403Webshell
Server IP : 134.236.49.22  /  Your IP : 216.73.216.114
Web Server : Apache/2.2.15 (Fedora)
System : Linux km10.dyndns.org 2.6.31.5-127.fc12.i686.PAE #1 SMP Sat Nov 7 21:25:57 EST 2009 i686
User : apache ( 48)
PHP Version : 5.3.3
Disable Function : NONE
MySQL : ON  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : ON  |  Sudo : ON  |  Pkexec : ON
Directory :  /var/www/html/use/q/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/html/use/q//Report.php
<?php
$ebits = ini_get('error_reporting');
error_reporting($ebits ^ E_NOTICE);
session_start();
include("dbconfig.php");
mysql_select_db("KPI");
mysql_query("SET NAMES 'tis620'; ");
$_SESSION["cUserName"] ='Guest';
if (!isset($_SESSION["uDept"]))$_SESSION["uDept"]='NA';
//สอบ auth
if (isset($_POST['username'])) {	     
	$_SESSION["uDept"]='NA';
	$pwd = base64_encode(trim($_POST['password']));
	$usr = trim($_POST['username']);
	$Login = trim(file_get_contents("http://192.168.1.2/queue/login.php?&uid=$usr&pwd=$pwd"));
	if ($Login <>'UnAuth') {
		$_SESSION["cUserName"] = substr($Login,10);
		$sql='select * from  users  where password = "'.$usr.'"';
		$result=mysql_query($sql);
		while ($object = mysql_fetch_array($result)) {
			$_SESSION["uDept"] = $object['dept'];
		}
	}
	if ($_SESSION["cUserName"] =='Guest'){
		echo '<script language="javascript">';
		echo 'alert("ไม่ถูกต้อง")';
		echo '</script>';
	}
}
//-----------
if (!isset($_SESSION["DeptName"])){
	//ต้องการให้ค้นครั้งเดียว
	$curID=0;
	$deptList='';
	$sql="select * from dept order by dept_id";
	$result=mysql_query($sql);
	while ($object = mysql_fetch_array($result)) {
		if (	$object['dept_id'] == $curID) {
			if ($deptList == '') $deptList='"'.$object['dept'].'"';
			else $deptList .=',"'.$object['dept'].'"';
			$curID +=1;
		} else {
			for ($i = $curID; $i <= $object['dept_id']; $i++) {
				if ($i == $object['dept_id']){
					if ($deptList == '') $deptList='"'.$object['dept'].'"';
					else $deptList .=',"'.$object['dept'].'"';
				} else {
				if ($deptList == '') $deptList='""';
				else $deptList .=',""';
				}
			}
			$curID = $object['dept_id']+1;
		}
	}	
	eval ('$_SESSION["DeptName"] = array('.$deptList.'); '); 
}
if (isset($_POST['insert'])) {	     
	if ($_POST['insert']='บันทึก' ){
		/* 
		    กรณีที่ SAVE จาก "add_report "  
			1.ปรับปรุง หน่วยงานรับผิดชอบ dept ฐาน indicators 
		*/
		$Savedate = (substr($_POST['date'],6)-543).'-'.substr($_POST['date'],3,2).'-'.substr($_POST['date'],0,2);
		$deptList = '';
		foreach($_POST["framework"] as $row) {
  			$deptList .= $row . ',';  //ต้องมี , ปิดท้ายเสมอ ไว้ค้นหา
		}
		$sql="update indicators  set dept ='".$deptList."',name1='".$_POST['name1']."',name2='".$_POST['name2']."',
		HA='".$_POST['HA_no']."',PA='".$_POST['PA_no']."' where id_no='".$_POST['id_no']."'"; 
		$result=mysql_query($sql);
		//echo  $sql; //ตรวจคำสั่ง update
		/*
			2.บันทึกข้อมูลรายวันฐาน Result   โดยลบข้อมูลวันนี้เดิมออกก่อนแล้ว insert ใหม่ (ป้องกันบันทึกซ้ำ )
		*/
		$sql="delete from  result  where id_no='".$_POST['id_no']."' and date = '".$Savedate."'";
		$result=mysql_query($sql);
		if (($_POST['amount']+0)<>0 || ($_POST['total']+0)<>0 ) {
			$sql="insert into result (id_no,date,amount,total) 
				values ('".$_POST['id_no']."','".$Savedate."',".$_POST['amount'].",".$_POST['total'].")";
			$result=mysql_query($sql);
			/*
				3.รวมข้อมูลเป็นรายเดือน จาก Result เพื่อบันทึกในฐาน goal ช่องเดือน(m1-12 และ m1b-m12b)ของ reccord ตามปีงบปรมาณนั้น
			*/
			$suma=0;
			$sumt=0;
			$nextm = date('Y-m-t',strtotime($Savedate)); //วันสุดท้ายของเดือน
			$sql="select sum(amount) as suma , sum(total) as sumt from result where id_no='".$_POST['id_no']."' and 
			date >= '".substr($Savedate,0,8)."01' and date <= '".$nextm."'" ;
			$result=mysql_query($sql);
			while ($object = mysql_fetch_object($result)) {
				$suma = ($object ->suma);
				$sumt = ($object -> sumt);
				/* ตั้งใจว่าจำนวนทั้งหมดควรมากกว่าหรือเท่ากับกลุ่มที่เป็นเป้าหมาย
				// แต่อาจไม่ใช่ก็ได้แล้วแต่จุดประสงค์
				if (($object -> sumt ) < ($object -> suma))  $sumt = ($object -> suma);
				else $sumt = ($object -> sumt);
				*/
			}
			// 4 บันทึก ผลรายเดือนที่ได้ ลงฐาน goal บรรทัด " ปีงบประมาณ "ที่ระบุ
			$ButgMonth = substr($Savedate,5,2);
			$ButgYear   = substr($Savedate,0,4);
			if ($ButgMonth >='10') {
				$ButgMonth = $ButgMonth-9;    		//1,2,3  ตุลาคม 10 - ธันวาคม 12
				$ButgYear = $ButgYear+1;
			} else $ButgMonth = ($ButgMonth+3);  //4-12  มกราคม 1 - กันยายน
			$sql="select * from goal where id_no='".$_POST['id_no']."' and year = '".$ButgYear."' limit 1" ;
			$result = mysql_query($sql);
			$Rows = mysql_num_rows($result);
			if ($Rows == 0) 	//ไม่เคยมีบรรทัดปีนี้ ให้ insert
				$sql="insert into goal (id_no,year,compair,goal,eva,m".$ButgMonth.",m".$ButgMonth."b) 
				 value ('".$_POST['id_no']."','".$ButgYear."','".$_POST['goal1']."',".$_POST['goal2'].",'".$_POST['goal3']."',".$suma.",".$sumt.")";
			else 					//เคยมีบรรทัดปี ให้Update
				$sql="update goal set  m".$ButgMonth."=".$suma.",m".$ButgMonth."b=".$sumt.
				",goal=".$_POST['goal2'].",eva='".$_POST['goal3']."',compair='".$_POST['goal1'].
				"' where id_no='".$_POST['id_no']."' and year='".$ButgYear."'";
			$result=mysql_query($sql);
			/*
				5.รวมข้อมูลรายปี goal ช่องเดือน m1ถึง m12 และ m1b ถึง m12b
				   บันทึก Update ฐาน goal ช่อง toal และ totalb และปะเมินผลเป็นค่าสี บันทึกใน 
				   ช่อง Result ของ reccord ปี งบ นั้น
			*/
			$suma=0;
			$sumt=0;
			$sql="select * from goal where id_no='".$_POST['id_no']."' and year = '".$ButgYear."' limit 1" ;
			$result=mysql_query($sql);
			while ($object = mysql_fetch_array($result)) {
				$compair = trim($object['compair'] );
				$eva =$object['eva'] ;
				$goal =$object['goal'] ;
				for ($i = 1; $i <= 12; $i++) {
					$suma = $suma+$object["m".$i];
					$sumt = $sumt +$object["m".$i."b"];
				}
			}
			$totalx=$suma;   // ผลประเมิน เบื้องต้นให้เป็นจำนวน
			switch (trim($eva)) {
				case '%':		// ถ้าเป้าเป็น % ผลประเมินต้องเป็น %
					if ($suma==0) $totalx = 0.00;
					else {
						if ($sumt==0) $totalx = 100.00;
						else	$totalx = $suma *100/$sumt ; 
					}
					break;
				case '/':
					if ($suma==0) $totalx = 0.00;
					else {
						if ($sumt==0) $totalx = $suma;
						else $totalx = $suma /$sumt ; 
					}
					break;
			}
			if ($compair=='') $result='';
			else {
				$result='red';
				//พิจารณาตาม compair
				eval ('if ('.$totalx.$compair.$goal.') $result = "green"; '); 
			}
			$sql="update goal set  total=".$suma.",totalb=".$sumt.",totalx=".$totalx.",result='".$result."' 
			where id_no='".$_POST['id_no']."' and year='".$ButgYear."'";
			$result=mysql_query($sql);
		}
	}
}
/// ----  ถ้าจาก "onChange()" จะมีตัวแปร $_GET[ ] ส่งมาด้วย 
if (isset($_GET['Rdept'])) $_SESSION['deptRep'] = $_GET['Rdept'];
elseif (!isset($_SESSION['deptRep'])) $_SESSION['deptRep'] = 'All'; 
if (isset($_GET['resp'])) $_SESSION['resp'] = $_GET['resp'];
elseif (!isset($_SESSION['resp'])) $_SESSION['resp'] = 'All'; 
if (isset($_GET['work'])) $_SESSION['work'] = $_GET['work'];
elseif (!isset($_SESSION['work'])) $_SESSION['work'] = 'All'; 
if (isset($_GET['byear']))	$_SESSION['byear'] = $_GET['byear'];
if (!isset($_SESSION['byear'])){    				// -- เข้า page นี้ครั้งแรกให้ใช้ ปีปัจจุบัน
	$year =  date('Y');
	$_SESSION['byear'] =$year+543;
} else $year = $_SESSION['byear']-543;		// -- เข้า page ครั้งต่อๆไป จะมีปีเป็นตามที่ใช้อยู่
if (isset($_GET['logoff'])){
	if ($_GET['logoff']=='yes') $_SESSION["uDept"]='NA';
}
?>
<!DOCTYPE html>
<html>
<script type="text/javascript"> 
	function getValue(vname) 
	{ 
		var n = document.getElementById(vname).value
		return n;
	} 
	function changeFunc(cLOG) {
    	var URL;
		URL= "<?php echo $_SERVER['PHP_SELF'] ?>";
		URL+= "?&byear=";
		URL+= getValue('byear');
		URL+= "&Rdept=";
		URL+= getValue('dept_id');
		URL+= "&resp=";
		URL+= getValue('resp_id');
		URL+= "&work=";
		URL+= getValue('work');
		URL+= "&logoff=";
		URL+= cLOG;
		window.location= URL;
   	}
	function createDynamicURL(cIDNO,cYear,cName){
	var URL;
	URL="index_y.php?&id_no=";
	URL+= cIDNO;
	URL+= "&rYear=";
	URL+= cYear;
	URL+= "&RepName=";
	URL+= cName;
	return URL;
  }
  function RedirectURL(cIDNO,cYear,cName){
	//window.location= createDynamicURL(cIDNO,cYear,cName);
	window.open(createDynamicURL(cIDNO,cYear,cName), '_blank');
  }
</script>
<style>
.tooltip {
  position: relative;
  display: inline-block;
  border-bottom: 1px dotted black;
}

.tooltip .tooltiptext {
  visibility: hidden;
  width: 120px;
  background-color: #555;
  color: #fff;
  text-align: center;
  border-radius: 6px;
  padding: 5px 0;
  position: absolute;
  z-index: 1;
  bottom: 125%;
  left: 50%;
  margin-left: -60px;
  opacity: 0;
  transition: opacity 0.3s;
}

.tooltip .tooltiptext::after {
  content: "";
  position: absolute;
  top: 100%;
  left: 50%;
  margin-left: -5px;
  border-width: 5px;
  border-style: solid;
  border-color: #555 transparent transparent transparent;
}

.tooltip:hover .tooltiptext {
  visibility: visible;
  opacity: 1;
}
</style>
<head>
<title>รายงานตัวชี้วัด</title>
<script language="JavaScript" src="bak/date-picker.js"></script>
<meta http-equiv="Content-Type" content="text/html; charset=windows-874">
</head>
<body background="image/bg.JPG" >
<table width="1015" height="51" border="0" align="center" cellpadding="3">
  <tr>
    <td align="center"><a  href="K/index.html"><img src="image/004.png" width="69" height="65" align="left" title="คู่มือการใช้งาน"></a>
      <div align="center"> <img src="image/templatemo_logo.png" width="184" height="43" align="top" "><br>
    <span class="style3" > ตอบสนองวิสัยทัศน์ : บริการปลอดภัย ร่วมใจทุกภาคี เจ้าหน้าที่มีความสุข</span></td>
  </tr>
</table> 

<table width="1011" height="45" border="2" align="center" cellpadding="3" cellspacing="2" background="bak/image/bg.JPG">
  <tr>
    <td width="75"  align="center" ><span class="style4"><a href="index.php">เกี่ยวกับเรา</a></span></td>
	<td width="140"><p>ปี
	    <input type="text" name="byear" id="byear" size="10" value="<? echo $_SESSION['byear'];?>" onChange="changeFunc('')">
</td>
	<td width="264"><p>ฝ่ายงาน
		<select name="dept_id" id="dept_id" onChange="changeFunc('')" >
				<option value="All" <?php if($_SESSION['deptRep'] == 'All'){echo("selected");}?>>&nbsp;&nbsp;ทั้งหมด</option>
				<option value="Adm" <?php if($_SESSION['deptRep'] == 'Adm'){echo("selected");}?>>&nbsp;&nbsp;ที่รับผิดชอบ</option>
			<?php
				//mysql_select_db("KPI");
				//mysql_query("SET NAMES 'tis620'; ");
				$sql="select * from dept ";
				$result=mysql_query($sql);
				while ($rowResp = mysql_fetch_object($result)) {
    				if ($_SESSION['deptRep'] == $rowResp -> dept_id)
					echo '<option value="'.$rowResp -> dept_id .'" selected >'.$rowResp-> dept_id.
					"&nbsp;&nbsp;&nbsp;&nbsp;".$rowResp-> dept.'</option>';
					else 
					echo '<option value="'.$rowResp -> dept_id .'" >'.$rowResp-> dept_id.
					"&nbsp;&nbsp;&nbsp;&nbsp;".$rowResp-> dept.'</option>';
				}
				?>			
	</select></p></td>  
		<td width="228"><p>ภารกิจ
		<select name="resp_id" id="resp_id" onChange="changeFunc('')" >
				<option value="All" <?php if($_SESSION['resp'] == 'All'){echo("selected");}?>>&nbsp;&nbsp;ทั้งหมด</option>
	<?php
				mysql_select_db("KPI");
				mysql_query("SET NAMES 'tis620'; ");
				$sql="select * from response order by resp_id";
				$result=mysql_query($sql);
				while ($rowresp = mysql_fetch_object($result)) {
    				if ($_SESSION['resp'] == $rowresp -> colum_name)
					echo '<option value="'.$rowresp -> colum_name .'" selected >'.$rowresp-> resp_id.
					"&nbsp;&nbsp;&nbsp;&nbsp;".$rowresp-> response.'</option>';
					else 
					echo '<option value="'.$rowresp ->colum_name.'" >'.$rowresp-> resp_id.
					"&nbsp;&nbsp;&nbsp;&nbsp;".$rowresp-> response.'</option>';
				}
				?>	
    </select></p></td>
		<td width="196">ประเมินผลงาน  
			<select name="work" id="work" onChange="changeFunc('')" > 
		 		<option value="All" <?php if ($_SESSION['work'] == 'All') echo 'selected'; ?>>ทั้งหมด</option>
		 		<option value="green" <?php if ($_SESSION['work'] == 'green') echo 'selected'; ?>>ผ่าน</option>
		 		<option value="red" <?php if ($_SESSION['work'] == 'red') echo 'selected'; ?>>ไม่ผ่าน</option>
			</select>    	</td>
		<td width="42" align="center" valign="top"><?php 
			if ($_SESSION["uDept"]=='NA') 
				echo '<a href="manu_index.php"><img src="image/icon/user.gif" 
				width="31" height="30" border="0"  title="ลงชื่อเข้าใช้งาน">Login</a>';
			else 
				echo '<img src="image/log_off.png" 
				width="31" height="30" border="0"  title="ออกจากระบบ" onclick="changeFunc(\'yes\')">Logout';
		?></td>
  </tr>
</table>
<?php
if ($_SESSION['deptRep'] == 'All'|| $_SESSION["uDept"]=='NA' ) 
	$sql="select a.*,b.dept,b.indicators,b.HA,b.PA,b.name1,b.name2 from goal a left join indicators b on a.id_no=b.id_no where year = '".$year."'";
else  {
	if ($_SESSION['deptRep'] == 'Adm' ) {
		$sql="select a.*,b.dept,b.indicators,b.HA,b.PA,b.name1,b.name2 from goal a left join indicators b on a.id_no = b.id_no where ( ";
		$u_Dept =$_SESSION["uDept"];
		$i_Dept ='';
		while ($u_Dept<>''){
	 		$nAt = strpos($u_Dept,',');
			if ($nAt ) {
				$subc = substr($u_Dept,0,$nAt+1);  //01;
				if ($i_Dept =='') $i_Dept = "instr(b.dept,'".$subc."')";
				else $i_Dept .= " or instr(b.dept,'".$subc."')";
				$u_Dept = substr($u_Dept,$nAt+1);
			} else $u_Dept = '';
		}
		$sql .= $i_Dept.") and year = '".$year."'" ;
	} else 
		$sql="select a.*,b.dept,b.indicators,b.HA,b.PA,,b.name1,b.name2 from goal a left join indicators b on a.id_no = b.id_no 
		where instr(b.dept,'".$_SESSION['deptRep']."') and year = '".$year."'" ;
}	
if ($_SESSION['work'] <> 'All' ) $sql .= " and  INSTR(a.result,'".$_SESSION['work']."') > 0 "; //'red'
if ($_SESSION['resp'] <> 'All' ) { 
	$sql .= " and LENGTH ( b.".$_SESSION['resp'].") >= 3 ";   // 'HA,'  				
	$sql = $sql." order by ".$_SESSION['resp'] ;
} else  $sql = $sql." order by id_no";

//echo $sql;      // เอาไว้อ่านทบทวนค่ำสั่ง SQL
?>
<br>
<table width="1009" height="63" border="2" align="center" cellpadding="3"  bgcolor="#FFFFFF">
  <tr>
    <td width="80" align="center"><strong>รหัส &nbsp; id_no</strong></td>
    <td width="303" align="center"><strong> ตัวชี้วัด  &nbsp; Indicators</strong></td>
    <td width="84" align="center"><strong> ค่าเป้าหมาย &nbsp;  Goal</strong></td>
    <td width="51" align="center"><strong> ปี <? echo $year+537;?></strong></td>
    <td width="51" align="center"><strong> ปี <? echo $year+538;?></strong></td>
   <td width="51" align="center"><strong> ปี <? echo $year+539;?></strong></td>
    <td width="51" align="center"><strong> ปี <? echo $year+540;?></strong></td>
    <td width="51" align="center"><strong> ปี <? echo $year+541;?></strong></td>
    <td width="51" align="center"><strong> ปี <? echo $year+542;?></strong></td>
    <td width="51" align="center"><strong> ปี <? echo $year+543;?></strong></td>
	<td width="69" align="center"><strong>กลุ่มงาน</strong></td>
  </tr>
<?php
$result=mysql_query($sql);
while ($object = mysql_fetch_object($result)) { //แต่ละ ID_NO
    $deptList = $object -> dept;
    $id_no = $object -> id_no;
	$compair = $object ->compair ;
	$eva =$object ->eva ;
	$goal =$object ->goal ;
    $cgoal = trim($compair).trim($goal).' '.trim($eva);
	//$sql = "select  indicators  from indicators  where id_no = '".$id_no."' limit 1";
	//$item=mysql_query($sql);
	$indicators=$object -> indicators;
	$name1=$object -> iname1;
	$name2=$object -> iname2;
	/*while ($rec = mysql_fetch_object($item)) {
		$indicators = $rec -> indicators; //เป้าหมายปีสุดท้าย
	}
	*/
	$Ayear =array(array('green','-    '),array('green','    '),array('green','    '),array('green','    '),array('green','    ')
				,array('green','    '));
	$minYear = $year-6;
	$sql="select year,totalx,result from goal  where id_no='".$id_no."' and  year >='".$minYear."' and year < '".$year."'";
	$resYear=mysql_query($sql);
	while ($rec = mysql_fetch_object($resYear)) {
		$nowY =$rec-> year;
		$nowY = 6-($year-$nowY );
		$Ayear[$nowY][1] = $rec-> totalx;
		$Ayear[$nowY][0] = ($rec-> result);
	}
	?>
	<tr> 
		<td height="24"><div align="center">
			<?php 
				if (InDept( $deptList,  $_SESSION['uDept']))
					echo '<a href="add_report.php?&id_no='.$id_no.'&goal='.$goal.'&eva='.$eva.'&compair='.$compair.'" >'.$id_no.'</a>';
				else 	echo $id_no;
			?>
		</div></td>
		<td><div align="left">
			<?php 
				if (InDept( $deptList,  $_SESSION['uDept']))
					echo '<a href="add_report.php?&id_no='.$id_no.'&goal='.$goal.'&eva='.$eva.'&compair='.$compair.'" >'.$indicators.'</a>';
				else 	echo $indicators;
			?>
		</div></td>
		<td><div align="center"><? echo $cgoal ; ?></div></td>
		<?php 
			for ($i = 0; $i <= 6; $i++) {
			  	$show = '<td  align="right" bordercolor="#FFFFFF"><a href="#" onclick="RedirectURL(\''.$id_no.
				'\',\''.($year+(537+$i)).'\',\''.$indicators.'\');return false;" target="_parent" class="style14" 
				style="text-decoration: none;"><font color="';
				if ($i == 6) $show .=$object -> result.'">'.$object -> totalx.'</font></a></td>';
				else $show .=$Ayear[$i][0].'">'.$Ayear[$i][1].'</font></a></td>';
				echo $show;
			}
			if (substr_count($deptList,',') > 1){ ?>
				<td>	<div class="tooltip"><? echo $deptList ; ?>
			  	<span class="tooltiptext"><?php echo DeptName($deptList);?></span></div>
				</td>
			<?php
			} else echo '<td>'.DeptName($deptList).'</td>';
			?>
	</tr>
<?php
 }
function InDept($i_Dept,$u_Dept){
	if ($u_Dept=='All,') return true;
	if (trim($i_Dept)=='' || $u_Dept=='NA') return false;
	while ($i_Dept<>''){
	 	$nAt = strpos($i_Dept,',');
		if ($nAt ) {
			$subc = substr($i_Dept,0,$nAt+1);
			if (substr_count($u_Dept,$subc) > 0) return true;
			$i_Dept = substr($i_Dept,$nAt+1);
		} else return false;
	}
	return false;
} 
function DeptName($cList){
	$cName='';
	while ($cList<>''){
	 	$nAt = strpos($cList,',');
		if ($nAt ) {
				$subc = substr($cList,0,$nAt);
				$cList = substr($cList,$nAt+1);
		} else {
				$subc = 'NA';
				$cList = '';
		}
		if ($subc <> 'NA'){
			if ($cName=='') $cName =$_SESSION['DeptName'][($subc+0)]; 
			else 	$cName .= ','.$_SESSION['DeptName'][($subc+0)]; 
		}
	}
	return $cName; 
}
?>
</table>
</body>
</html>

Youez - 2016 - github.com/yon3zu
LinuXploit