HEX
Server: Apache/2.4.52 (Ubuntu)
System: Linux spn-python 5.15.0-89-generic #99-Ubuntu SMP Mon Oct 30 20:42:41 UTC 2023 x86_64
User: arjun (1000)
PHP: 8.1.2-1ubuntu2.20
Disabled: NONE
Upload Files
File: /var/www/html/shootinschool/wp-content/plugins/shootin-school-plugin/player_forum.php
<?php
function render_siab_player_forum()
{
    ob_start();
    global $wpdb;
    // echo  $_GET['id'];
    $comments = $wpdb->get_results("SELECT * FROM " . DB_FORUM . " WHERE playerID = " . $_GET['id'] . " AND forum_type = 1", ARRAY_A);
    // echo "<pre>";
    // print_r($comments);
    $user_id = get_current_user_id();
?>

    <style>
        .comment-list {
            list-style: none;
            padding: 0;
        }

        .comment {
            margin-bottom: 30px;
        }

        .comment-body {
            border: 1px solid #ddd;
            padding: 20px;
            border-radius: 5px;
            background-color: #f9f9f9;
        }

        .comment-author {
            margin-bottom: 10px;
        }

        .comment-author .comment-author {
            display: block;
            font-size: 20px;
            font-weight: bold;
            color: #333;
        }

        .comment-meta {
            color: #888;
            font-size: 14px;
        }

        p {
            font-size: 16px;
            line-height: 1.6;
        }
    </style>
    <div class="wrap">
        <div class="css_loader">Loading&#8230;</div>
        <div class="alert alert-info" role="alert">
            <?php $playerDetails = $wpdb->get_row("SELECT * FROM " . DB_CHILD_DETAILS . " WHERE id = " . $_GET['id'], ARRAY_A); ?>
            <h3> Player Forum </h3>
            <small><b>Discussion about Player : <?php echo $playerDetails['first_name'] . " " . $playerDetails['last_name']; ?></b></small>
        </div>
        <div class="clearfix">

            <div id="comments" class="comments-area">
                <?php if (!empty($comments)) {

                ?>
                    <h4 class="comments-title">Discussions</h4>
                    <?php foreach ($comments as $comment) {
                        $commentedUser = get_userdata($comment['created_by']);

                        $commentedDate = date('M-d-Y h:i:A', strtotime($comment['created_at']));

                    ?>




                        <ul class="comment-list stm-list-duty">

                            <li class="comment byuser comment-author-sam-2 bypostauthor even thread-even depth-1">
                                <div id="div-comment-12869" class="comment-body">

                                    <div class="clearfix">


                                        <div class="comment-author vcard">
                                            <span class="comment-author heading-font"><?php echo $commentedUser->data->display_name; ?></span>
                                            <span class="comment-meta commentmetadata">
                                                <span class="date heading-font"><?php echo $commentedDate; ?></span>
                                            </span>
                                            <p><?php echo $comment['comment']; ?></p>
                                            <?php if ($comment['userType'] == 3 && $comment['staus'] == 0) { ?>
                                                <div class="row-actions"><span class="Mark"><a class="btn btn-success btn-xs" onclick="openApproveCommentModal(<?php echo $comment['id']; ?>)">Approve Comment</a> | </span>
                                                    <span class="Cancel"><a class="btn btn-danger btn-xs"  onclick="openRejectCommentModal(<?php echo $comment['id']; ?>) ">Reject Comment</a></span>
                                                </div>
                                            <?php } ?>

                                        </div>
                                    </div>


                                </div>
                            </li><!-- #comment-## -->
                        </ul>
                <?php }
                } ?>
                <div class="clearfix"></div>




                <div id="respond" class="comment-respond">
                    <h3 id="reply-title" class="comment-reply-title">Add Your Update</h3>
                    <form id="chatForm">


                        <div class="form-group comment-form-comment">
                            <input type="hidden" value="<?php echo $_GET['id']; ?>" name="playerID" name="playerID">
                            <input type="hidden" value="<?php echo $user_id; ?>" name="customerID" name="customerID">
                            <input type="hidden" value="1" name="forum_type" name="forum_type">
                            <input type="hidden" value="2" name="userType" name="userType">
                            <textarea id="comment" class="form-control" name="comment" rows="9" aria-required="true" required></textarea>
                        </div>
                        <p class="form-submit">
                            <input type="button" onclick="AddComemnt_admin()" id="btn_submit" value="Send Message">

                        </p>
                    </form>
                </div><!-- #respond -->

            </div>
        </div>


        <div class="modal" id="RejectCommentModal" role="dialog">

            <div class="css_loader">Loading&#8230;</div>

            <div class="modal-dialog">
                <!-- Modal content-->
                <div class="modal-content">
                    <div class="modal-header">
                        <button type="button" class="close" data-dismiss="modal">&times;</button>
                        <h4 class="modal-title">Reject Comment</h4>
                    </div>
                    <div class="modal-body">

                        <p>Are you sure you want to Reject this comment ?</p>
                    </div>
                    <div class="modal-footer">
                        <button type="button" id="cancelbtn" data-comment-id="" class="btn btn-primary" onclick="RejectCommentfun(this)">Yes</button>
                        <button type="button" class="btn btn-default" data-dismiss="modal">No</button>
                    </div>
                </div>
            </div>
        </div>
        <div class="modal" id="ApproveCommentModal" role="dialog">

            <div class="css_loader">Loading&#8230;</div>

            <div class="modal-dialog">
                <!-- Modal content-->
                <div class="modal-content">
                    <div class="modal-header">
                        <button type="button" class="close" data-dismiss="modal">&times;</button>
                        <h4 class="modal-title">Approve Comment</h4>
                    </div>
                    <div class="modal-body">

                        <p>Are you sure you want to Approve this comment ?</p>
                    </div>
                    <div class="modal-footer">
                        <button type="button" id="approveBtn" data-comment-id="" class="btn btn-primary" onclick="approveCommentfun(this)">Yes</button>
                        <button type="button" class="btn btn-default" data-dismiss="modal">No</button>
                    </div>
                </div>
            </div>
        </div>
        <script type="text/javascript">
            function AddComemnt_admin() {

                if (jQuery("#chatForm").parsley().validate()) {
                    jQuery(".css_loader").show();
                    jQuery('#btn_submit').prop('disabled', true);
                    var formData = new FormData();
                    console.log(formData);

                    formData.append("data", jQuery('#chatForm').serialize());
                    formData.append("action", 'add_comment_admin');
                    jQuery.ajax({
                        url: ajaxurl,
                        method: "post",
                        dataType: "json",
                        processData: false,
                        contentType: false,
                        data: formData,
                        success: function(response) {
                            jQuery(".css_loader").hide();
                            jQuery('#btn_submit').prop('disabled', false);
                            if (response.status) {
                                toastr.success(response.message);
                                setTimeout(function() {
                                    location.reload();
                                }, 1000);

                            } else {
                                // jQuery('#addchild_error_modalBody').html('<p><strong>'+response.message+'</strong></p>');
                                // jQuery('#addchild_error_modal').modal('show');
                            }
                        },
                        error: function(data) {
                            toastr.error(data.message);
                        }
                    });
                }
            }


            function openRejectCommentModal(commentID) {
                jQuery("#cancelbtn").attr("data-commentID", commentID);
                jQuery("#RejectCommentModal").appendTo("body").modal("show");

            }

            function RejectCommentfun(commentID) {


                jQuery(".css_loader").show();

                var commentID = commentID;

                jQuery.ajax({
                    url: ajaxurl,
                    method: "post",
                    dataType: "json",
                    data: {
                        action: "reject_comment",
                        "commentID": jQuery(commentID).attr("data-commentID")
                    },
                    success: function(response) {
                        if (response.status) {


                            jQuery("#RejectCommentModal").hide();
                            jQuery(".css_loader").hide();
                            location.reload();
                        }

                    },
                    error: function(data) {
                        console.log("inside error");
                    }
                });

            }
            function openApproveCommentModal(commentID) {
                jQuery("#approveBtn").attr("data-commentID", commentID);
                jQuery("#ApproveCommentModal").appendTo("body").modal("show");

            }

            function approveCommentfun(commentID) {


                jQuery(".css_loader").show();

                var commentID = commentID;

                jQuery.ajax({
                    url: ajaxurl,
                    method: "post",
                    dataType: "json",
                    data: {
                        action: "approve_Comment",
                        "commentID": jQuery(commentID).attr("data-commentID")
                    },
                    success: function(response) {
                        if (response.status) {


                            jQuery("#ApproveCommentModal").hide();
                            jQuery(".css_loader").hide();
                            location.reload();
                        }

                    },
                    error: function(data) {
                        console.log("inside error");
                    }
                });

            }
        </script>
    <?php

}


add_action('wp_ajax_nopriv_add_comment_admin', 'add_comment_admin');
add_action('wp_ajax_add_comment_admin', 'add_comment_admin');
function add_comment_admin()
{

    filter_var_array($_POST, FILTER_SANITIZE_STRING);

    global $wpdb;

    $user_id = get_current_user_id();

    parse_str($_POST['data'], $form_data); //This will convert the string to array

    if (!empty($form_data)) {
        $args = array(
            "forum_type" => $form_data['forum_type'],
            "customerID" => $form_data['customerID'],
            "playerID"   => $form_data['playerID'],
            "comment"    => $form_data['comment'],
            "userType"   => $form_data['userType'],
            "staus"     => 1,
            "created_at" => date('Y-m-d H:i:s'),
            "created_by" => $user_id,
            "updated_at" => date('Y-m-d H:i:s'),
            "updated_by" => $user_id,
        );

        $sql = $wpdb->insert(DB_FORUM, $args);

        //-----------------Send mail to customer----------------------
        
        $player = $wpdb->get_row("SELECT * FROM " . DB_CHILD_DETAILS . " WHERE id = " . $form_data['playerID']);
        $player_name = $player->first_name . ' ' . $player->last_name; // Store player name
        
        $user_data = $wpdb->get_row("SELECT * FROM " . DB_USERS . " WHERE ID=" . $player->user_id); // Corrected query
        $email = $user_data->user_email;
        $name = $user_data->display_name;
        
        $email_instructor = $wpdb->get_row("SELECT * FROM " . DB_EMAILS . " WHERE id = 55", ARRAY_A);
		$msg = $email_instructor['body'];
        $msg_template = $email_instructor['body'];

		// Replace placeholders
		preg_match_all('/{(.*?)}/', $msg, $matches);
		if (in_array("customer_name", $matches[1])) {
			$msg = str_replace('{customer_name}', $name, $msg);
		}
        if (in_array("player_name", $matches[1])) {
            $msg = str_replace('{player_name}', $player_name, $msg);
        }

		//$admin_email = get_option('admin_email');
		$headers[] = 'Content-Type: text/html; charset=UTF-8';
		$headers[] = 'From: ShootInSchool <noreply@shootinschool.com>';

		// Send the email
		try {
			wp_mail($email, $email_instructor['subject'], $msg, $headers);
		} catch (Exception $th) {
			// Handle error
		}
        $appoinment = $wpdb->get_results("SELECT distinct instructor_id FROM " . DB_APPOINTMENTS . " WHERE child_id = " . $form_data['playerID'] ." AND instructor_id is not NULL", ARRAY_A);
		foreach ($appoinment as $comment) {
			$commentedUser = get_userdata($comment['instructor_id']);
			$email=$commentedUser->data->user_email;
			$name=$commentedUser->data->display_name;
		
            // $email_admin = $wpdb->get_row("SELECT * FROM " . DB_EMAILS . " WHERE id = 54", ARRAY_A);
            // $msg_admin = $email_admin['body'];

            $email_instructor = $wpdb->get_row("SELECT * FROM " . DB_EMAILS . " WHERE id = 55", ARRAY_A);
            $msg = $email_instructor['body'];


            preg_match_all('/{(.*?)}/', $msg, $matches);

            if (in_array("customer_name", $matches[1])) {
                $msg = str_replace('{customer_name}', $name, $msg);
            }
            if (in_array("player_name", $matches[1])) {
                $msg = str_replace('{player_name}', $player_name, $msg);
            }
            // if (in_array("instructor_email", $matches[1])) {
            // 	$msg = str_replace('{instructor_email}', $email, $msg);
            // }
            // if (in_array("instructor_password", $matches[1])) {
            // 	$msg = str_replace('{instructor_password}', $password, $msg);
            // }
            $admin_email = get_option('admin_email');
            $headers[] = 'Content-Type: text/html; charset=UTF-8';
            $headers[] = 'From: ShootInSchool <noreply@shootinschool.com>';
            //if ($email_instructor['notify_via_email'] == 1) {
                try {
                    //code...
                    wp_mail($email, $email_instructor['subject'], $msg, $headers);

                } catch (Exception $th) {
                    //throw $th;
                }
            //}
	    }

        $users_data = $wpdb->get_results("SELECT * FROM " . DB_USERS . " WHERE ID IN (1, 3366)  AND ID NOT IN ($user_id)");

        // Loop through each user and send the email
        foreach ($users_data as $user_data) {
            $email = $user_data->user_email;
            $name = $user_data->display_name;
            $msg = $msg_template;
            // Replace placeholders in the message
            preg_match_all('/{(.*?)}/', $msg, $matches);
            if (in_array("customer_name", $matches[1])) {
                $msg = str_replace('{customer_name}', $name, $msg);
            }
            if (in_array("player_name", $matches[1])) {
                $msg = str_replace('{player_name}', $player_name, $msg);
            }

            // Prepare email headers
            $headers[] = 'Content-Type: text/html; charset=UTF-8';
            $headers[] = 'From: ShootInSchool <noreply@shootinschool.com>';

            // Send the email
            try {
                wp_mail($email, $email_instructor['subject'], $msg, $headers);
            } catch (Exception $th) {
                // Handle error for the current email
            }
        }
        //-----------------------------------------------------
        echo json_encode(['status' => true, 'message' => "Comments added successfully"]);
        die();
    }
}


add_action('wp_ajax_nopriv_approve_Comment', 'approve_Comment');
add_action('wp_ajax_approve_Comment', 'approve_Comment');
function approve_Comment()
{

    filter_var_array($_POST, FILTER_SANITIZE_STRING);

    global $wpdb;

    $user_id = get_current_user_id();



    if (!empty($_POST['commentID'])) {
       // echo $_POST['commentID'];
       
        // $wpdb->update(DB_FORUM,['status' => 1], ['id' => $_POST['commentID']]);
        $wpdb->update(DB_FORUM, array('staus' => 1), array('id' => $_POST['commentID']));

        //----------------------Send mail to customer-----------------------------------
        $commentID = $wpdb->get_row("SELECT * FROM " . DB_FORUM . " WHERE id = " . $_POST['commentID']);
        $player = $wpdb->get_row("SELECT * FROM " . DB_CHILD_DETAILS . " WHERE id = " . $commentID->playerID);
        $player_name = $player->first_name . ' ' . $player->last_name; // Store player name

        // $appoinment = $wpdb->get_results("SELECT distinct instructor_id FROM " . DB_APPOINTMENTS . " WHERE child_id = " . $commentID->playerID ." AND instructor_id is not NULL", ARRAY_A);
		// foreach ($appoinment as $comment) {
		// 	$commentedUser = get_userdata($comment['instructor_id']);
		// 	$email=$commentedUser->data->user_email;
		// 	$name=$commentedUser->data->display_name;
		
        //     // $email_admin = $wpdb->get_row("SELECT * FROM " . DB_EMAILS . " WHERE id = 54", ARRAY_A);
        //     // $msg_admin = $email_admin['body'];

        //     $email_instructor = $wpdb->get_row("SELECT * FROM " . DB_EMAILS . " WHERE id = 55", ARRAY_A);
        //     $msg = $email_instructor['body'];


        //     preg_match_all('/{(.*?)}/', $msg, $matches);

        //     if (in_array("customer_name", $matches[1])) {
        //         $msg = str_replace('{customer_name}', $name, $msg);
        //     }
        //     if (in_array("player_name", $matches[1])) {
        //         $msg = str_replace('{player_name}', $player_name, $msg);
        //     }
        //     // if (in_array("instructor_email", $matches[1])) {
        //     // 	$msg = str_replace('{instructor_email}', $email, $msg);
        //     // }
        //     // if (in_array("instructor_password", $matches[1])) {
        //     // 	$msg = str_replace('{instructor_password}', $password, $msg);
        //     // }
        //     $admin_email = get_option('admin_email');
        //     $headers[] = 'Content-Type: text/html; charset=UTF-8';
        //     $headers[] = 'From: ShootInSchool <noreply@shootinschool.com>';
        //     //if ($email_instructor['notify_via_email'] == 1) {
        //         try {
        //             //code...
        //             wp_mail($email, $email_instructor['subject'], $msg, $headers);

        //         } catch (Exception $th) {
        //             //throw $th;
        //         }
        //     //}
	    // }
        
        $user_data = $wpdb->get_row("SELECT * FROM " . DB_USERS . " WHERE ID=" . $player->user_id); // Corrected query
        $email1 = $user_data->user_email;
        $name = $user_data->display_name;
        
        $email_instructor = $wpdb->get_row("SELECT * FROM " . DB_EMAILS . " WHERE id = 55", ARRAY_A);
        $msg = $email_instructor['body'];

        // Replace placeholders
        preg_match_all('/{(.*?)}/', $msg, $matches);
        if (in_array("customer_name", $matches[1])) {
            $msg = str_replace('{customer_name}', $name, $msg);
        }
        if (in_array("player_name", $matches[1])) {
            $msg = str_replace('{player_name}', $player_name, $msg);
        }

        //$admin_email = get_option('admin_email');
        $headers[] = 'Content-Type: text/html; charset=UTF-8';
        $headers[] = 'From: ShootInSchool <noreply@shootinschool.com>';

        // Send the email
        try {
            wp_mail($email1, $email_instructor['subject'], $msg, $headers);
        } catch (Exception $th) {
            // Handle error for the first email
        }

        // $users_data = $wpdb->get_results("
		// 	SELECT u.* 
		// 	FROM " . DB_USERS . " u
		// 	INNER JOIN " . DB_USERMETA . " um ON u.ID = um.user_id
		// 	WHERE um.meta_key = 'wp_5d4e9f5293ff5_capabilities'
		// 	AND um.meta_value LIKE '%siab_sub_admin%' and AND um.meta_value LIKE '%administrator%' AND u.ID != $user_id
		// ");

        // $users_data = $wpdb->get_results("SELECT * FROM " . DB_USERS . " WHERE ID IN (1, 3366)  AND ID NOT IN ($user_id)");
        // foreach ($users_data as $user_data) {
        //     $email = $user_data->user_email;
        //     $name = $user_data->display_name;

        //     // Replace placeholders in the message
        //     preg_match_all('/{(.*?)}/', $msg, $matches);
        //     if (in_array("customer_name", $matches[1])) {
        //         $msg = str_replace('{customer_name}', $name, $msg);
        //     }
        //     if (in_array("player_name", $matches[1])) {
        //         $msg = str_replace('{player_name}', $player_name, $msg);
        //     }

        //     // Prepare email headers
        //     $headers[] = 'Content-Type: text/html; charset=UTF-8';
        //     $headers[] = 'From: ShootInSchool <noreply@shootinschool.com>';

        //     // Send the email
        //     try {
        //         wp_mail($email, $email_instructor['subject'], $msg, $headers);
        //     } catch (Exception $th) {
        //         // Handle error for the current email
        //     }
        // }
        //------------------------------------------------------------------------------

        echo json_encode(['status' => true, 'message' => "Comments Approved successfully"]);
        die();
    }
}


add_action('wp_ajax_nopriv_reject_comment', 'reject_comment');
add_action('wp_ajax_reject_comment', 'reject_comment');
function reject_comment()
{

    filter_var_array($_POST, FILTER_SANITIZE_STRING);

    global $wpdb;

    $user_id = get_current_user_id();



    if (!empty($_POST['commentID'])) {
       // echo $_POST['commentID'];
       
        // $wpdb->update(DB_FORUM,['status' => 1], ['id' => $_POST['commentID']]);
        // $wpdb->update(DB_FORUM, array('staus' => 1), array('id' => $_POST['commentID']));
        $wpdb->delete(DB_FORUM, array('id' => $_POST['commentID']));
        echo json_encode(['status' => true, 'message' => "Comments Rejected successfully"]);
        die();
    }
}