shell bypass 403

Cubjrnet7 Shell


name : dispatch-details.php
<?php
include('login-status.php');
include("global.inc.php");
include("connection.inc.php");

$order_id = isset($_REQUEST['o'])?trim($_REQUEST['o']):'';
$EditArray = isset($_SESSION['EditArray'])?$_SESSION['EditArray']:initialize_array($order_id);
$successMessage = isset($_SESSION['successMessage'])?$_SESSION['successMessage']:'';
$validationMessage = isset($_SESSION['validationMessage'])?$_SESSION['validationMessage']:'';
$ErrorFields = isset($_SESSION['ErrorFields'])?$_SESSION['ErrorFields']:'';

$selectedDispatchModeFlag = false;

if(isset($_SESSION['EditArray']))unset($_SESSION['EditArray']);
if(isset($_SESSION['successMessage']))unset($_SESSION['successMessage']);
if(isset($_SESSION['validationMessage']))unset($_SESSION['validationMessage']);
if(isset($_SESSION['ErrorFields']))unset($_SESSION['ErrorFields']);


pageHeaderOne("Eklavya Publications Order Details");
adminPageHeaderTwo();


if(strlen($ErrorFields)>0)
{
	echo '<style type="text/css">';
	echo $ErrorFields.'{background:#ffc0cb;border:solid 1px #ff0000;color:#ff0000;}';
	echo '</style>';
}

?>
<style type="text/css">
<!--
#hdr_bot a{display:none;}
-->
</style>

<link type="text/css" rel="stylesheet" href="JSCal/src/css/jscal2.css" />
<script language="JavaScript" type="text/javascript" src="JSCal/src/js/jscal2.js"></script>
<script language="JavaScript" type="text/javascript" src="JSCal/src/js/lang/en.js"></script>
<?php
$php_array = getAllServiceNameWithURL();
$js_array = json_encode($php_array);
//echo "var urlArr = ". $js_array . ";\n";
?>
<script language="JavaScript" type="text/javascript">
function closeTheWindow()
{
 window.opener.location.reload(true);
 window.opener.focus();
 self.close();
}
function addDocketField(val, fieldValues)
{
 	var field = '<input name="order_docket_no[]" type="text" id="order_docket_no1" size="10" maxlength="20" value="" />';
	var oldArray = fieldValues.split(", ");
	var extend = val - oldArray.length;
	var content = '';
	
	for(var i=0;i<oldArray.length;i++)
	{
	 	content += '<input name="order_docket_no[]" type="text" id="order_docket_no1" size="10" maxlength="20" value="'+oldArray[i]+'" /> ';			
	}
	if(extend > 0)
	{
	 	for(var i=0;i<extend;i++)
  	{
  	 	content += '<input name="order_docket_no[]" type="text" id="order_docket_no1" size="10" maxlength="20" value="" /> ';			
  	}									
	}	
	document.getElementById('docket').innerHTML = content;		 
}
function displayCourierList(id)
{
	document.getElementById("interstitial").style.display="inline";
	var select = document.getElementById("service_provider");
	for (i = 0; i < select.options.length; i++) {
	  select.options[i] = null;
	}

	var strURL = "serviceProviderList.php?d="+id;

	if(window.XMLHttpRequest)
	{
		xmlhttp = new XMLHttpRequest();
	}
	else if (window.ActiveXObject) { // IE
         try {
            xmlhttp = new ActiveXObject("Msxml2.XMLHTTP");//
         } catch (e) {
            try {
               xmlhttp = new ActiveXObject("Microsoft.XMLHTTP");
            } catch (e) {}
         }
    }
	if (!xmlhttp) {
         alert('Unable to create XMLHTTP instance');
         return false;
     }

	xmlhttp.onreadystatechange=function()
	{
		if(xmlhttp.readyState == 4 && xmlhttp.status == 200)
		{
			document.getElementById("service_provider").innerHTML = xmlhttp.responseText;
			if(xmlhttp.responseText != '')
				document.getElementById("interstitial").style.display="none";
		}
	}

	xmlhttp.open("GET", strURL, true);
	xmlhttp.send();
}
function displayURL(id)
{
	if(urlArr[id] != null && urlArr[id] != '')
		document.getElementById('url').innerHTML = "<a href='"+urlArr[id]+"' target='_blank'>"+ urlArr[id]+ "</a>";
	else
		document.getElementById('url').innerHTML = 'No Tracking.';
}
</script>
<?php 
adminPageHeaderThree();
?>
<!-- Display the page header -->
<div id="content_box" style="width:980px; color:">
<h2 style="margin-bottom:0;">Dispatch Details</h2>
<?php 
if(strlen($validationMessage)>0)
echo '<div class="ErrorMessage">'.$validationMessage.'</div>';
if(strlen($successMessage)>0)
echo '<div class="successMessage">'.$successMessage.'</div>';
?>
<form name="FrmDispatchDetails" action="dispatch-details-process.php" method="post">
<input type="hidden" name="o" value="<?php echo $order_id;?>">
<table style="width:450px;">
  <tr>
    <td style="width:35%;">Bill#</td>
    <td><input name="order_bill_no" type="text" id="order_bill_no" size="25" maxlength="20" value="<?php echo $EditArray['order_bill_no'];?>" /></td>
  </tr>
  <tr>
    <td>Bill Date </td>
    <td>
				<input name="order_bill_date" type="text" id="order_bill_date" size="25" maxlength="11" value="<?php echo $EditArray['order_bill_date'];?>"/>
  			<button type="button" id="dpb1" class="button">&nbsp;...&nbsp;</button>
				<script type="text/javascript">
 						new Calendar
					(
						{
 								inputField: "order_bill_date",
 								dateFormat: "%d-%b-%Y",
 								trigger: "dpb1",
 								bottomBar: false,
 								onSelect: function() 
							{
 									var date = Calendar.intToDate(this.selection.get());
 									this.hide();
 								}
 							}
					);
 					</script>

		</td>
  </tr>
	<tr>
    <td>Dispatch Date </td>
    <td>
				<input name="order_dispatch_date" type="text" id="order_dispatch_date" size="25" maxlength="11" value="<?php echo $EditArray['order_dispatch_date'];?>"/>
  			<button type="button" id="dpb2" class="button">&nbsp;...&nbsp;</button>
				<script type="text/javascript">
 						new Calendar
					(
						{
 								inputField: "order_dispatch_date",
 								dateFormat: "%d-%b-%Y",
 								trigger: "dpb2",
 								bottomBar: false,
 								onSelect: function() 
							{
 									var date = Calendar.intToDate(this.selection.get());
 									this.hide();
 								}
 							}
					);
 					</script>

		</td>
  </tr>
  <tr>
    <td>Number of Packets </td>
    <td><input name="order_num_of_packets" type="text" id="order_num_of_packets" size="25" maxlength="4" value="<?php echo $EditArray['order_num_of_packets'];?>" onblur="addDocketField(this.value, '<?php echo $EditArray['order_docket_no'];?>')" /></td>
  </tr>
  <tr>
    <td style="vertical-align:top;">Docket# </td>
    <td id="docket">
				<?php 
							$explode = explode(', ', $EditArray['order_docket_no']);
							for($i=0;$i<$EditArray['order_num_of_packets'];$i++)
							{
							 $val = isset($explode[$i])?$explode[$i]:'';
							 echo '<input name="order_docket_no[]" type="text" id="order_docket_no'.$i.'" size="10" maxlength="20" value="'.$val.'" /> ';			
							}
				 ?>
						
		</td>
  </tr>
  <tr>
    <td>Dispatch Mode </td>
    <td><select name="order_dispatch_mode" size="1" id="order_dispatch_mode" onChange="displayCourierList(this.value);">
					<?php 
						$service_mode = getServiceType();
						if(count($service_mode) > 0)
						{
							echo '<option value="0" onclick="displayCourierList(0);">Please Select</option>';
							foreach($service_mode as $k => $v)
							{		 
								echo '<option value="'.trim($k).'" ';
								if($k == $EditArray['order_dispatch_mode'])
								{
									echo ' selected="selected" ';
								}
								//echo 'onclick="displayCourierList('.trim($k).')"';
								echo '>'.$v.'</option>';
							}
						}
					?>
    		</select>
			<div id='interstitial' style="display:none;">
				<img src="loadingAnimation.gif" align="top" width="20" height="20" alt="Loading ... Please wait... " />
			</div>
		</td>
  </tr>
  <tr id="courierDetail">
    <td>Service Provider Name: </td>
    <td>
		<select name="service_provider" size="1" id="service_provider" onChange="displayURL(this.value);">
			<?php
				$sid = 0;
				if(isset($EditArray['order_dispatch_mode']))
					$sid = $EditArray['order_dispatch_mode'];
					
				$courierNameArr = getCourierNameWithURL($sid);
				$courierkey;

				echo '<option value="0">Please Select</option>';
				if(count($courierNameArr) > 0)
				{
					foreach($courierNameArr as $key => $val)
					{
						echo '<option value="'.$key.'"';
							if($key == $EditArray['order_service_provider_id'])
							{
								$courierkey = $key;
								echo ' selected="selected"';
							}
						echo '>'.$val["provider_name"].'</option>';
					}
				}
			?>
   		</select>
		
	</td>
  </tr>
  <tr id="courierURL" >
    <!--td>Courier URL: </td-->
    <td colspan="2">
		<label id="url">
		<?php
			if(isset($EditArray['order_service_provider_id']))
				echo '<a href="'.$courierNameArr[$courierkey]['provider_url'].'">'.$courierNameArr[$courierkey]['provider_url'].'</a>';
			else
				echo 'Please select service provider name';
		?></label>
	</td>
  </tr>
  <tr>
    <td colspan="2" style="text-align:center;">
		<input type="submit" name="Submit" value="Save" />
		<input type="button" name="close" value="Close" onclick="closeTheWindow()"></td>
    </tr>
</table>
</form>
</div>
<?php 
function initialize_array($order_id)
{
    include_once('config.inc.php');
$db = mysqli_connect(HOST, USER_NAME, PASSWORD, DB_NAME) or die("Not connected.");
	$EditArray = array('order_bill_no' => '', 'order_bill_date' => '', 'order_dispatch_date' => '', 'order_num_of_packets' => '1', 'order_docket_no' => '', 'order_dispatch_mode' => '', 'order_service_provider_id'=>'');
	
	$varQuery = 'SELECT order_bill_no, DATE_FORMAT(order_bill_date, "%d-%b-%Y") AS order_bill_date, '.
				' DATE_FORMAT(order_dispatch_date, "%d-%b-%Y") AS order_dispatch_date, '.
										' order_num_of_packets, order_docket_no, order_dispatch_mode, order_service_provider_id '.
							 ' FROM customer_order '.
							' WHERE order_id = "'.$order_id.'"';
	$VarResult = mysqli_query($db, $varQuery) or die(mysqli_error());
	
	while($row = mysqli_fetch_object($VarResult))
	{
		$EditArray['order_bill_no'] = $row->order_bill_no;
		$EditArray['order_bill_date'] = $row->order_bill_date;
		$EditArray['order_dispatch_date'] = $row->order_dispatch_date;
		$EditArray['order_num_of_packets'] = $row->order_num_of_packets;
		$EditArray['order_docket_no'] = $row->order_docket_no;
		$EditArray['order_dispatch_mode'] = $row->order_dispatch_mode;
		$EditArray['order_service_provider_id'] = $row->order_service_provider_id;
	}
	return $EditArray;
}
?>
</body>
</html>

© 2025 Cubjrnet7