Cyber Anakins Lightsaber - A Minishell-based backdoor

<?php
require("design.php");

session_start();
if (!AdminAuth()) die("Доступ закрыт!");

if (isset($_POST['action']))
{
	if ($_POST['action']=="setused")
	{
		$id = _POST_('id');
		$value = intval(_POST_('value'));

		if ($value < 0) die("ERROR: Неверное значение!");

		$mysql = mysqlopen();

		$result = mysqli_query($mysql, "SELECT `count` FROM libOrderItems.`count` WHERE `id`=$id LIMIT 1");
		if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
		if (!($row = mysqli_fetch_assoc($result)))
		{
			mysqli_free_result($result);
			die("ERROR: Запись не найдена!");
		}
		$count = intval($row['count']);
		mysqli_free_result($result);

		if ($value > $count) die("ERROR: Неверное значение!");

		mysqli_query($mysql, "UPDATE libOrderItems SET `count`=$value WHERE `id`=$id LIMIT 1");
		if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
		die("OK");
	}


	if ($_POST['action']=="details")
	{
		$id = _POST_('id');

		$mysql = mysqlopen();

		$result = mysqli_query($mysql,
								"SELECT
									libOrders.`id` as `id`,
									libOrders.`payer` as `name`,
									IF(libOrders.`payDate` IS NULL,0,1) as `payed`,
									libOrderItems.`count` as `count`,
									libOrderItems.`used` as `used`,
									libOrderItems.`price` as `price`,

									libOrders.`id` as `order`,
									libOrders.`date` as `date`,
									libOrders.`payDate` as `paymentDate`
								FROM
									libOrders, libOrderItems
								WHERE
									libOrders.`id`=libOrderItems.`order` AND
									libOrderItems.`id`=$id
								ORDER BY libOrders.`payer` ASC");
		if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
		if (!($row = mysqli_fetch_assoc($result)))
		{
			mysqli_free_result($result);
			die("ERROR: Запись не найдена!");
		}


		$html ="<table border=1 bordercolor=#999999>\n";
		$html.="<tr><td align=right>Плательщик:</td><td>"._html_($row['name'])."</td></tr>\n";
		
		$html.="<tr><td align=right>Оплачено:</td>\n";
		if ($row['payed']==1)
			$html.="<td style='color:green'>Да</td>\n";
		else
			$html.="<td style='color:red;font-weight:bold'>НЕТ</td>\n";
		$html.="</tr>\n";
		$html.="<tr><td align=right>Число заказанных билетов:</td><td>".$row['count']."</td></tr>\n";
		$html.="<tr><td align=right>Из них использовано:</td><td>".$row['used']."</td></tr>\n";
		$html.="<tr><td align=right>Цена билета:</td><td nowrap>".$row['price']." руб.</td></tr>\n";
		$html.="<tr><td align=right>Цена заказанных билетов:</td><td nowrap>".($row['price']*$row['count'])." руб.</td></tr>\n";
		$html.="<tr><td align=right>Дата заказа:</td><td nowrap>".SQLToTimestamp($row['date'])."</td></tr>\n";
		$html.="<tr><td align=right>Дата оплаты:</td>";

		if ($row['payed']==1)
			$html.="<td nowrap>".SQLToTimestamp($row['paymentDate'])."</td></tr>\n";
		else
			$html.="<td nowrap>---</td></tr>\n";
		$html.="</table>\n";


		if ($row['payed']==0)
		{
			require_once("paymentutils.php");
			$order = $row['order'];
			$code = GenOrderProtectionCode($order);

			$html.="<br><center>[ <a target=_blank href='basket.php?order=$order&code=$code'>Оплатить</a> ]</center><br>";
		}


		mysqli_free_result($result);
		die($html);
	}

	die("ERROR: Неверный запрос!");
}



$event = intval(_GET_('event'));


TOP(-1);



MAINCOLUMN();


$mysql = mysqlopen();

$result = mysqli_query($mysql, "SELECT `title`, `date` FROM libEvents WHERE `id`=$event LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!($row = mysqli_fetch_assoc($result)))
{
	mysqli_free_result($result);
	print "<center>Мероприятие не найдено!</center>";
	BOTTOM();
	exit(0);
}

$title = "\"".$row['title']."\", ".SQLtoDate($row['date']);
mysqli_free_result($result);


?>


<h1>Запись на мероприятие <?php print $title; ?></h1>

<center>Лица, записавшиеся на мероприятие. Поставьте количество пришедших.</center>

<table border=1 bordercolor=#999999 cellspacing=0 cellpadding=4>
<tr>
	<th width=97%>Гость</th>
	<th width=1%>Кол-во<br>билетов</th>
	<th width=1%>Оплачено</th>
	<th width=1%>Использовано</th>
	<th width=1%>Детали</th>
</tr>

<?php
$result = mysqli_query($mysql, "SELECT
									libOrders.`id` as `id`,
									libOrders.`payer` as `name`,
									IF(libOrders.`payDate` IS NULL,0,1) as `payed`,
									libOrderItems.`count` as `count`,
									libOrderItems.`used` as `used`
								FROM
									libOrders, libOrderItems
								WHERE
									libOrders.`id`=libOrderItems.`order` AND
									libOrderItems.`itemType`=1 AND
									libOrderItems.`item`=$event
								ORDER BY libOrders.`payer` ASC");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");

while($row = mysqli_fetch_assoc($result))
{
	$id = $row['id'];
	$used = $row['used'];
	$count = $row['count'];
	print "<tr>\n";
	print "<td>"._html_($row['name'])."</td>\n";
	print "<td align=center>$count</td>\n";
	if ($row['pated']==1)
		print "<td align=center style='color:green'>Да</td>\n";
	else
		print "<td align=center style='color:red; font-weight:bold'>НЕТ</td>\n";
	print "<td><input type=number minvalue=0 maxvalue=$count onchange=\"setUsed(this,$id, $count)\" style='width:100%;text-align:center' value=$used></td>\n";
	print "<td><input type=button style='width:100' value='Детали' onclick='showDetails($id)'></td>\n";
	print "</tr>";
}
?>
</table>


<script>
function setUsed(input, id, maxValue)
{
	var n = parseInt(input.value);
	if (isNaN(n) || n < 0)
	{
		errorBox("Введите количество использованных билетов!", function() { input.focus(); });
		return;
	}
	if (n > maxValue)
	{
		errorBox("Количество должно быть не более "+maxValue+"!", function() { input.focus(); });
		return;
	}	


	sendXHR('eventguest.php','action=setused&id='+id+'&value='+n,
		null,
		function(error)
		{
			errorBox(error);
		});
}

function showDetails(id)
{
	sendXHR('eventguest.php','action=details&id='+id,
		function(data)
		{
			messageBox(data);
		});
} 
</script>

<hr>
<br>
<center><input type=button class=dlgBtn onclick='history.back()' value='«Назад'></center><br>


<?php BOTTOM(); ?>