Zploit 0-Day Shell

:: Editing File: profile_save.php

<?php
// === profile_save.php: Simplified Script to handle profile updates ===

// 1. SETUP AND AUTHORIZATION
session_start();
// NOTE: Ensure your 'db.php' connects and creates a variable named $conn
require_once 'db.php';

$upload_dir = '../uploads/profile_pics/'; // Folder where images will be saved
$redirect_page = 'profile-edit.php';   // Page to send the user back to

$error_msg = "";  // Start with no errors
$update_sql_parts = []; // Array to build the SQL 'SET' clause pieces

// Check if the user is logged in
if (!isset($_SESSION['loggedin']) || $_SESSION['loggedin'] !== true || !isset($_SESSION['id'])) {
    $final_error = urlencode("Security Error: Please log in again.");
    header("location: index.php?status=danger&msg=" . $final_error);
    exit;
}

// Get the unique ID of the current user
$user_id = $_SESSION['id'];
//$user_id = '2';

if ($_SERVER["REQUEST_METHOD"] == "POST") {

// 2. HANDLE PROFILE PICTURE UPLOAD
    
    // Check if the file was uploaded without errors
    if (isset($_FILES['user_pic_file']) && $_FILES['user_pic_file']['error'] === UPLOAD_ERR_OK) {
        $file = $_FILES['user_pic_file'];
        $file_ext = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));

$allowed_ext = ['jpg', 'jpeg', 'png', 'gif'];
        $max_size = 2000000; // 2MB

// Validation checks
        if (!in_array($file_ext, $allowed_ext)) {
            $error_msg = "Error: Only JPG, JPEG, PNG, and GIF files are allowed.";
        } elseif ($file['size'] > $max_size) { 
            $error_msg = "Error: File size must be under 2MB.";
        }
        
        // If file is valid and no errors yet
        if (empty($error_msg)) {
            // Create the directory if it doesn't exist
            if (!is_dir($upload_dir)) {
                mkdir($upload_dir, 0777, true);
            }
            
            // Create a unique file name
            $new_file_name = "user_{$user_id}_" . time() . '.' . $file_ext;
            $destination = $upload_dir . $new_file_name;

// Move the file and prepare SQL part
            if (move_uploaded_file($file['tmp_name'], $destination)) {
                $pic_path = mysqli_real_escape_string($conn, $destination);
                // Add the file path update to the SQL list
                $update_sql_parts[] = "user_pic = '$pic_path'";
            } else {
                $error_msg = "Error: Could not move uploaded file. Check folder permissions.";
            }
        }
    }
    
    // If an error occurred during file upload, we stop processing text fields
    if (!empty($error_msg)) {
        goto error_redirect;
    }

// 3. HANDLE TEXT FIELDS (One by One - Easier to read than a loop)

// --- Full Name ---
    if (isset($_POST['full_name'])) {
        $full_name = trim($_POST['full_name']);
        $safe_name = mysqli_real_escape_string($conn, $full_name);
        $update_sql_parts[] = "full_name = '$safe_name'"; // 'username' is the DB column
    }

// --- Email Address ---
    if (isset($_POST['email_id'])) {
        $email = trim($_POST['email_id']);
        $safe_email = mysqli_real_escape_string($conn, $email);
        $update_sql_parts[] = "email_id = '$safe_email'"; // 'email_id' is the DB column
    }
    
    // --- Location ---
    if (isset($_POST['location'])) {
        $location = trim($_POST['location']);
        $safe_location = mysqli_real_escape_string($conn, $location);
        $update_sql_parts[] = "location = '$safe_location'"; // 'location' is the DB column
    }
	
	 // --- Role ---
    if (isset($_POST['role'])) {
        $role = trim($_POST['role']);
        $safe_role = mysqli_real_escape_string($conn, $role);
        $update_sql_parts[] = "role = '$safe_role'"; // 'role' is the DB column
    }

// --- About Me (Message) ---
    if (isset($_POST['message'])) {
        $message = trim($_POST['message']);
        $safe_message = mysqli_real_escape_string($conn, $message);
        $update_sql_parts[] = "message = '$safe_message'"; // 'message' is the DB column
    }
    
    // Note: 'role' is usually read-only, so we skip processing it here.

$update_sql_parts[] = "updated_at = NOW()";
	
    
    // 4. EXECUTE DATABASE UPDATE

// Check if we actually have anything to update
    if (empty($update_sql_parts)) {
        $error_msg = "No new information was submitted to save.";
        goto error_redirect;
    }

// Join the pieces into the final SQL 'SET' command
    // Example: "username = 'Alice', location = 'London'"
    $sql_set_clause = implode(', ', $update_sql_parts);

// Build the final SQL query
     $sql = "UPDATE users SET $sql_set_clause WHERE id = $user_id";

// Run the query!
    if (mysqli_query($conn, $sql)) {
        // Success: Redirect back with a success message
        mysqli_close($conn);
        $success_msg = urlencode("Your profile was successfully updated.");
        header("location: $redirect_page?status=success&msg=" . $success_msg);
        exit;
    } else {
        // Query failed
        $error_msg = "Database Error: Could not update profile. " . mysqli_error($conn);
    }
    
    
    // 5. FINAL ERROR REDIRECT (This section is jumped to if any error occurs)
    error_redirect:
    
    if (!empty($error_msg)) {
        // Close DB connection and redirect with the error message
        mysqli_close($conn);
        $final_error = urlencode($error_msg);
        header("location: $redirect_page?status=danger&msg=" . $final_error);
        exit;
    }

// Close connection if script finishes normally without redirection
    mysqli_close($conn);
}
?>