Fallagassrini Bypass Shell

<?
//session_start();
//include("config.php");
//include("includes/fonctions.php");
//$page="xml";
//include("auth.php");

$force 		= "1";
//$affectation_xml=$_REQUEST['affectation_xml'];
$date_generation_xml						= date("Y-m-d");
if ($affectation_xml)
{
$myquery = "SELECT * from constat where 1 and id IN (".implode(',',$affectation_xml).") order by id desc";	
$myquery_calls = $db->get_results($myquery);
$num = $db->num_rows;
if (!empty($myquery_calls))
	{
	foreach ( $myquery_calls as $liste )
	{
	$requete="UPDATE  constat set date_generation_xml='".$date_generation_xml."'  where id	=".$liste->id;
	$db->query($requete);
	//echo $requete;
	$virement_nombre=$virement_nombre+1;
	$virement_montant=$virement_montant+$reservation->tarif;
	}
	}


$date1 = new DateTime(date("Y-m-d"));
$date2 = new DateTime(date("Y")."-01-01");
$diff = $date2->diff($date1)->format("%a");
$reference_globale="HE/".date("Y")."/".$diff;
$virement_date = date('Y-m-d', strtotime('+0 days')); 
$message="";
$message.= "<?xml version=\"1.0\" encoding=\"UTF-8\" standalone=\"no\"?> \n";
$message.= "<Document xmlns=\"urn:iso:std:iso:20022:tech:xsd:pain.001.001.03\">\n";
$message.= "<CstmrCdtTrfInitn>\n";
$message.= "	<GrpHdr>\n";
$message.= "		<MsgId>".$reference_globale."</MsgId>\n";
$message.= "		<CreDtTm>".date("Y-m-d")."T".date("H:i:s")."</CreDtTm>\n";
$message.= "		<NbOfTxs>".$virement_nombre."</NbOfTxs>\n";
$message.= "		<CtrlSum>".$virement_montant."</CtrlSum>\n";
$message.= "		<InitgPty>\n";
$message.= "			<Nm>HE</Nm>\n";
$message.= "		</InitgPty>\n";
$message.= "	</GrpHdr>\n";
$message.= "			<PmtInf>\n";
$message.= "				<PmtInfId>HE/".$diff."</PmtInfId>\n";
$message.= "				<PmtMtd>TRF</PmtMtd>\n";
$message.= "				<BtchBookg>false</BtchBookg>\n";
$message.= "				<NbOfTxs>".$virement_nombre."</NbOfTxs>\n";
$message.= "				<CtrlSum>".$virement_montant."</CtrlSum>\n";
$message.= "				<PmtTpInf>\n";
$message.= "					<SvcLvl>\n";
$message.= "						<Cd>SEPA</Cd>\n";
$message.= "					</SvcLvl>\n";
$message.= "				</PmtTpInf>\n";
$message.= "				<ReqdExctnDt>".$virement_date."</ReqdExctnDt>\n";
$message.= "				<Dbtr>\n";
$message.= "					<Nm>HE</Nm>\n";
$message.= "				</Dbtr>\n";
$message.= "				<DbtrAcct>\n";
$message.= "					<Id>\n";
$message.= "						<IBAN>FR7610057192950002003160258</IBAN>\n";
$message.= "					</Id>\n";
$message.= "				</DbtrAcct>\n";
$message.= "				<DbtrAgt>\n";
$message.= "					<FinInstnId>\n";
$message.= "						<BIC>CMCIFRPP</BIC>\n";
$message.= "					</FinInstnId>\n";
$message.= "				</DbtrAgt>\n";
$message.= "				<ChrgBr>SLEV</ChrgBr>\n";




if (!empty($myquery_calls))
{
foreach ( $myquery_calls as $liste )
{

$montant	=	$liste->tarif;
$montant	= 	$montant*0.91;
$montant	= 	round($montant,2);
$myquery = "SELECT * from huissier where id=".$liste->attribution_id;
$resultat = $db->get_row($myquery);
$resultat->huissier=str_replace("&","-",$resultat->huissier);
$message.= "			<CdtTrfTxInf>\n";
$message.= "				<PmtId>\n";
$message.= "					<InstrId>".$resultat->id."/".$liste->id."</InstrId>\n";
$message.= "					<EndToEndId>HE/".str_replace(" ","",$liste->nom)." ".str_replace(" ","",$liste->prenom)."</EndToEndId>\n";
$message.= "				</PmtId>\n";
$message.= "				<Amt>\n";
$message.= "					<InstdAmt Ccy=\"EUR\">".$montant."</InstdAmt>\n";
$message.= "				</Amt>\n";
$message.= "				<CdtrAgt>\n";
$message.= "					<FinInstnId>\n";
$message.= "						<BIC>".$resultat->bic."</BIC>\n";
$message.= "					</FinInstnId>\n";
$message.= "				</CdtrAgt>\n";
$message.= "				<Cdtr>\n";
$message.= "					<Nm>".html_entity_decode(str_replace(" ","",$resultat->huissier)." ")."</Nm>\n";
$message.= "				</Cdtr>\n";
$message.= "				<CdtrAcct>\n";
$message.= "					<Id>\n";
$message.= "						<IBAN>".strtoupper($resultat->iban)."</IBAN>\n";
$message.= "					</Id>\n";
$message.= "				</CdtrAcct>\n";
$message.= "				<RgltryRptg>\n";
$message.= "					<Dtls>\n";
$message.= "						<Cd>150</Cd>\n";
$message.= "					</Dtls>\n";
$message.= "				</RgltryRptg>\n";
$message.= "				<RmtInf>\n";
$message.= "					<Ustrd>".$liste->id."</Ustrd>\n";
$message.= "				</RmtInf>\n";
$message.= "			</CdtTrfTxInf>\n";
}
}
$message.= "						</PmtInf>\n";
$message.= "					</CstmrCdtTrfInitn>\n";
$message.= "				</Document>\n";

if (!$force)
{
	
print_r ($message);
}

else
{
$nom_fichier="resultat".utf8_encode(date("Y-m-d-H-i"));
$fp = fopen('xml/'.$nom_fichier.'.xml', 'w+');
fputs($fp, $message);
?>
<div class="note note-warning note-bordered">Telecharger le fichier XML : Click droit et "Enregistrer sous"<br>
<a target="_blank" href="xml/<?echo $nom_fichier;?>.xml"><?echo $nom_fichier;?>.xml</a>
</div>
<?
}
}
?>