www.dev2.delv-in.com - UnknownSec 403

upload mass deface mass delete console info server
name : m_stories.php
 <?php

class Story {

	private $Database;
	private $db_table = 'stories';

	function __construct(){
		global $Database;
		$this->Database = $Database;
	}

	public function get($storyID, $rank1){

		$data = array();

		$Template = new Template;

		if ($storyID > 0){
			// get 1
			if ($stmt = $this->Database->prepare("SELECT * FROM `" . $this->db_table . "` WHERE `storyID` = ?")){
				$stmt->bind_param('i', $storyID);
				$stmt->execute();
				$stmt->store_result();
				$stmt->bind_result($storyID, $stTitle, $stDescript, $movieFile, $rank);
				if ($stmt->num_rows() > 0){
					$stmt->fetch();
					$data = array('storyID'=>$storyID, 'stTitle'=>$stTitle, 'stDescript'=>$stDescript, 'movieFile'=>$movieFile, 'rank'=>$rank);
					return $data;
					$stmt->close();
				}
			} else {
				$Template->set_alert("Query error: ".__line__." m_stories");
			}

		} else {
			// get all
			if ($rank == ''){
				$rank1 = "`stTitle`";
			} else {
				$rank1 = $rank;
			}
			$query = "SELECT * FROM " . $this->db_table . "` ORDER BY " . $rank1;

			// echo __line__ . ": " . $query ."<br>";

			if ($stmt = $this->Database->prepare("SELECT * FROM `" . $this->db_table . "` ORDER BY " . $rank1)){
				$stmt->execute();
				$stmt->store_result();
				$stmt->bind_result($storyID, $stTitle, $stDescript, $movieFile, $rank);
				while ($stmt->fetch()){
					$data[$storyID] = array('storyID'=>$storyID, 'stTitle'=>$stTitle, 'stDescript'=>$stDescript, 'movieFile'=>$movieFile, 'rank'=>$rank);
				}

				return $data;
				$stmt->close();

			} else {
				$Template->set_alert("Query error: ".__line__." m_stories");
			}
		}
	} // end get method



	public function add_mod($storyID, $stTitle, $stDescript, $xMovieFile){

		$Template = new Template;

		$movieFile = $xMovieFile;

		$upload_result = false;
		$uploadfile = '';


		if (count($_FILES['movieFile']['name']) == 3){
			foreach ($_FILES['movieFile']['name'] as $key => $name){
				if (strlen(substr($name, strpos($name, "."))) > 5){
					$new_name = substr($name, 0, strpos($name, ".")) . "." . substr($_FILES['movieFile']['type'][$key], 6);
				} else {
					$new_name = $name;
				}
				
			// 	upload the temp file
				$uploadfile = "views/stories/".$new_name;

				if (move_uploaded_file($_FILES['movieFile']['tmp_name'][$key], $uploadfile)) {
					$attach = $_FILES['movieFile']['name'];
					$upload_result .= $new_name ;
				}
			
			}
			$movieFile = substr($_FILES['movieFile']['name'][0], 0, strpos($_FILES['movieFile']['name'][0], ".")) ;

		} else if (isset($_POST['delMovieFile'])){
			$movieFile = '';
		} else {
			$movieFile = $xMovieFile;	
		}
		date_default_timezone_set('Canada/Pacific');
		$addedTS = strtotime('now');

		if ($storyID > 0){
			// update record

			if ($stmt = $this->Database->prepare("UPDATE ". $this->db_table . " SET stTitle=?, stDescript=?, movieFile=? WHERE storyID = ?")){
				$stmt->bind_param('sssi', $stTitle, $stDescript, $movieFile, $storyID);
				if ($stmt->execute()){
					$alert_stDescript = 'Story updated';

					if ($upload_result != false && count($_FILES['movieFile']['name']) == 3){
						$alert_stDescript .= " & video upload successful.";

					} else if ($upload_result == false && count($_FILES['movieFile']['name']) == 3){
						$alert_stDescript .= " BUT video did not upload (" . $upload_result . ").";
					}

					$Template->set_alert($alert_stDescript, 'success');
				} else {
					$Template->set_alert('ERROR: Story did not update', 'error');
				}

			}
		} else {
			// insert record

			$rows = $this->get('', '');
			$rank = count($rows) + 1;

			if ($stmt = $this->Database->prepare("INSERT INTO ". $this->db_table . " (storyID, stTitle, stDescript, movieFile, rank) VALUES (?,?,?,?,?)")){
				$stmt->bind_param('isssi', $storyID, $stTitle, $stDescript, $movieFile, $rank);
				if ($stmt->execute()){
					$alert_stDescript = 'Story added';
					if ($upload_result === true){
						$alert_stDescript .= " & video upload successful.";
					} else {
						$alert_stDescript .= " BUT video did not upload.";
					}
					$Template->set_alert($alert_stDescript, 'success');
				} else {
					$Template->set_alert('ERROR: Story was not added', 'error');
				}

			}
		}
	} // end add_mod method



    public function update_rank($storyID, $rank, $oldRank){

        $Template = new Template;

        // echo __line__.": rank =".$rank.", oldRank=".$oldRank."<br>";
        $increment = 1;

        if ($rank > $oldRank){

            $this->decrement_rank($storyID, $rank, $oldRank);
            

        } else if ($rank < $oldRank){

            $this->increment_rank($storyID, $rank, $oldRank);

        }

        if ($storyID > 0){

        	 $query = "UPDATE " . $this->db_table ." SET rank = '".$rank."' WHERE storyID = '".$storyID."'";
	        // echo __line__.": ".$query."<br>";

	        if ($stmt = $this->Database->prepare("UPDATE " . $this->db_table ." SET rank = ? WHERE storyID = ?")){
	            $stmt->bind_param('ii', $rank, $storyID);
	            if ($stmt->execute()){
	                $Template->set_alert('Changes saved', 'success');
	            } else {
	                $Template->set_alert('ERROR: Changes not saved', 'error');
	            }
	            $stmt->close();
	        }
        }

       
    }


    public function decrement_rank($rank, $oldRank){

        $increment = 1;

        $Template = new Template;
            
        $query = 'UPDATE ' . $this->db_table . " SET rank = rank-1 WHERE rank > '".$oldRank."' and rank <= '".$rank."'";
        // echo __line__.": ".$query."<br>";

            if ($stmt = $this->Database->prepare('UPDATE ' . $this->db_table . " SET rank = rank-? WHERE rank > ? and rank <= ?")){
                $stmt->bind_param('iii', $increment, $oldRank, $rank);
                $stmt->execute();
                // $Template->set_alert($query);
                $stmt->close();
            }

    }

    public function increment_rank($storyID, $rank, $oldRank){

        $increment = 1;

        $Template = new Template;

        $query = "UPDATE ". $this->db_table . " SET rank = rank + 1 WHERE rank < '".$oldRank."' and rank >= '".$rank."'";
        // echo __line__.": ".$query."<br>";

        if ($stmt = $this->Database->prepare('UPDATE ' . $this->db_table . " SET rank = rank+? WHERE rank < ? and rank >= ?")){
            $stmt->bind_param('iii', $increment, $oldRank, $rank);
            $stmt->execute();
                // $Template->set_alert($query);
            $stmt->close();
        }

    }



	public function delete($storyID, $rank){

		$Template = new Template;

		if ($stmt = $this->Database->prepare("DELETE FROM " . $this->db_table . " WHERE storyID=?")){
			$stmt->bind_param('i', $storyID);
			if ($stmt->execute()){

				$this->update_rank($storyID, '', $rank);

				$Template->set_alert('Story deleted', 'success');
			} else {
				$Template->set_alert('ERROR: Story was not deleted', 'error');
			}
		}

	} // end delete method

}

?>
UnknownSec Shell
