Devil Killer Is Here MiNi Shell
MiNi SheLL

Current Path : /hermes/bosnacweb04/bosnacweb04ac/b1072/ipg.liuyuan7592410/wb_ecom/admin/
Linux boscustweb5004.eigbox.net 5.4.91 #1 SMP Wed Jan 20 18:10:28 EST 2021 x86_64
Current File : /hermes/bosnacweb04/bosnacweb04ac/b1072/ipg.liuyuan7592410/wb_ecom/admin/manage_account.php
<?PHP 
	require "top.inc.php";
	$allowedRole = SUPER_ADMIN|ADMIN|VENDOR_ADMIN|RETAILER_ADMIN;
	whoAllowed($allowedRole);

	function getInitRole(){
		switch($_SESSION['ADMIN_ROLE']){
			case SUPER_ADMIN:
				$role = ADMIN;
			break;
			case ADMIN:
				$role = 0;
			break;
			case VENDOR_ADMIN:
				$role = VENDOR_USER;
			break;
			case RETAILER_ADMIN:
				$role = RETAILER_USER;
		}
		return $role;
	}

	function getRoleName($con,$role){
		$row = mysqli_fetch_assoc(mysqli_query($con,"select str_value from t_sys_defination where value='$role' and t_name='t_admin_users' and field='role'"));
		return (isset($row['str_value']))?$row['str_value']:"";
	}

	$name = "";
	$username = "";
	$password = "";
	$role = getInitRole();
	$role_name = ($role!=0)?getRoleName($con,$role):"";
	$previlage = 0;
	$email = "";
	$mobile = "";
	$vendor_id = $_SESSION['VENDOR_ID'];
	$vendor_name = "";
	if($vendor_id!=0){
		$row = mysqli_fetch_assoc(mysqli_query($con,"select name from t_vendor where id='$vendor_id'"));
		$vendor_name=isset($row['name'])?$row['name']:"";
	}
	$retailer_id = $_SESSION['RETAILER_ID'];
	$retailer_name = "";
	if($retailer_id!=0){
		$row = mysqli_fetch_assoc(mysqli_query($con,"select name,ecom_url,logo from t_retailer where id='$retailer_id'"));
		$retailer_name=isset($row['name'])?$row['name']:"";
		$ecom_url = $row['ecom_url'];
		$logo_file = $row['logo'];
	}
	$ecom_url = "";
	$logo_file = "";

	$msg = "";

	if(isset($_GET["id"]) && ($_GET["id"]!="")){
		$id = get_safe_value($con,$_GET["id"]);
		$res = getAccountInfo($con,$id);
		$row = mysqli_fetch_assoc($res);
		$name = $row["name"];
		$username = $row["username"];
		$password = $row["password"];
		$role = $row["role"];
		$role_name = $row["role_name"];
		$previlage = $row["previlage"];
		$email = $row["email"];
		$mobile = $row["mobile"];
		$vendor_id = $row["vendor_id"];
		$vendor_name = $row["vendor_name"];
		$retailer_id = $row["retailer_id"];
		$retailer_name = $row["retailer_name"];
		$ecom_url = $row["ecom_url"];
		$logo_file = $row["logo"];
	}
	if(isset($_POST["submit"])){
		$name = get_safe_value($con,$_POST["name"]);
		$username = isset($_POST["username"])?strtolower(get_safe_value($con,$_POST["username"])):"";
		$password = isset($_POST["password"])?get_safe_value($con,$_POST["password"]):"";
		$role = get_safe_value($con,$_POST["role"]);
		$role_name = get_safe_value($con,$_POST["role_name"]);
		$prev1= isset($_POST["prev1"])?get_safe_value($con,$_POST["prev1"]):0;
		$prev2= isset($_POST["prev2"])?get_safe_value($con,$_POST["prev2"]):0;
		$prev3= isset($_POST["prev3"])?get_safe_value($con,$_POST["prev3"]):0;
		$prev4= isset($_POST["prev4"])?get_safe_value($con,$_POST["prev4"]):0;
		$prev5= isset($_POST["prev5"])?get_safe_value($con,$_POST["prev5"]):0;
		$prev6= isset($_POST["prev6"])?get_safe_value($con,$_POST["prev6"]):0;
		$previlage = $prev1|$prev2|$prev3|$prev4|$prev5|$prev6;
		$email = get_safe_value($con,$_POST["email"]);
		$mobile = get_safe_value($con,$_POST["mobile"]);
		$vendor_id = isset($_POST["vendor"])?get_safe_value($con,$_POST["vendor"]):$_SESSION['VENDOR_ID'];
		$vendor_name = isset($_POST["vendor_name"])?$_POST["vendor_name"]:"";
		$retailer_id = isset($_POST["retailer"])?get_safe_value($con,$_POST["retailer"]):$_SESSION['RETAILER_ID'];
		$retailer_name =  isset($_POST["retailer_name"])?$_POST["retailer_name"]:"";
		$ecom_url = isset($_POST["ecom_url"])?$_POST["ecom_url"]:"";

		$sql = "select * from t_admin_users where username=\"".$username."\"";
		$res = mysqli_query($con,$sql);
		$check = mysqli_num_rows($res);
		if($check>0){
			if(isset($_GET["id"]) && $_GET["id"]!=""){
				$row = mysqli_fetch_assoc($res);
				if($id!=$row["id"]){
					$msg = "This username has been used.";
				}
			}else{
				$msg = "This username has been used.";
			}
		}

		$vendor_or_retailer = "";
		if(!isset($_GET["id"])){
			if(($role==VENDOR_ADMIN)||($role==RETAILER_ADMIN)){
				$vendor_or_retailer = ($role==VENDOR_ADMIN)?"vendor":"retailer";
				$table = "t_".$vendor_or_retailer;
				$name_ven_or_re = ($role==VENDOR_ADMIN)?$vendor_name:$retailer_name;
				$check = mysqli_num_rows(mysqli_query($con,"select * from $table where mobile='$mobile'"));
				if($check>0){
					$msg = "This mobile phone number has been used.";
				}
				$check = mysqli_num_rows(mysqli_query($con,"select * from $table where email='$email'"));
				if($check>0){
					$msg = "This email address has been used.";
				}
			}
		}
			
		if($_FILES['logo']['type']!=''){
			if($_FILES['logo']['type']!='image/png' && $_FILES['logo']['type']!='image/jpg' && $_FILES['logo']['type']!='image/jpeg'){
				$msg="Please select only png, jpg and jpeg image formate";
			}
		}

		if($msg==""){
			if(isset($_GET["id"]) && $_GET["id"]!=""){
				if((($_SESSION['ADMIN_ROLE']&(SUPER_ADMIN|ADMIN))!=0)&&(($role==VENDOR_ADMIN)||($role==RETAILER_ADMIN))){
					if($role==VENDOR_ADMIN){
						$sql = "update t_vendor set name='$vendor_name',email='$email',mobile='$mobile' where id='$vendor_id'";					
					}else{
						$sql = "update t_retailer set name='$retailer_name',email='$email',mobile='$mobile',ecom_url='$ecom_url'";
						if(($_FILES['logo']['name']!="")&&($_FILES['logo']['error']==0)){
							$logo_file = $retailer_id.substr($_FILES['logo']['name'],strripos($_FILES['logo']['name'],'.'));
							unlink(LOGO_SERVER_PATH.$logo_file);
							move_uploaded_file($_FILES['logo']['tmp_name'], LOGO_SERVER_PATH.$logo_file);
							$sql .= ",logo='$logo_file'";
						}
						$sql .= " where id='$retailer_id'";
					}
					mysqli_query($con,$sql);
				}
				if(($_SESSION['ADMIN_ROLE']&(SUPER_ADMIN|ADMIN))!=0){
					$sql = "update t_admin_users set name='$name',username='$username',password='$password',role='$role',previlage='$previlage',email='$email',mobile='$mobile',vendor_id='$vendor_id',retailer_id='$retailer_id' where id='$id'";
				}else{
					$sql = "update t_admin_users set name='$name',email='$email',mobile='$mobile' where id='$id'";			
				}
			}else{
				if($vendor_or_retailer!=""){
					mysqli_query($con,"insert into $table (name,email,mobile,status) values ('$name_ven_or_re','$email','$mobile','1')");
					$new_id = mysqli_insert_id($con);
					if($vendor_or_retailer=="vendor"){
						$vendor_id = $new_id;
						$retailer_id = 0;
					}else{
						$retailer_id = $new_id;
						$vendor_id = 0;
					}
				}
				$sql = "insert into t_admin_users(name,username,password,role,previlage,email,mobile,vendor_id,retailer_id,created_by,added_on,status) values('$name','$username','$password','$role','$previlage','$email','$mobile','$vendor_id','$retailer_id','".$_SESSION['ADMIN_ID']."','".date("Y-m-d h:i:s")."','1')";
			}
			mysqli_query($con,$sql);
//			header("refresh:0;url=account.php");
			header("location:account.php");
			die();	
		}
	}

?>
<div class="content pb-0">
	<div class="animated fadeIn">
		<div class="row">
			<div class="col-lg-12">
				<div class="card">
					<div class="card-header"><strong><?PHP echo (!isset($_GET['id']))?"Create an ":$name." ";?>Account</strong><small> Form</small></div>
					<form method="POST" enctype="multipart/form-data">
						<div class="card-body card-block">
							<div class="form-group">
								<label for="categories" class=" form-control-label">Name</label>
								<input type="text" name="name" placeholder="Enter first and last name" class="form-control" required value='<?PHP echo $name;?>'>
							</div>
							<div class="form-group">
								<label for="categories" class=" form-control-label">Username</label>
								<input type="text" name="username" placeholder="Enter login username" class="form-control" required value='<?PHP echo $username;?>'>
							</div>
							<div class="form-group">
								<label for="categories" class=" form-control-label">password</label>
								<input type="text" name="password" placeholder="Enter login password" class="form-control" required value='<?PHP echo $password;?>'>
							</div>
							<div class="form-group">
								<label for="categories" class=" form-control-label">Email</label>
								<input type="text" name="email" placeholder="Enter Email address" class="form-control" required value='<?PHP echo $email;?>'>
							</div>
							<div class="form-group">
								<label for="categories" class=" form-control-label">Mobile</label>
								<input type="text" name="mobile" placeholder="Enter Mobile phone number" class="form-control" required value='<?PHP echo $mobile;?>'>
							</div>
							<div class="form-group">
								<label for="categories" class=" form-control-label">Account Type</label>
								<?PHP
									$display_role_id = "hidden";
									$display_role_name = "hidden";
									$display_vendor_div = "hidden";
									$display_retailer_div = "hidden";

									if((!isset($_GET['id']))&&($_SESSION['ADMIN_ROLE']==ADMIN)){
										$display_role_id = "";
										$display_role_name = " hidden ";										
										$display_vendor_div = "hidden";
										$display_retailer_div = "hidden";
									}else{
										$display_role_id = " hidden ";
										$display_role_name = "";		
										if(($role&(VENDOR_USER|VENDOR_ADMIN))!=0){
											$display_vendor_div = "";
											$display_retailer_div = "hidden";							
										}elseif(($role&(RETAILER_USER|RETAILER_ADMIN))!=0){
											$display_vendor_div = "hidden";
											$display_retailer_div = "";							
										}																
									}
								?>
								<select class="form-control" name="role" id="role" onchange="changeAccType();" required <?PHP echo $display_role_id;?>>
								<?PHP
									switch($_SESSION['ADMIN_ROLE']){
										case SUPER_ADMIN:
											$condition = " and value>".SUPER_ADMIN;
										break;
										case ADMIN:
											$condition = (isset($_GET['id']))?(" and value>".ADMIN):(" and (value=".VENDOR_ADMIN." or value=".RETAILER_ADMIN.")");
										break;
										case VENDOR_ADMIN:
											$condition = " and value=".VENDOR_USER;
										break;
										case RETAILER_ADMIN:
											$condition = " and value=".RETAILER_USER;
									}

									$sql = "select value,str_value from t_sys_defination where t_name='t_admin_users' and field='role' ".$condition." order by value";
									$res = mysqli_query($con,$sql);
									$html_option = "<option value=''>Select an account type</option>";
									while($row = mysqli_fetch_assoc($res)){
										$is_selected = ($row['value']==$role)?"selected":"";
										$html_option .= "<option value=".$row['value']." ".$is_selected.">".$row['str_value']."</option>";
									}
									echo $html_option;
								?>
								</select>
								<input type="text" name="role_name" id="role_name" class="form-control" value=<?PHP echo "'".$role_name."'".$display_role_name;?> readonly>
							</div>
							<?PHP
								if(($_SESSION['ADMIN_ROLE']==VENDOR_ADMIN)||
									(($role&(VENDOR_ADMIN|VENDOR_USER))!=0)||
									((!isset($_GET['id']))&&($_SESSION['ADMIN_ROLE']==ADMIN))){
							?>
							<div class="form-group" id="div_vendor" <?PHP echo $display_vendor_div;?>>
								<label for="categories" class=" form-control-label">Vendor</label>
								<?PHP 
									if(($_SESSION['ADMIN_ROLE']==VENDOR_ADMIN)||
										($role==VENDOR_ADMIN)||
										((!isset($_GET['id']))&&(($_SESSION['ADMIN_ROLE']&ADMIN)!=0))){
										$is_readonly=($_SESSION['ADMIN_ROLE']==VENDOR_ADMIN)?" readonly ":"";
										$display_vendor = " hidden ";
										$display_vendor_name = "";
									}else{
										$display_vendor = "";
										$display_vendor_name = " hidden ";
										$is_readonly = "readonly";
									}
								?>
								<input type="text" name="vendor_name" class="form-control" placeholder="Enter Vendor Name" value=<?PHP echo "'".$vendor_name."' ".$is_readonly.$display_vendor_name;?>>
								<select class="form-control" name="vendor" <?php echo $display_vendor;?>>
								<?PHP
									$sql = "select id,name from t_vendor order by id asc";
									$res = mysqli_query($con,$sql);
									echo "<option value=''>Select a Vendor</option>";
									while($row=mysqli_fetch_assoc($res)){
										$is_selected = ($vendor_id==$row['id'])?"selected":"";
										echo "<option value='".$row['id']."' ".$is_selected.">".$row['name']."</option>";	
									}
								?>
								</select>
							</div>
							<?PHP
								}
								if(($_SESSION['ADMIN_ROLE']==RETAILER_ADMIN)||
									(($role&(RETAILER_ADMIN|RETAILER_USER))!=0)||
									((!isset($_GET['id']))&&($_SESSION['ADMIN_ROLE']==ADMIN))){
							?>
							<div class="form-group" id="div_retailer" <?PHP echo $display_retailer_div;?>>
								<label for="categories" class=" form-control-label">Retailer</label>
								<?PHP 
									if(($_SESSION['ADMIN_ROLE']==RETAILER_ADMIN)||
										($role==RETAILER_ADMIN)||
										((!isset($_GET['id']))&&(($_SESSION['ADMIN_ROLE']&ADMIN)!=0))){
										$is_readonly=($_SESSION['ADMIN_ROLE']==RETAILER_ADMIN)?"readonly":"";
										$display_retailer = " hidden ";
										$display_retailer_name = "";
									}else{
										$display_retailer = "";
										$display_retailer_name = " hidden ";
										$is_readonly = "readonly";
									}
								?>
								<input type="text" name="retailer_name" class="form-control" placeholder='Enter Retailer Name' value=<?PHP echo "'".$retailer_name."' ".$is_readonly.$display_retailer_name;?>>
								<select class="form-control" name="retailer" <?php echo $display_retailer;?>>
								<?PHP
									$sql = "select id, name from t_retailer order by id asc";
									$res = mysqli_query($con,$sql);
									echo "<option value=''>Select a Retailer</option>";
									while($row=mysqli_fetch_assoc($res)){
										$is_selected = ($retailer_id==$row['id'])?"selected":"";
										echo "<option value='".$row['id']."' ".$is_selected.">".$row['name']."</option>";	
									}
								?>
								</select>
							</div>
							<?PHP
								}
								if(($_SESSION["ADMIN_ROLE"]&(ADMIN|SUPER_ADMIN))!=0){
							?>
							<div class="form-group ecom" id="div_ecom_url" <?PHP echo ($role==RETAILER_ADMIN)?"":"hidden";?>>
								<label for="categories" class=" form-control-label" >eCommerce URL:</label>
								<input type="text" name="ecom_url" placeholder="Enter Your eCommerce web site." class="form-control" value='<?PHP echo $ecom_url;?>' <?PHP echo " ".$is_readonly.$display_retailer_name;?>>
							</div>
							<div class="form-group ecom" id="div_logo" <?PHP echo ($role==RETAILER_ADMIN)?"":"hidden";?>>
								<label for="categories" class=" form-control-label">Logo image file:</label>
								<input type="file" name="logo" class="form-control">
							</div>
							<?PHP	
								}
								if(($_SESSION['ADMIN_ROLE']&ADMIN)!=0){
							?>
							<div class="form-group" id="previlage">
								<label for="categories" class=" form-control-label">Previlage</label>
								<div class="form-control">
									<label><input type="checkbox" class="previlage" name="prev1" value=<?PHP echo PREVILAGE_PRESALE." ".((($previlage&PREVILAGE_PRESALE)!=0)?"checked":"");?>>Presale</label>
								</div>
							</div>
							<?PHP
								}
							?>
							<button id="payment-button" name="submit" type="submit" class="btn btn-lg btn-info btn-block">
							<span id="payment-button-amount" name="submit">Submit</span>
							</button>
							<div class="field-error"><?PHP echo $msg;?></div>
						</div>
					</form>
				</div>
			</div>
		</div>
	</div>
</div>

<script src="js/jquery-3.2.1.min.js"></script>
<script type="text/javascript">
function get_sub_cat(){
	var categories_id = jQuery("#categories_id").val();
	jQuery.ajax({
		url: "get_sub_cat.php",
		method: "post",
		data: "categories_id="+categories_id,
		success: function(result){
			jQuery("#sub_categories_id").html(result);
		}
	});
}

function changeAccType(){
	var role = $("#role").val();
	$("#role_name").val($("#role option:selected").text());
	switch(role){
		case <?php echo "'".ADMIN."'";?>:
			$("#div_vendor").hide();
			$("#div_retailer").hide();
			$(".ecom").prop("hidden",true);
		break;
		case <?php echo "'".VENDOR_ADMIN."'";?>:
		case <?php echo "'".VENDOR_USER."'";?>:
			$("#div_vendor").prop("hidden",false);
			$("#div_retailer").prop("hidden",true);
			$(".ecom").prop("hidden",true);		
		break;
		case <?php echo "'".RETAILER_ADMIN."'";?>:
			$(".ecom").prop("hidden",false);
			$("#div_vendor").prop("hidden",true);		
			$("#div_retailer").prop("hidden",false);	
		break;
		case <?php echo "'".RETAILER_USER."'";?>:
			$(".ecom").prop("hidden",true);
			$("#div_vendor").prop("hidden",true);		
			$("#div_retailer").prop("hidden",false);	
		break;
		default:
			$(".ecom").prop("hidden",true);
			$("#div_vendor").hide();
			$("#div_retailer").hide();
	}
}

</script>
<?PHP 
	require "footer.inc.php";
?>
Creat By MiNi SheLL
Email: devilkiller@gmail.com