Fallagassrini Bypass Shell

<?php
session_start();
error_reporting(E_ALL);
ini_set('display_errors','On');
require_once 'MangoPay/mangoPayApi.inc';
define('MangoPayDemo_ClientId', 'philippe2015');
define('MangoPayDemo_ClientPassword', 'hK15oQKQig9N2UFEXQpCoirptU4VTeU28p0CTyiprt0fQuwFPP'); 
define('MangoPayDemo_ReturnURL', 'https://www.happy-r.fr/mangopay/paiement_simple_verification.php'); 
define('MangoPayDemo_TemporaryFolder', 'temp');

$mangoPayApi = new MangoPay\MangoPayApi();
$mangoPayApi->Config->ClientId = MangoPayDemo_ClientId;
$mangoPayApi->Config->ClientPassword = MangoPayDemo_ClientPassword;
$mangoPayApi->Config->TemporaryFolder = MangoPayDemo_TemporaryFolder;
$mangoPayApi->Config->BaseUrl = 'https://api.mangopay.com';


$remboursement_id	=	"";
$paymentid 			=	"";
$amount 			=	"";
$AuthorId 			=	"";
$error_refund 		=	"";
$requete	 		=	"";

define('db_name', 'happyrenashappy');
define('db_user', 'happyrenashappy');
define('db_password', 'K4Pli74zZfv');
define('db_host', 'happyrenashappy.mysql.db');

include("../includes/ez_sql_core.php");
include("../includes/ez_sql_mysqli.php");
$db = new ezSQL_mysqli(db_user,db_password,db_name,db_host);

if (isset($_POST['paymentid'])) {
    $paymentid = $_POST['paymentid'];
}

if (isset($_POST['amount'])) {
    $amount = $_POST['amount'];
}


$remboursement_date			= 	date("Y-m-d H:i:s");
$remboursement_date 		= 	date("Y-m-d", strtotime($remboursement_date));



if($paymentid && $amount)
{
	/// SET EMAILER
	require_once('../includes/class.phpmailer.php');
	require_once('../includes/class.smtp.php');
				
	//GET AMOUNT AND AUTHOR ID
	$payin = $mangoPayApi->PayIns->Get($paymentid);
	$amount_credited = $payin->CreditedFunds->Amount;
	$AuthorId = $payin->AuthorId;
	$amount_credited=$amount_credited/100;
	/// GET DATABASE INFO
	$myquery 			= 	"SELECT * from client_reservation where payment_id = '".$paymentid."'";
	$reservation 		= 	$db->get_row($myquery);
	$id					=	$reservation->id;
	$is_repayed			=	$reservation->is_repayed;
	
	
	/// check if asked amount is inferior to debited amount
	if($amount_credited>=$amount && $is_repayed == 0 && $id!="")
	{ 
	
		/// FORCE remboursement_montant
		$remboursement_montant  = $amount;
		
		//Build the parameters for the request
		$Refund = new \MangoPay\Refund();
		$Refund->AuthorId = $AuthorId;
		$Refund->DebitedFunds = new \MangoPay\Money();
		$Refund->DebitedFunds->Currency = "EUR";
		$Refund->DebitedFunds->Amount = $remboursement_montant;
		$Refund->Fees = new \MangoPay\Money();
		$Refund->Fees->Currency = "EUR";
		$Refund->Fees->Amount = 0;
		
		// DEBUG
		echo $AuthorId."<br>";
		echo $remboursement_montant;
		echo "<pre>";print_r($Refund);echo "</pre>";
		// DEBUG
		//DO THE REFUND
		$result = $mangoPayApi->PayIns->CreateRefund($paymentid, $Refund);
		//$remboursement_id = $result->Id;		
		
		/// MAIL TO THE CLIENT
		include('tpl_remboursement.php');
		$objet="Remboursement";
		$from			=	"contact@happy-r.fr";
		$destinataire	=	"phil_aph@hotmail.com";
		$reply			=	$from;
		$mail = new PHPmailer();
		$mail->SMTPDebug  = 0;
		$mail->CharSet = "UTF-8";
		$mail->IsHTML(true);
		$mail->From=$from;
		$mail->AddAddress($destinataire);
		$mail->AddReplyTo($reply);	
		$mail->Subject=$objet;
		$mail->Body=$message;
		if(!$mail->Send())
		{echo $mail->ErrorInfo;}
		else{echo '';}
		unset($mail);
				
		//// UPDATE DATABASE
		$requete = "UPDATE  client_reservation SET  is_repayed =  1, remboursement_id = '".$remboursement_id."', remboursement_destinataire = '".$AuthorId."', remboursement_date = '".$remboursement_date."', remboursement_montant =  '".$remboursement_montant."' WHERE  `id` =".$id;
		echo $requete;
		$db->query($requete);
	
	}
	
	else
	
	{
		$AuthorId = '';
		if($amount_credited<$amount)
			{ 
			$error_refund = 'Le montant demand&eacute; ('.$amount.' &euro;) est sup&eacute;rieur au montant d&eacute;bit&eacute; au client ( '.$amount_credited.' &euro;)';
			}
		
		if($id=='')
			{ 
			$error_refund = 'Aucune reservation associee a cet ID de transaction';
			}
		
		if($is_repayed > 0)
			{ 
			$error_refund = 'Cette transaction a deja ete remboursee';
			}
	}
	
}

?>

<form action="remboursement_v3.php" method="post">
	<input type="text" placeholder="montant" name="amount" value="<?= $amount ?>" />
    <input type="text" placeholder="payin ID" name="paymentid" value="<?= $paymentid ?>" />
    <input type="submit" />

</form>

<?php if($AuthorId!='') {?>
Rembourssement de <?echo $remboursement_montant ?>&euro; effectu&eacute; le <?= date('d').'/'.date('m').'/'.date('Y') ?> pour la r&eacute;servation <?echo $id ?>
<?php } ?>

<?php if($error_refund!='') {?>
<?echo $error_refund ?> 
<?php } ?>