| Server IP : 104.21.21.239 / Your IP : 216.73.216.25 Web Server : Apache/2.4.68 (Amazon Linux) OpenSSL/3.5.5 System : Linux ip-172-31-69-123.ec2.internal 6.1.176-223.369.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Fri Jul 24 13:34:27 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.23 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : ON Directory : /home/mitzvahm/wwwdevplanner/mod/ |
Upload File : |
<?php include('_mod_security.php'); ?>
<?php
if (isset($_SESSION['user_id'])) :
//if (isset($_REQUEST['id'])) :
$action = "Edit";
//else :
//$action = "Add New";
//endif;
else :
exit();
endif;
//var_dump($_POST);
$active_tab = 'general';
if ($_POST['ajax_event_submitted'] == '1') :
if (isset($_POST['active_tab'])) :
$active_tab = $_POST['active_tab'];
else :
$active_tab = 'general';
endif;
$ar_err = array();
if (!empty($_POST['pwd_old']) || !empty($_POST['pwd_new']) || !empty($_POST['pwd_new2'])) :
if (empty($_POST['pwd_old'])) :
$ar_err['pwd_old'] = 'Old password required!';
$err_flag = true;
$err_tab = 'password';
else :
$sql = "SELECT * FROM users WHERE id = ".$_SESSION['user_id'];
$result = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result) > 0) :
$row = mysqli_fetch_object($result);
//echo 'old: '.$row->password.'<br />';
//echo 'new: '.mysqli_real_escape_string($GLOBALS['con'], trim($_POST['pwd_old'])).'<br />';
if (!empty($row->password2)) :
if ($row->password2 != mysqli_real_escape_string($GLOBALS['con'], trim($_POST['pwd_old']))) :
$ar_err['pwd_old'] = 'Old password invalid!';
$err_flag = true;
$err_tab = 'password';
endif;
else :
if ($row->password != mysqli_real_escape_string($GLOBALS['con'], trim($_POST['pwd_old']))) :
$ar_err['pwd_old'] = 'Old password invalid!';
$err_flag = true;
$err_tab = 'password';
endif;
endif;
endif;
endif;
if (empty($_POST['pwd_new'])) :
$ar_err['pwd_new'] = 'New password required!';
$err_flag = true;
$err_tab = 'password';
endif;
if (empty($_POST['pwd_new2']) || $_POST['pwd_new2'] != $_POST['pwd_new']) :
$ar_err['pwd_new2'] = 'New password confirmation must match!';
$err_flag = true;
$err_tab = 'password';
endif;
endif;
if (empty($_POST['first_name'])) :
$ar_err['first_name'] = 'First name is required!';
$err_flag = true;
$err_tab = 'general';
endif;
if (empty($_POST['last_name'])) :
$ar_err['last_name'] = 'Last name is required!';
$err_flag = true;
$err_tab = 'general';
endif;
if (empty($_POST['street'])) :
$ar_err['street'] = 'Street address is required!';
$err_flag = true;
$err_tab = 'general';
endif;
if (empty($_POST['city'])) :
$ar_err['city'] = 'City is required!';
$err_flag = true;
$err_tab = 'general';
endif;
if (empty($_POST['state'])) :
$ar_err['state'] = 'State is required!';
$err_flag = true;
$err_tab = 'general';
endif;
if (empty($_POST['zip'])) :
$ar_err['zip'] = 'Zip code is required!';
$err_flag = true;
$err_tab = 'general';
endif;
if (empty($_POST['phone'])) :
$ar_err['phone'] = 'Phone code is required!';
$err_flag = true;
$err_tab = 'general';
endif;
if (empty($_POST['email'])) :
$ar_err['email'] = 'Email is required!';
$err_flag = true;
$err_tab = 'general';
endif;
if (empty($_POST['security_question'])) :
$ar_err['security_question'] = 'Security Question is required!';
$err_flag = true;
$err_tab = 'general';
endif;
if (empty($_POST['security_answer'])) :
$ar_err['security_answer'] = 'Security Answer is required!';
$err_flag = true;
$err_tab = 'general';
endif;
if (!$err_flag) :
if ($action == 'Edit') :
$sql = "UPDATE users set ".
"first_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['first_name']))."', ".
"last_name = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['last_name']))."', ".
"street = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['street']))."', ".
"street2 = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['street2']))."', ".
"city = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['city']))."', ".
"state = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['state']))."', ".
"zip = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['zip']))."', ".
"phone = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['phone']))."', ".
"mobile = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['mobile']))."', ".
"email = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['email']))."', ".
"security_question = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['security_question']))."', ".
"security_answer = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['security_answer']))."' ".
"WHERE id = ".$_SESSION['user_id'];
mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (!empty($_POST['pwd_new'])) :
if (empty($_POST['salt'])) :
$sql = "UPDATE users set ".
"salt = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['salt2']))."', ".
"password2 = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['pwd_new']))."', ".
"password = NULL ".
"WHERE id = ".$_SESSION['user_id'];
else :
$sql = "UPDATE users set ".
"password2 = '".mysqli_real_escape_string($GLOBALS['con'], trim($_POST['pwd_new']))."' ".
"WHERE id = ".$_SESSION['user_id'];
endif;
mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
//mysqli_query($GLOBALS['con'], $sql) or die(mysqli_error($GLOBALS['con']).' '.$sql);
endif;
endif;
$form_message = "Saved sucessfully!";
unset($_POST['pwd_old']);
unset($_POST['pwd_new']);
unset($_POST['pwd_new2']);
else :
$active_tab = $err_tab;
$form_message = "Errors found!";
unset($_POST['pwd_old']);
unset($_POST['pwd_new']);
unset($_POST['pwd_new2']);
endif;
else:
if ($action == 'Edit') :
$sql = "SELECT * FROM users WHERE id = ".$_SESSION['user_id'];
$result = mysqli_query($GLOBALS['con'], $sql) or die('Database Error!');
if (mysqli_num_rows($result) > 0) :
$row = mysqli_fetch_object($result);
$_POST['first_name'] = $row->first_name;
$_POST['last_name'] = $row->last_name;
$_POST['street'] = $row->street;
$_POST['street2'] = $row->street2;
$_POST['city'] = $row->city;
$_POST['state'] = $row->state;
$_POST['zip'] = $row->zip;
$_POST['phone'] = $row->phone;
$_POST['mobile'] = $row->mobile;
$_POST['email'] = $row->email;
$_POST['security_question'] = $row->security_question;
$_POST['security_answer'] = $row->security_answer;
$_POST['salt'] = $row->salt;
$_POST['salt2'] = hash('sha512', random_bytes(64));
endif;
endif;
endif;
function show_login_form_error($err_text)
{
if (!empty($err_text)) :
echo '<br /><div class="login_form_error">'.$err_text.'</div>';
endif;
}
?>
<script>
var active_page = '<?php echo $_REQUEST['IX']; ?>';
var active_tab = '';
encode_pwd = function()
{
if (document.getElementById('salt').value)
{
if (document.getElementById('pwd_old').value)
{
document.getElementById('pwd_old').value = CryptoJS.SHA512(document.getElementById('salt').value + document.getElementById('pwd_old').value);
}
if (document.getElementById('pwd_new').value)
{
document.getElementById('pwd_new').value = CryptoJS.SHA512(document.getElementById('salt').value + document.getElementById('pwd_new').value);
}
if (document.getElementById('pwd_new2').value)
{
document.getElementById('pwd_new2').value = CryptoJS.SHA512(document.getElementById('salt').value + document.getElementById('pwd_new2').value);
}
}
else
{
if (document.getElementById('pwd_old').value)
{
document.getElementById('pwd_old').value = MD5(document.getElementById('pwd_old').value);
}
if (document.getElementById('pwd_new').value)
{
document.getElementById('pwd_new').value = CryptoJS.SHA512(document.getElementById('salt2').value + document.getElementById('pwd_new').value);
}
if (document.getElementById('pwd_new2').value)
{
document.getElementById('pwd_new2').value = CryptoJS.SHA512(document.getElementById('salt2').value + document.getElementById('pwd_new2').value);
}
}
return true;
}
update_header = function()
{
if ($("#first_name").val() > "" || $("#last_name").val() > "")
{
$("#header_repeater").text(" - " + $("#first_name").val() + " " + $("#last_name").val());
}
}
$(document).ready(function()
{
switch_tab('<?php echo $active_tab; ?>');
update_header();
$(':input').change(function() {sheet_dirty = true;} );
}
)
</script>
<h1>My Account<span id="header_repeater"></span></h1>
<?php get_help_guide('help_account_form_'.$active_tab); ?>
<?php echo form_message($form_message); ?>
<form style="" name="frm_account" id="frm_account" method="post" action="" onsubmit="encode_pwd();">
<input name="ajax_event_submitted" type="hidden" value="1" />
<input name="active_tab" id="active_tab" type="hidden" value="general" />
<!-- -------------------------------------------------------------------------------------------------------------- -->
<div class="form_strip">
<input type="button" value="Save" onclick="sheet_dirty = false; encode_pwd(); this.form.submit();" />
<input type="button" value="Cancel" onclick="sheet_dirty = false; window.location.href = 'index.php?IX=ez_guide'" />
</div>
<!-- -------------------------------------------------------------------------------------------------------------- -->
<div class="tab_strip">
<div class="tab_header" id="tab_general" onclick="switch_tab('general');">
General Information
</div>
<div class="tab_header" id="tab_password" onclick="switch_tab('password');">
Change Password
</div>
<div class="tab_header" id="tab_payments" onclick="switch_tab('payments');">
Payment History
</div>
</div>
<div class="cleardiv">
</div>
<div class="tab_content" id="tab_content_general">
<div class="form_header">
General Account Information
</div>
<table class="input_block">
<tr>
<td>
First Name
</td>
<td>
<input name="first_name" id="first_name" type="text" maxlength="50" onblur="update_header();" value="<?php echo $_POST['first_name']; ?>" />
<?php show_form_error($ar_err['first_name']); ?>
</td>
</tr>
<tr>
<td>
Last Name
</td>
<td>
<input name="last_name" id="last_name" type="text" maxlength="50" onblur="update_header();" value="<?php echo $_POST['last_name']; ?>" />
<?php show_form_error($ar_err['last_name']); ?>
</td>
</tr>
<tr>
<td>
Street
</td>
<td>
<input name="street" id="street" type="text" maxlength="150" value="<?php echo $_POST['street']; ?>" />
<?php show_form_error($ar_err['street']); ?>
</td>
</tr>
<tr>
<td>
</td>
<td>
<input name="street2" id="street2" type="text" maxlength="150" value="<?php echo $_POST['street2']; ?>" />
<?php show_form_error($ar_err['street2']); ?>
</td>
</tr>
<tr>
<td>
City
</td>
<td>
<input name="city" id="city" type="text" maxlength="50" value="<?php echo $_POST['city']; ?>" />
<?php show_form_error($ar_err['city']); ?>
</td>
</tr>
<tr>
<td>
State
</td>
<td>
<select name="state" id="state" >
<option value="">State...</option>
<?php
$sql_str = 'SELECT state, state_name FROM states ORDER BY state_name';
$result = mysqli_query($GLOBALS['con'], $sql_str) or die('Database Error!');
while ($row = mysqli_fetch_object($result)) :
$selected = '';
if ($_POST['state'] == $row->state) :
$selected = 'selected="selected"';
endif;
echo '<option value="'.$row->state.'" '.$selected.'>'.$row->state_name.'</option>';
endwhile;
?>
</select>
<?php show_form_error($ar_err['state']); ?>
</td>
</tr>
<tr>
<td>
Zip Code
</td>
<td>
<input name="zip" id="zip" type="text" maxlength="100" value="<?php echo $_POST['zip']; ?>" />
<?php show_form_error($ar_err['zip']); ?>
</td>
</tr>
<tr>
<td>
Phone
</td>
<td>
<input name="phone" id="phone" type="text" maxlength="20" value="<?php echo $_POST['phone']; ?>" />
<?php show_form_error($ar_err['phone']); ?>
</td>
</tr>
<tr>
<td>
Mobile
</td>
<td>
<input name="mobile" id="mobile" type="text" maxlength="20" value="<?php echo $_POST['mobile']; ?>" />
<?php show_form_error($ar_err['mobile']); ?>
</td>
</tr>
<tr>
<td>
Email
</td>
<td>
<input name="email" id="email" type="text" class="mail_field" maxlength="100" value="<?php echo $_POST['email']; ?>" /><a id="linkout_email" href="mailto:<?php echo $_POST['email']; ?>"><img class="link_out" src="img/link_out_icon.png" /></a>
<?php show_form_error($ar_err['email']); ?>
</td>
</tr>
<tr>
<td>
Security Question
</td>
<td>
<select name="security_question" id="security_question" >
<option value="">Select one...</option>
<?php
$sql_str = 'SELECT id, question FROM security_questions ORDER BY id';
$result = mysqli_query($GLOBALS['con'], $sql_str) or die('Database Error!');
while ($row = mysqli_fetch_object($result)) :
$selected = '';
if ($_POST['security_question'] == $row->question) :
$selected = 'selected="selected"';
endif;
echo '<option value="'.$row->question.'" '.$selected.'>'.$row->question.'</option>';
endwhile;
?>
</select>
<?php show_form_error($ar_err['security_question']); ?>
</td>
</tr>
<tr>
<td>
Security Answer
</td>
<td>
<input name="security_answer" id="security_answer" type="text" maxlength="100" value="<?php echo $_POST['security_answer']; ?>" />
<?php show_form_error($ar_err['security_answer']); ?>
</td>
</tr>
</table>
</div>
<!-- -------------------------------------------------------------------------------------------------------------- -->
<div class="tab_content" id="tab_content_password">
<div class="form_header">
Change Password
</div>
<table class="input_block">
<tr>
<td>
Old Password
</td>
<td>
<input name="salt" id="salt" type="hidden" value="<?php echo $_POST['salt']; ?>" />
<input name="salt2" id="salt2" type="hidden" value="<?php echo $_POST['salt2']; ?>" />
<input name="pwd_old" id="pwd_old" type="password" maxlength="150" value="<?php echo $_POST['pwd_old']; ?>" />
<?php show_form_error($ar_err['pwd_old']); ?>
</td>
</tr>
<tr>
<td>
New Password
</td>
<td>
<input name="pwd_new" id="pwd_new" type="password" maxlength="150" value="<?php echo $_POST['pwd_new']; ?>" />
<?php show_form_error($ar_err['pwd_new']); ?>
</td>
</tr>
<tr>
<td>
Confirm New Password
</td>
<td>
<input name="pwd_new2" id="pwd_new2" type="password" maxlength="150" value="<?php echo $_POST['pwd_new2']; ?>" />
<?php show_form_error($ar_err['pwd_new2']); ?>
</td>
</tr>
</table>
</div>
<!-- -------------------------------------------------------------------------------------------------------------- -->
<div class="tab_content" id="tab_content_payments">
<div class="form_header">
Payment History
</div>
<table class="input_block">
<tr>
<td width="100">
Date
</td>
<td width="185">
Type
</td>
<td width="125">
Card Number
</td>
<td width="70">
Amount
</td>
<td width="140">
Authorization Code
</td>
<td width="140">
Transaction ID
</td>
</tr>
<?php
$sql_pmt = "SELECT * FROM payments WHERE user_id = ".$_SESSION['user_id']." ORDER BY pmt_date DESC";
$result_pmt = mysqli_query($GLOBALS['con'], $sql_pmt) or die('Database Error!');
while($row_pmt = mysqli_fetch_object($result_pmt)) :
?>
<tr>
<td>
<?php echo nzdate_display($row_pmt->pmt_date); ?>
</td>
<td>
<?php echo $row_pmt->pmt_type; ?>
</td>
<td>
<?php echo $row_pmt->pmt_cc; ?>
</td>
<td align="right">
<?php echo $row_pmt->pmt_amt; ?>
</td>
<td>
<?php echo $row_pmt->auth_code; ?>
</td>
<td>
<?php echo $row_pmt->trans_id; ?>
</td>
</tr>
<?php
endwhile;
?>
</table>
</div>
<!-- -------------------------------------------------------------------------------------------------------------- -->
<div class="form_strip">
<input type="button" value="Save" onclick="sheet_dirty = false; encode_pwd(); this.form.submit();" />
<input type="button" value="Cancel" onclick="sheet_dirty = false; window.location.href = 'index.php?IX=ez_guide'" />
</div>
</form>