Fallagassrini Bypass Shell

<?php
	/*	Class Function for Admin	*/
	class Staff extends MysqlFns
	{
	static $Gname,$Uid,$Cid; 
	/* class constructor */
	function Staff(){
	  $this->MysqlFns();
	  $this->uploadPath='';
	}
	
	function chkSLogin($objArray){
	  global $_SESSION;
	  if(isset($_SESSION['User_ID']) && isset($_SESSION['UserName']))
	    return true;
	  else
	    Redirect("index.php");
	}
	
	function changePassword(){
	  global $objSmarty;
	  if($this->chkPassword($_POST['txtCurPwd'], $_SESSION['StaffId'])){
	    $UpQuery = "UPDATE `micromak_user_master` SET `password` = '".addslashes($_POST['txtpword'])."' WHERE `user_group` = ". $_SESSION['StaffId'];
		$UpResult	= $this->ExecuteQuery($UpQuery, "update");
		$objSmarty->assign("SuccessMessage", "Password has been updated successfully");
	  }
	  else{ 
	    $objSmarty->assign("ErrorMessage", "Invalid Current Password");
		return false;
	  }
	}

	function chkPassword($CurPwd, $StaffId){
	  $SelQuery	= "SELECT `user_group ` FROM `micromak_user_master` WHERE `password` = '".$CurPwd."' AND `user_group ` = '".$StaffId."' LIMIT 0,1";
	  $SelResult	= $this->ExecuteQuery($SelQuery, "selectassoc");
	  if(!empty($SelResult) && !empty($SelResult[0]['category'])){	
	    return true;
	  }
	  else
	    return false;
	}
	
	function chkStaffLogin($objArray){
	//print_r($_POST);
	  global $objSmarty;
	  if ($_POST["txtuname"] &&  $_POST["txtpword"])
	  {
	  $Login	= $_POST["txtuname"];	
	  $Password	= $_POST["txtpword"];

		$SelQuery	= "SELECT * FROM micromak_user_master WHERE `user_id` = '".($_POST["txtuname"])."' AND `password` = '" .($_POST["txtpword"]). "' LIMIT 0,1";
	  	$SelResult	= $this->ExecuteQuery($SelQuery, "select");
	 	if(!empty($SelResult)) {

		$_SESSION['User_ID']	= $StaffLogin	= $SelResult[0]['user_id'];
		$_SESSION['USER_GROUP']	= $StaffGroup	= $SelResult[0]['user_group'];
		$_SESSION['UserName']	= $StaffLogin	= $SelResult[0]['username'];
		$_SESSION['Mobile']	= $StaffLogin	= $SelResult[0]['mobile'];
		$_SESSION['Email']	= $StaffLogin	= $SelResult[0]['email_id'];
		$_SESSION['Phone']	= $StaffLogin	= $SelResult[0]['phone'];
	//	$_SESSION['Type']	= $StaffLogin	= $SelResult[0]['type'];
		$_SESSION['Department']	= $StaffLogin	= $SelResult[0]['department'];
		$Gname	= $_SESSION['USER_GROUP'];
		//print_r($_SESSION['USER_GROUP']);
		//session_register("User_ID");
		return true;
	  		}
	  	else {
	    $objSmarty->assign('ErrorMessage', "Invalid User Name or Password !");
	//	$objSmarty->assign('ErrorMessage', 'Email should not be blank');
		return false;
	  }
	  }
	}
	
	
	
	
	function UpdateSiteConfig(){
	  if(!get_magic_quotes_gpc()){
	    $_POST['SiteTitle']=addslashes($_POST['SiteTitle']);
		$_POST['TADescription']=addslashes($_POST['TADescription']);
		$_POST['TAKeywords']=addslashes($_POST['TAKeywords']);
	  }
	  $Upd1="UPDATE `tbl_admin_configuration` SET `const_value`='".$_POST['SiteTitle']."' WHERE `ident`='1' AND `const_name`='SITE_NAME'";
	  $this->ExecuteQuery($Upd1,'update');
	  $Upd2="UPDATE `tbl_admin_configuration` SET `const_value`='".$_POST['TADescription']."' WHERE `ident`='2' AND `const_name`='META_DESC'";
	  $this->ExecuteQuery($Upd2,'update');
	  $Upd3="UPDATE `tbl_admin_configuration` SET `const_value`='".$_POST['TAKeywords']."' WHERE `ident`='3' AND `const_name`='META_KEY'";
	  $this->ExecuteQuery($Upd3,'update');
	  
	}
	
	function GetSiteConfig(){
	  global $objSmarty;
	  $SelQry="SELECT * FROM `tbl_admin_configuration` ";
	  
	  $Result=$this->ExecuteQuery($SelQry,'selectassoc');
	  
	  if(count($Result)>0)
	    foreach($Result as $Value)
		  $Result1[$Value['const_name']]=$Value['const_value'];

	  $objSmarty->assign('Result1',$Result1);	  
	}
}
?>