imgWithTitle; ?></td>
					<td><?php echo $list_details_arr[$i]['o_from']?></td>
					<td style="text-align:right;" id="div_amount<?php echo $i;?>">
					<?php
					if($_SESSION['access'] == 1)
					echo ($list_details_arr[$i]['payment_mode'] == OFFLINE || $list_details_arr[$i]['o_status_code'] == 3)?showAmountPaid($list_details_arr[$i]['order_paid_amount'], $order_id, $i):$list_details_arr[$i]['order_paid_amount']; 
				// 	else if($_SESSION['access'] == 2)
				// 	echo ($list_details_arr[$i]['payment_mode'] == OFFLINE || $list_details_arr[$i]['o_status_code'] == 3)?showAmountPaid($list_details_arr[$i]['order_paid_amount'], $order_id, $i):$list_details_arr[$i]['order_paid_amount']; 
					else
					echo $list_details_arr[$i]['order_paid_amount'];
					?>
					</td>
					<td style="text-align:center;padding:0;" id="div_status<?php echo $i;?>">
					<?php	
					if($_SESSION['access'] == 1)
						showStatus($status_arr, $list_details_arr[$i]['o_status'], $list_details_arr[$i]['o_status_code'], $order_id, $i, $list_details_arr[$i]['payment_mode']);
					//else if($_SESSION['access'] == 2)
						//showStatus($status_arr, $list_details_arr[$i]['o_status'], $list_details_arr[$i]['o_status_code'], $order_id, $i, $list_details_arr[$i]['payment_mode']);
					else
						echo $list_details_arr[$i]['o_status'];?>
					</td>
				</tr>
<?php		}?>
</table>
</form>
<?php
			}
			else
			{
				echo "No records found!";
			}
			
function check_validate($start_date,$end_date,&$error_msg)
{
  if($start_date == '')
  {
    $error_msg .="Please select FROM date<br>";
    return false;
  }	
  if($end_date == '')
  {
    $error_msg  .="Please select TO date<br>";
    return false;
  }	
  if(strtotime($start_date) > strtotime($end_date))
  {
    $error_msg  .="From date not greater than To date<br>";
    return false;
  }
  return true;
}
?>



© 2025 Cubjrnet7