Zploit 0-Day Shell

:: Editing File: products_save.php

<?php
// product_save.php - Saves a new Product record into the 'groups' table

require_once 'db.php';
require_once 'session.php';

// Define the base file upload directory
$base_upload_dir = '../uploads/group/';
$redirect_page = "products_add.php"; // Page to redirect back to on error

if ($_SERVER["REQUEST_METHOD"] == "POST") {

// 2. Sanitize and Get Input Data
    $collectiongroups_id = (int)($_POST['collectiongroups_id'] ?? 0);
    $subheading        = trim($_POST['subheading'] ?? '');
    $content           = trim($_POST['content'] ?? '');
    $spefication       = trim($_POST['spefication'] ?? '');
    $url               = trim($_POST['url'] ?? NULL);
    $sort_order        = (int)($_POST['sort_order'] ?? 0);
    $image_path        = NULL; // Will store the full path for cleanup
    $new_file_name     = NULL; // Will store only the filename for the database

// --- Dynamic Directory Logic ---
    // 1. Create URL-safe directory name from the slug ($url)
    $dir_name = $url ? strtolower(preg_replace('/[^a-z0-9]+/', '-', trim($url, '-'))) : 'default';
    if (empty($dir_name)) {
        $dir_name = 'default';
    }

// 2. Define the full upload directory path
    $upload_dir = $base_upload_dir . $dir_name . '/';

// 3. Ensure the upload directory exists
    if (!is_dir($upload_dir)) {
        // Create the directory recursively with read/write permissions for all (0777)
        if (!mkdir($upload_dir, 0777, true)) {
            $_SESSION['error'] = "File upload directory ('{$upload_dir}') could not be created. Check server permissions.";
            header("Location: {$redirect_page}");
            exit;
        }
    }
    // --- End Dynamic Directory Logic ---

// Required field validation
    if ($collectiongroups_id <= 0 || empty($subheading) || empty($content) || empty($spefication)) {
        $_SESSION['error'] = "Required fields (Group, Name, Description, Specification) are missing or invalid.";
        header("Location: {$redirect_page}");
        exit;
    }

// 3. Handle File Upload (Image)
    if (isset($_FILES['image']) && $_FILES['image']['error'] === UPLOAD_ERR_OK) {
        $file_name = $_FILES['image']['name'];
        $file_tmp = $_FILES['image']['tmp_name'];
        $file_ext = strtolower(pathinfo($file_name, PATHINFO_EXTENSION));
        $allowed_ext = ['jpg', 'jpeg', 'png', 'gif'];

if (in_array($file_ext, $allowed_ext)) {
            // Create a unique file name
            $new_file_name = uniqid('prod_') . '_' . time() . '.' . $file_ext;

// Define the final destination path
            $destination = $upload_dir . $new_file_name;

if (move_uploaded_file($file_tmp, $destination)) {
                $image_path = $destination; // Store full path for error cleanup
            } else {
                $_SESSION['error'] = "Failed to upload image. Please check directory permissions.";
                header("Location: {$redirect_page}");
                exit;
            }
        } else {
            $_SESSION['error'] = "Invalid file type. Only JPG, PNG, and GIF are allowed.";
            header("Location: {$redirect_page}");
            exit;
        }
    }

// 4. Prepare and Execute INSERT Query
    $sql = "INSERT INTO `groups`
        (`collectiongroups_id`, `image`, `url`, `subheading`, `content`, `spefication`, `sort_order`)
        VALUES (?, ?, ?, ?, ?, ?, ?)";

$stmt = mysqli_prepare($conn, $sql);

// Bind parameters: i s s s s s i
    // NOTE: $new_file_name contains only the file name (e.g., prod_12345.jpg), not the full path.
    // The full path will be constructed dynamically when displaying/editing.
    mysqli_stmt_bind_param($stmt, "isssssi",
        $collectiongroups_id,
        $new_file_name,
        $url,
        $subheading,
        $content,
        $spefication,
        $sort_order
    );

if (mysqli_stmt_execute($stmt)) {
        $_SESSION['success'] = "Product **'" . htmlspecialchars($subheading) . "'** added successfully! 🎉";
        // Redirect to the products list page
        header("Location: products.php");
        exit;
    } else {
        // Handle database execution error
        $_SESSION['error'] = "Error saving product: " . mysqli_error($conn);

// Clean up the uploaded file if the DB insert failed
        if ($image_path && file_exists($image_path)) {
            unlink($image_path);
        }
        header("Location: {$redirect_page}");
        exit;
    }

mysqli_stmt_close($stmt);
    mysqli_close($conn);

} else {
    // If accessed directly without POST data
    $_SESSION['error'] = "Invalid request method.";
    header("Location: {$redirect_page}");
    exit;
}
?>