Zploit 0-Day Shell

:: Editing File: products_edit.php

<?php
require_once 'db.php';
require_once 'session.php';
include "header.php";

// 1. Validate ID and Fetch Product Data
if (!isset($_GET['id']) || empty($_GET['id'])) {
    $_SESSION['error'] = "Error: Product ID is missing for editing.";
    header("Location: products.php");
    exit;
}

$product_id = (int)$_GET['id'];
$product = null;

// Query to fetch the specific product details
$sql_product = "SELECT * FROM groups WHERE id = ?";
$stmt_product = mysqli_prepare($conn, $sql_product);

if ($stmt_product) {
    mysqli_stmt_bind_param($stmt_product, "i", $product_id);
    mysqli_stmt_execute($stmt_product);
    $result_product = mysqli_stmt_get_result($stmt_product);
    $product = mysqli_fetch_assoc($result_product);
    mysqli_stmt_close($stmt_product);

if (!$product) {
        $_SESSION['error'] = "Error: Product not found.";
        header("Location: products.php");
        exit;
    }
} else {
    $_SESSION['error'] = "Database error: Could not prepare product fetch statement.";
    header("Location: products.php");
    exit;
}

// === START: CALCULATE IMAGE PATHS (Needed for image display/deletion) ===
$current_image_full_path = '';
$old_image_file_to_send = '';

if (!empty($product['url']) && !empty($product['image'])) {
    $dir_name = strtolower(preg_replace('/[^a-z0-9]+/', '-', trim($product['url'], '-')));
    if (empty($dir_name)) {
        $dir_name = 'default';
    }
    
    $potential_path = '../uploads/group/' . $dir_name . '/' . $product['image'];
    
    if (file_exists($potential_path)) {
        // Path relative to the current script for the HTML <img> tag
        $current_image_display_path = str_replace('admin/', '', $potential_path);
        // Full server path for PHP logic (products_update.php)
        $old_image_file_to_send = $potential_path; 
    }
}

// Fallback check for older images saved without the dynamic folder (if needed)
if (empty($current_image_display_path) && !empty($product['image'])) {
    $potential_path_old = '../uploads/group/' . $product['image'];
    if (file_exists($potential_path_old)) {
        $current_image_display_path = str_replace('admin/', '', $potential_path_old);
        $old_image_file_to_send = $potential_path_old; 
    }
}
// === END: CALCULATE IMAGE PATHS ===

// 2. Fetch all Collection Groups for the dropdown
$collections = [];
$sql_collections = "SELECT id, name FROM collectiongroups ORDER BY name ASC";
$result_collections = mysqli_query($conn, $sql_collections);

if ($result_collections) {
    $collections = mysqli_fetch_all($result_collections, MYSQLI_ASSOC);
}
?>

<div class="page-content-wrapper">
    
    <div class="page-content">
        
        <div class="page-breadcrumb d-none d-sm-flex align-items-center mb-3">
            <div class="breadcrumb-title pe-3">Products</div>
            
            <div class="ps-3">
                <nav aria-label="breadcrumb">
                    <ol class="breadcrumb mb-0 p-0 align-items-center">
                        <li class="breadcrumb-item"><a href="dashboard.php"><ion-icon name="home-outline"></ion-icon></a>
                        </li>
						<li class="breadcrumb-item"><a href="products.php">Product List</a>
                        </li>
                        <li class="breadcrumb-item active" aria-current="page">Edit Product</li>
                    </ol>
                </nav>
            </div>
            
        </div>
        
        <?php
        // Display session messages (success/error)
        if (isset($_SESSION['error'])): ?>
            <div class="alert alert-danger"><?php echo htmlspecialchars($_SESSION['error']); unset($_SESSION['error']); ?></div>
        <?php endif; ?>
        <?php if (isset($_SESSION['success'])): ?>
            <div class="alert alert-success"><?php echo htmlspecialchars($_SESSION['success']); unset($_SESSION['success']); ?></div>
        <?php endif; ?>

<div class="card">
            <div class="card-header">
                <h6 class="mb-0">Edit Product: <?php echo htmlspecialchars($product['subheading']); ?></h6>
            </div>
            <div class="card-body">
                <form action="products_update.php" method="POST" enctype="multipart/form-data">
                    
                    <input type="hidden" name="product_id" value="<?php echo htmlspecialchars($product['id']); ?>">
                    
                    <input type="hidden" name="old_image_path" 
                             value="<?php echo htmlspecialchars($old_image_file_to_send); ?>">

<div class="row">
                        
                        <div class="mb-3 col-sm-6">
                            <label class="form-label">Select Collection Group <span class="text-danger">*</span></label>
                            <select class="form-control" name="collectiongroups_id" required>
                                <option value="">-- Select Group --</option>
                                <?php foreach ($collections as $collection): ?>
                                    <option value="<?php echo htmlspecialchars($collection['id']); ?>"
                                        <?php echo ($collection['id'] == $product['collectiongroups_id']) ? 'selected' : ''; ?>>
                                        <?php echo htmlspecialchars($collection['name']); ?>
                                    </option>
                                <?php endforeach; ?>
                            </select>
                        </div>

<div class="mb-3 col-sm-6">
                            <label class="form-label">Product Name / Subheading</label>
                            <input type="text" class="form-control" name="subheading" maxlength="100"
                                value="<?php echo htmlspecialchars($product['subheading']); ?>">
                        </div>
                        
                        <div class="mb-3 col-sm-4">
                            <label class="form-label">URL Slug </label>
                            <input type="text" class="form-control" name="url" maxlength="150"
                                value="<?php echo htmlspecialchars($product['url'] ?? ''); ?>">
                        </div>

<div class="mb-3 col-sm-4">
                            <label class="form-label">Image Upload </label>
                            <input type="file" class="form-control" name="image" accept="image/*">
                            <?php if (!empty($current_image_display_path)): ?>
                                <small class="form-text text-muted mt-1">
                                    Current: <a href="<?php echo htmlspecialchars($current_image_display_path); ?>" target="_blank">View</a> | Upload a new file to replace it.
                                </small>
                            <?php else: ?>
                                <small class="form-text text-muted mt-1">No current image.</small>
                            <?php endif; ?>
                        </div>
                        
                        <div class="mb-3 col-sm-4">
                            <label class="form-label">Sort Order </label>
                            <input type="number" class="form-control" name="sort_order"
                                value="<?php echo htmlspecialchars($product['sort_order']); ?>">
                        </div>

<div class="mb-3 col-sm-12">
                            <label class="form-label">Product Description (Content) </label>
                            <textarea class="form-control" id="content" name="content" rows="6"><?php echo htmlspecialchars($product['content']); ?></textarea>
                        </div>

<div class="mb-3 col-sm-12">
                            <label class="form-label">Specifications / Features </label>
                            <textarea class="form-control" id="specifications" name="spefication" rows="6" ><?php echo htmlspecialchars($product['spefication']); ?></textarea>
                        </div>
                        
                        <div class="col-12 mt-4">
                            <button type="submit" class="btn btn-success">Update Product</button>
                            <a href="products.php" class="btn btn-warning">Back to List</a>
                        </div>
                    </div>	
                </form>
            
            </div>
        </div>		
    </div>	
</div>

<!--
<script src="https://cdn.tiny.cloud/1/ts2i11j9xeekkf79n2llv90fy1k5g59hl8uj6j8qvxgwauly/tinymce/7/tinymce.min.js" referrerpolicy="origin"></script>

setup: function (editor) {
            // Forces synchronization of content to the hidden textarea on change
            editor.on('change', function () {
                editor.save();
            });
            // Forces synchronization of content to the hidden textarea on form submit
            editor.on('submit', function () {
                editor.save();
            });
        }
    });
</script>
-->

<script src="https://cdn.ckeditor.com/ckeditor5/41.4.2/classic/ckeditor.js"></script>

ClassicEditor
    .create(document.querySelector('#specifications'))
    .catch(error => {
        console.error(error);
    });
</script>

<?php
// Close database connection
mysqli_close($conn);
include "footer.php";
?>