HEX
Server: LiteSpeed
System: Linux php-prod-3.spaceapp.ru 5.15.0-151-generic #161-Ubuntu SMP Tue Jul 22 14:25:40 UTC 2025 x86_64
User: sarli3128 (1010)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
Upload Files
File: //home/retile.ru/public_html/catalog/controller/feedback/feedback.php
<?php
class ControllerFeedbackFeedback extends Controller {
	public function postone() {
        $json = [];

        // Upload
        $allowed = array('png', 'jpg', 'gif', 'svg', 'zip', 'txt', 'doc', 'docx', 'cdr', 'ai', 'eps');
        if (isset($_FILES['upl']) && $_FILES['upl']['error'] == 0) {
            $extension = pathinfo($_FILES['upl']['name'], PATHINFO_EXTENSION);
            if (!in_array(strtolower($extension), $allowed)) {
                echo '{"status":"error"}';
                exit;
            }
            if (move_uploaded_file($_FILES['upl']['tmp_name'], 'uploads/' . $_FILES['upl']['name'])) {
                echo '{"status":"success"}';
                exit;
            }
        }
        /*
        $db = new DB(DB_DRIVER, DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, DB_DATABASE);

        $obTbPhn = $db->query("SELECT COUNT(*) AS `count` FROM `feedback_list` WHERE `date`='" . date("Y-m-d") . "' AND `phone`='".trim($_POST['Телефон'])."'");

        if ($obTbPhn->row['count'] == '0') {
            $nosend = false;
            $db->query("INSERT INTO `feedback_list` (`phone`, `date`) VALUES ('".trim($_POST['Телефон'])."', '" . date("Y-m-d") . "')");
        } else {
            $nosend = true;
        }

        if($nosend) {
            echo 'Не пройдена валидация запроса!';
            exit;
        }
        */

        $string = file_get_contents('php://input');

        $arPost = explode('&', $string);
        foreach($arPost as $k => $aPost) {
            $arPost[$k] = urldecode($aPost);
            [$key, $value] = explode('=', $arPost[$k]);

            if(empty($_POST[$key])) {
                $this->request->post[$key] = $value;
            }
        }

        $captcha = $this->load->controller('extension/captcha/basic/validate');

        if ($captcha) {
            $json['error']['captcha'] = $captcha;
        }

        if(mb_strlen($this->request->post['Имя']) < 2 || mb_strlen($this->request->post['Имя']) > 32) {
            $json['error']['name'] = 'Неправильно: Имя';
        }

        if(mb_strlen($this->request->post['Телефон']) < 8 || mb_strlen($this->request->post['Телефон']) > 32) {
            $json['error']['name'] = 'Неправильно: Телефон';
        }

        if(mb_strlen($this->request->post['Сообщение']) < 5 || mb_strlen($this->request->post['Сообщение']) > 512) {
            $json['error']['name'] = 'Неправильно: Сообщение';
        }
// Mail
// Если скрытое поле заполнено
        if ($this->request->post['name'] != '' || $json['error']) {
            die('BOTS!');
        } else {

//////////////////////////////////////

            foreach($this->request->post as $cle => $val) {
                if($cle == 'name' || $cle == 'captcha' || $cle == 'Политика принята') continue;
                $message .= "<strong>" . $cle . ": </strong>" . $val . "<p />";
            }
            $mRes = $this->send_mime_mail('Бесплатная консультация',
                'admin@retile.ru',
                "ADMIN",
                "info@retile.ru",
                'UTF-8',
                'KOI8-R',
                'Запрос консультации с сайта retile.ru',
                $message);

            if ($mRes == 1) {
                echo '';
                $json['status'] = 'Success';
            } else {
                echo '';
                $json['status'] = 'Fail';
            }
        }

		$this->response->addHeader('Content-Type: application/json');
		$this->response->setOutput(json_encode($json));
	}

    // Обработка формы
    private function send_mime_mail($name_from, // имя отправителя
                            $email_from, // email отправителя
                            $name_to, // имя получателя
                            $email_to, // email получателя
                            $data_charset, // кодировка переданных данных
                            $send_charset, // кодировка письма
                            $subject, // тема письма
                            $body // текст письма
    )
    {
        $to = $this->mime_header_encode($name_to, $data_charset, $send_charset)
            . ' <' . $email_to . '>';
        $subject = $this->mime_header_encode($subject, $data_charset, $send_charset);
        $from = $this->mime_header_encode($name_from, $data_charset, $send_charset)
            . ' <' . $email_from . '>';
        if ($data_charset != $send_charset) {
            $body = iconv($data_charset, $send_charset, $body);
        }
        $headers = "From: $from\r\n";
        $headers .= "Content-type:text/html; charset=$send_charset\r\n";
        return mail($to, $subject, $body, $headers);
    }

////////////////////////////////////////////
    private function mime_header_encode($str, $data_charset, $send_charset)
    {
        if ($data_charset != $send_charset) {
            $str = iconv($data_charset, $send_charset, $str);
        }
        return '=?' . $send_charset . '?B?' . base64_encode($str) . '?=';
    }

    public function posttwo()
    {
        $json = [];

        // Upload
        $allowed = array('png', 'jpg', 'gif', 'svg', 'zip', 'txt', 'doc', 'docx', 'cdr', 'ai', 'eps');
        if (isset($_FILES['upl']) && $_FILES['upl']['error'] == 0) {
            $extension = pathinfo($_FILES['upl']['name'], PATHINFO_EXTENSION);
            if (!in_array(strtolower($extension), $allowed)) {
                echo '{"status":"error"}';
                exit;
            }
            if (move_uploaded_file($_FILES['upl']['tmp_name'], 'uploads/' . $_FILES['upl']['name'])) {
                echo '{"status":"success"}';
                exit;
            }
        }
        /*
        $db = new DB(DB_DRIVER, DB_HOSTNAME, DB_USERNAME, DB_PASSWORD, DB_DATABASE);

        $obTbPhn = $db->query("SELECT COUNT(*) AS `count` FROM `feedback_list` WHERE `date`='" . date("Y-m-d") . "' AND `phone`='".trim($_POST['Телефон'])."'");

        if ($obTbPhn->row['count'] == '0') {
            $nosend = false;
            $db->query("INSERT INTO `feedback_list` (`phone`, `date`) VALUES ('".trim($_POST['Телефон'])."', '" . date("Y-m-d") . "')");
        } else {
            $nosend = true;
        }

        if($nosend) {
            echo 'Не пройдена валидация запроса!';
            exit;
        }
        */

        $string = file_get_contents('php://input');

        $arPost = explode('&', $string);
        foreach($arPost as $k => $aPost) {
            $arPost[$k] = urldecode($aPost);
            [$key, $value] = explode('=', $arPost[$k]);

            if(empty($_POST[$key])) {
                $this->request->post[$key] = $value;
            }
        }

        $captcha = $this->load->controller('extension/captcha/basic/validate');

        if ($captcha) {
            $json['error']['captcha'] = $captcha;
        }

        if(mb_strlen($this->request->post['Ваше имя']) < 2 || mb_strlen($this->request->post['Ваше имя']) > 32) {
            $json['error']['name'] = 'Неправильно: Ваше имя';
        }

        if(mb_strlen($this->request->post['Телефон']) < 8 || mb_strlen($this->request->post['Телефон']) > 32) {
            $json['error']['name'] = 'Неправильно: Телефон';
        }

// Mail
// Если скрытое поле заполнено
        if ($this->request->post['phone'] != '') {
            die('BOTS!');
        } else {

//////////////////////////////////////
            foreach($this->request->post as $cle => $val) {
                if($cle == 'name' || $cle == 'captcha' || $cle == 'Политика принята') continue;
                $message .= "<strong>" . $cle . ": </strong>" . $val . "<p />";
            }

            $mRes = $this->send_mime_mail('Коммерческое предложение',
                'admin@retile.ru',
                "ADMIN",
                "info@retile.ru",
                'UTF-8',
                'KOI8-R',
                'Коммерческое предложение с сайта retile.ru',
                $message);

                if ($mRes == 1) {
                    echo '';
                    $json['status'] = 'Success';

                } else {
                    echo '';
                    $json['status'] = 'Fail';
                }

            $this->response->addHeader('Content-Type: application/json');
            $this->response->setOutput(json_encode($json));
        }
    }
}