Mini Shell Moded By TiGER HeX

//proc/self/root/var/www/50mmla/admin/eventExplore.php

<?
include_once('../includes/static/configure.php');
include_once('../includes/static/util.php');
include_once('../includes/static/dbcon.php');
include_once('../includes/static/gdimg.php');
include_once('../includes/static/sessions.php');
include_once('includes/static/util.php');
include_once('includes/appTop.php');
$page_id = str_replace(".php","",basename($_SERVER['PHP_SELF']));
if(!has_permission($page_id)){
   die("You don't have permission to view this page!");
}
include_once('includes/header.php');

if( isset($_REQUEST['delete']) ){
   while(list($key,$value) = each($_REQUEST)){
	 if(preg_match("/story_/i",$key)){
		 $ids = explode("_",$key);
		 $sql = "DELETE FROM 50mm_stories WHERE story_id = '".$ids[1]."'";
		 if( !($result = $db->sql_query($sql)) ){
			 $sql_error = $db->sql_error();
			 die($sql_error['message']);
		 }
		 $sql = "DELETE FROM 50mm_embed WHERE story_id = '".$ids[1]."'";
		 if( !($result = $db->sql_query($sql)) ){
			 $sql_error = $db->sql_error();
			 die($sql_error['message']);
		 }
	 }
   }
   echo "<div class=\"hilite\">operation successful</div>";
}
?>
<form action="<?echo $_SERVER['PHP_SELF']?>" method="post" enctype="multipart/form-data">
<?
$sql = "SELECT story_id,story_title FROM 50mm_stories WHERE story_type = 'EVENT' ORDER BY story_id DESC";
if( !($result = $db->sql_query($sql)) ){
   $sql_error = $db->sql_error();
   die($sql_error['message']);
}
$modrows = Array();
while ($row = $db->sql_fetchrow($result)){
   $id = $row['story_id'];
   $row['story_title'] = get_trim_string($row['story_title'],60);
   $imgsql = "SELECT image FROM 50mm_embed WHERE story_id = '$id' LIMIT 1";
   if( !($imgresult = $db->sql_query($imgsql)) ){
	   $sql_error = $db->sql_error();
	   die($sql_error['message']);
   }
   $imgrow = $db->sql_fetchrow($imgresult);
   if(is_file(ROOT_DIR.STORY_LIMG_DIR.$imgrow['image'])){
	   $img_info = getimagesize(ROOT_DIR.STORY_LIMG_DIR.$imgrow['image']);
	   //width is greater so scale width
	   if($img_info[0] > $img_info[1]){
		  $scale = $img_info[0]/50;
	   }else{
		  $scale = $img_info[1]/50;
	   }
	   $w = round($img_info[0]/$scale);
	   $h = round($img_info[1]/$scale);

$js = "popImage('".urlencode(STORY_LIMG_DIR.$imgrow['image'])."','".$img_info[0]."','".$img_info[1]."');";
	   $row['image'] = "<img src=\"".STORY_SIMG_DIR.$imgrow['image']."\" border=\"0\" width=\"$w\" height=\"$h\" style=\"cursor:pointer;\" onClick=\"".$js."\">";
   }else{
       $row['image'] = "no image on disk";
   }
   $xtras['view'] = "<a href=\"#\" onClick=\"window.open('viewStory.php?storyId=".$id."','storyPreview');\">view</a>";
   if(has_permission("eventEdit")){
	   $xtras['edit'] = "<a href=\"eventEdit.php?storyId=$id\">edit</a>";
   }
   if(has_permission("eventDelete")){
	   $xtras['delete'] = "<input type=\"checkbox\" name=\"story_".$id."\" value=\"\">";
   }
   unset($row['story_id']);

$all = array_merge($row,$xtras);
   array_push($modrows, $all);
}
echo(get_table($modrows));
if(has_permission("eventDelete")){
	//$submit = "<input type=\"checkbox\" name=\"selectAll\" onClick=\"return checkUncheckAll(this.form);\"> Select/Deselect All<br>\n";
	$submit.= "<br><br><input type=\"submit\" class=\"button\" name=\"delete\" value=\"Delete Selected\" onClick=\"return validateDelete(this.form);\">";
	echo $submit;
}
?>
<input type="hidden" name="storyId" value="<?echo $story_id?>">
</form>
<?
include_once('includes/footer.php');
include_once('includes/appBottom.php');
?>