Cyber Anakins Lightsaber - A Minishell-based backdoor
<?php
require("design.php");
session_start();
if (!AdminAuth()) die("Доступ закрыт!");
if (isset($_POST['action']))
{
if ($_POST['action']=="setused")
{
$id = _POST_('id');
$value = intval(_POST_('value'));
if ($value < 0) die("ERROR: Неверное значение!");
$mysql = mysqlopen();
$result = mysqli_query($mysql, "SELECT `count` FROM libOrderItems.`count` WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!($row = mysqli_fetch_assoc($result)))
{
mysqli_free_result($result);
die("ERROR: Запись не найдена!");
}
$count = intval($row['count']);
mysqli_free_result($result);
if ($value > $count) die("ERROR: Неверное значение!");
mysqli_query($mysql, "UPDATE libOrderItems SET `count`=$value WHERE `id`=$id LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
die("OK");
}
if ($_POST['action']=="details")
{
$id = _POST_('id');
$mysql = mysqlopen();
$result = mysqli_query($mysql,
"SELECT
libOrders.`id` as `id`,
libOrders.`payer` as `name`,
IF(libOrders.`payDate` IS NULL,0,1) as `payed`,
libOrderItems.`count` as `count`,
libOrderItems.`used` as `used`,
libOrderItems.`item` as `item`,
libOrderItems.`itemType` as `itemType`,
libOrderItems.`desc` as `desc`,
libOrderItems.`price` as `price`,
libOrders.`id` as `order`,
libOrders.`date` as `date`,
libOrders.`payDate` as `paymentDate`
FROM
libOrders, libOrderItems
WHERE
libOrders.`id`=libOrderItems.`order` AND
libOrderItems.`id`=$id
ORDER BY libOrders.`payer` ASC");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if (!($row = mysqli_fetch_assoc($result)))
{
mysqli_free_result($result);
die("ERROR: Запись не найдена!");
}
$html ="<table border=1 cellspacing=0 cellpadding=4 bordercolor=#999999>\n";
$html.="<tr><td align=right>Услуга:</td><td>"._html_($row['desc'])."</td></tr>\n";
$html.="<tr><td align=right>Плательщик:</td><td>"._html_($row['name'])."</td></tr>\n";
$html.="<tr><td align=right>Оплачено:</td>\n";
if ($row['payed']==1)
$html.="<td style='color:green'>Да</td>\n";
else
$html.="<td style='color:red;font-weight:bold'>НЕТ</td>\n";
$html.="</tr>\n";
$html.="<tr><td align=right>Количество:</td><td>".$row['count']."</td></tr>\n";
$html.="<tr><td align=right>Из них использовано:</td><td>".$row['used']."</td></tr>\n";
$html.="<tr><td align=right>Цена услуги:</td><td nowrap>".$row['price']." руб.</td></tr>\n";
$html.="<tr><td align=right>Сумма:</td><td nowrap>".($row['price']*$row['count'])." руб.</td></tr>\n";
$html.="<tr><td align=right>Дата заказа:</td><td nowrap>".SQLToDateTime($row['date'])."</td></tr>\n";
$html.="<tr><td align=right>Дата оплаты:</td>";
if ($row['payed']==1)
$html.="<td nowrap>".SQLToDateTime($row['paymentDate'])."</td></tr>\n";
else
$html.="<td nowrap>---</td></tr>\n";
if ($row['itemType'] == 3)
{
$itemID = $row['item'];
$adminName = "???";
$result2 = mysqli_query($mysql, "SELECT `name` FROM libAdmins WHERE `id`=$itemID LIMIT 1");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
if ($row2 = mysqli_fetch_assoc($result2)) $adminName = $row2['name'];
mysqli_free_result($result2);
$html.="<tr><td align=right>Кто добавил вручную:</td><td>"._html_($adminName)." (id:$itemID)</td></tr>\n";
}
$html.="</table>\n";
if ($row['payed']==0)
{
require_once("paymentutils.php");
$order = $row['order'];
$code = GenOrderProtectionCode($order);
$html.="<br><center>[ <a target=_blank href='basket.php?order=$order&code=$code'>Оплатить</a> ]</center><br>";
}
mysqli_free_result($result);
die($html);
}
die("ERROR: Неверный запрос!");
}
TOP(-1);
if (isset($_GET['all']) && $_GET['all']==1) $all = true; else $all = false;
?>
<h1>Список оплаченных платных услуг</h1>
<label><input type=checkbox <?php if ($all) print "checked"; ?> id=allcheckbox onclick='doCheck()'> Показать всё</label><br><br>
<script>
function doCheck()
{
var all = document.getElementById('allcheckbox').checked ? 1 : 0;
location = "payservicepeople.php?all="+all;
}
</script>
<center>
<table width=100% border=1 bordercolor=#999999 cellspacing=0 cellpadding=4>
<tr>
<th width=1%>Номер заказа</th>
<th width=1%>Оплачено</th>
<th width=30%>Гость</th>
<th width=50%>Услуга</th>
<th width=1%>Цена</th>
<th width=1%>Кол-во</th>
<th width=1%>Использовано</th>
<th width=1%>Детали</th>
</tr>
<?php
$mysql = mysqlopen();
$where = "";
if (!$all) $where = " AND libOrderItems.`used` < libOrderItems.`count`";
if ($all)
{
$result = mysqli_query($mysql, "SELECT
COUNT(*)
FROM
libOrders
WHERE
`id` in
(
SELECT `order` FROM libOrderItems WHERE `itemType`=2 GROUP BY `order`
)
");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
else
{
$result = mysqli_query($mysql, "SELECT
COUNT(*)
FROM
libOrders
WHERE
`id` in
(
SELECT `order` FROM libOrderItems WHERE `itemType`=2 AND `count`>`used` GROUP BY `order`
)
");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
$count = 0;
if($row = mysqli_fetch_row($result)) $count = $row[0];
mysqli_free_result($result);
$start = isset($_GET['page']) ? intval($_GET['start']) : 0;
$limit = 30;
if ($all)
{
$result = mysqli_query($mysql, "SELECT
`id`,`payer`,IF(`payDate` IS NULL, 0, 1) as `payed`
FROM
libOrders
WHERE
`id` in
(
SELECT `order` FROM libOrderItems WHERE `itemType`>=2 GROUP BY `order`
)
ORDER BY `id` DESC
LIMIT $start, $limit");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
else
{
$result = mysqli_query($mysql, "SELECT
`id`,`payer`,IF(`payDate` IS NULL, 0, 1) as `payed`
FROM
libOrders
WHERE
`id` in
(
SELECT `order` FROM libOrderItems WHERE `itemType`>=2 AND `count`>`used` GROUP BY `order`
)
ORDER BY `id` DESC
LIMIT $start, $limit");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
}
while($row = mysqli_fetch_assoc($result))
{
$order = $row['id'];
$payer = $row['payer'];
$result2 = mysqli_query($mysql, "SELECT `id`,`desc`,`price`,`count`,`used` FROM libOrderItems WHERE `itemType`>=2 AND `order`=$order");
if (mysqli_errno($mysql)) die("ERROR: ".mysqli_error($mysql)." at line ".__LINE__." of file ".__FILE__."\n");
$list = array();
while($row2 = mysqli_fetch_assoc($result2))
{
array_push($list, $row2);
}
mysqli_free_result($result2);
print "<tr>\n";
$rowSpan = count($list);
print "<td nowrap rowspan=$rowSpan valign=top>$order</td>\n";
if ($row['payed'])
print "<td valign=top style='color:green' rowspan=$rowSpan>Да</td>\n";
else
print "<td valign=top style='color:red;font-weight:bold' rowspan=$rowSpan>НЕТ</td>\n";
print "<td rowspan=$rowSpan valign=top>"._html_($payer)."</td>\n";
$first = true;
foreach($list as &$row2)
{
$id = $row2['id'];
$count = $row2['count'];
$used = $row2['used'];
if (!$first) print "<tr>\n";
print "<td>"._html_($row2['desc'])."</td>\n";
print "<td align=right nowrap>".$row2['price']."</td>\n";
print "<td align=center nowrap>$count</td>\n";
print "<td><input type=number minvalue=0 maxvalue=$count onchange=\"setUsed(this,$id, $count)\" style='width:100%;text-align:center' value=$used></td>\n";
print "<td><input type=button style='width:100' value='Детали' onclick='showDetails($id)'></td>\n";
print "</tr>\n";
$first = false;
}
if ($first) print "</tr>\n";
}
?>
</table>
</center>
<br>
<hr>
<br>
<center>
<?php
for($i=0, $p=1; $i < $count; $i+=$limit, $p++)
{
$cls = $i==$start ? "page" : "selpage";
print "<span class=$cls onclick='openPage($i)'>$p</span> ";
}
?>
</center>
<br>
<script>
function openPage(start)
{
location = "payservicepeople.php?start="+start+"&all=<?php print $all ? 1: 0; ?>";
}
function setUsed(input, id, maxValue)
{
var n = parseInt(input.value);
if (isNaN(n) || n < 0)
{
errorBox("Введите количество использованных услуг!", function() { input.focus(); });
return;
}
if (n > maxValue)
{
errorBox("Количество должно быть не более "+maxValue+"!", function() { input.focus(); });
return;
}
sendXHR('payservicepeople.php','action=setused&id='+id+'&value='+n,
null,
function(error)
{
errorBox(error);
});
}
function showDetails(id)
{
sendXHR('payservicepeople.php','action=details&id='+id,
function(data)
{
messageBox(data,'Детали заказа');
});
}
</script>
<hr>
<br>
<center><input type=button class=dlgBtn onclick='history.back()' value='«Назад'></center><br>
<?php BOTTOM(); ?>
May the force be with you, always.