403Webshell
Server IP : 167.235.67.158  /  Your IP : 216.73.216.179
Web Server : Apache
System : Linux ubuntu-8gb-nbg1-1 6.8.0-111-generic #111-Ubuntu SMP PREEMPT_DYNAMIC Sat Apr 11 23:16:02 UTC 2026 x86_64
User : upstairsbar.co.uk ( 982)
PHP Version : 8.3.6
Disable Function : NONE
MySQL : OFF  |  cURL : ON  |  WGET : ON  |  Perl : ON  |  Python : OFF  |  Sudo : ON  |  Pkexec : OFF
Directory :  /var/www/esl.the-word.com/wp-content/themes/esl/members-area/functions/

Upload File :
current_dir [ Writeable ] document_root [ Writeable ]

 

Command :


[ Back ]     

Current File : /var/www/esl.the-word.com/wp-content/themes/esl/members-area/functions/endpoints.php
<?php
/**
 * Register custom endpoints for member sections
 */
function register_member_endpoints() {
    $members_base = 'members-area';
    
    // Member area endpoints
    add_rewrite_rule(
        "^{$members_base}/member-documents/(\d+)/?$",
        "index.php?pagename={$members_base}&section=member-documents&id=\$matches[1]",
        'top'
    );
    
    add_rewrite_rule(
        "^{$members_base}/assignments/?$",
        "index.php?pagename={$members_base}&section=assignments",
        'top'
    );
    
    add_rewrite_rule(
        "^{$members_base}/statements/?$",
        "index.php?pagename={$members_base}&section=statements",
        'top'
    );
    
    // Admin endpoints with subpages
    add_rewrite_rule(
        "^{$members_base}/users-admin/edit/(\d+)/?$",
        "index.php?pagename={$members_base}&section=users-admin&action=edit&user_id=\$matches[1]",
        'top'
    );
    
    add_rewrite_rule(
        "^{$members_base}/users-admin/add/?$",
        "index.php?pagename={$members_base}&section=users-admin&action=add",
        'top'
    );
    
    add_rewrite_rule(
        "^{$members_base}/users-admin/?$",
        "index.php?pagename={$members_base}&section=users-admin",
        'top'
    );
    
    add_rewrite_rule(
        "^{$members_base}/schools-admin/(\w+)/?$",
        "index.php?pagename={$members_base}&section=schools-admin&action=\$matches[1]",
        'top'
    );
    
    // Documents admin endpoints
    add_rewrite_rule(
        "^{$members_base}/documents-admin/(\d+)/?$",
        "index.php?pagename={$members_base}&section=documents-admin&category=\$matches[1]",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/documents-admin/?$",
        "index.php?pagename={$members_base}&section=documents-admin",
        'top'
    );

    // Add rules for user child pages
    add_rewrite_rule(
        "^{$members_base}/users-admin/edit/(\d+)/calendar/?$",
        "index.php?pagename={$members_base}&section=users-admin&action=edit&user_id=\$matches[1]&subpage=calendar",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/users-admin/edit/(\d+)/documents/?$",
        "index.php?pagename={$members_base}&section=users-admin&action=edit&user_id=\$matches[1]&subpage=documents",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/users-admin/edit/(\d+)/assignments/?$",
        "index.php?pagename={$members_base}&section=users-admin&action=edit&user_id=\$matches[1]&subpage=assignments",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/users-admin/edit/(\d+)/holidaypay/?$",
        "index.php?pagename={$members_base}&section=users-admin&action=edit&user_id=\$matches[1]&subpage=holidaypay",
        'top'
    );

    // Schools admin endpoints
    add_rewrite_rule(
        "^{$members_base}/schools-admin/edit/(\d+)/?$",
        "index.php?pagename={$members_base}&section=schools-admin&action=edit&school_id=\$matches[1]",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/schools-admin/edit/(\d+)/contacts/?$",
        "index.php?pagename={$members_base}&section=schools-admin&action=edit&school_id=\$matches[1]&subpage=contacts",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/schools-admin/edit/(\d+)/calendar/?$",
        "index.php?pagename={$members_base}&section=schools-admin&action=edit&school_id=\$matches[1]&subpage=calendar",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/schools-admin/add/?$",
        "index.php?pagename={$members_base}&section=schools-admin&action=add",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/schools-admin/?$",
        "index.php?pagename={$members_base}&section=schools-admin",
        'top'
    );

    // Holiday Pay admin endpoints
    add_rewrite_rule(
        "^{$members_base}/holidaypay-admin/?$",
        "index.php?pagename={$members_base}&section=holidaypay-admin",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/holidaypay-admin/(\d+)/?$",
        "index.php?pagename={$members_base}&section=holidaypay-admin&user_id=\$matches[1]",
        'top'
    );

    // Assignment admin endpoints
    add_rewrite_rule(
        "^{$members_base}/assignments-admin/?$",
        "index.php?pagename={$members_base}&section=assignments-admin",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/assignments-admin/(\d+)/?$",
        "index.php?pagename={$members_base}&section=assignments-admin&user_id=\$matches[1]",
        'top'
    );

    // Assignment details endpoint (for AJAX)
    add_rewrite_rule(
        "^{$members_base}/assignment-details/(\d+)/?$",
        "index.php?pagename={$members_base}&section=assignment-details&assignment_id=\$matches[1]",
        'top'
    );

    // Schedule admin endpoints
    add_rewrite_rule(
        "^{$members_base}/schedules-admin/manage-schedules/?$",
        "index.php?pagename={$members_base}&section=schedules-admin&action=manage-schedules",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/schedules-admin/?$",
        "index.php?pagename={$members_base}&section=schedules-admin",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/schedules-admin/(\d+)/?$",
        "index.php?pagename={$members_base}&section=schedules-admin&user_id=\$matches[1]",
        'top'
    );

    // Member Zone Manager endpoints
    add_rewrite_rule(
        "^{$members_base}/member-zone-manager/?$",
        "index.php?pagename={$members_base}&section=member-zone-manager",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/member-zone-manager/add-menu/?$",
        "index.php?pagename={$members_base}&section=member-zone-manager&action=add-menu",
        'top'
    );

    // Member holidaypay endpoint
    add_rewrite_rule(
        "^{$members_base}/member-holidaypay/?$",
        "index.php?pagename={$members_base}&section=member-holidaypay",
        'top'
    );

    // Member account endpoint
    add_rewrite_rule(
        "^{$members_base}/member-account/?$",
        "index.php?pagename={$members_base}&section=member-account",
        'top'
    );

    // Member documents endpoints
    add_rewrite_rule(
        "^{$members_base}/member-documents/(\d+)/?$",
        "index.php?pagename={$members_base}&section=member-documents&category=\$matches[1]",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/member-documents/?$",
        "index.php?pagename={$members_base}&section=member-documents",
        'top'
    );

    // Member calendar endpoint
    add_rewrite_rule(
        "^{$members_base}/member-calendar/?$",
        "index.php?pagename={$members_base}&section=member-calendar",
        'top'
    );

    // Member assignments endpoint
    add_rewrite_rule(
        "^{$members_base}/member-assignments/?$",
        "index.php?pagename={$members_base}&section=member-assignments",
        'top'
    );

    // Invoicing admin endpoints
    add_rewrite_rule(
        "^{$members_base}/invoicing-admin/?$",
        "index.php?pagename={$members_base}&section=invoicing-admin",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/invoicing-admin/upload-invoices/?$",
        "index.php?pagename={$members_base}&section=invoicing-admin&action=upload-invoices",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/invoicing-admin/manage-invoices/?$",
        "index.php?pagename={$members_base}&section=invoicing-admin&action=manage-invoices",
        'top'
    );

    // School Account endpoints
    add_rewrite_rule(
        "^{$members_base}/school-account/?$",
        "index.php?pagename={$members_base}&section=school-account",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/school-account/details/?$",
        "index.php?pagename={$members_base}&section=school-account&subpage=details",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/school-account/school-details/?$",
        "index.php?pagename={$members_base}&section=school-account&subpage=school-details",
        'top'
    );

    // School Calendar endpoint
    add_rewrite_rule(
        "^{$members_base}/school-calendar/?$",
        "index.php?pagename={$members_base}&section=school-calendar",
        'top'
    );

    // School Invoices endpoint
    add_rewrite_rule(
        "^{$members_base}/school-invoices/?$",
        "index.php?pagename={$members_base}&section=school-invoices",
        'top'
    );

    // Invoice view/download endpoint
    add_rewrite_rule(
        "^{$members_base}/invoice/invoice-(\d+)/?$",
        "index.php?pagename={$members_base}&section=invoice&invoice_id=\$matches[1]",
        'top'
    );

    // Schedule email preview endpoints  
    add_rewrite_rule(
        "^{$members_base}/schedule-email-preview/?$",
        "index.php?pagename={$members_base}&section=schedule-email-preview",
        'top'
    );

    add_rewrite_rule(
        "^{$members_base}/invoice-email-preview/?$",
        "index.php?pagename={$members_base}&section=invoice-email-preview",
        'top'
    );

    // Register query vars
    add_filter('query_vars', function($vars) {
        $vars[] = 'section';
        $vars[] = 'action';
        $vars[] = 'user_id';
        $vars[] = 'school_id';
        $vars[] = 'id';
        $vars[] = 'subpage';
        $vars[] = 'category';
        $vars[] = 'invoice_id';
        return $vars;
    });

    // Handle endpoint requests
    add_action('template_redirect', function() {
        $section = get_query_var('section');
        if (!$section) return;

        if (!is_user_logged_in()) {
            ma_redirect();
            exit;
        }

        $user_role = get_user_role();
        
        // Check permissions based on section
        switch($section) {
            case 'users-admin':
                if ($user_role !== 'member-admin') {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                
                $action = get_query_var('action');
                if ($action === 'add') {
                    $template = locate_template("members-area/templates/users-admin/add/index.php");
                } else if ($action === 'edit') {
                    $subpage = get_query_var('subpage');
                    if ($subpage) {
                        $template = locate_template("members-area/templates/users-admin/edit/{$subpage}.php");
                    } else {
                        $template = locate_template("members-area/templates/users-admin/edit/index.php");
                    }
                } else {
                    $template = locate_template("members-area/templates/users-admin/index.php");
                }
                break;
                
            case 'schools-admin':
                if ($user_role !== 'member-admin') {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                
                $action = get_query_var('action');
                if ($action === 'add') {
                    $template = locate_template("members-area/templates/schools-admin/add/index.php");
                } else if ($action === 'edit') {
                    $subpage = get_query_var('subpage');
                    if ($subpage) {
                        $template = locate_template("members-area/templates/schools-admin/edit/{$subpage}.php");
                    } else {
                        $template = locate_template("members-area/templates/schools-admin/edit/index.php");
                    }
                } else {
                    $template = locate_template("members-area/templates/schools-admin/index.php");
                }
                break;
                
            case 'documents-admin':
                if ($user_role !== 'member-admin') {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                $template = locate_template("members-area/templates/{$section}/index.php");
                break;
            
            case 'member-documents':
                if (!in_array($user_role, ['member', 'member-admin'])) {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                $template = locate_template("members-area/templates/{$section}/index.php");
                break;
                
            case 'assignments':
            case 'statements':
                if (!in_array($user_role, ['member', 'member-admin'])) {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                $template = locate_template("members-area/templates/{$section}/index.php");
                break;
                
            case 'holidaypay-admin':
                $template = locate_template('members-area/templates/holidaypay-admin/index.php');
                break;
                
                case 'schedules-admin':
                    if ($user_role !== 'member-admin') {
                        wp_redirect(home_url() . '/members-area/');
                        exit;
                    }
                    
                    $action = get_query_var('action');
                    switch($action) {
                        case 'manage-schedules':
                            $template = locate_template("members-area/templates/schedules-admin/manage-schedules/index.php");
                            break;
                        default:
                            $template = locate_template("members-area/templates/schedules-admin/index.php");
                    }
                    break;
                
            case 'member-zone-manager':
                if ($user_role !== 'member-admin') {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                
                $action = get_query_var('action');
                if ($action === 'add-menu') {
                    $template = locate_template("members-area/templates/member-zone-manager/add-menu/index.php");
                } else {
                    $template = locate_template("members-area/templates/member-zone-manager/index.php");
                }
                break;
                
            case 'member-holidaypay':
                if (!in_array($user_role, ['member', 'member-admin'])) {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                $template = locate_template("members-area/templates/{$section}/index.php");
                break;
                
            case 'member-account':
                if (!in_array($user_role, ['member', 'member-admin'])) {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                $template = locate_template("members-area/templates/member-account/index.php");
                break;
                
            case 'member-calendar':
                if (!in_array($user_role, ['member', 'member-admin'])) {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                $template = locate_template("members-area/templates/{$section}/index.php");
                break;
                
            case 'member-assignments':
                if (!in_array($user_role, ['member', 'member-admin'])) {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                $template = locate_template("members-area/templates/{$section}/index.php");
                break;
                
            case 'invoicing-admin':
                if ($user_role !== 'member-admin') {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                
                $action = get_query_var('action');
                switch($action) {
                    case 'upload-invoices':
                        $template = locate_template("members-area/templates/invoicing-admin/upload-invoices/index.php");
                        break;
                    case 'manage-invoices':
                        $template = locate_template("members-area/templates/invoicing-admin/manage-invoices/index.php");
                        break;
                    default:
                        $template = locate_template("members-area/templates/invoicing-admin/index.php");
                }
                break;
                
            case 'school-account':
                if ($user_role !== 'member-school') {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                
                $subpage = get_query_var('subpage');
                if (!$subpage) {
                    wp_redirect(home_url('members-area/school-account/details'));
                    exit;
                }
                $template = locate_template("members-area/templates/school-account/{$subpage}.php");
                break;
                
            case 'school-calendar':
                if ($user_role !== 'member-school') {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                $template = locate_template("members-area/templates/school-calendar/index.php");
                break;
                
            case 'invoice':
                $invoice_id = get_query_var('invoice_id');
                if (!$invoice_id) {
                    wp_redirect(home_url() . '/members-area/');
                    exit;
                }
                
                // Check if user has permission to view this invoice
                if ($user_role === 'member-admin') {
                    // Admin can view all invoices
                    generate_invoice($invoice_id, isset($_GET['downloadPDF']) ? 'download' : 'inline');
                    exit;
                } else if ($user_role === 'member-school') {
                    // School can only view their own invoices
                    global $wpdb;
                    $school_id = get_user_meta(get_current_user_id(), 'school_id', true);
                    
                    // Check if invoice belongs to this school
                    $invoice_belongs_to_school = $wpdb->get_var($wpdb->prepare(
                        "SELECT COUNT(*) FROM Invoices i
                         JOIN Schedules sch ON i.ScheduleID = sch.ScheduleID
                         WHERE i.InvoiceID = %d AND sch.SchoolID = %d",
                        $invoice_id, $school_id
                    ));
                    
                    if ($invoice_belongs_to_school) {
                        generate_invoice($invoice_id, isset($_GET['downloadPDF']) ? 'download' : 'inline');
                        exit;
                    }
                }
                
                // If we get here, user doesn't have permission
                wp_redirect(home_url() . '/members-area/');
                exit;
                break;

            case 'schedule-email-preview':
                // Get parameters from URL query string
                $schedule_id = isset($_GET['schedule_id']) ? intval($_GET['schedule_id']) : 0;
                $email_type = isset($_GET['email_type']) ? sanitize_text_field($_GET['email_type']) : '';
                
                if (!$schedule_id || !in_array($email_type, ['school', 'member'])) {
                    wp_die('Invalid schedule ID (' . $schedule_id . ') or email type (' . $email_type . ').');
                }
                
                // Only admins can view schedule email previews
                if ($user_role !== 'member-admin') {
                    wp_die('You do not have permission to view email previews. Current role: ' . $user_role);
                }
                
                // Create a REST request to get the preview content
                $request = new WP_REST_Request('GET', '/members-area/v1/schedule-email-preview/' . $schedule_id);
                $request->set_param('type', $email_type);
                $response = get_schedule_email_preview($request);
                
                if (is_wp_error($response)) {
                    $error_message = $response->get_error_message();
                    wp_die('Schedule not found or error generating preview: ' . $error_message);
                }
                
                $data = $response->get_data();
                
                // Output HTML preview
                ?>
                <!DOCTYPE html>
                <html>
                <head>
                    <title><?php echo esc_html($data['subject']); ?> - Schedule Email Preview</title>
                    <meta charset="utf-8">
                    <style>
                        body { 
                            font-family: Arial, sans-serif; 
                            margin: 20px; 
                            background-color: #f9f9f9; 
                        }
                        .preview-container { 
                            background: white; 
                            padding: 20px; 
                            border: 1px solid #ddd; 
                            max-width: 800px; 
                            margin: 0 auto; 
                        }
                        .preview-header { 
                            background: #6C207E; 
                            color: white; 
                            padding: 15px; 
                            margin: -20px -20px 20px -20px; 
                        }
                        .preview-header h1 { margin: 0; }
                        .email-meta { 
                            background: #f5f5f5; 
                            padding: 10px; 
                            margin-bottom: 20px; 
                            border-left: 4px solid #6C207E; 
                        }
                    </style>
                </head>
                <body>
                    <div class="preview-container">
                        <div class="preview-header">
                            <h1><?php echo ucfirst($email_type); ?> Email Preview</h1>
                        </div>
                        <div class="email-meta">
                            <strong>Subject:</strong> <?php echo esc_html($data['subject']); ?><br>
                        </div>
                        <div class="email-content">
                            <?php echo $data['html']; ?>
                        </div>
                    </div>
                </body>
                </html>
                <?php
                exit;
                break;

            case 'invoice-email-preview':
                $preview_type = isset($_GET['preview_type']) ? sanitize_text_field($_GET['preview_type']) : '';
                $id = isset($_GET['invoice_id']) ? intval($_GET['invoice_id']) : intval($_GET['school_id'] ?? 0);
                $paid_date = isset($_GET['paid_date']) ? sanitize_text_field($_GET['paid_date']) : '';

                if (!$id || !in_array($preview_type, ['paid', 'debtor'], true)) {
                    wp_die('Invalid preview parameters.');
                }

                if ($user_role !== 'member-admin') {
                    wp_die('You do not have permission to view email previews. Current role: ' . $user_role);
                }

                $request = new WP_REST_Request('GET', '/members-area/v1/invoice-email-preview/' . $id);
                $request->set_param('preview_type', $preview_type);
                if ($paid_date) {
                    $request->set_param('paid_date', $paid_date);
                }

                $response = get_invoice_email_preview($request);

                if (is_wp_error($response)) {
                    wp_die('Error generating preview: ' . $response->get_error_message());
                }

                $data = $response->get_data();
                ?>
                <!DOCTYPE html>
                <html>
                <head>
                    <title><?php echo esc_html($data['subject']); ?> - Invoice Email Preview</title>
                    <meta charset="utf-8">
                    <style>
                        body {
                            font-family: Arial, sans-serif;
                            margin: 20px;
                            background-color: #f9f9f9;
                        }
                        .preview-container {
                            background: white;
                            padding: 20px;
                            border: 1px solid #ddd;
                            max-width: 800px;
                            margin: 0 auto;
                        }
                        .preview-header {
                            background: #6C207E;
                            color: white;
                            padding: 15px;
                            margin: -20px -20px 20px -20px;
                        }
                        .preview-header h1 { margin: 0; }
                        .email-meta {
                            background: #f5f5f5;
                            padding: 10px;
                            margin-bottom: 20px;
                            border-left: 4px solid #6C207E;
                        }
                    </style>
                </head>
                <body>
                    <div class="preview-container">
                        <div class="preview-header">
                            <h1><?php echo $preview_type === 'paid' ? 'Paid Confirmation' : 'Old Debtor'; ?> Email Preview</h1>
                        </div>
                        <div class="email-meta">
                            <strong>Subject:</strong> <?php echo esc_html($data['subject']); ?><br>
                        </div>
                        <div class="email-content">
                            <?php echo $data['html']; ?>
                        </div>
                    </div>
                </body>
                </html>
                <?php
                exit;
                break;
                
            default:
                $template = locate_template("members-area/templates/{$section}/index.php");
        }

        if ($template) {
            include $template;
            exit;
        }
    });
}
add_action('init', 'register_member_endpoints');

/**
 * Flush rewrite rules on plugin activation
 */
function flush_member_endpoints() {
    register_member_endpoints();
    flush_rewrite_rules();
}
register_activation_hook(__FILE__, 'flush_member_endpoints'); 

Youez - 2016 - github.com/yon3zu
LinuXploit