This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | include_once __DIR__ . '/admin_header.php'; |
||
3 | /* |
||
4 | * 处理 |
||
5 | **/ |
||
6 | |||
7 | //头部 |
||
8 | include "martin.header.php"; |
||
9 | $currentFile = basename(__FILE__); |
||
10 | $myModuleAdmin = new ModuleAdmin(); |
||
11 | echo $myModuleAdmin->addNavigation($currentFile); |
||
12 | |||
13 | //parameter 参数 |
||
14 | $action = isset($_POST['action']) ? $_POST['action'] : @$_GET['action']; |
||
15 | $action = empty($action) ? 'list' : $action; |
||
16 | $action = trim(strtolower($action)); |
||
17 | $id = !empty($_POST['id']) ? $_POST['id'] : @$_GET['id']; |
||
18 | $id = (int)($id); |
||
19 | $start = isset($_GET['start']) ? (int)($_GET['start']) : 0; |
||
20 | $hotel_city_id = isset($_GET['hotel_city_id']) ? (int)($_GET['hotel_city_id']) : 0; |
||
21 | |||
22 | $searchData = array( |
||
23 | 'hotel_city_id' => (int)($_GET['hotel_city_id']), |
||
24 | 'hotel_star' => (int)($_GET['hotel_star']), |
||
25 | 'hotel_name' => trim($_GET['hotel_name'])); |
||
26 | //确认删除 |
||
27 | $confirm = (isset($_POST['confirm'])) ? $_POST['confirm'] : 0; |
||
28 | //parameter 参数 |
||
29 | |||
30 | //模块配置 |
||
31 | $Ranks = GetRanks($xoopsModuleConfig); |
||
32 | //Hotels |
||
33 | $hotel_handler =& xoops_getmodulehandler('hotel', MARTIN_DIRNAME, true); |
||
34 | //城市 |
||
35 | $hotelcity_handler =& xoops_getmodulehandler('hotelcity', MARTIN_DIRNAME, true); |
||
36 | //是否存在 |
||
37 | if ($id > 0 && !$hotel_handler->CheckExist($id)) { |
||
38 | redirect_header(XOOPS_URL, 3, _AM_MARTIN_UNAUTHORIZED_ACCESS); |
||
39 | } |
||
40 | $HotelCityObj = $hotelcity_handler->create(); |
||
41 | //Hotels |
||
42 | $HotelObj = $id > 0 ? $hotel_handler->get($id) : $hotel_handler->create(); |
||
43 | |||
44 | $TmpFilePath = '../images/hotel/tmp/'; |
||
45 | $FilePath = '../images/hotel/'; |
||
46 | $FileType = array('.jpg', '.bmp', '.png', '.gif', '.jpeg'); |
||
47 | |||
48 | // martin_adminMenu(2, "订房后台 > 酒店管理"); |
||
49 | |||
50 | switch ($action) { |
||
51 | View Code Duplication | case "add": |
|
52 | include MARTIN_ROOT_PATH . 'include/form.hotel.php'; |
||
53 | martin_collapsableBar('createtable', 'createtableicon', _AM_MARTIN_ADD_HOTEL, _AM_MARTIN_ADD_HOTEL); |
||
54 | //Create_button(array('addcity'=>array('url'=>'mconfirmartin.hotel.city.php?action=add','value'=>_AM_MARTIN_CITY_NAME))); |
||
55 | $form = new form_hotel($HotelObj, $HotelCityObj); |
||
56 | |||
57 | $form->display(); |
||
58 | martin_close_collapsable('createtable', 'createtableicon'); |
||
0 ignored issues
–
show
Unused Code
introduced
by
![]() |
|||
59 | break; |
||
60 | case "save": |
||
61 | $alias_url = str_replace(' ', '-', addslashes($_POST['hotel_alias'])); |
||
62 | $alias_url = ($hotel_handler->CheckAliasExist($alias_url, $id)) ? $alias_url . '-' . mt_rand(10000, 100000) : $alias_url; |
||
63 | |||
64 | $hotel_city_id = implode(',', $_POST['hotel_city_id']); |
||
65 | |||
66 | $HotelObj->setVar('hotel_id', $id); |
||
67 | $HotelObj->setVar('hotel_city', (isset($_POST['hotel_city'])) ? (int)($_POST['hotel_city']) : 0); |
||
68 | $HotelObj->setVar('hotel_city_id', $hotel_city_id); |
||
69 | $HotelObj->setVar('hotel_environment', (isset($_POST['hotel_environment'])) ? addslashes($_POST['hotel_environment']) : ''); |
||
70 | $HotelObj->setVar('hotel_rank', (isset($_POST['hotel_rank'])) ? (int)($_POST['hotel_rank']) : 0); |
||
71 | $HotelObj->setVar('hotel_name', (isset($_POST['hotel_name'])) ? addslashes($_POST['hotel_name']) : ''); |
||
72 | $HotelObj->setVar('hotel_enname', (isset($_POST['hotel_enname'])) ? addslashes($_POST['hotel_enname']) : ''); |
||
73 | $HotelObj->setVar('hotel_alias', (isset($_POST['hotel_alias'])) ? $alias_url : ''); |
||
74 | $HotelObj->setVar('hotel_keywords', (isset($_POST['hotel_keywords'])) ? addslashes($_POST['hotel_keywords']) : ''); |
||
75 | $HotelObj->setVar('hotel_tags', (isset($_POST['hotel_tags'])) ? addslashes($_POST['hotel_tags']) : ''); |
||
76 | $HotelObj->setVar('hotel_description', (isset($_POST['hotel_description'])) ? addslashes($_POST['hotel_description']) : ''); |
||
77 | $HotelObj->setVar('hotel_star', (isset($_POST['hotel_star'])) ? (int)($_POST['hotel_star']) : 0); |
||
78 | $HotelObj->setVar('hotel_address', (isset($_POST['hotel_address'])) ? addslashes($_POST['hotel_address']) : ''); |
||
79 | $HotelObj->setVar('hotel_telephone', (isset($_POST['hotel_telephone'])) ? addslashes($_POST['hotel_telephone']) : ''); |
||
80 | $HotelObj->setVar('hotel_fax', (isset($_POST['hotel_fax'])) ? addslashes($_POST['hotel_fax']) : ''); |
||
81 | $HotelObj->setVar('hotel_room_count', (isset($_POST['hotel_room_count'])) ? (int)($_POST['hotel_room_count']) : 0); |
||
82 | |||
83 | //file upload |
||
84 | $hotel_icon = isset($_POST['hotel_icon_old']) ? $_POST['hotel_icon_old'] : null; |
||
85 | |||
86 | include XOOPS_ROOT_PATH . '/class/uploader.php'; |
||
87 | |||
88 | if (!empty($_FILES['hotel_icon']['tmp_name'])) { |
||
89 | $path = MARTIN_ROOT_PATH . '/images/hotelicon/'; |
||
90 | $FileTypeUpload = array("image/jpg", "image/png", "image/gif", "image/jpeg"); |
||
91 | $uploader = new XoopsMediaUploader($path, $FileTypeUpload, 2048 * 1024); |
||
92 | if ($uploader->fetchMedia($_POST["xoops_upload_file"][0])) { |
||
93 | $uploader->ext = strtolower(ltrim(strrchr($uploader->getMediaName(), '.'), '.')); |
||
94 | $SaveFileName = time() . mt_rand(1000, 10000) . "." . $uploader->ext; |
||
95 | $uploader->setTargetFileName($SaveFileName); |
||
96 | if (!$uploader->upload()) { |
||
97 | xoops_error($uploader->getErrors()); |
||
98 | exit(); |
||
99 | } elseif (file_exists($uploader->getSavedDestination())) { |
||
100 | //delete images |
||
101 | if (!empty($hotel_icon)) { |
||
102 | unlink(MARTIN_ROOT_PATH . '/images/hotelicon/' . $hotel_icon); |
||
103 | } |
||
104 | $hotel_icon = $uploader->getSavedFileName(); |
||
105 | } |
||
106 | } else { |
||
107 | xoops_error($uploader->getErrors()); |
||
108 | } |
||
109 | } |
||
110 | |||
111 | //echo $hotel_icon;exit; |
||
112 | |||
113 | $hotel_icon = empty($hotel_icon) ? 'hotel.jpg' : $hotel_icon; |
||
114 | $HotelObj->setVar('hotel_icon', $hotel_icon); |
||
115 | |||
116 | //得到图片 |
||
117 | $images = array(); |
||
118 | if (!empty($_POST['FileData']) && is_array($_POST['FileData'])) { |
||
119 | foreach ($_POST['FileData'] as $key => $Value) { |
||
120 | if ($id > 0 && file_exists($FilePath . $key)) { |
||
121 | $images[] = array('filename' => $key, 'alt' => $Value); |
||
122 | continue; |
||
123 | } |
||
124 | foreach ($FileType as $Prefix) { |
||
125 | $TmpFileName = $TmpFilePath . $key . $Prefix; |
||
126 | if (file_exists($TmpFileName)) { |
||
127 | $FileName = time() . mt_rand(1000, 10000) . $Prefix; |
||
128 | $images[] = array('filename' => $FileName, 'alt' => $Value); |
||
129 | copy($TmpFileName, $FilePath . $FileName); |
||
130 | break; |
||
131 | } |
||
132 | } |
||
133 | } |
||
134 | } |
||
135 | //clear dir |
||
136 | deldir($TmpFilePath); |
||
137 | |||
138 | $HotelObj->setVar('hotel_image', serialize($images)); |
||
139 | $HotelObj->setVar('hotel_google', serialize(array($_POST['GmapLatitude'], $_POST['GmapLongitude']))); |
||
140 | $HotelObj->setVar('hotel_characteristic', (isset($_POST['hotel_characteristic'])) ? addslashes($_POST['hotel_characteristic']) : ''); |
||
141 | $HotelObj->setVar('hotel_reminded', (isset($_POST['hotel_reminded'])) ? addslashes($_POST['hotel_reminded']) : ''); |
||
142 | $HotelObj->setVar('hotel_facility', (isset($_POST['hotel_facility'])) ? addslashes($_POST['hotel_facility']) : ''); |
||
143 | $HotelObj->setVar('hotel_info', (isset($_POST['hotel_info'])) ? ($_POST['hotel_info']) : ''); |
||
144 | $HotelObj->setVar('hotel_status', (isset($_POST['hotel_status'])) ? (int)($_POST['hotel_status']) : 0); |
||
145 | //$HotelObj->setVar('hotel_open_time',strtotime(trim($_POST['hotel_open_time']['date'])) + (int)(trim($_POST['hotel_open_time']['time'])) ); |
||
146 | $HotelObj->setVar('hotel_open_time', strtotime(trim($_POST['hotel_open_time']))); |
||
147 | $HotelObj->setVar('hotel_add_time', time()); |
||
148 | |||
149 | //var_dump($HotelObj); |
||
150 | //var_dump($_POST); |
||
151 | if (!$id) { |
||
152 | $HotelObj->setNew(); |
||
153 | } |
||
154 | |||
155 | if ($HotelObj->isNew()) { |
||
156 | $redirect_msg = _AM_MARTIN_ADDED_SUCCESSFULLY; |
||
157 | $redirect_to = 'martin.hotel.php'; |
||
158 | } else { |
||
159 | $redirect_msg = _AM_MARTIN_MODIFIED_SUCCESSFULLY; |
||
160 | $redirect_to = 'martin.hotel.php'; |
||
161 | } |
||
162 | if (!$hotel_handler->insert($HotelObj)) { |
||
163 | if ($HotelObj->_errors) { |
||
164 | xoops_error($HotelObj->error); |
||
165 | } |
||
166 | redirect_header('javascript:history.go(-1);', 2, _AM_MARTIN_OPERATION_FAILED); |
||
167 | exit(); |
||
168 | } |
||
169 | |||
170 | $hotel_id = $HotelObj->getVar('hotel_id'); |
||
171 | $hotel_tags = $HotelObj->getVar('hotel_tags'); |
||
172 | // hotel tag |
||
173 | if ($hotel_id > 0 && !empty($hotel_tags)) { |
||
174 | $hotel_handler->updateTags($HotelObj); |
||
175 | } |
||
176 | |||
177 | redirect_header($redirect_to, 2, $redirect_msg); |
||
178 | break; |
||
179 | /*case "upload": |
||
180 | include MARTIN_ROOT_PATH . "admin/upload.php"; |
||
181 | break; |
||
182 | case "showtmpimg": |
||
183 | include MARTIN_ROOT_PATH . "admin/thumbnail.php"; |
||
184 | break;*/ |
||
185 | case "saverank": |
||
186 | $RankData = $_POST['Ranks']; |
||
187 | $savemsg = _AM_MARTIN_SAVING_FAILED; |
||
188 | if ($hotel_handler->saveRank($RankData)) { |
||
189 | $savemsg = _AM_MARTIN_SAVING_SUCCESSFUL; |
||
190 | } |
||
191 | redirect_header('martin.hotel.php', 2, $savemsg); |
||
192 | break; |
||
193 | case "deleteimg": |
||
194 | $HotelImgPath = MARTIN_ROOT_PATH . 'images/hotel/'; |
||
195 | $HotelImgName = isset($_POST['img']) ? $_POST['img'] : $_GET['img']; |
||
196 | $FullImg = $HotelImgPath . $HotelImgName; |
||
197 | if (file_exists($FullImg) && is_writable($FullImg)) { |
||
198 | unlink($FullImg); |
||
199 | } |
||
200 | break; |
||
201 | View Code Duplication | case "del": |
|
202 | if (!$confirm) { |
||
203 | xoops_confirm(array('op' => 'del', 'id' => $id, 'confirm' => 1, 'name' => $HotelObj->hotel_name()), '?action=del', _DELETE . " '" . $HotelObj->hotel_name() . "'. <br /> <br />". _AM_MARTIN_OK_TO_DELETE_HOTEL, _DELETE); |
||
204 | } else { |
||
205 | if ($hotel_handler->delete($HotelObj)) { |
||
206 | $redirect_msg = _AM_MARTIN_OK_TO_DELETE_THE_ORDER; |
||
207 | $redirect_to = "martin.hotel.php"; |
||
208 | } else { |
||
209 | $redirect_msg = _AM_MARTIN_DELETE_FAILED; |
||
210 | $redirect_to = "javascript:history.go(-1);"; |
||
211 | } |
||
212 | redirect_header($redirect_to, 2, $redirect_msg); |
||
213 | } |
||
214 | |||
215 | break; |
||
216 | case "list": |
||
217 | martin_collapsableBar('createtable', 'createtableicon', _AM_MARTIN_HOTEL_LIST, _AM_MARTIN_HOTEL_LIST); |
||
218 | Create_button(array('addhotel' => array('url' => 'martin.hotel.php?action=add', 'value' => _AM_MARTIN_ADD_HOTEL))); |
||
219 | |||
220 | $HotelObjs = $hotel_handler->getHotelList($searchData, $xoopsModuleConfig['perpage'], $start); |
||
221 | //print_r($hotel_handler->hotel_ids); |
||
222 | $hotelRooms = $hotel_handler->GethotelRooms(); |
||
223 | |||
224 | //分页 |
||
225 | $HotelCout = $hotel_handler->getCount($searchData); |
||
226 | include_once XOOPS_ROOT_PATH . '/class/pagenav.php'; |
||
227 | $pagenav = new XoopsPageNav($HotelCout, $xoopsModuleConfig['perpage'], $start, 'start', "hotel_city_id={$searchData['hotel_city_id']}&hotel_star={$searchData['hotel_star']}&hotel_name={$searchData['hotel_name']}&start"); |
||
228 | $pavStr = '<div style="text-align:left;">' . $pagenav->renderNav() . '</div>'; |
||
229 | |||
230 | $StarStr = "<option value='0'>----</option>"; |
||
231 | foreach ($Ranks as $key => $Rank) { |
||
232 | $selected = $key == $_GET['hotel_star'] ? ' selected' : ''; |
||
233 | $StarStr .= "<option value='$key' $selected>$Rank</option>"; |
||
234 | } |
||
235 | // Creating the objects for top categories |
||
236 | echo "$pavStr<table width='100%' cellspacing=1 cellpadding=9 border=0 class = outer>"; |
||
237 | echo "<tr><td class='bg3' align='right'> |
||
238 | <form action='' method='get'> |
||
239 | " . _AM_MARTIN_HOTEL_AREA . ":{$hotelcity_handler->getTree('hotel_city_id', $_GET['hotel_city_id'])} |
||
240 | " . _AM_MARTIN_HOTEL_STARS . ":<select name='hotel_star'>$StarStr</select> |
||
241 | " . _AM_MARTIN_HOTEL_NAME . ":<input type='text' name='hotel_name' value='{$_GET['hotel_name']}'> |
||
242 | <input type='submit' value=" . _AM_MARTIN_SEARCH . "> |
||
243 | </form> |
||
244 | </td></tr>"; |
||
245 | echo "</table>"; |
||
246 | echo "<form action='martin.hotel.php?action=saverank' method='post'><div align='right'><input type='submit' value='" . _AM_MARTIN_SAVE_RANK . "'.</div><table width='100%' cellspacing=1 cellpadding=9 border=0 class = outer>"; |
||
247 | echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_NAME . "</b></td>"; |
||
248 | echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_ROOM_TYPE . "</b></td>"; |
||
249 | echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_AREA . "</b></td>"; |
||
250 | echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_STARS . "</b></td>"; |
||
251 | echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_PHONE . "</b></td>"; |
||
252 | echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_FAX . "</b></td>"; |
||
253 | echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_THE_NUMBER_OF_ROOMS . "</b></td>"; |
||
254 | echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_STATUS . "</b></td>"; |
||
255 | echo "<td class='bg3' align='left'><b>" . _AM_MARTIN_HOTEL_SORTING . "</b><br></td>"; |
||
256 | echo "<td width='150' class='bg3' align='center'><b>" . _AM_MARTIN_ACTIONS . "</b></td>"; |
||
257 | echo "</tr>"; |
||
258 | $Status = array('<div style="background-color:#FF0000">' . _AM_MARTIN_DRAFT . '</div>', '<div style="background-color:#00FF00">' . _AM_MARTIN_PUBLISH . '</div>'); |
||
259 | if ($HotelCout > 0) { |
||
260 | foreach ($HotelObjs as $hotel) { |
||
261 | $add = "<a href='martin.hotel.service.php?action=addhotel&hotel_id=" . $hotel['hotel_id'] . "' title='" . _AM_MARTIN_ADD_HOTEL_SERVICE . "'><img src='" . XOOPS_URL . "/modules/" . $xoopsModule->dirname() . "/images/icon/add.jpg'/></a>"; |
||
262 | $addroom = "<a href='martin.room.php?action=add&hotel_id=" . $hotel['hotel_id'] . "' title='" . _AM_MARTIN_ADD_HOTEL_ROOMS . "'><img src='" . XOOPS_URL . "/modules/" . $xoopsModule->dirname() . "/images/icon/addroom.jpg'/></a>"; |
||
263 | $modify = "<a href='?action=add&id=" . $hotel['hotel_id'] . "'><img src='" . XOOPS_URL . "/modules/" . $xoopsModule->dirname() . "/images/icon/edit.gif'/></a>"; |
||
264 | $delete = "<a href='?action=del&id=" . $hotel['hotel_id'] . "'><img src='" . XOOPS_URL . "/modules/" . $xoopsModule->dirname() . "/images/icon/delete.gif'/></a>"; |
||
265 | $hotel_url = XOOPS_URL . '/hotel-' . $hotel['hotel_alias'] . $xoopsModuleConfig['hotel_static_prefix']; |
||
266 | echo '<tr>'; |
||
267 | echo "<td class='even' align='lefet'><a href='$hotel_url'>{$hotel['hotel_name']}</a></td>"; |
||
268 | echo "<td class='even' align='lefet'><a href='martin.room.php?action=add&hotel_id={$hotel['hotel_id']}'><img src='../images/icon/add_btn_icon.gif' title='" . _AM_MARTIN_NEW_ROOM_TYPES . "'></a></td>"; |
||
269 | echo "<td class='even' align='lefet'>{$hotel['city_name']}</td>"; |
||
270 | echo "<td class='even' align='lefet'>{$Ranks[$hotel['hotel_star']]}</td>"; |
||
271 | echo "<td class='even' align='lefet'>{$hotel['hotel_telephone']}</td>"; |
||
272 | echo "<td class='even' align='lefet'>{$hotel['hotel_fax']}</td>"; |
||
273 | echo "<td class='even' align='lefet'>{$hotel['hotel_room_count']}</td>"; |
||
274 | echo "<td class='even' align='lefet'>{$Status[$hotel['hotel_status']]}</td>"; |
||
275 | echo "<td class='even' align='lefet'><input type='text' name='Ranks[{$hotel['hotel_id']}]' size=5 value='{$hotel['hotel_rank']}'></td>"; |
||
276 | echo "<td class='even' align='center'> $addroom $add $modify $delete </td>"; |
||
277 | echo '</tr>'; |
||
278 | $rooms = isset($hotelRooms[$hotel['hotel_id']]) ? $hotelRooms[$hotel['hotel_id']] : null; |
||
279 | if (is_array($rooms)) { |
||
280 | foreach ($rooms as $room) { |
||
281 | echo '<tr>'; |
||
282 | echo "<td class='even' align='lefet'></td>"; |
||
283 | echo "<td class='even' align='lefet'><a href='martin.room.php?action=add&id={$room['room_id']}'>{$room['room_type_info']}</a></td>"; |
||
284 | echo "<td class='even' align='lefet'>" . _AM_MARTIN_HOTEL_AREA . ":{$room['room_area']}</td>"; |
||
285 | echo "<td class='even' align='lefet'>" . _AM_MARTIN_HOTEL_FLOOR . ":{$room['room_floor']}</td>"; |
||
286 | echo "<td class='even' align='lefet'>{$Status[$room['room_status']]}</td>"; |
||
287 | echo "<td class='even' align='lefet'><a href='martin.room.php?action=addprice&room_id={$room['room_id']}'>" . _AM_MARTIN_PRICE_MANAGEMENT . "</a></td>"; |
||
288 | echo "<td class='even' align='lefet'></td>"; |
||
289 | echo "<td class='even' align='lefet'></td>"; |
||
290 | echo "<td class='even' align='lefet'></td>"; |
||
291 | echo "<td class='even' align='center'></td>"; |
||
292 | echo '</tr>'; |
||
293 | } |
||
294 | } |
||
295 | } |
||
296 | } else { |
||
297 | echo "<tr>"; |
||
298 | echo "<td class='head' align='center' colspan= '9'>" . MARTIN_IS_NUll . "</td>"; |
||
299 | echo "</tr>"; |
||
300 | $categoryid = '0'; |
||
301 | } |
||
302 | echo "</table></form>\n"; |
||
303 | echo "$pavStr<br />"; |
||
304 | martin_close_collapsable('createtable', 'createtableicon'); |
||
0 ignored issues
–
show
|
|||
305 | echo "<br>"; |
||
306 | |||
307 | break; |
||
308 | |||
309 | martin_close_collapsable('createtable', 'createtableicon'); |
||
0 ignored issues
–
show
|
|||
310 | echo "<br>"; |
||
311 | break; |
||
312 | default: |
||
313 | redirect_header(XOOPS_URL, 2, _AM_MARTIN_UNAUTHORIZED_ACCESS); |
||
314 | break; |
||
315 | } |
||
316 | |||
317 | //底部 |
||
318 | include_once __DIR__ . '/admin_footer.php'; |
||
319 |