HEX
Server: Apache/2.4.52 (Ubuntu)
System: Linux spn-python 5.15.0-89-generic #99-Ubuntu SMP Mon Oct 30 20:42:41 UTC 2023 x86_64
User: arjun (1000)
PHP: 8.1.2-1ubuntu2.20
Disabled: NONE
Upload Files
File: /var/www/html/shootinschool/wp-content/plugins/shootin-school-plugin/instructors/playerforum.php
<?php
 function ins_render_siab_player_forum()
 {
    ob_start();
    global $wpdb;
    // echo  $_GET['id'];
    $comments = $wpdb->get_results("SELECT * FROM " . DB_FORUM . " WHERE playerID = " . $_GET['id'] . " AND forum_type = 1", ARRAY_A);
    // echo "<pre>";
    // print_r($comments);
    $user_id = get_current_user_id();
?>

         <!-- new class  -->
         <div id="wpbody" role="main" class="wpbody-nw">
            <div id="wpbody-content">
               <div class="wrap alert-nw">
                  <div class="css_loader">Loading…</div>
                  <div class="alert alert-info" role="alert">
                  <?php   $playerDetails = $wpdb->get_row("SELECT * FROM " . DB_CHILD_DETAILS . " WHERE id = " . $_GET['id'], ARRAY_A);?>
                     <h3> Player Forum </h3>
                     <small>Discussion About Player : <?php echo $playerDetails['first_name']." ".$playerDetails['last_name']; ?></small>
                  </div>
               </div>
               <?php if (!empty($comments)) {

?>
               <div class="forms-box-main">
                  <div class="title-md">Discussions</div>
                  <?php foreach ($comments as $comment) {
                    $commentedUser = get_userdata($comment['created_by']);

                    $commentedDate = date('M-d-Y h:i:A', strtotime($comment['created_at']));

                ?>
                  <div class="item-start">
                     <strong><?php echo $commentedUser->data->display_name; ?></strong>
                     <small><?php echo $commentedDate; ?></small>
                     <div class="para">
                     <?php echo $comment['comment']; ?>
                     </div>
                  </div>
                  <?php }
            }else{
               ?> <p class="notFound"> No Records Found<p>
            <?php } ?>
                 
               </div>
               
              
               
             
            <div id="respond" class="comment-respond">
                <h3 id="reply-title" class="comment-reply-title">Add Your Update</h3>
                <form id="chatForm">


                    <div class="form-group comment-form-comment">
                        <input type="hidden" value="<?php echo $_GET['id']; ?>" name="playerID" name="playerID">
                        <input type="hidden" value="<?php echo $user_id; ?>" name="customerID" name="customerID">
                        <input type="hidden" value="1" name="forum_type" name="forum_type">
                        <?php 
                        $issupervisor = get_user_meta($user_id, 'issupervisor', true);

                        // Check if the meta exists
                        if ($issupervisor == 1) {
                            // Meta exists

                            $userTypevalue = 4;
                        } else {
                            // Meta doesn't exist
                            $userTypevalue = 3;
                        }
                        ?>
                        <input type="hidden" value="<?php echo $userTypevalue; ?>" name="userType" name="userType">
                        <textarea id="comment" class="form-control" name="comment" rows="9" aria-required="true" required></textarea>
                    </div>
                    <p class="form-submit">
                        <input type="button" onclick="AddComemnt_admin()"  id="btn_submit" value="Send Message">

                    </p>
                </form>
            </div><!-- #respond -->
              
              
            </div>
            <!-- wpbody-content -->

            <div class="clear"></div>
         </div>
         <!-- wpbody -->
         <div class="clear"></div>
     
    
    <script type="text/javascript">
        function AddComemnt_admin() {

            if (jQuery("#chatForm").parsley().validate()) {
                jQuery(".css_loader").show();
                jQuery('#btn_submit').prop('disabled', true);
                var formData = new FormData();
                console.log(formData);
                formData.append("data", jQuery('#chatForm').serialize());
                formData.append("action", 'add_comment_player');
                jQuery.ajax({
                    url: ajaxurl,
                    method: "post",
                    dataType: "json",
                    processData: false,
                    contentType: false,
                    data: formData,
                    success: function(response) {
                        jQuery(".css_loader").hide();
                        jQuery('#btn_submit').prop('disabled', false);
                        if (response.status) {
                            toastr.success(response.message);
                            setTimeout(function() {
                                location.reload();
                            }, 1000);

                        } else {
                            // jQuery('#addchild_error_modalBody').html('<p><strong>'+response.message+'</strong></p>');
                            // jQuery('#addchild_error_modal').modal('show');
                        }
                    },
                    error: function(data) {
                        toastr.error(data.message);
                    }
                });
            }
        }
    </script>
<?php
 }

function ins_render_siab_player_forum_instructor()
{
    ob_start();
    global $wpdb;
    // echo  $_GET['id'];
    $comments = $wpdb->get_results("SELECT * FROM " . DB_FORUM . " WHERE playerID = " . $_GET['id'] . " AND forum_type = 2", ARRAY_A);
    // echo "<pre>";
    // print_r($comments);
    $user_id = get_current_user_id();
?>

         <!-- new class  -->
         <div id="wpbody" role="main" class="wpbody-nw">
            <div id="wpbody-content">
               <div class="wrap alert-nw">
                  <div class="css_loader">Loading…</div>
                  <div class="alert alert-info" role="alert">
                  <?php   $trainerDetails = $wpdb->get_row("SELECT * FROM " . DB_USERS . " WHERE ID = " . $_GET['id'], ARRAY_A);?>
                     <h3> Trainer Forum </h3>
                     <small>Discussion About Trainer : <?php echo $trainerDetails['display_name']; ?></small>
                  </div>
               </div>
               <?php if (!empty($comments)) {

?>
               <div class="forms-box-main">
                  <div class="title-md">Discussions</div>
                  <?php foreach ($comments as $comment) {
                    $commentedUser = get_userdata($comment['created_by']);

                    $commentedDate = date('M-d-Y h:i:A', strtotime($comment['created_at']));

                ?>
                  <div class="item-start">
                     <strong><?php echo $commentedUser->data->display_name; ?></strong>
                     <small><?php echo $commentedDate; ?></small>
                     <div class="para">
                     <?php echo $comment['comment']; ?>
                     </div>
                  </div>
                  <?php }
            }else{
               ?> <p class="notFound"> No Records Found<p>
            <?php } ?>
                 
               </div>
               
              
               
             
            <div id="respond" class="comment-respond">
                <h3 id="reply-title" class="comment-reply-title">Add Your Update</h3>
                <form id="chatForm">


                    <div class="form-group comment-form-comment">
                        <input type="hidden" value="<?php echo $_GET['id']; ?>" name="playerID" name="playerID">
                        <input type="hidden" value="<?php echo $user_id; ?>" name="customerID" name="customerID">
                        <input type="hidden" value="2" name="forum_type" name="forum_type">
                        <?php 
                        $issupervisor = get_user_meta($user_id, 'issupervisor', true);

                        // Check if the meta exists
                        if ($issupervisor == 1) {
                            // Meta exists

                            $userTypevalue = 4;
                        } else {
                            // Meta doesn't exist
                            $userTypevalue = 3;
                        }
                        ?>
                        <input type="hidden" value="<?php echo $userTypevalue; ?>" name="userType" name="userType">
                        <textarea id="comment" class="form-control" name="comment" rows="9" aria-required="true" required></textarea>
                    </div>
                    <p class="form-submit">
                        <input type="button" onclick="AddComemnt_admin()"  id="btn_submit" value="Send Message">

                    </p>
                </form>
            </div><!-- #respond -->
              
              
            </div>
            <!-- wpbody-content -->

            <div class="clear"></div>
         </div>
         <!-- wpbody -->
         <div class="clear"></div>
     
    
    <script type="text/javascript">
        function AddComemnt_admin() {

            if (jQuery("#chatForm").parsley().validate()) {
                jQuery(".css_loader").show();
                jQuery('#btn_submit').prop('disabled', true);
                var formData = new FormData();
                console.log(formData);
                formData.append("data", jQuery('#chatForm').serialize());
                formData.append("action", 'add_comment_instructor');
                jQuery.ajax({
                    url: ajaxurl,
                    method: "post",
                    dataType: "json",
                    processData: false,
                    contentType: false,
                    data: formData,
                    success: function(response) {
                        jQuery(".css_loader").hide();
                        jQuery('#btn_submit').prop('disabled', false);
                        if (response.status) {
                            toastr.success(response.message);
                            setTimeout(function() {
                                location.reload();
                            }, 1000);

                        } else {
                            // jQuery('#addchild_error_modalBody').html('<p><strong>'+response.message+'</strong></p>');
                            // jQuery('#addchild_error_modal').modal('show');
                        }
                    },
                    error: function(data) {
                        toastr.error(data.message);
                    }
                });
            }
        }
    </script>
<?php

}


add_action('wp_ajax_nopriv_add_comment_instructor', 'add_comment_instructor');
add_action('wp_ajax_add_comment_instructor', 'add_comment_instructor');
function add_comment_instructor()
{

    filter_var_array($_POST, FILTER_SANITIZE_STRING);

    global $wpdb;

    $user_id = get_current_user_id();

    parse_str($_POST['data'], $form_data); //This will convert the string to array
   $issupervisor = get_user_meta($user_id, 'issupervisor', true);

    // Check if the meta exists
    if ($issupervisor == 1) {
        // Meta exists

        $staus = 1;
    } else {
        // Meta doesn't exist
        $staus = 0;
    }
    if (!empty($form_data)) {
        $args = array(
            "forum_type" => $form_data['forum_type'],
            "customerID" => $form_data['customerID'],
            "playerID"   => $form_data['playerID'],
            "comment"    => $form_data['comment'],
            "userType"   => $form_data['userType'],
            "staus"     => $staus,
            "created_at" => date('Y-m-d H:i:s'),
            "created_by" => $user_id,
            "updated_at" => date('Y-m-d H:i:s'),
            "updated_by" => $user_id,
        );

        $sql = $wpdb->insert(DB_FORUM, $args);
        //-----------------Send mail to customer----------------------
        
        
        $player = $wpdb->get_row("SELECT * FROM " . DB_USERS . " WHERE id = " . $form_data['playerID']);
        $player_name = $player->display_name; // Store player name

        $email_instructor = $wpdb->get_row("SELECT * FROM " . DB_EMAILS . " WHERE id = 53", ARRAY_A);
		$msg_template = $email_instructor['body'];
        

        $args = array(
            'role'     => 'siab_supervisor',
            'orderby'  => 'created_at',
            'order'    => 'DESC',
            'fields' => array( 'ID' ),
            'meta_query' => array(
                array(
                    'key'     => 'issupervisor',
                    'value'   => 1,
                    'compare' => '=' // You can change this if necessary (e.g., '!=' for not equal)
                )
            )
        );
        $userIds = get_users( $args );
        
        $temp = array();
        foreach ($userIds as $single) {
            $temp[] = $single->ID;
        }
        $users_table = $wpdb->prefix . "users";
        if(count($temp) > 0){
            $data = $wpdb->get_results("SELECT * FROM " .$users_table." WHERE ID IN (" .implode(',', $temp). ")");
        } else{
            $data = array();
        }
        // echo json_encode(['status' => true, 'message' =>  $data]);
        // Loop through each user and send the email
        foreach ($data as $user_data) {
            $email = $user_data->user_email;
            $name = $user_data->display_name;
            $msg = $msg_template;
            // Replace placeholders in the message
            preg_match_all('/{(.*?)}/', $msg, $matches);
            if (in_array("customer_name", $matches[1])) {
                $msg = str_replace('{customer_name}', $name, $msg);
            }
            if (in_array("player_name", $matches[1])) {
                $msg = str_replace('{player_name}', $player_name, $msg);
            }

            // Prepare email headers
            $headers[] = 'Content-Type: text/html; charset=UTF-8';
            $headers[] = 'From: ShootInSchool <noreply@shootinschool.com>';

            // Send the email
            try {
                wp_mail($email, $email_instructor['subject'], $msg, $headers);
            } catch (Exception $th) {
                // Handle error for the current email
            }
        }
        
       
        $email_instructor = $wpdb->get_row("SELECT * FROM " . DB_EMAILS . " WHERE id = 53", ARRAY_A);
		$msg = $email_instructor['body'];
        $users_data = $wpdb->get_results("SELECT * FROM " . DB_USERS . " WHERE ID IN (1, 3366)");


        // Loop through each user and send the email
        foreach ($users_data as $user_data) {
            $email = $user_data->user_email;
            $name = $user_data->display_name;
            $msg = $msg_template;
            // Replace placeholders in the message
            preg_match_all('/{(.*?)}/', $msg, $matches);
            if (in_array("customer_name", $matches[1])) {
                $msg = str_replace('{customer_name}', $name, $msg);
            }
            if (in_array("player_name", $matches[1])) {
                $msg = str_replace('{player_name}', $player_name, $msg);
            }

            // Prepare email headers
            $headers[] = 'Content-Type: text/html; charset=UTF-8';
            $headers[] = 'From: ShootInSchool <noreply@shootinschool.com>';

            // Send the email
            try {
                wp_mail($email, $email_instructor['subject'], $msg, $headers);
            } catch (Exception $th) {
                // Handle error for the current email
            }
        }

    
        //-----------------------------------------------------
        echo json_encode(['status' => true, 'message' => "Comments added successfully"]);
        die();
    }
}



add_action('wp_ajax_nopriv_add_comment_player', 'add_comment_player');
add_action('wp_ajax_add_comment_player', 'add_comment_player');
function add_comment_player()
{

    filter_var_array($_POST, FILTER_SANITIZE_STRING);

    global $wpdb;

    $user_id = get_current_user_id();

    parse_str($_POST['data'], $form_data); //This will convert the string to array
   $issupervisor = get_user_meta($user_id, 'issupervisor', true);

    // Check if the meta exists
    if ($issupervisor == 1) {
        // Meta exists

        $staus = 1;
    } else {
        // Meta doesn't exist
        $staus = 0;
    }
    if (!empty($form_data)) {
        $args = array(
            "forum_type" => $form_data['forum_type'],
            "customerID" => $form_data['customerID'],
            "playerID"   => $form_data['playerID'],
            "comment"    => $form_data['comment'],
            "userType"   => $form_data['userType'],
            "staus"     => $staus,
            "created_at" => date('Y-m-d H:i:s'),
            "created_by" => $user_id,
            "updated_at" => date('Y-m-d H:i:s'),
            "updated_by" => $user_id,
        );

        $sql = $wpdb->insert(DB_FORUM, $args);
        //-----------------Send mail to customer----------------------
        
        
            $player = $wpdb->get_row("SELECT * FROM " . DB_CHILD_DETAILS . " WHERE id = " . $form_data['playerID']);
            $player_name = $player->first_name . ' ' . $player->last_name; // Store player name
        if ($issupervisor == 1) 
        {    
            $user_data = $wpdb->get_row("SELECT * FROM " . DB_USERS . " WHERE ID=" . $player->user_id); // Corrected query
            $email1 = $user_data->user_email;
            $name = $user_data->display_name;
            
            $email_instructor = $wpdb->get_row("SELECT * FROM " . DB_EMAILS . " WHERE id = 55", ARRAY_A);
            $msg = $email_instructor['body'];

            // Replace placeholders
            preg_match_all('/{(.*?)}/', $msg, $matches);
            if (in_array("customer_name", $matches[1])) {
                $msg = str_replace('{customer_name}', $name, $msg);
            }
            if (in_array("player_name", $matches[1])) {
                $msg = str_replace('{player_name}', $player_name, $msg);
            }

            //$admin_email = get_option('admin_email');
            $headers[] = 'Content-Type: text/html; charset=UTF-8';
            $headers[] = 'From: ShootInSchool <noreply@shootinschool.com>';

            // Send the email
            try {
                wp_mail($email1, $email_instructor['subject'], $msg, $headers);
            } catch (Exception $th) {
                // Handle error for the first email
            }
            //--------------------------------------------------------------------------------------------------------------------
        }
            $appoinment = $wpdb->get_results("SELECT distinct instructor_id as created_by FROM " . DB_APPOINTMENTS . " WHERE child_id = " . $form_data['playerID'] ." AND instructor_id is not NULL and instructor_id != ".$user_id, ARRAY_A);
		    foreach ($appoinment as $comment) 
            {
                $commentedUser = get_userdata($comment['created_by']);
                $email=$commentedUser->data->user_email;
                $name=$commentedUser->data->display_name;
                $email_instructor = $wpdb->get_row("SELECT * FROM " . DB_EMAILS . " WHERE id = 55", ARRAY_A);
                $msg = $email_instructor['body'];

                preg_match_all('/{(.*?)}/', $msg, $matches);

                if (in_array("customer_name", $matches[1])) {
                    $msg = str_replace('{customer_name}', $name, $msg);
                }
                if (in_array("player_name", $matches[1])) {
                    $msg = str_replace('{player_name}', $player_name, $msg);
                }
                $admin_email = get_option('admin_email');
                $headers[] = 'Content-Type: text/html; charset=UTF-8';
                $headers[] = 'From: ShootInSchool <noreply@shootinschool.com>';
                //if ($email_instructor['notify_via_email'] == 1) {
                    try {
                        //code...
                        wp_mail($email, $email_instructor['subject'], $msg, $headers);

                    } catch (Exception $th) {
                        //throw $th;
                    }
                //}
            }
       
        $email_instructor = $wpdb->get_row("SELECT * FROM " . DB_EMAILS . " WHERE id = 55", ARRAY_A);
		$msg_template = $email_instructor['body'];

		// Replace placeholders
        // Fetch both users with ID 1 and ID 3366
        // $users_data = $wpdb->get_results("
		// 	SELECT u.* 
		// 	FROM " . DB_USERS . " u
		// 	INNER JOIN " . DB_USERMETA . " um ON u.ID = um.user_id
		// 	WHERE um.meta_key = 'wp_5d4e9f5293ff5_capabilities'
		// 	AND um.meta_value LIKE '%siab_sub_admin%' and AND um.meta_value LIKE '%administrator%'
		// ");
        $users_data = $wpdb->get_results("SELECT * FROM " . DB_USERS . " WHERE ID IN (1, 3366)");


        // Loop through each user and send the email
        foreach ($users_data as $user_data) {
            $email = $user_data->user_email;
            $name = $user_data->display_name;
            $msg = $msg_template;
            // Replace placeholders in the message
            preg_match_all('/{(.*?)}/', $msg, $matches);
            if (in_array("customer_name", $matches[1])) {
                $msg = str_replace('{customer_name}', $name, $msg);
            }
            if (in_array("player_name", $matches[1])) {
                $msg = str_replace('{player_name}', $player_name, $msg);
            }

            // Prepare email headers
            $headers[] = 'Content-Type: text/html; charset=UTF-8';
            $headers[] = 'From: ShootInSchool <noreply@shootinschool.com>';

            // Send the email
            try {
                wp_mail($email, $email_instructor['subject'], $msg, $headers);
            } catch (Exception $th) {
                // Handle error for the current email
            }
        }

    
        //-----------------------------------------------------
        echo json_encode(['status' => true, 'message' => "Comments added successfully"]);
        die();
    }
}