shell bypass 403

GrazzMean Shell

: /var/www/vhosts/m-auto.co/httpdocs/admin/ [ drwxr-xr-x ]
Uname: Linux serv.m-auto.co 3.10.0-1160.42.2.el7.x86_64 #1 SMP Tue Sep 7 14:49:57 UTC 2021 x86_64
Software: nginx/1.28.2
PHP version: 8.1.34 [ PHP INFO ] PHP os: Linux
Server Ip: 41.215.243.19
Your Ip: 216.73.216.151
User: m-auto.co_vxasg6smqe (10000) | Group: psacln (1003)
Safe Mode: OFF
Disable Function:
opcache_get_status,mail

name : video_form.php
<?php 
include 'includes/header.php';
if (isset($_GET['id'])) {
    require_permission('videos_edit');
} else {
    require_permission('videos_add');
}
include '../includes/db.php'; 

$video = [
    'id' => '',
    'title' => '',
    'description' => '',
    'video_url' => '',
    'video_file' => '',
    'thumbnail' => '',
    'video_type' => 'url',
    'active' => 1
];
$page_title = "إضافة فيديو جديد";

if (isset($_GET['id'])) {
    $video_id = $_GET['id'];
    $stmt = $conn->prepare("SELECT * FROM videos WHERE id = ?");
    $stmt->bind_param("i", $video_id);
    $stmt->execute();
    $result = $stmt->get_result();
    if ($result->num_rows === 1) {
        $video = $result->fetch_assoc();
        $page_title = "تعديل الفيديو";
    } else {
        header("Location: videos.php?error=Video not found");
        exit();
    }
    $stmt->close();
}
?>

<h3 class="fs-4 mb-3"><?= $page_title ?></h3>

<div class="row">
    <div class="col">
        <div class="glass-card p-4">
            <form action="video_process.php" method="POST" enctype="multipart/form-data">
                <input type="hidden" name="id" value="<?= htmlspecialchars($video['id']) ?>">

                <div class="mb-3">
                    <label for="title" class="form-label">عنوان الفيديو <span class="text-danger">*</span></label>
                    <input type="text" class="form-control" id="title" name="title" value="<?= htmlspecialchars($video['title']) ?>" required>
                </div>

                <div class="mb-3">
                    <label for="description" class="form-label">وصف الفيديو</label>
                    <textarea class="form-control" id="description" name="description" rows="3"><?= htmlspecialchars($video['description']) ?></textarea>
                </div>

                <div class="mb-3">
                    <label class="form-label">نوع الفيديو <span class="text-danger">*</span></label>
                    <div class="form-check">
                        <input class="form-check-input" type="radio" name="video_type" id="video_type_url" value="url" <?= $video['video_type'] == 'url' ? 'checked' : '' ?>>
                        <label class="form-check-label" for="video_type_url">
                            رابط خارجي (YouTube, Vimeo, إلخ)
                        </label>
                    </div>
                    <div class="form-check">
                        <input class="form-check-input" type="radio" name="video_type" id="video_type_file" value="file" <?= $video['video_type'] == 'file' ? 'checked' : '' ?>>
                        <label class="form-check-label" for="video_type_file">
                            ملف فيديو محلي
                        </label>
                    </div>
                </div>

                <div class="mb-3" id="url_section" style="<?= $video['video_type'] == 'file' ? 'display:none;' : '' ?>">
                    <label for="video_url" class="form-label">رابط الفيديو</label>
                    <input type="url" class="form-control" id="video_url" name="video_url" value="<?= htmlspecialchars($video['video_url']) ?>" placeholder="https://www.youtube.com/watch?v=...">
                    <div class="form-text">يدعم روابط YouTube و Vimeo وغيرها من المنصات</div>
                </div>

                <div class="mb-3" id="file_section" style="<?= $video['video_type'] == 'url' ? 'display:none;' : '' ?>">
                    <label for="video_file" class="form-label">ملف الفيديو (MP4, WebM, OGV)</label>
                    <input class="form-control" type="file" id="video_file" name="video_file" accept="video/*">
                    <?php if (!empty($video['video_file'])): ?>
                        <div class="mt-2">
                            <small>الملف الحالي: <?= htmlspecialchars($video['video_file']) ?></small>
                            <input type="hidden" name="current_video_file" value="<?= htmlspecialchars($video['video_file']) ?>">
                        </div>
                    <?php endif; ?>
                </div>

                <div class="mb-3" id="thumbnail_section" style="<?= $video['video_type'] == 'url' ? 'display:none;' : '' ?>">
                    <label for="thumbnail" class="form-label">صورة مصغرة للفيديو (اختيارية)</label>
                    <input class="form-control" type="file" id="thumbnail" name="thumbnail" accept="image/*">
                    <?php if (!empty($video['thumbnail'])): ?>
                        <div class="mt-2">
                            <small>الصورة الحالية:</small>
                            <img src="../uploads/videos/<?= htmlspecialchars($video['thumbnail']) ?>" width="120" class="ms-2 rounded">
                            <input type="hidden" name="current_thumbnail" value="<?= htmlspecialchars($video['thumbnail']) ?>">
                        </div>
                    <?php endif; ?>
                </div>

                <div class="form-check mb-3">
                    <input class="form-check-input" type="checkbox" id="active" name="active" value="1" <?= $video['active'] ? 'checked' : '' ?>>
                    <label class="form-check-label" for="active">
                        فعال (عرض هذا الفيديو في الصفحة الرئيسية)
                    </label>
                </div>

                <button type="submit" class="btn btn-success mt-3">حفظ</button>
                <a href="videos.php" class="btn btn-secondary mt-3">إلغاء</a>
            </form>
        </div>
    </div>
</div>

<script>
document.addEventListener('DOMContentLoaded', function() {
    const urlRadio = document.getElementById('video_type_url');
    const fileRadio = document.getElementById('video_type_file');
    const urlSection = document.getElementById('url_section');
    const fileSection = document.getElementById('file_section');
    const thumbnailSection = document.getElementById('thumbnail_section');

    function toggleSections() {
        if (urlRadio.checked) {
            urlSection.style.display = 'block';
            fileSection.style.display = 'none';
            thumbnailSection.style.display = 'none';
            document.getElementById('video_url').required = true;
            document.getElementById('video_file').required = false;
        } else {
            urlSection.style.display = 'none';
            fileSection.style.display = 'block';
            thumbnailSection.style.display = 'block';
            document.getElementById('video_url').required = false;
            document.getElementById('video_file').required = <?= empty($video['id']) ? 'true' : 'false' ?>;
        }
    }

    urlRadio.addEventListener('change', toggleSections);
    fileRadio.addEventListener('change', toggleSections);
    
    // Initial call
    toggleSections();
});
</script>

<?php include 'includes/footer.php'; ?>
© 2026 GrazzMean