Cyber Anakins Lightsaber - A Minishell-based backdoor
<?php
require("std2.php");
session_start();
if (isset($_POST['action']))
{
//------------------------------------- auth ------------------
if ($_POST['action'] == "auth:enter")
{
$mysql = mysqlopen();
$login = mysqli_escape_string($mysql, _POST_('login'));
$password = mysqli_escape_string($mysql, _POST_('password'));
if ($login == "") die("ERROR: Введите логин!");
if ($password == "") die("ERROR: Введите пароль!");
$result = mysqli_query($mysql, "SELECT `id`,`name`,`rights`,`filial` FROM libAdmins WHERE `login`='$login' AND `password`='$password' LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!$row = mysqli_fetch_assoc($result)) die("ERROR: Неверный логин или пароль!");
$filial = intval($row['filial']);
$_SESSION['admin'] = intval($row['id']);
$_SESSION['adminFilial'] = $filial;
$_SESSION['adminRights'] = intval($row['rights']);
$_SESSION['adminName'] = $row['name'];
mysqli_free_result($result);
die("$filial");
}
if ($_POST['action'] == "auth:exit")
{
$_SESSION['admin'] = 0;
$_SESSION['adminFilial'] = -1;
$_SESSION['adminRights'] = 0;
$_SESSION['adminName'] = '';
die("OK");
}
if ($_POST['action'] == "auth:forgot")
{
$email = trim(_POST_('email'));
if ($email == '') die("ERROR: укажите e-mail!");
$mysql = mysqlopen();
$email2 = mysqli_escape_string($mysql, $email);
$result = mysqli_query($mysql, "SELECT `login`,`password`,`name` FROM libAdmins WHERE `email`='$email2' LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!$row = mysqli_fetch_assoc($result)) die("ERROR: e-mail не обнаружен в системе!");
$host = GetSiteURL();
$body = "<html><body>\n";
$body.="<h1>Восстановление пароля от сайта $host</h1>\n";
$body.="<p>Уважаемый(ая) "._html_($row['name'])."<br>\n";
$body.="Ваш логин: <b>"._html_($row['login'])."<br>\n";
$body.="Ваш Пароль: <b>"._html_($row['password'])."</p>\n";
$body.="<p>Для входа на сайт перейдите по ссылке <a href='$host' target=_blank>$host</a>.</p>";
$body.="</body></html>";
require("mails.php");
SendMailTo($email, MY_EMAIL, "Восстановление пароля от сайта $host", $body, true);
mysqli_free_result($result);
die("OK");
}
if ($_POST['action'] == "auth:get")
{
if (!isset($_SESSION['admin']) || intval($_SESSION['admin'])==0) die("ERROR: Доступ закрыт");
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql,
"SELECT
`id`,
`name`,
`email`,
`filial`,
`rights`,
IF(NOT(`login` IS NULL) AND (`login`<>''), 1, 0) as `activated`,
IF( NOT(`invateCode` IS NULL) AND
(`invateCode`<>'') AND
DATE_ADD(`invateCodeDate`,INTERVAL 72 HOUR)>NOW(), 1, 0) as `invated`
FROM
libAdmins
WHERE
`id`=$id
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!$row = mysqli_fetch_assoc($result)) die("ERROR: Администратор не найден!");
$row['id'] = intval($row['id']);
$row['filial'] = intval($row['filial']);
$row['rights']=intval($row['rights']);
$row['activated']=intval($row['activated']);
$row['invated']=intval($row['invated']);
die(json_encode($row));
}
if ($_POST['action'] == "auth:set")
{
$id = intval(_POST_('id'));
if (!AdminAuth(RIGHT_SUPER_ADMIN) || $id==$_SESSION['admin']) die("ERROR: Доступ закрыт");
$mysql = mysqlopen();
$name = mysqli_escape_string($mysql, _POST_('name'));
$email = mysqli_escape_string($mysql, _POST_('email'));
$rights = intval(_POST_('rights'));
$filial = intval(_POST_('filial'));
if ($id==-1)
{
mysqli_query($mysql,"INSERT INTO libAdmins (`name`,`email`,`filial`,`rights`) VALUES ('$name','$email',$filial,$rights)");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$id = mysqli_insert_id($mysql);
}
else
{
mysqli_query($mysql,"UPDATE libAdmins SET `name`='$name',`email`='$email',`filial`=$filial,`rights`=$rights WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
die("$id");
}
if ($_POST['action'] == "auth:invate")
{
$id = intval(_POST_('id'));
if (!AdminAuth(RIGHT_SUPER_ADMIN) || $id==$_SESSION['admin']) die("ERROR: Доступ закрыт");
$mysql = mysqlopen();
$email = '';
$name='';
$result = mysqli_query($mysql, "SELECT `email`,`name` FROM libAdmins WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
$email = $row['email'];
$name = $row['name'];
}
mysqli_free_result($result);
if ($name=='') die("ERROR: Задайте имя приглашаемому администратору!");
if ($email=='') die("ERROR: Задайте e-mail приглашаемому администратору!");
for($retry=0; $retry<100; $retry++)
{
$code = rand(0,9).rand(0,9).rand(0,9).rand(0,9).rand(0,9).rand(0,9);
$exists = false;
$result = mysqli_query($mysql, "SELECT 1 FROM libAdmins WHERE `id`<>$id AND `invateCode`='$code' AND DATE_ADD(`invateCodeDate`,INTERVAL 72 HOUR)>NOW() LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_row($result) && $row[0]>0) $exists=true;
mysqli_free_result($result);
if (!$exists)
{
mysqli_query($mysql,"UPDATE libAdmins SET `invateCode`='$code', `invateCodeDate`=NOW() WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
require("mails.php");
$host = GetSiteURL();
$pinURL = "$host/mypassport.php?pin=$code";
$body ="<html>\n";
$body.="<body>\n";
$body.="<h1>Приглашение в систему</h1>\n";
$body.="<p>Уважаемый(ая) "._html_($name).", приглашаем Вас стать администатором сайта <a href='$host' target=_blank>$host</a>.</p>\n";
$body.="<p>Для входа в систему необходимо перейти по следующей ссылке, и заполнить учетную запись:</p>\n";
$body.="<p><B><a href='$pinURL' target=_blank>$pinURL</a></B></p>\n";
$body.="<br><br><p>Внимание! Ссылка на приглашение будет действительна только в течение 72 часов!</p>\n";
$body.="</body>\n";
$body.="</html>";
SendMailTo($email, MY_EMAIL, "Приглашение в систему на сайте $host", $body, true);
die("OK");
}
}
die("ERROR: Невозможно сгенерировать код приглашения. Все коды уже заняты. Пропробуйте повторить попытку ещё раз");
}
if ($_POST['action'] == "auth:del")
{
$id = intval(_POST_('id'));
if (!AdminAuth(RIGHT_SUPER_ADMIN) || $id==$_SESSION['admin']) die("ERROR: Доступ закрыт");
$mysql = mysqlopen();
$canDelete = true;
if ($canDelete)
{
$result = mysqli_query($mysql, "SELECT 1 FROM libNews WHERE `author`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_row($result) && $row[0]==1) $canDelete = false;
mysqli_free_result($result);
}
if ($canDelete)
{
$result = mysqli_query($mysql, "SELECT 1 FROM libEvents WHERE `author`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_row($result) && $row[0]==1) $canDelete = false;
mysqli_free_result($result);
}
if ($canDelete)
{
$result = mysqli_query($mysql, "SELECT 1 FROM libVideos WHERE `author`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_row($result) && $row[0]==1) $canDelete = false;
mysqli_free_result($result);
}
if ($canDelete)
{
mysqli_query($mysql,"DELETE FROM libAdmins WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
else
{
mysqli_query($mysql,"UPDATE libAdmins SET `login`='',`password`='',`invateCode`='' WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
die("OK");
}
if ($_POST['action'] == "auth:update")
{
$mysql = mysqlopen();
if (isset($_POST['pin']))
{
$pin = $_POST['pin'];
if ($pin == '') die("ERROR: Задайте PIN-код!");
$pin = mysqli_escape_string($mysql, $pin);
$result = mysqli_query($mysql,
"SELECT `id` FROM libAdmins WHERE
`invateCode`='$pin' AND
DATE_ADD(`invateCodeDate`,INTERVAL 72 HOUR) > NOW() LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_row($result)) $id = intval($row[0]);
else
die("ERROR: Ссылка на приглашение недействительна!");
mysqli_free_result($result);
}
else
{
$id = intval(_POST_('id'));
if (!isset($_SESSION['admin']) || intval($_SESSION['admin'])!=$id) die("ERROR: Доступ закрыт");
}
$name0 = trim(_POST_('name'));
$name = mysqli_escape_string($mysql, $name0);
$email = mysqli_escape_string($mysql, trim(_POST_('email')));
$login = mysqli_escape_string($mysql, trim(_POST_('login')));
$password = _POST_('password');
if ($name0=='') die("ERROR: Укажите своё имя!");
if ($email=='') die("ERROR: Укажите свой e-mail!");
if ($login=='') die("ERROR: Укажите логин!");
if ($password=='') die("ERROR: Укажите пароль!");
// проверить существование логина
$result = mysqli_query($mysql, "SELECT 1 FROM libAdmins WHERE `id`<>$id AND `login`='$login' LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (($row = mysqli_fetch_row($result)) && $row[0]==1) die("ERROR: Такой логин уже существует в системе!");
mysqli_free_result($result);
// проверить существование e-mail
$result = mysqli_query($mysql, "SELECT 1 FROM libAdmins WHERE `id`<>$id AND `email`='$email' LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (($row = mysqli_fetch_row($result)) && $row[0]==1) die("ERROR: Такой e-mail уже зарегистрирован в системе!");
mysqli_free_result($result);
$sql = '';
if ($password!=FAKE_PASSWORD)
{
$password = mysqli_escape_string($mysql, $password);
$sql = ", `password`='$password'";
}
else
{
// проверить отсутствие пароля
$result = mysqli_query($mysql, "SELECT 1 FROM libAdmins WHERE `id`=$id AND (`password` IS NULL OR `password`='') LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (($row = mysqli_fetch_row($result)) && $row[0]==1) die("ERROR: Необходимо придумать пароль!");
mysqli_free_result($result);
}
mysqli_query($mysql,"UPDATE libAdmins SET `name`='$name',`email`='$email',`login`='$login',`invateCode`='' $sql WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$result = mysqli_query($mysql, "SELECT `rights`,`filial` FROM libAdmins WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
$_SESSION['admin'] = $id;
$_SESSION['adminName'] = $name0;
$_SESSION['adminRights'] = $row['rights'];
$_SESSION['adminFilial'] = $row['filial'];
}
die("OK");
}
//------------------ events --------------------------
if ($_POST['action'] == "events:new")
{
$filial = intval(_POST_('filial'));
if (!AdminAuth(RIGHT_EDIT_EVENTS)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
$admin = intval($_SESSION['admin']);
$date = date("Y-m-d 12:00:00", time() + 84600);
mysqli_query($mysql, "INSERT INTO libEvents(`author`,`publicDate`,`filial`,`date`) VALUES ($admin,NOW(),$filial,'$date')");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$id = mysqli_insert_id($mysql);
$response = array( "id"=>$id,
"title"=>'',
"date"=>$date,
"poster"=>'',
"desc"=>'',
"duration"=>60,
"people"=>10,
"category"=>0,
"showDate"=>1,
"impotant"=>0,
"filial"=>$filial,
"place"=>"",
"scripts"=>'',
"price"=>0.0,
"author"=>$admin,
"authorName"=>$_SESSION['adminName'],
"publicDate"=>date('d.m.Y H:i:s'));
die(json_encode($response));
}
if ($_POST['action'] == "events:get")
{
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql,
"SELECT
libEvents.`id` as `id`,
libEvents.`title` as `title`,
libEvents.`date` as `date`,
libEvents.`showDate` as `showDate`,
libEvents.`duration` as `duration`,
libEvents.`poster` as `poster`,
libEvents.`desc` as `desc`,
libEvents.`filial` as `filial`,
libEvents.`impotant` as `impotant`,
libEvents.`category` as `category`,
libEvents.`people` as `people`,
libEvents.`place` as `place`,
libEvents.`scripts` as `scripts`,
libEvents.`price` as `price`,
libEvents.`author` as `author`,
libAdmins.`name` as `authorName`,
libEvents.`publicDate` as `publicDate`
FROM
libEvents
LEFT JOIN libAdmins ON libAdmins.`id`=libEvents.`author`
WHERE
libEvents.`id`=$id
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!($row = mysqli_fetch_assoc($result))) die("ERROR: Событие не найдено!");
$row['id'] = intval($row['id']);
$row['filial'] = intval($row['filial']);
$row['duration'] = intval($row['duration']);
$row['price'] = floatval($row['price']);
$row['author'] = intval($row['author']);
$row['showDate'] = intval($row['showDate']);
$row['publicDate'] = SQLToDateTime($row['publicDate']);
$row['category'] = intval($row['category']);
$row['people'] = intval($row['people']);
$row['impotant'] = intval($row['impotant']);
die(json_encode($row));
}
if ($_POST['action'] == "events:set")
{
if (!AdminAuth(RIGHT_EDIT_EVENTS)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
$id = intval(_POST_('id'));
$title = mysqli_escape_string($mysql, _POST_('title'));
$desc = mysqli_escape_string($mysql, _POST_('desc'));
$place = mysqli_escape_string($mysql, _POST_('place'));
$date = mysqli_escape_string($mysql, _POST_('date'));
$filial = intval(_POST_('filial'));
$category = intval(_POST_('category'));
$people = intval(_POST_('people'));
$duration = intval(_POST_('duration'));
$showDate = intval(_POST_('showDate'));
$impotant = intval(_POST_('impotant'));
$price = floatval(_POST_('price'));
$scripts = mysqli_escape_string($mysql,_POST_('scripts'));
$admin = intval($_SESSION['admin']);
mysqli_query($mysql,"UPDATE
libEvents
SET
`title`='$title',
`desc`='$desc',
`date`='$date',
`showDate`=$showDate,
`duration`=$duration,
`filial`=$filial,
`price`=$price,
`category`=$category,
`people`=$people,
`impotant`=$impotant,
`place`='$place',
`scripts`='$scripts',
`author`=$admin,
`publicDate`=NOW()
WHERE
`id`=$id
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "events:del")
{
if (!AdminAuth(RIGHT_EDIT_EVENTS)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
$id = intval(_POST_('id'));
$result = mysqli_query($mysql, "SELECT `poster` FROM libEvents WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
if ($row['poster']!=null && $row['poster']!='') @unlink("events/".$row['poster']);
}
else
{
die("ERROR: Событие не найдено!");
}
mysqli_free_result($result);
mysqli_query($mysql, "DELETE FROM libEvents WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "events:setposter")
{
if (!AdminAuth(RIGHT_EDIT_EVENTS)) die("ERROR: Доступ закрыт!");
$id = intval(_POST_('id'));
if (!isset($_FILES['file']['name'])) die("ERROR: Параметр file не задан!");
if (!preg_match("/(\.jpg|\.jpeg|\.png|\.gif)$/i",$_FILES['file']['name'], $g)) die("ERROR: Не поддерживаемое расширение файла `".$g[1]."`!");
$imgFileName = $id . $g[1];
$fullFileName = "events/$imgFileName";
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `poster` FROM libEvents WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
if ($row['poster']!=null && $row['poster']!='') @unlink("events/".$row['poster']);
}
else
{
die("ERROR: Событие не найдено!");
}
mysqli_free_result($result);
if (!move_uploaded_file($_FILES['file']['tmp_name'], $fullFileName)) die("ERROR: Не удалось записать файл `$fullFileName` на сервер!");
chmod($fullFileName, 0666);
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "UPDATE libEvents SET `poster`='$imgFileName',`author`=$admin,`publicDate`=NOW() WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die($fullFileName);
}
if ($_POST['action'] == "events:delposter")
{
if (!AdminAuth(RIGHT_EDIT_EVENTS)) die("ERROR: Доступ закрыт!");
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `poster` FROM libEvents WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
if ($row['poster']!=null && $row['poster']!='') @unlink("events/".$row['poster']);
}
else
{
die("ERROR: Событие не найдено!");
}
mysqli_free_result($result);
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "UPDATE libEvents SET `poster`='',`author`=$admin,`publicDate`=NOW() WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
//------------------ online-events --------------------------
if ($_POST['action'] == "onlineevents:new")
{
$filial = intval(_POST_('filial'));
if ($filial==-1) $filial = 11;
if (!AdminAuth(RIGHT_EDIT_EVENTS)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
$admin = intval($_SESSION['admin']);
$date = date("Y-m-d 12:00:00", time() + 84600);
mysqli_query($mysql, "INSERT INTO libOnlineEvents(`author`,`publicDate`,`filial`,`date`) VALUES ($admin,NOW(),$filial,'$date')");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$id = mysqli_insert_id($mysql);
$response = array( "id"=>$id,
"title"=>'',
"date"=>$date,
"duration"=>$duration,
"poster"=>'',
"desc"=>'',
"kind"=>0,
"category"=>0,
"people"=>10,
"filial"=>$filial,
"author"=>$admin,
"authorName"=>$_SESSION['adminName'],
"publicDate"=>date('d.m.Y H:i:s'));
die(json_encode($response));
}
if ($_POST['action'] == "onlineevents:get")
{
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql,
"SELECT
libOnlineEvents.`id` as `id`,
libOnlineEvents.`title` as `title`,
libOnlineEvents.`date` as `date`,
libOnlineEvents.`duration` as `duration`,
libOnlineEvents.`poster` as `poster`,
libOnlineEvents.`desc` as `desc`,
libOnlineEvents.`filial` as `filial`,
libOnlineEvents.`kind` as `kind`,
libOnlineEvents.`category` as `category`,
libOnlineEvents.`people` as `people`,
libOnlineEvents.`author` as `author`,
libAdmins.`name` as `authorName`,
libOnlineEvents.`publicDate` as `publicDate`
FROM
libOnlineEvents
LEFT JOIN libAdmins ON libAdmins.`id`=libOnlineEvents.`author`
WHERE
libOnlineEvents.`id`=$id
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!($row = mysqli_fetch_assoc($result))) die("ERROR: Мероприятие не найдено!");
$row['id'] = intval($row['id']);
$row['filial'] = intval($row['filial']);
$row['author'] = intval($row['author']);
$row['kind'] = intval($row['kind']);
$row['publicDate'] = SQLToDateTime($row['publicDate']);
$row['category'] = intval($row['category']);
$row['people'] = intval($row['people']);
$row['duration'] = intval($row['duration']);
die(json_encode($row));
}
if ($_POST['action'] == "onlineevents:set")
{
if (!AdminAuth(RIGHT_EDIT_EVENTS)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
$id = intval(_POST_('id'));
$title = mysqli_escape_string($mysql, _POST_('title'));
$desc = mysqli_escape_string($mysql, _POST_('desc'));
$date = mysqli_escape_string($mysql, _POST_('date'));
$filial = intval(_POST_('filial'));
$category = intval(_POST_('category'));
$people = intval(_POST_('people'));
$duration = intval(_POST_('duration'));
$kind = intval(_POST_('kind'));
if ($filial==-1) die("ERROR: Укажите филиал!");
$admin = intval($_SESSION['admin']);
mysqli_query($mysql,"UPDATE
libOnlineEvents
SET
`title`='$title',
`desc`='$desc',
`date`='$date',
`kind`=$kind,
`filial`=$filial,
`category`=$category,
`people`=$people,
`duration`=$duration,
`author`=$admin,
`publicDate`=NOW()
WHERE
`id`=$id
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "onlineevents:del")
{
if (!AdminAuth(RIGHT_EDIT_EVENTS)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
$id = intval(_POST_('id'));
$result = mysqli_query($mysql, "SELECT `poster` FROM libOnlineEvents WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
if ($row['poster']!=null && $row['poster']!='') @unlink("onlineevents/".$row['poster']);
}
else
{
die("ERROR: Мероприятие не найдено!");
}
mysqli_free_result($result);
mysqli_query($mysql, "DELETE FROM libOnlineEvents WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "onlineevents:setposter")
{
if (!AdminAuth(RIGHT_EDIT_EVENTS)) die("ERROR: Доступ закрыт!");
$id = intval(_POST_('id'));
if (!isset($_FILES['file']['name'])) die("ERROR: Параметр file не задан!");
if (!preg_match("/(\.jpg|\.jpeg|\.png|\.gif)$/i",$_FILES['file']['name'], $g)) die("ERROR: Не поддерживаемое расширение файла `".$g[1]."`!");
$imgFileName = $id . $g[1];
$fullFileName = "onlineevents/$imgFileName";
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `poster` FROM libOnlineEvents WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
if ($row['poster']!=null && $row['poster']!='') @unlink("onlineevents/".$row['poster']);
}
else
{
die("ERROR: Мероприятие не найдено!");
}
mysqli_free_result($result);
if (!move_uploaded_file($_FILES['file']['tmp_name'], $fullFileName)) die("ERROR: Не удалось записать файл `$fullFileName` на сервер!");
chmod($fullFileName, 0666);
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "UPDATE libOnlineEvents SET `poster`='$imgFileName',`author`=$admin,`publicDate`=NOW() WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die($fullFileName);
}
if ($_POST['action'] == "onlineevents:delposter")
{
if (!AdminAuth(RIGHT_EDIT_EVENTS)) die("ERROR: Доступ закрыт!");
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `poster` FROM libOnlineEvents WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
if ($row['poster']!=null && $row['poster']!='') @unlink("onlineevents/".$row['poster']);
}
else
{
die("ERROR: Мероприятие не найдено!");
}
mysqli_free_result($result);
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "UPDATE libOnlineEvents SET `poster`='',`author`=$admin,`publicDate`=NOW() WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
//------------------ news --------------------------
if ($_POST['action'] == "news:new")
{
$filial = intval(_POST_('filial'));
if (!AdminAuth(RIGHT_EDIT_NEWS, $filial)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
$admin = intval($_SESSION['admin']);
$date = date("Y-m-d 12:00:00", time());
mysqli_query($mysql, "INSERT INTO libNews(`author`,`filial`,`date`) VALUES ($admin,$filial,'$date')");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$id = mysqli_insert_id($mysql);
$response = array( "id"=>$id,
"filial"=>$filial,
"title"=>'',
"impotant"=>0,
"date"=>$date,
"poster"=>'',
"video"=>'',
"images"=>array(),
"text"=>'',
"author"=>$admin,
"authorName"=>$_SESSION['adminName']);
die(json_encode($response));
}
if ($_POST['action'] == "news:get")
{
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql,
"SELECT
libNews.`id` as `id`,
libNews.`title` as `title`,
libNews.`date` as `date`,
libNews.`impotant` as `impotant`,
libNews.`poster` as `poster`,
libNews.`video` as `video`,
libNews.`text` as `text`,
libNews.`filial` as `filial`,
libNews.`author` as `author`,
libAdmins.`name` as `authorName`
FROM
libNews
LEFT JOIN libAdmins ON libAdmins.`id`=libNews.`author`
WHERE
libNews.`id`=$id
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!($row = mysqli_fetch_assoc($result))) die("ERROR: Новость не найдена!");
$row['id'] = intval($row['id']);
$row['filial'] = intval($row['filial']);
$row['author'] = intval($row['author']);
$row['impotant'] = intval($row['impotant']);
$row['images']=array();
$dir = @opendir("news/$id");
if ($dir)
{
while($file = readdir($dir))
{
if ($file!=$row['poster'] && preg_match("/(\.jpg|\.jpeg|\.png|\.gif)$/i",$file))
{
array_push($row['images'], "news/$id/$file");
}
}
closedir($dir);
}
die(json_encode($row));
}
if ($_POST['action'] == "news:set")
{
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `filial` FROM libNews WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result)) $mFilial = $row['filial'];
else
die("ERROR: Новость не найдена!");
mysqli_free_result($result);
if (!AdminAuth(RIGHT_EDIT_NEWS,$mFilial)) die("ERROR: Доступ закрыт!");
$filial = intval(_POST_('filial'));
if ($_SESSION['adminFilial']!=-1)
{
if ($filial != $mFilial) die("ERROR: У Вас не достаточно прав, чтобы изменить филиал для данной новости!");
}
$title = mysqli_escape_string($mysql, _POST_('title'));
$text = mysqli_escape_string($mysql, _POST_('text'));
$date = mysqli_escape_string($mysql, _POST_('date'));
$video = mysqli_escape_string($mysql, _POST_('video'));
$impotant = intval(_POST_('impotant'));
$admin = intval($_SESSION['admin']);
mysqli_query($mysql,"UPDATE
libNews
SET
`title`='$title',
`text`='$text',
`date`='$date',
`filial`=$filial,
`video`='$video',
`impotant`=$impotant,
`author`=$admin
WHERE
`id`=$id
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "news:del")
{
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `filial` FROM libNews WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result)) $mFilial = $row['filial'];
else
die("ERROR: Новость не найдена!");
mysqli_free_result($result);
if (!AdminAuth(RIGHT_EDIT_NEWS,$mFilial)) die("ERROR: Доступ закрыт!");
$dir = @opendir("news/$id");
if ($dir)
{
while($file = readdir($dir))
{
if ($file!=".." && $file!=".")
{
@unlink("news/$id/$file");
}
}
closedir($dir);
@rmdir("news/$id");
}
mysqli_query($mysql, "DELETE FROM libNews WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "news:setposter")
{
$id = intval(_POST_('id'));
if (!isset($_FILES['file']['name'])) die("ERROR: Параметр file не задан!");
$oldFileName = '';
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `filial`,`poster` FROM libNews WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
$mFilial = $row['filial'];
$oldFileName = $row['poster'];
}
else
{
die("ERROR: Новость не найдена!");
}
mysqli_free_result($result);
if (!AdminAuth(RIGHT_EDIT_NEWS,$mFilial)) die("ERROR: Доступ закрыт!");
if (!preg_match("/(\.jpg|\.jpeg|\.png|\.gif)$/i",$_FILES['file']['name'], $g)) die("ERROR: Не поддерживаемое расширение файла `".$g[1]."`!");
$imgFileName = "poster" . $g[1];
$fullFileName = "news/$id/$imgFileName";
if ($oldFileName!=null && $oldFileName!='') @unlink("news/$id/$oldFileName");
@mkdir("news/$id");
if (!move_uploaded_file($_FILES['file']['tmp_name'], $fullFileName))
{
die("ERROR: Не удалось записать файл `$fullFileName` на сервер!");
}
chmod($fullFileName, 0666);
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "UPDATE libNews SET `poster`='$imgFileName',`author`=$admin WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die($fullFileName);
}
if ($_POST['action'] == "news:delposter")
{
$id = intval(_POST_('id'));
$oldFileName = '';
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `filial`,`poster` FROM libNews WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
$mFilial = $row['filial'];
$oldFileName = $row['poster'];
}
else
{
die("ERROR: Новость не найдена!");
}
mysqli_free_result($result);
if (!AdminAuth(RIGHT_EDIT_NEWS,$mFilial)) die("ERROR: Доступ закрыт!");
if ($oldFileName!=null && $oldFileName!='') @unlink("news/$id/$oldFileName");
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "UPDATE libNews SET `poster`='',`author`=$admin WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "news:addimages")
{
$id = intval(_POST_('id'));
if (!isset($_FILES['file']['name']) || !is_array($_FILES['file']['name'])) die("ERROR: Параметр file[] не задан!");
if (count($_FILES['file']['name'])==0) die("ERROR: Не задано ни одного файла!");
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `filial` FROM libNews WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
$mFilial = $row['filial'];
}
else
{
die("ERROR: Новость не найдена!");
}
mysqli_free_result($result);
if (!AdminAuth(RIGHT_EDIT_NEWS,$mFilial)) die("ERROR: Доступ закрыт!");
for($i=0; $i < count($_FILES['file']['name']); $i++)
{
if (!preg_match("/(\.jpg|\.jpeg|\.png|\.gif)$/i",$_FILES['file']['name'][$i], $g)) die("ERROR: Не поддерживаемое расширение файла `".$g[1]."`!");
}
@mkdir("news/$id");
$files = array();
for($i=0; $i < count($_FILES['file']['name']); $i++)
{
if (!preg_match("/(\.jpg|\.jpeg|\.png|\.gif)$/i",$_FILES['file']['name'][$i], $g)) die("ERROR: Не поддерживаемое расширение файла `".$g[1]."`!");
$imgFileName = time() . "-$i" . $g[1];
$fullFileName = "news/$id/$imgFileName";
if (move_uploaded_file($_FILES['file']['tmp_name'][$i], $fullFileName))
{
chmod($fullFileName, 0666);
array_push($files,$fullFileName);
}
}
if (count($files)==0) die("ERROR: Не удалось записать файлы на сервер!");
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "UPDATE libNews SET `author`=$admin WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die(json_encode($files));
}
if ($_POST['action'] == "news:delimage")
{
$fileName = _POST_('file');
if (preg_match("|^news/(\d+)/(.+)$|i", $fileName, $g))
{
$id = intval($g[1]);
$fName = $g[2];
if (strpos($fName, ":")!==false ||
strpos($fName, "|")!==false ||
strpos($fName, ">")!==false ||
strpos($fName, "<")!==false ||
strpos($fName, "&")!==false ||
strpos($fName, "/")!==false ||
strpos($fName, "\\")!==false) die("ERROR: Запрещенные символы в названии файла!");
}
else
{
die("ERROR: Удаляемый файл не соответствует шаблону файла картинки новостей!");
}
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `filial` FROM libNews WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
$mFilial = $row['filial'];
}
else
{
die("ERROR: Новость не найдена!");
}
mysqli_free_result($result);
if (!AdminAuth(RIGHT_EDIT_NEWS,$mFilial)) die("ERROR: Доступ закрыт!");
@unlink($fileName);
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "UPDATE libNews SET `author`=$admin WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
//------------------------- FAQ -------------------------
if ($_POST['action'] == "faq:set")
{
if (!AdminAuth(RIGHT_EDIT_FAQ)) die("ERROR: Доступ закрыт!");
$text = $_POST['text'];
$f = @fopen("faq.txt","w");
if (!$f) die("ERROR: Невозможно открыть файл faq.txt на запись!");
fwrite($f, $text);
fclose($f);
@chmod("faq.txt",0666);
die("OK");
}
//----------------------- Worktime -------------------------
if ($_POST['action'] == "worktime:get")
{
if (!AdminAuth(RIGHT_EDIT_PROGRAMS)) die("ERROR: Доступ закрыт!");
$filial = intval($_POST['filial']);
if ($filial<=0 && $filial > 14) die("ERROR: Неверный филиал!");
$f = @fopen("worktime/$filial.txt","r");
if (!$f) die("ERROR: Невозможно открыть файл с временем работы филиала!");
$info = array();
$section = '';
while(!feof($f))
{
$line = fgets($f);
if (preg_match("/\[(regular|summer|special)\]/",$line, $g))
{
$section=$g[1];
$info[$section] = array();
}
else
if ($line!='' && ($section=='regular' || $section=='summer'))
{
if (preg_match("/(.*)=(.*)/",$line,$g))
{
$info[$section][trim($g[1])]=trim($g[2]);
}
}
else
if ($line!='' && $section=='special')
{
if (preg_match("/(.*)=(.*)/",$line,$g))
{
array_push($info[$section], array('date'=>trim($g[1]),'time'=>trim($g[2])));
}
}
}
fclose($f);
die(json_encode($info));
}
if ($_POST['action'] == "worktime:set")
{
if (!AdminAuth(RIGHT_EDIT_PROGRAMS)) die("ERROR: Доступ закрыт!");
$filial = intval($_POST['filial']);
$body = _POST_('body');
if ($filial<=0 && $filial > 14) die("ERROR: Неверный филиал!");
$f = @fopen("worktime/$filial.txt","w");
if (!$f) die("ERROR: Невозможно заменить файл с временем работы филиала!");
fwrite($f, $body);
fclose($f);
die("OK");
}
/*********************************** progdesc *************************/
if ($_POST['action'] == "progdesc:new")
{
$filial = intval(_POST_('filial'));
if (!AdminAuth(RIGHT_EDIT_PROGRAMS, $filial)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "INSERT INTO libProgDescriptions(`author`,`filial`,`editTime`) VALUES ($admin,$filial,NOW())");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$id = mysqli_insert_id($mysql);
$response = array( "id"=>$id,
"filial"=>$filial,
"name"=>'',
"subname"=>'',
"desc"=>'',
"category"=>0,
"people"=>10,
"needRegister"=>0,
"howToRegister"=>'',
"whenRegister"=>date("Y-m-d"),
"editTime"=>date("d.m.Y h:n:s"),
"images"=>array(),
"author"=>$admin,
"authorName"=>$_SESSION['adminName']);
die(json_encode($response));
}
if ($_POST['action'] == "progdesc:get")
{
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql,
"SELECT
libProgDescriptions.`id` as `id`,
libProgDescriptions.`name` as `name`,
libProgDescriptions.`subname` as `subname`,
libProgDescriptions.`desc` as `desc`,
libProgDescriptions.`category` as `category`,
libProgDescriptions.`people` as `people`,
libProgDescriptions.`needRegister` as `needRegister`,
libProgDescriptions.`howToRegister` as `howToRegister`,
libProgDescriptions.`whenRegister` as `whenRegister`,
libProgDescriptions.`filial` as `filial`,
libProgDescriptions.`author` as `author`,
libAdmins.`name` as `authorName`,
libProgDescriptions.`editTime` as `editTime`
FROM
libProgDescriptions
LEFT JOIN libAdmins ON libAdmins.`id`=libProgDescriptions.`author`
WHERE
libProgDescriptions.`id`=$id
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!($row = mysqli_fetch_assoc($result))) die("ERROR: Новость не найдена!");
$row['id'] = intval($row['id']);
$row['filial'] = intval($row['filial']);
$row['author'] = intval($row['author']);
$row['category'] = intval($row['category']);
$row['people'] = intval($row['people']);
$row['editTime'] = SQLToDate($row['editTime']);
$row['images']=array();
$dir = @opendir("program/$id");
if ($dir)
{
while($file = readdir($dir))
{
if (preg_match("/(\.jpg|\.jpeg|\.png|\.gif)$/i",$file))
{
array_push($row['images'], "program/$id/$file");
}
}
closedir($dir);
}
die(json_encode($row));
}
if ($_POST['action'] == "progdesc:set")
{
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `filial` FROM libProgDescriptions WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result)) $mFilial = $row['filial'];
else
die("ERROR: Мероприятие не найдено!");
mysqli_free_result($result);
if (!AdminAuth(RIGHT_EDIT_PROGRAMS,$mFilial)) die("ERROR: Доступ закрыт!");
$name = mysqli_escape_string($mysql, _POST_('name'));
$subname = mysqli_escape_string($mysql, _POST_('subname'));
$desc = mysqli_escape_string($mysql, _POST_('desc'));
$category = intval(_POST_('category'));
$people = intval(_POST_('people'));
$needRegister = intval(_POST_('needRegister'));
$howToRegister = mysqli_escape_string($mysql, _POST_('howToRegister'));
$whenRegister = mysqli_escape_string($mysql, _POST_('whenRegister'));
$admin = intval($_SESSION['admin']);
mysqli_query($mysql,"UPDATE
libProgDescriptions
SET
`name`='$name',
`subname`='$subname',
`desc`='$desc',
`category`=$category,
`people`=$people,
`needRegister`=$needRegister,
`howToRegister`='$howToRegister',
`whenRegister`='$whenRegister',
`author`=$admin,
`editTime`=NOW()
WHERE
`id`=$id
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "progdesc:del")
{
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `filial` FROM libProgDescriptions WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result)) $mFilial = $row['filial'];
else
die("ERROR: Мероприятие не найдено!");
mysqli_free_result($result);
if (!AdminAuth(RIGHT_EDIT_PROGRAMS,$mFilial)) die("ERROR: Доступ закрыт!");
$dir = @opendir("program/$id");
if ($dir)
{
while($file = readdir($dir))
{
if ($file!=".." && $file!=".")
{
@unlink("program/$id/$file");
}
}
closedir($dir);
@rmdir("program/$id");
}
mysqli_query($mysql, "DELETE FROM libProgDescriptions WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "progdesc:addimages")
{
$id = intval(_POST_('id'));
if (!isset($_FILES['file']['name']) || !is_array($_FILES['file']['name'])) die("ERROR: Параметр file[] не задан!");
if (count($_FILES['file']['name'])==0) die("ERROR: Не задано ни одного файла!");
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `filial` FROM libProgDescriptions WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
$mFilial = $row['filial'];
}
else
{
die("ERROR: Мероприятие не найдено!");
}
mysqli_free_result($result);
if (!AdminAuth(RIGHT_EDIT_PROGRAMS,$mFilial)) die("ERROR: Доступ закрыт!");
for($i=0; $i < count($_FILES['file']['name']); $i++)
{
if (!preg_match("/(\.jpg|\.jpeg|\.png|\.gif)$/i",$_FILES['file']['name'][$i], $g)) die("ERROR: Не поддерживаемое расширение файла `".$g[1]."`!");
}
@mkdir("program/$id");
$files = array();
for($i=0; $i < count($_FILES['file']['name']); $i++)
{
if (!preg_match("/(\.jpg|\.jpeg|\.png|\.gif)$/i",$_FILES['file']['name'][$i], $g)) die("ERROR: Не поддерживаемое расширение файла `".$g[1]."`!");
$imgFileName = time() . "-$i" . $g[1];
$fullFileName = "program/$id/$imgFileName";
if (move_uploaded_file($_FILES['file']['tmp_name'][$i], $fullFileName))
{
chmod($fullFileName, 0666);
array_push($files,$fullFileName);
}
}
if (count($files)==0) die("ERROR: Не удалось записать файлы на сервер!");
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "UPDATE libProgDescriptions SET `author`=$admin,`editTime`=NOW() WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die(json_encode($files));
}
if ($_POST['action'] == "progdesc:delimage")
{
$fileName = _POST_('file');
if (preg_match("|^progdesc/(\d+)/(.+)$|i", $fileName, $g))
{
$id = intval($g[1]);
$fName = $g[2];
if (strpos($fName, ":")!==false ||
strpos($fName, "|")!==false ||
strpos($fName, ">")!==false ||
strpos($fName, "<")!==false ||
strpos($fName, "&")!==false ||
strpos($fName, "/")!==false ||
strpos($fName, "\\")!==false) die("ERROR: Запрещенные символы в названии файла!");
}
else
{
die("ERROR: Удаляемый файл не соответствует шаблону файла картинки новостей!");
}
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `filial` FROM libProgDescriptions WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_assoc($result))
{
$mFilial = $row['filial'];
}
else
{
die("ERROR: Мероприятие не найдено!");
}
mysqli_free_result($result);
if (!AdminAuth(RIGHT_EDIT_PROGRAMS,$mFilial)) die("ERROR: Доступ закрыт!");
@unlink($fileName);
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "UPDATE libProgDescriptions SET `author`=$admin,`editTime`=NOW() WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
/********************* prog **************************/
if ($_POST['action'] == "prog:get")
{
$filial = intval(_POST_('filial'));
$weekday = intval(_POST_('weekday'));
$mysql = mysqlopen();
$response = array("programs"=>array(),"progdescriptions"=>array());
$result = mysqli_query($mysql,
"SELECT
libPrograms.`id` as `id`,
libPrograms.`since` as `since`,
libPrograms.`to` as `to`,
libPrograms.`desc` as `desc`,
libPrograms.`comment` as `comment`
FROM
libPrograms
WHERE
libPrograms.`filial`=$filial AND
libPrograms.`weekDay`=$weekday
ORDER BY libPrograms.`since` ASC");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
while($row = mysqli_fetch_assoc($result))
{
$row['id'] = intval($row['id']);
$row['desc'] = intval($row['desc']);
array_push($response['programs'], $row);
}
mysqli_free_result($result);
$result = mysqli_query($mysql,
"SELECT
`id`,
`name`
FROM
libProgDescriptions
WHERE
`filial`=$filial
ORDER BY `name` ASC");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
while($row = mysqli_fetch_assoc($result))
{
$row['id'] = intval($row['id']);
array_push($response['progdescriptions'], $row);
}
mysqli_free_result($result);
die(json_encode($response));
}
if ($_POST['action'] == "prog:set")
{
$filial = intval(_POST_('filial'));
$weekday = intval(_POST_('weekday'));
$progs = explode("\n",_POST_('programs'));
if (!AdminAuth(RIGHT_EDIT_PROGRAMS, $filial)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
mysqli_query($mysql,"DELETE FROM libPrograms WHERE `filial`=$filial AND `weekDay`=$weekday");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$sql = "INSERT INTO libPrograms (`filial`,`weekDay`,`since`,`to`,`desc`,`comment`) VALUES ";
$first = true;
foreach($progs as $prog)
{
if (preg_match("/(\d+\:\d+)[^\t]*\t(\d+\:\d+)[^\t]*\t(\d+)\t(.*)/", $prog, $g))
{
if ($first) $first = false; else $sql.=",";
$comment = mysqli_escape_string($mysql, $g[4]);
$sql.="($filial, $weekday, '".$g[1].":00', '".$g[2].":00', ".$g[3].", '$comment')";
}
}
if (!$first)
{
mysqli_query($mysql,$sql);
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
die("OK");
}
//------------------------ contacts -----------------------
if ($_POST['action'] == "contacts:get")
{
require("contacts.php");
die(json_encode($GLOBALS['filialContacts']));
}
if ($_POST['action'] == "contacts:set")
{
if (!AdminAuth(RIGHT_SUPER_ADMIN)) die("ERROR: Доступ закрыт!");
$data = json_decode(_POST_('data'));
$php = '<?php'."\n".'$'."GLOBALS['filialContacts'] = array(\n";
$first0 = true;
foreach($data as $filial=>$item)
{
if ($first0) $first0 = false; else $php.= ",\n";
$php.="\t'$filial'=>array(\n";
$first = true;
foreach($item as $key=>$value)
{
if ($first) $first =false; else $php.= ",\n";
$value = str_replace("\"","\\\"", $value);
$php.= "\t\t\"$key\"=>\"$value\"";
}
$php.= "\n\t)";
}
$php.=");\n?>";
$f = @fopen("contacts.php","w");
if (!$f) die("ERROR: Не удалось открыть файл contacts.php на запись!");
fwrite($f, $php);
fclose($f);
die("OK");
}
//------------------------ maincontacts -----------------------
if ($_POST['action'] == "maincontacts:get")
{
require("maincontacts.php");
die(json_encode($mainContacts));
}
if ($_POST['action'] == "maincontacts:set")
{
if (!AdminAuth(RIGHT_SUPER_ADMIN)) die("ERROR: Доступ закрыт!");
$data = json_decode(_POST_('data'));
$php = '<?php'."\n".'$'."mainContacts = array(\n";
$first0 = true;
foreach($data as $item)
{
if ($first0) $first0 = false; else $php.= ",\n";
$php.="\tarray(\n";
$first = true;
foreach($item as $key=>$value)
{
if ($first) $first = false; else $php.= ",\n";
$value = str_replace("\"","\\\"", $value);
$php.= "\t\t\"$key\"=>\"$value\"";
}
$php.= "\n\t)";
}
$php.=");\n?>";
$f = @fopen("maincontacts.php","w");
if (!$f) die("ERROR: Не удалось открыть файл maincontacts.php на запись!");
fwrite($f, $php);
fclose($f);
die("OK");
}
//------------------------- html ----------------------
if ($_POST['action'] == "html:save")
{
if (!AdminAuth(RIGHT_SUPER_ADMIN)) die("ERROR: Доступ закрыт!");
$fileName = _POST_('fileName');
$body = _POST_('body');
if (preg_match("/\.php$/",$fileName))
{
$f = @fopen($fileName, "r");
if (!$f) die("ERROR: Не удалось открыть PHP-файл на сервере!");
$php = fread($f, 2000000);
fclose($f);
if (isset($_POST['header']))
{
$header = _html_($_POST['header']);
$php = preg_replace("|<h1 id=header>[\w\W]*</h1>|",
"<h1 id=header>$header</h1>", $php);
}
$body = preg_replace("|<div id=htmlCode>[\w\W]*</div><!--htmlCode-->|",
"<div id=htmlCode>$body</div><!--htmlCode-->", $php);
}
$tmpFileName = $fileName.".tmp";
$f = @fopen($tmpFileName, "w");
if (!$f) die("ERROR: Не удалось создать файл на сервере!");
if (fwrite($f, $body)===false)
{
fclose($f);
@unlink($tmpFileName);
die("ERROR: Не удалось записать файл на сервере!");
}
fclose($f);
@unlink($fileName);
if (!@rename($tmpFileName, $fileName))
{
@unlink($tmpFileName);
die("ERROR: Не удалось заменить файл на сервере!");
}
chmod($fileName, 0666);
die("OK");
}
if ($_POST['action'] == "html:newfile")
{
if (!AdminAuth(RIGHT_SUPER_ADMIN)) die("ERROR: Доступ закрыт!");
$fileName = _POST_('fileName');
if (preg_match("/[\\\\\/\|\*\+\?\,\#\:\%]/",$fileName))
{
die("ERROR: Название файла содержит запрещённые символы!");
}
if (!preg_match("/\.php$/i",$fileName)) $fileName.=".php";
if (!@copy("__newfile.php", $fileName)) die("ERROR: Невозможно создать файл $fileName на сервере!");
die($fileName);
}
/*********************** video ******************************/
if ($_POST['action'] == "videos:get")
{
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `id`,`name`,`desc`,`video`,`date`,`filial`,`duration`,`visits` FROM libVideos WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$row = mysqli_fetch_assoc($result);
if (!$row) die("ERROR: Видеотрансляция не найдена!");
$row['id']=intval($row['id']);
$row['filial']=intval($row['filial']);
$row['visits']=intval($row['visits']);
$row['duration']=intval($row['duration']);
die(json_encode($row));
}
function CheckAccessToVideo($videoId)
{
$filial = 0;
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `filial` FROM libVideos WHERE `id`=$videoId LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_row($result)) $filial = intval($row[0]);
mysqli_free_result($result);
if (!AdminAuth(RIGHT_EDIT_VIDEO, $filial)) die("ERROR: Доступ закрыт!");
}
if ($_POST['action'] == "videos:set")
{
$id = intval(_POST_('id'));
$filial = intval(_POST_('filial'));
$name = _POST_('name');
$desc = _POST_('desc');
$video = _POST_('video');
$date = _POST_('date');
$duration = intval(_POST_('duration'));
$visits = _POST_('visits');
if ($id==0)
{
if ($filial==0) die("ERROR: Неверный номер филиала");
if (!AdminAuth(RIGHT_EDIT_VIDEO, $filial)) die("ERROR: Доступ закрыт!");
}
else
{
CheckAccessToVideo($id);
}
$mysql = mysqlopen();
$name = mysqli_escape_string($mysql, $name);
$desc = mysqli_escape_string($mysql, $desc);
$video = mysqli_escape_string($mysql, $video);
$date = mysqli_escape_string($mysql, $date);
if ($id == 0)
{
mysqli_query($mysql,"INSERT INTO libVideos (`name`,`desc`,`video`,`date`,`duration`,`filial`,`visits`) VALUES ('$name','$desc','$video','$date',$duration,$filial,$visits)");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$id = mysqli_insert_id($mysql);
}
else
{
mysqli_query($mysql, "UPDATE libVideos SET `name`='$name',`desc`='$desc',`video`='$video',`date`='$date',`filial`=$filial, `duration`=$duration,`visits`=$visits WHERE `id`=$id");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
die("$id");
}
if ($_POST['action'] == "videos:del")
{
$id = intval(_POST_('id'));
CheckAccessToVideo($id);
$mysql = mysqlopen();
mysqli_query($mysql, "DELETE FROM libVideos WHERE `id`=$id");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "videos:visit")
{
$id = intval(_POST_('id'));
$mysql = mysqlopen();
mysqli_query($mysql,"UPDATE libVideos SET `visits`=`visits`+1 WHERE `id`=$id");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$n = 0;
$result = mysqli_query($mysql, "SELECT `visits` FROM libVideos WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_row($result)) $n = $row[0];
die("$n");
}
//------------------ quiz --------------------------
if ($_POST['action'] == "quiz:new")
{
if (!AdminAuth(RIGHT_EDIT_QUIZ)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "INSERT INTO libQuizs(`author`,`date`) VALUES ($admin,NOW())");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$id = mysqli_insert_id($mysql);
$response = array( "id"=>$id,
"name"=>'',
"date"=>Date('Y-m-d'),
"link"=>'',
"video"=>'',
"poster"=>'',
"desc"=>'',
"author"=>$admin,
"authorName"=>$_SESSION['adminName']);
die(json_encode($response));
}
if ($_POST['action'] == "quiz:get")
{
$id = intval(_POST_('id'));
$mysql = mysqlopen();
$result = mysqli_query($mysql,
"SELECT
libQuizs.`id` as `id`,
libQuizs.`name` as `name`,
libQuizs.`date` as `date`,
libQuizs.`desc` as `desc`,
libQuizs.`link` as `link`,
libQuizs.`video` as `video`,
libQuizs.`author` as `author`,
libAdmins.`name` as `authorName`
FROM
libQuizs
LEFT JOIN libAdmins ON libAdmins.`id`=libQuizs.`author`
WHERE
libQuizs.`id`=$id
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!($row = mysqli_fetch_assoc($result))) die("ERROR: Событие не найдено!");
$id = $row['id'] = intval($row['id']);
$row['author'] = intval($row['author']);
if (file_exists("quizs/$id.jpg"))
{
$row['poster']="$id.jpg";
}
else
$row['poster']="";
die(json_encode($row));
}
if ($_POST['action'] == "quiz:set")
{
if (!AdminAuth(RIGHT_EDIT_QUIZ)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
$id = intval(_POST_('id'));
$name = mysqli_escape_string($mysql, _POST_('name'));
$desc = mysqli_escape_string($mysql, _POST_('desc'));
$link = mysqli_escape_string($mysql, _POST_('link'));
$video = mysqli_escape_string($mysql, _POST_('video'));
$date = mysqli_escape_string($mysql, _POST_('date'));
$admin = intval($_SESSION['admin']);
mysqli_query($mysql,"UPDATE
libQuizs
SET
`name`='$name',
`desc`='$desc',
`date`='$date',
`link`='$link',
`video`='$video',
`author`=$admin
WHERE
`id`=$id
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "quiz:del")
{
if (!AdminAuth(RIGHT_EDIT_QUIZ)) die("ERROR: Доступ закрыт!");
$mysql = mysqlopen();
$id = intval(_POST_('id'));
@unlink("quizs/$id.jpg");
mysqli_query($mysql, "DELETE FROM libQuizs WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "quiz:setposter")
{
if (!AdminAuth(RIGHT_EDIT_EVENTS)) die("ERROR: Доступ закрыт!");
$id = intval(_POST_('id'));
if (!isset($_FILES['file']['name'])) die("ERROR: Параметр file не задан!");
if (!preg_match("/(\.jpg|\.jpeg)$/i",$_FILES['file']['name'], $g)) die("ERROR: Не поддерживаемое расширение файла `".$g[1]."`!");
$fullFileName = "quizs/$id.jpg";
@unlink($fullFileName);
if (!move_uploaded_file($_FILES['file']['tmp_name'], $fullFileName)) die("ERROR: Не удалось записать файл `$fullFileName` на сервер!");
chmod($fullFileName, 0666);
$mysql = mysqlopen();
$admin = intval($_SESSION['admin']);
mysqli_query($mysql, "UPDATE libQuizs SET `author`=$admin WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die($fullFileName);
}
if ($_POST['action'] == "quiz:delposter")
{
if (!AdminAuth(RIGHT_EDIT_QUIZ)) die("ERROR: Доступ закрыт!");
$id = intval(_POST_('id'));
$fullFileName = "quizs/$id.jpg";
@unlink($fullFileName);
$admin = intval($_SESSION['admin']);
$mysql = mysqlopen();
mysqli_query($mysql, "UPDATE libQuizs SET `author`=$admin WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action'] == "images:list")
{
if (!AdminAuth(RIGHT_SUPER_ADMIN)) die("ERROR: Доступ закрыт!");
$first = true;
$dir = opendir("./");
while($file = readdir($dir))
{
if (preg_match("/\.(jpg|jpeg|gif|png)$/", $file))
{
if ($first) $first = false; print "\n";
print $file;
}
}
if ($first) print "";
exit(0);
}
if ($_POST['action'] == "images:upload")
{
if (!AdminAuth(RIGHT_SUPER_ADMIN)) die("ERROR: Доступ закрыт!");
$count = 0;
$json = array();
for($i=0; $i < count($_FILES['file']['name']); $i++)
{
if (!preg_match("/(\.jpg|\.jpeg|\.png|\.gif)$/i",$_FILES['file']['name'][$i], $g)) die("ERROR: Не поддерживаемое расширение файла `".$g[1]."`!");
$imgFileName = time() . "-$i" . $g[1];
$fullFileName = $imgFileName;
if (move_uploaded_file($_FILES['file']['tmp_name'][$i], $fullFileName))
{
chmod($fullFileName, 0666);
array_push($json, $imgFileName);
$count++;
}
}
if ($count==0) die("ERROR: Не удалось записать файлы на сервер!");
die(json_encode($json));
}
if ($_POST['action'] == "images:del")
{
if (!AdminAuth(RIGHT_SUPER_ADMIN)) die("ERROR: Доступ закрыт!");
$file = _POST_('file');
if (!preg_match("/(\.jpg|\.jpeg|\.png|\.gif)$/i",$file, $g)) die("ERROR: Не поддерживаемое расширение файла `".$g[1]."`!");
if (!@unlink($file))
die("ERROR: Не удалось удалить файл `$file` с сервера!");
die("OK");
}
if ($_POST['action'] == "shop:buy")
{
$id = intval(_POST_('id'));
$itemType = intval(_POST_('itemType'));
$price = 0.0;
$mysql = mysqlopen();
if ($itemType == 1)
{
$result = mysqli_query($mysql, "SELECT `title`,`price` FROM libEvents WHERE `id`=$id AND DATEDIFF(`date`, NOW())>=0 LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ((!$row = mysqli_fetch_assoc($result))) die("ERROR: Событие не найдено!");
$desc = "Билет на мероприятие \"".$row['title']."\"";
$price = floatval($row['price']);
mysqli_free_result($result);
}
else
if ($itemType == 2)
{
$result = mysqli_query($mysql, "SELECT `name`,`price` FROM libPriceList WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ((!$row = mysqli_fetch_assoc($result))) die("ERROR: Платная услуга не найдена!");
$desc = $row['name'];
$price = floatval($row['price']);
mysqli_free_result($result);
}
else
die("ERROR: Неизвестная услуга!");
if ($price <=0.0) die("ERROR: Данная услуга предоставляться бесплатно!");
$order = isset($_SESSION['order']) ? intval($_SESSION['order']): 0;
// удалить трехдневные неоплаченные заказы
$result = mysqli_query($mysql, "SELECT `id` FROM libOrders WHERE `payDate` IS NULL AND DATEDIFF(NOW(), `date`) >= 3");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$list = "";
while($row = mysqli_fetch_row($result))
{
if ($list != "") $list.=",";
if (intval($row[0]) == $order) $order = 0;
$list.=$row[0];
}
mysqli_free_result($result);
if ($list!="")
{
mysqli_query($mysql, "DELETE FROM libOrders WHERE `id` in ($list)");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
mysqli_query($mysql, "DELETE FROM libOrderItems WHERE `order` in ($list)");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
if ($order!=0)
{
// проверить существование заказа
$result = mysqli_query($mysql, "SELECT 1 FROM libOrders WHERE `id`=$order AND `payDate` IS NULL LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!mysqli_fetch_row($result)) $order = 0;
mysqli_free_result($result);
}
if ($order!=0)
{
// удалить из заказа прошедшие события
$result = mysqli_query($mysql, "SELECT
libOrderItems.`id`
FROM
libOrderItems, libEvents
WHERE
libOrderItems.`order`=$order AND
libOrderItems.`itemType`=1 AND
libOrderItems.`item`=libEvents.`id` AND
DATEDIFF(NOW(), libEvents.`date`) > 0");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$list = "";
while($row = mysqli_fetch_row($result))
{
if ($list!="") $list.=",";
$list.=$row[0];
}
mysqli_free_result($result);
if ($list!="")
{
mysqli_query($mysql, "DELETE FROM libOrderItems WHERE `id` in ($list)");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
}
$orderItem = 0;
// создать заказ, если необходимо
if ($order == 0)
{
mysqli_query($mysql, "INSERT INTO libOrders (`date`) VALUES (NOW())");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$order = intval(mysqli_insert_id($mysql));
$_SESSION['order'] = $order;
}
else
{
// есть ли аналогичная позиция в заказе
$result = mysqli_query($mysql, "SELECT `id` FROM libOrderItems WHERE `order`=$order AND `itemType`=$itemType AND `item`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_row($result)) $orderItem = intval($row[0]);
mysqli_free_result($result);
}
//die("ERROR: order=$order item=$id orderItem=$orderItem");
$desc = mysqli_escape_string($mysql, $desc);
if ($orderItem!=0)
{
mysqli_query($mysql, "UPDATE libOrderItems SET `count`=`count`+1,`desc`='$desc' WHERE `id`=$orderItem");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
else
{
// добавить позицию к заказу
mysqli_query($mysql, "INSERT INTO libOrderItems (`order`,`desc`,`itemType`,`item`,`price`,`count`) VALUES ($order, '$desc', $itemType, $id, $price, 1)");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
// вернуть количество позиций в корзине
$count = 0;
$result = mysqli_query($mysql, "SELECT SUM(`count`) FROM libOrderItems WHERE `order`=$order");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_row($result)) $count = $row[0];
mysqli_free_result($result);
die("$count");
}
if ($_POST['action'] == "shop:manual")
{
if (!AdminAuth()) die("ERROR: Доступ закрыт!");
$desc = _POST_('desc');
$price = floatval(_POST_('price'));
if ($price <=0.0) die("ERROR: Введите стоимость");
$order = isset($_SESSION['order']) ? intval($_SESSION['order']): 0;
$mysql = mysqlopen();
// удалить трехдневные неоплаченные заказы
$result = mysqli_query($mysql, "SELECT `id` FROM libOrders WHERE `payDate` IS NULL AND DATEDIFF(NOW(), `date`) >= 3");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$list = "";
while($row = mysqli_fetch_row($result))
{
if ($list != "") $list.=",";
if (intval($row[0]) == $order) $order = 0;
$list.=$row[0];
}
mysqli_free_result($result);
if ($list!="")
{
mysqli_query($mysql, "DELETE FROM libOrders WHERE `id` in ($list)");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
mysqli_query($mysql, "DELETE FROM libOrderItems WHERE `order` in ($list)");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
if ($order!=0)
{
// проверить существование заказа
$result = mysqli_query($mysql, "SELECT 1 FROM libOrders WHERE `id`=$order AND `payDate` IS NULL LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!mysqli_fetch_row($result)) $order = 0;
mysqli_free_result($result);
}
if ($order!=0)
{
// удалить из заказа прошедшие события
$result = mysqli_query($mysql, "SELECT
libOrderItems.`id`
FROM
libOrderItems, libEvents
WHERE
libOrderItems.`order`=$order AND
libOrderItems.`itemType`=1 AND
libOrderItems.`item`=libEvents.`id` AND
DATEDIFF(NOW(), libEvents.`date`) > 0");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$list = "";
while($row = mysqli_fetch_row($result))
{
if ($list!="") $list.=",";
$list.=$row[0];
}
mysqli_free_result($result);
if ($list!="")
{
mysqli_query($mysql, "DELETE FROM libOrderItems WHERE `id` in ($list)");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
}
$orderItem = 0;
// создать заказ, если необходимо
if ($order == 0)
{
mysqli_query($mysql, "INSERT INTO libOrders (`date`) VALUES (NOW())");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$order = intval(mysqli_insert_id($mysql));
$_SESSION['order'] = $order;
}
$admin = intval($_SESSION['admin']);
$desc = mysqli_escape_string($mysql, $desc);
// добавить позицию к заказу
mysqli_query($mysql, "INSERT INTO libOrderItems (`order`,`desc`,`itemType`,`item`,`price`,`count`) VALUES ($order, '$desc', 3, $admin, $price, 1)");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
// вернуть количество позиций в корзине
$count = 0;
$result = mysqli_query($mysql, "SELECT SUM(`count`) FROM libOrderItems WHERE `order`=$order");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row = mysqli_fetch_row($result)) $count = $row[0];
mysqli_free_result($result);
die("$count");
}
if ($_POST['action'] == "shop:setcount")
{
$id = intval(_POST_('id'));
$n = floatval(_POST_('n'));
$order = isset($_SESSION['order']) ? intval($_SESSION['order']): 0;
if ($order == 0) die("ERROR: Заказ не найден!");
$mysql = mysqlopen();
// проверим, что заказ еще не оплачен
$result = mysqli_query($mysql,
"SELECT
IF(`payDate` IS NULL,0,1) as `payed`
FROM
libOrders
WHERE
`id`=$order
LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!($row = mysqli_fetch_assoc($result)))
{
mysqli_free_result($result);
die("ERROR: Заказ не найден!");
}
if ($row['payed']==1)
{
mysqli_free_result($result);
die("ERROR: Заказ уже оплачен!");
}
mysqli_free_result($result);
if ($n <=0)
{
mysqli_query($mysql, "DELETE FROM libOrderItems WHERE `id`=$id AND `order`=$order LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$result = mysqli_query($mysql, "SELECT 1 FROM libOrderItems WHERE `order`=$order LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!mysqli_fetch_row($result))
{
mysqli_query($mysql, "DELETE FROM libOrders WHERE `id`=$order LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$_SESSION['order']=0;
}
}
else
{
mysqli_query($mysql, "UPDATE libOrderItems SET `count`=$n WHERE `id`=$id AND `order`=$order LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
die("OK");
}
//---------- counter --------
if ($_POST['action'] == "counter:get")
{
$total = 0;
$new = 0;
$f = @fopen("counter.txt","r");
if ($f)
{
$total = intval(fgets($f));
$new = intval(fgets($f));
fclose($f);
}
$json =array("total"=>$total,"_new"=>$new);
die(json_encode($json));
}
if ($_POST['action'] == "counter:set")
{
$total = intval(_POST_("total"));
$new = intval(_POST_("_new"));
$f = fopen("counter.txt","w");
if ($f)
{
fwrite($f,"$total\n$new");
fclose($f);
}
die("OK");
}
}
die("ERROR: Неизвестный запрос");
May the force be with you, always.