403Webshell
Server IP : 202.61.199.114  /  Your IP : 216.73.217.139
Web Server : nginx/1.22.1
System : Linux de.arni-solutions.de 6.1.0-49-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.174-1 (2026-05-26) x86_64
User : web20 ( 1018)
PHP Version : 8.4.23
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/clients/client2/api.pacim.de/web/src/PaCIM/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/clients/client2/api.pacim.de/web/src/PaCIM/getBookings.php
<?php
if( !isset( $_SERVER['HTTP_X_REQUESTED_WITH'] ) || ( isset( $_SERVER['HTTP_X_REQUESTED_WITH'] ) && $_SERVER['HTTP_X_REQUESTED_WITH'] != 'com.pacim.sa' ) ) {

    require_once("send_mail.php");

    sendEmail(
       'report@pacim.de',
       'POSSIBLE ATTACK by ' . getIPAddress(),
       content_mail( $_SERVER ),
       TRUE
    );

    die('forbidden');
}

/**
 * @var \Fusio\Engine\ConnectorInterface $connector
 * @var \Fusio\Engine\ContextInterface $context
 * @var \Fusio\Engine\RequestInterface $request
 * @var \Fusio\Engine\Response\FactoryInterface $response
 * @var \Fusio\Engine\ProcessorInterface $processor
 * @var \Psr\Log\LoggerInterface $logger
 * @var \Psr\SimpleCache\CacheInterface $cache
 */

use PSX\Http\Exception as StatusCode;

/** @var \Doctrine\DBAL\Connection $connection */
$connection = $connector->getConnection('PaCIM-PAS');

// Datum einmal holen und als Bind-Parameter verwenden (statt direkter Interpolation)
$date = $request->getUriFragment('date');

$count = $connection->fetchColumn(
    'SELECT COUNT(booking_id) FROM pacim_booking WHERE booking_begin = ?',
    array($date)
);
// Hinweis: sofern keiner der LEFT JOINs unten Zeilen vervielfacht,
// liefert count($arr_bookings) denselben Wert und diese Query ist entbehrlich.

//parking_type(b.booking_type) AS booking_type,

$arr_bookings = $connection->fetchAll('
SELECT
	c.customer_id,
    c.customer_firstname,
    SUBSTRING_INDEX(c.customer_firstname, " ", 1) AS customer_shortname,
    c.customer_lastname,
    c.customer_source,
    c.customer_email,
    c.customer_phone,
    c.customer_street,
    c.customer_city,
    c.customer_zipcode,
    c.customer_country,
    b.booking_no,
    b.booking_id,
    UPPER(b.booking_serial) AS booking_serial,
    UPPER(REGEXP_REPLACE(TRIM(b.booking_serial), "^([0-9]{1,3}|[A-ZÄÖÜ]{1,3}).*?([0-9]{1,3}|[A-ZÄÖÜ]{1,3}).*?([A-ZÄÖÜ|0-9]{1,4})", "\\\1 - \\\2 \\\3")) AS license_plate,
    UPPER(REGEXP_REPLACE(TRIM(b.booking_serial), "^([0-9]{1,3}|[A-ZÄÖÜ]{1,3}).*?([0-9]{1,3}|[A-ZÄÖÜ]{1,3}).*?([A-ZÄÖÜ|0-9]{1,4})", "\\\1\\\2\\\3")) AS license_clear,
	
	IF(b.booking_cruise_checkin IS NOT NULL, DATE_FORMAT(b.booking_cruise_checkin, "%H:%i"), NULL) AS boarding_time,
	
    IF(b.booking_checkin IS NULL, "0000-00-00 00:00:00", b.booking_checkin) AS booking_checkin,
    IF(b.booking_checkout IS NULL, "0000-00-00 00:00:00", b.booking_checkout) AS booking_checkout,
	
    IF(b.booking_checkin IS NULL, "00:00", DATE_FORMAT(b.booking_checkin, "%H:%i")) AS checkin_zeit,
    IF(b.booking_checkin IS NULL, "0000-00-00", DATE_FORMAT(b.booking_checkin, "%d.%m.%Y")) AS checkin_datum,
	
    parking_type(b.booking_type) AS booking_parkplatz,
    (SELECT product_id FROM pacim_invoice_pos WHERE (product_id=8 OR product_id=10) AND invoice_id=b.booking_invoice LIMIT 1) AS booking_special,
    SUBSTR(parking_type(b.booking_type), 1, 1) AS booking_short,
    e.event_calendar_title AS booking_event,
	
    IF(b.booking_event_id IS NOT NULL,
    	IF(ei.event_logo IS NOT NULL,
    		ei.event_logo,
    		"img/seaside/parken-warnemuende.png"
    	),
    	"img/seaside/parken-warnemuende.png"
    ) AS event_logo,
    b.booking_begin,
    b.booking_end,
    DATE_FORMAT(b.booking_begin, "%d.%m.") AS booking_von,
    DATE_FORMAT(b.booking_end, "%d.%m.%Y") AS booking_bis,
    DATE_FORMAT(b.booking_begin, "%Y/%m/%d") AS link_von,
    DATE_FORMAT(b.booking_end, "%Y/%m/%d") AS link_bis,
    DATEDIFF(b.booking_end, b.booking_begin) AS booking_duration,
    d.invoice_status,
    d.invoice_no,
    d.invoice_id,
    d.invoice_price,
    d.invoice_payment,
    d.invoice_coupon,
    d.invoice_date,
    (SELECT FORMAT(SUM(payment_value), 2) AS payed FROM pacim_payments WHERE payment_invoice=d.invoice_id) AS price_payed,
    (SELECT
     FORMAT(SUM(
         IF((product_id <= 2 AND (d.invoice_coupon = 2 OR invoice_pos_discount_type = 2)),
            (invoice_pos_price*0.9*invoice_pos_quantity*1.19),
            IF((product_id <= 2 AND (d.invoice_coupon = 1 OR invoice_pos_discount_type = 1)),
               ((invoice_pos_price*invoice_pos_quantity*1.19)-5),
               (invoice_pos_price*invoice_pos_quantity*1.19)
              ))
     ), 2) AS price
     FROM pacim_invoice_pos
     WHERE invoice_id=b.booking_invoice) AS price
FROM pacim_booking b
    LEFT JOIN pacim_customer c ON c.customer_id = b.booking_customer
    LEFT JOIN pacim_invoice d ON d.invoice_id = b.booking_invoice
	LEFT JOIN pacim_events e ON b.booking_event_id = e.event_calendar_id
	LEFT JOIN pacim_events_info ei ON e.event_calendar_info_id = ei.event_id
WHERE b.booking_begin = ?
ORDER by b.booking_serial ASC', array($date));


// --- Positionen in EINER Query holen statt pro Buchung (N+1 vermeiden) ---
$invoiceIds = array_filter(array_unique(array_column($arr_bookings, 'invoice_id')));

$positionsByInvoice = array();
if (!empty($invoiceIds)) {
	$rows = $connection->fetchAll('
		SELECT
			invoice_id,
			invoice_pos_id AS pos_id,
			product_id AS product,
			invoice_pos_price AS price,
			invoice_pos_title AS titel,
			invoice_pos_discount_type AS discount_type,
			invoice_pos_discount AS discount
		FROM pacim_invoice_pos
		WHERE invoice_id IN (?)',
		array($invoiceIds),
		array(\Doctrine\DBAL\Connection::PARAM_INT_ARRAY)
	);

	foreach ($rows as $row) {
		$iid = $row['invoice_id'];
		unset($row['invoice_id']); // damit die Position-Ausgabe exakt identisch bleibt
		$positionsByInvoice[$iid][] = $row;
	}
}


$arr_collection = array();

if($count > 0) {
	
	foreach($arr_bookings as $key => $item) {
		
		$arr_collection[$key]['customer'] = array(
			'id' => $item['customer_id'],
			'firstname' => $item['customer_firstname'],
			'shortname' => $item['customer_shortname'],
			'lastname' => $item['customer_lastname'],
			'phone' => $item['customer_phone'],
			'email' => $item['customer_email'],
			'source' => $item['customer_source'],
			'street' => $item['customer_street'],
			'zipcode' => $item['customer_zipcode'],
			'city' => $item['customer_city']
		);
		
		$arr_collection[$key]['booking'] = array(
			'id' => $item['booking_id'],
			'no' => $item['booking_no'],
			'customer' => $item['customer_id'],
			'invoice' => $item['invoice_id'],
			'serial' => $item['booking_serial'],
			'license' => $item['license_plate'],
			'license_clear' => $item['license_clear'],
			'checkin' => $item['booking_checkin'],
			'checkout' => $item['booking_checkout'],
			'event' => $item['booking_event'],
			'type' => $item['booking_parkplatz'],
			'short' => $item['booking_short'],
			'valet' => $item['booking_special'],
			'begin' => $item['booking_begin'],
			'end' => $item['booking_end'],
			'duration' => $item['booking_duration'],
		);
		
		$arr_collection[$key]['event'] = array(
			'title' => $item['booking_event'],
			'logo' => $item['event_logo'],
			'von' => $item['booking_von'],
			'bis' => $item['booking_bis'],
		);
		
		$arr_collection[$key]['invoice'] = array(
			'id' => $item['invoice_id'],
			'no' => $item['invoice_no'],
			'price' => number_format( $item['price'], 2, '.', false ),
			'price_payed' => number_format( ( $item['price_payed'] ? $item['price_payed'] : ( $item['invoice_payment'] > 0 ? $item['price'] : 0 ) ), 2, '.', false ),
			'price_diff' => number_format( ( $item['price']-$item['price_payed'] ), 2, '.', false ),
			'payment' => ( $item['invoice_payment'] == 0 && $item['price_payed'] != null && ($item['price']-$item['price_payed']) == 0 ? 5 : $item['invoice_payment'] ),
			'customer' => $item['customer_id'],
			'coupon' => $item['invoice_coupon'],
			'status' => $item['invoice_status'],
			'date' => $item['invoice_date'],
			'positions' => isset($positionsByInvoice[$item['invoice_id']])
				? $positionsByInvoice[$item['invoice_id']]
				: array()
		);
	}
	
}

/*if (empty($arr_bookings)) {
    throw new StatusCode\NotFoundException('Entry not available');
}*/

return $response->build(200, [], array(
	'count' => $count,
	'date' => $date,
	'entries' => $arr_collection
));

Youez - 2016 - github.com/yon3zu
LinuXploit