shell bypass 403
UnknownSec Shell
:
/
home
/
delvin
/
dev.delv-in.com
/
models
/ [
drwxr-xr-x
]
upload
mass deface
mass delete
console
info server
name :
m_usr_PMS_ID.php
<?php /* User PMS ID Class */ class User_PMS_ID{ private $Database; private $db_table = 'users_PMS_ID'; function __construct(){ global $Database; $this->Database = $Database; } public function get_all($sortOrder){ if ($sortOrder == ''){ $sortOrder = 'effectiveTS DESC'; } $data = array(); if ($stmt = $this->Database->prepare("SELECT * FROM " . $this->db_table ." WHERE practiceID = ? ORDER BY ". $sortOrder)){ $stmt->bind_param('i', $_SESSION['PID']); $stmt->execute(); $stmt->store_result(); $stmt->bind_result($pmsLinkID, $practiceID, $producerID, $PMS_IDstr, $effectiveTS, $expireTS); while ($stmt->fetch()){ $data[] = array('pmsLinkID'=>$pmsLinkID, 'practiceID'=>$practiceID, 'producerID'=>$producerID, 'PMS_IDstr'=>$PMS_IDstr, 'effectiveTS'=>$effectiveTS, 'expireTS'=>$expireTS); } return $data; $stmt->close(); } } public function search($practiceID, $userID, $t1, $t2, $pmsLinkID, $sortOrder){ // echo __LINE__.": m_usr_punch_p: userID=". $userID. ", t1=". $t1 . ", t2=". $t2 . ", groupID=" . $groupID .", pmsLinkID=". $pmsLinkID .", sortOrder=". $sortOrder."<br>"; $rows = $this->get_all($sortOrder); foreach ($rows as $key => $row){ if ($pmsLinkID > 0 && $row['pmsLinkID'] != $pmsLinkID){ unset($rows[$key]); } if ($userID > 0 && $row['producerID'] != $userID){ unset($rows[$key]); } // unset policies that expired before t1 if (($t1 > 0 && $t2 <= 0) && ($row['expireTS'] > 0 && $row['expireTS'] < $t1) ){ unset($rows[$key]); } else if (($t1 > 0 && $t2 > 0) && $row['effectiveTS'] >= $t2 || ($row['expireTS'] > 0 && $row['expireTS'] < $t1)){ //unset records not active at any time from t1 to t2 unset($rows[$key]); } } if ($pmsLinkID > 0){ $rows = $rows[array_key_first($rows)]; } else { $rows = array_values($rows); } // echo __LINE__.": " . count($rows) . "<br>"; return $rows; } public function get_4_menu($practiceID, $userID, $t1, $t2, $sortOrder){ $rows = $this->search($practiceID, $userID, $t1, $t2, '', $sortOrder); // echo __LINE__." <pre>"; print_r($rows); echo "</pre>"; $data = array(); foreach ($rows as $row){ if (strpos($row['PMS_IDstr'], ":") !== false){ // its a hygienist $PMS_IDarr = unserialize($row['PMS_IDstr']); // echo __line__.": " . $row['PMS_IDstr'] . "<BR>"; // echo "<pre>"; print_r($PMS_IDarr); echo "</pre>"; foreach($PMS_IDarr as $PMS_ID){ $data[$PMS_ID] = $PMS_ID; } } else { // its a dentist $data[$row['PMS_IDstr']] = $row['PMS_IDstr']; } } $data = array_filter($data); natsort($data); // echo __LINE__. ": <pre>"; print_r($data); echo "</pre>"; return $data; } public function get_4_nameMenu($practiceID, $userID, $t1, $t2, $sortOrder){ $rows = $this->search($practiceID, $userID, $t1, $t2, '', $sortOrder); // echo __LINE__." <pre>"; print_r($rows); echo "</pre>"; $Users = new Users(); $uRows = $Users->get_4_menu($practiceID, $loginStatus, $empl_status, $jobAreaID, $t1, $t2, '', $punch_shift, $sortOrder); // echo __LINE__." <pre>"; print_r($uRows); echo "</pre>"; $data = array(); foreach ($rows as $row){ if (strpos($row['PMS_IDstr'], ":") === false){ // its a dentist if ($row['PMS_IDstr'] != ''){ $data[$row['PMS_IDstr']] = $uRows[$row['producerID']]; } } else { // its a hygienist $PMS_IDarr = unserialize($row['PMS_IDstr']); foreach ($PMS_IDarr as $producerID => $PMS_ID){ if (isset($uRows[$row['producerID']]) && $PMS_ID != ''){ $data[$PMS_ID] = $uRows[$row['producerID']]; } } } } $data = array_filter($data); // echo __LINE__.": <pre>"; print_r($data); echo "</pre>"; natsort($data); return $data; } public function add_mod($practiceID, $pmsLinkID, $producerID, $PMS_IDstr, $effectiveTS, $xEffectiveTS){ if ($pmsLinkID <= 0){ // insert $expireTS = 0; // get most recent policy $previous_policy = $this->search($practiceID, $_SESSION['edit_id'], '', '', '', '`effectiveTS` DESC'); $previous_policy = $previous_policy[0]; if (isset($previous_policy['pmsLinkID'])){ // set expire to the effective date of new policy $this->update_expire($previous_policy['pmsLinkID'], $practiceID, $effectiveTS - 1); } $query = "INSERT INTO `" . $this->db_table . "` (`practiceID`, `producerID`, `PMS_IDstr`, `effectiveTS`, `expireTS`) VALUES ('". $_SESSION['PID']."', '" .$producerID ."', '". $PMS_IDstr."', '". $effectiveTS."', '" . $expireTS."')"; // echo __LINE__.": " . $query ."<br>"; if ($stmt = $this->Database->prepare("INSERT INTO `" . $this->db_table . "` (`practiceID`, `producerID`, `PMS_IDstr`, `effectiveTS`, `expireTS`) VALUES (?,?,?,?,?)")){ $stmt->bind_param('iisii', $practiceID, $producerID, $PMS_IDstr, $effectiveTS, $expireTS); if ($stmt->execute()){ return true; } else { return false; } } else { return false; } } else { // update if ($xEffectiveTS != $effectiveTS ){ // effective date was changed -> need to update expire date of previous policy // look for policy with expireTS that matches xEffectiveTS $previous_policy = $this->search($practiceID, $_SESSION['edit_id'], '', '', '', 'effectiveTS DESC'); if (isset($previous_policy[1])){ $previous_policy = $previous_policy[1]; } if (isset($previous_policy['pmsLinkID'])){ $this->update_expire($previous_policy['pmsLinkID'], $practiceID, $effectiveTS - 1); } } $query = "UPDATE " . $this->db_table . " SET PMS_IDstr='".$PMS_IDstr."', effectiveTS='".$effectiveTS."' WHERE pmsLinkID='".$pmsLinkID."'"; if ($stmt = $this->Database->prepare("UPDATE `" . $this->db_table . "` SET `PMS_IDstr`=?, `effectiveTS`=? WHERE `pmsLinkID`=?")){ $stmt->bind_param('sii', $PMS_IDstr, $effectiveTS, $pmsLinkID); if ($stmt->execute()){ return true; } else { return false; } } else { return false; } } // echo __line__.": ".$query."<br>"; } public function update_expire($pmsLinkID, $practiceID, $expireTS){ $Template = new Template; if ($pmsLinkID > 0){ $query = "UPDATE ". $this->db_table." SET expireTS = '".$expireTS."' WHERE pmsLinkID = '".$pmsLinkID."'"; // echo __LINE__.": " .$query ."<br>"; if ($stmt = $this->Database->prepare("UPDATE ". $this->db_table." SET expireTS = ? WHERE pmsLinkID = ?")){ $stmt->bind_param('ii', $expireTS, $pmsLinkID); $stmt->execute(); $stmt->close(); return true; } else { return false; } } else { $zero = 0; if ($stmt = $this->Database->prepare("UPDATE ". $this->db_table." SET expireTS = ? WHERE userID = ? and expireTS = ? and practiceID = ?")){ $stmt->bind_param('iiii', $expireTS, $_SESSION['edit_id'], $zero, $practiceID); $stmt->execute(); $stmt->close(); return true; } else { return false; } } // echo __LINE__.": " .$query ."<br>"; } public function delete($pmsLinkID, $userID){ if ($pmsLinkID > 0){ $previous_policy = $this->search($_SESSION['edit_id'], '', '', '', '', 'effectiveTS DESC'); $previous_policy = $previous_policy[1]; if (isset($previous_policy['pmsLinkID'])){ $this->update_expire($previous_policy['pmsLinkID'], $_SESSION['PID'], '0'); } if ($stmt = $this->Database->prepare("DELETE FROM " . $this->db_table . " WHERE pmsLinkID = ?")){ $stmt->bind_param('i', $pmsLinkID); if ($stmt->execute()){ return true; } else { return false; } } } else if ($userID > 0){ if ($stmt = $this->Database->prepare("DELETE FROM " . $this->db_table . " WHERE producerID=? AND practiceID = ?")){ $stmt->bind_param('ii', $userID, $_SESSION['PID']); if ($stmt->execute()){ return true; } else { return false; } } } } public function v7update($userID, $userID2, $practiceID){ $query = "UPDATE `" . $this->db_table . "` SET `producerID` = '" . $userID . "' WHERE `producerID` = '" . $userID2 . "' and `practiceID` = '" . $practiceID . "'"; // echo __LINE__.": " . $query . "<br>"; if ($stmt = $this->Database->prepare("UPDATE `" . $this->db_table . "` SET `producerID` = ? WHERE `producerID` = ? and `practiceID` = ?")){ $stmt->bind_param('iii', $userID, $userID2, $practiceID); if ($stmt->execute()){ $stmt->close(); return 'success'; } else { return $query; } } } } ?>
© 2026 UnknownSec