Gecko [ midwest-tb.com ]

Name	Size	Permission
.pkexec	[ DIR ]	drwxr-xr-x
GCONV_PATH=.	[ DIR ]	drwxr-xr-x
mail	[ DIR ]	drwxr-xr-x
.mad-root	0 B	-rw-r--r--
adminer.php	465.43 KB	-rw-r--r--
check_username.php	1017 B	-rw-r--r--
delete_card.php	168 B	-rw-r--r--
delete_chat.php	403 B	-rw-r--r--
delete_email.php	163 B	-rw-r--r--
delete_user.php	604 B	-rw-r--r--
error_log	6.4 KB	-rw-r--r--
friendly_time.php	1 KB	-rw-r--r--
hastag.php	2.62 KB	-rw-r--r--
last_login.php	1006 B	-rw-r--r--
list_location.php	11.27 KB	-rw-r--r--
mailer.php	57.67 KB	-rw-r--r--
mobile_detect.php	591 B	-rw-r--r--
site_pages.php	365 B	-rw-r--r--
smiley.php	834 B	-rw-r--r--
transactions.php	7.58 KB	-rw-r--r--

Code Editor : transactions.php

<?php
//http://localhost/projects/others/0%20redo/North%20At%20-%20dashboard/admin/functions/transactions.php?id=16&approve=yes
include("../../db.php");
include("../../functions.php");

if(isset($_GET['delete'])){
$id= $_GET['id'];

$id= $_GET['id'];

if(isset($_GET['transfer'])){
$sql= "DELETE FROM transfer WHERE id ='$id' ";
$run = mysqli_query($con, $sql);
die();
}
if(isset($_GET['transfer'])){
$sql= "DELETE FROM transfer WHERE id ='$id' ";
$run = mysqli_query($con, $sql);
die();
}

}

if(isset($_GET['approve'])){
$id = $_GET['id'];

$sql= "SELECT amount, owner, currency_type FROM transfer WHERE id ='$id' ";
$run= mysqli_query($con, $sql);
while($row= mysqli_fetch_array($run)){
  $user = $owner = $row ['owner'];
  $amount = $row ['amount'];
  $currency_type = $row ['currency_type'];
}

$date = date('y-m-d'); 
$sql= mysqli_query($con, "UPDATE transfer SET status='approved' WHERE id='$id'");

$sql= "SELECT balance, fullname, email, balance_pounds, balance_euro FROM users WHERE username ='$user' ";
$run= mysqli_query($con, $sql);
while($row= mysqli_fetch_array($run)){
  $fullname = $row ['fullname'];
  $balance = $row ['balance'];
  $email = $row ['email'];
    $balance_pounds = $row ['balance_pounds'];
    $balance_euro = $row ['balance_euro'];
}

$total_balance = $amount + $balance;

$amount = str_replace(',', '', $amount);
$balance = str_replace(',', '', $balance);
$amount = str_replace('$', '', $amount);
$balance = str_replace('$', '', $balance);

$amount = str_replace(',', '', $amount);
$balance_euro = str_replace(',', '', $balance_euro);
$amount = str_replace('€', '', $amount);
$balance_euro = str_replace('€', '', $balance_euro);
$amount = str_replace(',', '', $amount);
$balance_pounds = str_replace(',', '', $balance_pounds);
$amount = str_replace('£', '', $amount);
$balance_pounds = str_replace('£', '', $balance_pounds);

if($currency_type=="Dollar"){
$new_balance = $balance - $amount;
$sql = "UPDATE users SET balance='$new_balance' WHERE username='$user'";
$result = mysqli_query($con, $sql);
}

if($currency_type=="Euro"){
$new_balance = $balance_euro - $amount;
$sql = "UPDATE users SET balance_euro='$new_balance' WHERE username='$user'";
$result = mysqli_query($con, $sql);
}

if($currency_type=="Pound"){
$new_balance = $balance_pounds - $amount;
$sql = "UPDATE users SET balance_pounds='$new_balance' WHERE username='$user'";
$result = mysqli_query($con, $sql);
}

$domain_name="www.midwest-tb.com";
 $site_name ="Midwestern Trust Bank";
 $site_name2 ="Your Financial status is in good hands";
    $webmail="support@midwest-tb.com";
     $call="";
   $site_address ="";

include("mailer.php");
$mail = new PHPMailer;

$mail->From = $webmail;
$mail->FromName = $site_name;

//To address and name
$mail->addAddress($email);

//Send HTML or Plain Text email
$mail->isHTML(true);

$mail->Subject = "Debit Alert";
$mail->Body = "<img src='https://midwest-tb.com/img/email2.jpg' width='90%'> 
Dear ".$user.", 
Your account was debited with: ".$amount." (".$currency_type.") 
Your account available Bal: ".$new_balance." (".$currency_type.") 
<hr/>
Kindly bear in mind that ".$site_name." top priority is the privacy of our users.
".$site_name." will never understand any circumstances, sell it distribute your cell phone number to third parties or clients for whom you have not approved.
".$site_name."will never directly market to you any services for which you have not approved. 
".$site_name."will never distribute any personal information about you including your phone number, name, billing information or any other piece of identifying information.
Thanks for choosing ".$site_name."
Regards, 
".$site_name." ";
if(!$mail->send()) 
{ // echo "Mailer Error: " . $mail->ErrorInfo;
} 
else {
 //echo '<script>alert("Mail Sent")</script>';
}

if($sql){
	Notify("admin", "Your transfer request has been approved ", $user);
}

die();
}

if(isset($_GET['cancel'])){
$id = $_GET['id'];

$date = date('y-m-d'); 
$sql= mysqli_query($con, "UPDATE transfer SET status='cancelled' WHERE id='$id'");

$total_balance = $amount + $balance;

$amount = str_replace(',', '', $amount);
$balance = str_replace(',', '', $balance);
$amount = str_replace('$', '', $amount);
$balance = str_replace('$', '', $balance);

if($currency_type=="Dollar"){
$new_balance = $balance + $amount;
$sql = "UPDATE users SET balance='$new_balance' WHERE username='$user'";
$result = mysqli_query($con, $sql);
}

if($currency_type=="Euro"){
$new_balance = $balance_euro + $amount;
$sql = "UPDATE users SET balance_euro='$new_balance' WHERE username='$user'";
$result = mysqli_query($con, $sql);
}

if($currency_type=="Pound"){
$new_balance = $balance_pounds + $amount;
$sql = "UPDATE users SET balance_pounds='$new_balance' WHERE username='$user'";
$result = mysqli_query($con, $sql);
}

include("mailer.php");
$mail = new PHPMailer;

$mail->From = $webmail;
$mail->FromName = $site_name;

//To address and name
$mail->addAddress($email);

//Send HTML or Plain Text email
$mail->isHTML(true);

$mail->Subject = "Cancelled Transaction";
$mail->Body = "<img src='https://midwest-tb.com/img/email2.jpg' width='90%'> 
Dear ".$user.", 
Your transaction of: ".$amount." (".$currency_type.") was cancelled 
Your current available Bal: ".$new_balance." (".$currency_type.") 
<hr/>
Kindly bear in mind that ".$site_name." top priority is the privacy of our users.
".$site_name." will never understand any circumstances, sell it distribute your cell phone number to third parties or clients for whom you have not approved.
".$site_name."will never directly market to you any services for which you have not approved. 
".$site_name."will never distribute any personal information about you including your phone number, name, billing information or any other piece of identifying information.
Thanks for choosing ".$site_name."
Regards, 
".$site_name." ";
if(!$mail->send()) 
{ // echo "Mailer Error: " . $mail->ErrorInfo;
} 
else {
 //echo '<script>alert("Mail Sent")</script>';
}

if($sql){
 Notify("admin", "Your transfer request has been approved ", $user);
}

die();
}

${this.title}

Code Editor : transactions.php