FM / admin

/var/www/clients/client1/web2/web/admin/

/var/www/clients/client1/web2/web/admin

Name	Size	Mode	Actions
css/	-	0755	rm
fonts/	-	0755	rm
imagenes/	-	0755	rm
js/	-	0755	rm
responsive-sidebar-navigation-master/	-	0755	rm
vendors/	-	0755	rm
access.php	344	0644	edit dl rm
admin.php	19898	0644	edit dl rm
assets.php	518	0644	edit dl rm
banners_mod2.php	4190	0644	edit dl rm
certificaciones_mod.php	2847	0644	edit dl rm
certificaciones_mod2.php	2551	0644	edit dl rm
comodin_mod.php	2368	0644	edit dl rm
comodin_mod2.php	1927	0644	edit dl rm
contactos_mod.php	1674	0644	edit dl rm
datepicker.php	138	0644	edit dl rm
editor.php	623	0644	edit dl rm
eliminar.php	449	0644	edit dl rm
eliminar_ajax.php	209	0644	edit dl rm
eliminar_archivo.php	215	0644	edit dl rm
estilos.css	1287	0644	edit dl rm
excel_contacto.php	2377	0644	edit dl rm
frases_mod2.php	1175	0644	edit dl rm
funciones.js	1316	0644	edit dl rm
funciones.php	13648	0644	edit dl rm
home.php	29	0644	edit dl rm
imagenes_home_add.php	1053	0644	edit dl rm
imagenes_home_mod.php	2669	0644	edit dl rm
imagenes_home_mod2.php	2352	0644	edit dl rm
index.php	3249	0644	edit dl rm
links_mod2.php	1157	0644	edit dl rm
log.php	2575	0644	edit dl rm
logout.php	200	0644	edit dl rm
medidas_mod.php	2448	0644	edit dl rm
medidas_mod2.php	2547	0644	edit dl rm
ordenar.php	543	0644	edit dl rm
pdfs_mod2.php	3090	0644	edit dl rm
post_procesos.php	624	0644	edit dl rm
procesos.php	10335	0644	edit dl rm
process.ordenar.php	435	0644	edit dl rm
representantes_mod.php	2317	0644	edit dl rm
representantes_mod2.php	4025	0644	edit dl rm
sliders_mod.php	2468	0644	edit dl rm
sliders_mod2.php	5073	0644	edit dl rm
sube_fotos.php	6605	0644	edit dl rm
sube_fotos_multiple.php	6104	0644	edit dl rm
t.php	698	0644	edit dl rm
tabla_fusion_mod.php	3475	0644	edit dl rm
tabla_fusion_mod2.php	4797	0644	edit dl rm
tabla_mod.php	3220	0644	edit dl rm
tabla_mod2.php	4145	0644	edit dl rm
titulos.php	2722	0644	edit dl rm
usuarios_mod.php	2265	0644	edit dl rm
usuarios_mod2.php	1776	0644	edit dl rm
videos_mod.php	2444	0644	edit dl rm
videos_mod2.php	1915	0644	edit dl rm
video_home_mod2.php	1457	0644	edit dl rm
zona_mod.php	1832	0644	edit dl rm
zona_mod2.php	1521	0644	edit dl rm

Edit: /var/www/clients/client1/web2/web/admin/procesos.php (10335B)

<?php include "access.php";

//fijar a 800
error_reporting(E_ALL);
ini_set('display_errors', 1);

if($_POST['Id']!=''){
	$id = intval($_POST['Id']);  
  } else {
	 if(@$_POST["MM_insert"] != "usuarios_add"){ 
		
		$query_marcas = "SELECT Id FROM ".escape($_POST["MM_update"])." order by Id desc limit 1 ";
		$marcas = mysqli_query($latynconexiones, $query_marcas) or die(mysqli_error());
		$row_marcas = mysqli_fetch_assoc($marcas);
		if(mysqli_num_rows($marcas)){
				$id=$row_marcas['Id']+1;
	 	} else { 
	 			$id=1;
        }

mysqli_query($latynconexiones, "INSERT INTO ".escape($_POST["MM_update"])." (Id) VALUES ($id)") or die(mysqli_error());
  
	 }
  }
  
  
if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "tabla")) {
  $campo = sube_fotos3("arch","foto","../img_tabla/","N","1200","","","","N","N","Y","","N","N");	
  $campo1 = sube_fotos3("arch1","ficha","../img_tabla/","","","","","","N","N","N","","N","N");		
  $updateSQL = sprintf("UPDATE tabla SET id_categoria=%s, nombre=%s, codigo=%s, descripcion=%s, foto=%s, ficha=%s, video=%s WHERE Id=%s",
                       GetSQLValueString($_POST['id_categoria'], "text"),
                       GetSQLValueString($_POST['nombre'], "text"),
                       GetSQLValueString($_POST['codigo'], "text"),
                       GetSQLValueString($_POST['descripcion'], "text"),
                       GetSQLValueString($campo, "text"),
                       GetSQLValueString($campo1, "text"),
                       GetSQLValueString($_POST['video'], "text"),
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL) or die(mysqli_error($latynconexiones));
  $GoTo = "admin.php?p=tabla_mod&id_categoria=".intval($_POST['id_categoria']);
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "tabla_fusion")) {
  $campo = sube_fotos3("arch","foto","../img_tabla_fusion/","N","1200","","","","N","N","Y","","N","N");	
  $campo1 = sube_fotos3("arch1","ficha","../img_tabla_fusion/","","","","","","N","N","N","","N","N");		
  $updateSQL = sprintf("UPDATE tabla_fusion SET id_categoria=%s, nombre=%s, codigo=%s, descripcion=%s, foto=%s, ficha=%s, video=%s WHERE Id=%s",
                       GetSQLValueString($_POST['id_categoria'], "text"),
                       GetSQLValueString($_POST['nombre'], "text"),
                       GetSQLValueString($_POST['codigo'], "text"),
                       GetSQLValueString($_POST['descripcion'], "text"),
                       GetSQLValueString($campo, "text"),
                       GetSQLValueString($campo1, "text"),
                       GetSQLValueString($_POST['video'], "text"),
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL) or die(mysqli_error($latynconexiones));
  $GoTo = "admin.php?p=tabla_fusion_mod&id_categoria=".intval($_POST['id_categoria']);
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "medidas")) {
  $updateSQL = sprintf("UPDATE medidas SET id_producto=%s, medidas=%s, dn=%s, l=%s, qn=%s, qmax=%s, rosca=%s WHERE Id=%s",
                       GetSQLValueString($_POST['id_producto'], "int"),
                       GetSQLValueString($_POST['medidas'], "text"),
                       GetSQLValueString($_POST['dn'], "text"),
                       GetSQLValueString($_POST['l'], "text"),
                       GetSQLValueString($_POST['qn'], "text"),
                       GetSQLValueString($_POST['qmax'], "text"),
                       GetSQLValueString($_POST['rosca'], "text"),
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL ) or die(mysqli_error());
  $GoTo = "admin.php?p=medidas_mod&id_producto=".intval($_POST['id_producto']);
}
  
  
if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "videos")) {
  $updateSQL = sprintf("UPDATE videos SET id_sitio=%s, titulo=%s, copete=%s, video=%s WHERE Id=%s",
                       GetSQLValueString($_POST['id_sitio'], "int"),
                       GetSQLValueString($_POST['titulo'], "text"),
                       GetSQLValueString($_POST['copete'], "text"),
                       GetSQLValueString($_POST['video'], "text"),
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL ) or die(mysqli_error());
  $GoTo = "admin.php?p=videos_mod&id_sitio=".intval($_POST['id_sitio']);
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "pdfs")) {
  $campo = sube_fotos3("arch","pdf","../img_pdfs/","","","","","","N","N","N","","N","N");  	
  $updateSQL = sprintf("UPDATE pdfs SET id_sitio=%s, pdf=%s, tipo=%s WHERE Id=%s",
                       GetSQLValueString($_POST['id_sitio'], "text"),
                       GetSQLValueString($campo, "text"),
                       GetSQLValueString($_POST['tipo'], "text"),
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL) or die(mysqli_error());
  $GoTo = "admin.php?p=pdfs_mod2&id_sitio=".intval($_REQUEST['id_sitio'])."&id=$id&success";
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "frases")) {
   $updateSQL = sprintf("UPDATE frases SET  frase=%s WHERE Id=%s",
                       GetSQLValueString($_POST['frase'], "text"),
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL) or die(mysqli_error());
  $GoTo = "admin.php?p=frases_mod2&id=".intval($id)."&success";
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "links")) {
   $updateSQL = sprintf("UPDATE links SET  link=%s WHERE Id=%s",
                       GetSQLValueString($_POST['link'], "text"),
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL) or die(mysqli_error());
  $GoTo = "admin.php?p=links_mod2&id=".intval($id)."&success";
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "usuarios")) {
  $updateSQL = sprintf("UPDATE usuarios SET user=%s, pass=%s WHERE Id=%s",
                       GetSQLValueString($_POST['user'], "text"),
                       GetSQLValueString($_POST['pass'], "text"),					   
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL) or die(mysqli_error());
  $GoTo = "admin.php?p=usuarios_mod&success";
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "sliders")) {
  $campo = sube_fotos3("arch","foto","../img_sliders/","","","","","","N","N","Y","","N","N");  
  $campo1 = sube_fotos3("arch1","foto_mobile","../img_sliders/","","","","","","N","N","Y","","N","N");    
  $campo2 = sube_fotos3("arch2","archivo","../img_sliders/","","","","","","N","N","N","","N","N");      
 $updateSQL = sprintf("UPDATE sliders SET foto=%s, foto_mobile=%s,archivo=%s,  link=%s, id_sitio=%s WHERE Id=%s",
                       GetSQLValueString($campo, "text"),
                       GetSQLValueString($campo1, "text"),					   
                       GetSQLValueString($campo2, "text"),					   					   
                       GetSQLValueString($_POST['link'], "text"),
                       GetSQLValueString($_POST['id_sitio'], "text"),					   
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL) or die(mysqli_error());
  $GoTo = "admin.php?p=sliders_mod&id_sitio=".intval($_REQUEST['id_sitio']);
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "banners")) {
  $campo = sube_fotos3("arch","foto","../img_banners/","","","","","","N","N","Y","","N","N");  
  $campo1 = sube_fotos3("arch1","foto_mobile","../img_banners/","","","","","","N","N","Y","","N","N");    	
  $updateSQL = sprintf("UPDATE banners SET id_sitio=%s, link=%s,  foto=%s, foto_mobile=%s WHERE Id=%s",
                       GetSQLValueString($_POST['id_sitio'], "int"),
                       GetSQLValueString($_POST['link'], "text"),					   
                       GetSQLValueString($campo, "text"),
                       GetSQLValueString($campo1, "text"),					   
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL) or die(mysqli_error());
  $GoTo = "admin.php?p=banners_mod2&success&id=".intval($id);
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "comodin")) {
  $updateSQL = sprintf("UPDATE comodin SET titulo=%s, texto=%s, id_sitio=%s, url=%s WHERE Id=%s",
                       GetSQLValueString($_POST['titulo'], "text"),
                       GetSQLValueString($_POST['texto'], "text"),					   
                       GetSQLValueString($_POST['id_sitio'], "int"),					   
                       GetSQLValueString($_POST['url'], "text"),
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL) or die(mysqli_error());
  $GoTo = "admin.php?p=comodin_mod2&success&id=".intval($_REQUEST['id_sitio']);
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "certificaciones")) {
  $campo = sube_fotos3("arch","archivo","../img_certificaciones/","","","","","","N","N","N","","N","N");  	
  $updateSQL = sprintf("UPDATE certificaciones SET id_sitio=%s, nombre=%s, archivo=%s WHERE Id=%s",
                       GetSQLValueString($_POST['id_sitio'], "int"),
                       GetSQLValueString($_POST['nombre'], "text"),
                       GetSQLValueString($campo, "text"),
                       GetSQLValueString($id, "int"));
  mysqli_query($latynconexiones, $updateSQL ) or die(mysqli_error());
  $GoTo = "admin.php?p=certificaciones_mod&id_sitio=".intval($_POST['id_sitio']);
}

if ((isset($_POST["MM_update"])) && ($_POST["MM_update"] == "video_home")) {
  $campo = sube_fotos3("arch","video","../videos/","","","","","","N","N","N","","N","N");  		
  $updateSQL = sprintf("UPDATE video_home SET video=%s WHERE Id=%s",
                       GetSQLValueString($campo, "text"),
                       GetSQLValueString(1, "int"));
  mysqli_query($latynconexiones, $updateSQL ) or die(mysqli_error());
  $GoTo = "admin.php?p=video_home_mod2&success";
}

mysqli_close($latynconexiones);
  header("Location: " . $GoTo);
?>