JEMBOT MAWOT Bypass Shell

<?php
include_once '../../../../php/dao/include_dao.php';
include_once '../../outils.php';
session_start();
if (isset($_POST['op'])) {
    $transaction = new Transaction();
    $horaire = new Horaire();


    if ($_POST['op'] == 'add') {

        $horaire->fkFilm = $_POST['fkFilm'];
//        @list($date, $heure) = explode(' ', $_POST['heure']);
//
//        @list($heure, $minute) = explode(':', $heure);
//        @list($jour, $mois, $annee) = explode('/', $date);

        $horaire->heure = Date::dateFrancaisToLocal($_POST['heure']);

        if (isset($_POST['patria'])) {
            $horaire->patria = testValeur($_POST['patria'], "on", -1, 0);
        }
        if (isset($_POST['nosLoisirs'])) {
            $horaire->nosLoisirs = testValeur($_POST['nosLoisirs'], "on", -1, 0);
        }

//        print_r($horaire);

        $arr = DAOFactory::getHoraireDAO()->insert($horaire);
        $transaction->commit();
    }


    if ($_POST['op'] == 'del') {
        $horaire->pkHoraire = $_POST['pkHoraire'];
        $arr = DAOFactory::getHoraireDAO()->delete($horaire->pkHoraire);
        $transaction->commit();
    }
}
?>


<div id="listeHoraires">
    <table class="table100pc">
        <tr>
            <td>Horaire</td>
            <td>Patria</td>
            <td>Nos Loisirs</td>
        </tr>
        <?php
        $listeHoraires = DAOFactory::getHoraireDAO()->queryByFkFilm($_SESSION['pkFilm']);
        foreach ($listeHoraires as $horaire) {
            ?>

            <tr>
                <td>
                    <?php echo Date::formatageDate($horaire->heure, Date::D_M_Y_H_N); ?>

                </td>
                <td>
                    <?php
                    echo testValeur($horaire->patria, "-1", '<div class="valid"></div>', '');
                    ?>

                </td>
                <td>
                    <?php
                    echo testValeur($horaire->nosLoisirs, "-1", '<div class="valid"></div>', '');
                    ?>
                </td>
                <td>
                    <button id="btnHoraire_<?php echo $horaire->pkHoraire ?>">Supprimer</button>
                </td>
            </tr>
            <?php
        }
        ?>
        <tr>
            <td><input id="heure"></td>
            <td>
                <input id="patria" type="checkbox"/>
            </td>
            <td>
                <input id="nosLoisirs" type="checkbox" />
            </td>
            <td>
                <button id="buttonHorraireAdd">Ajouter</button>

            </td>
        </tr>
    </table>
    <script>

<?php
foreach ($listeHoraires as $horaire) {
    ?>
            $("#btnHoraire_<?php echo $horaire->pkHoraire; ?>").button();


            $("#btnHoraire_<?php echo $horaire->pkHoraire; ?>").click(function () {
                target = '#listeHoraires';
                execAjax(
                        'php/film/horaire/data.php', target, {
                            op: 'del',
                            pkHoraire: <?php echo $horaire->pkHoraire; ?>

                        }, 1
                        );



            });
    <?php
}
?>
        $("#buttonHorraireAdd").button();
        $('#heure').datetimepicker(
                {
                    dateFormat: 'dd/mm/yy',
                    timeFormat: ('HH:mm')

                });

        $("#buttonHorraireAdd").click(function () {
            target = '#listeHoraires';
            execAjax(
                    'php/film/horaire/data.php', target, {
                        op: 'add',
                        fkFilm: pkFilm,
                        heure: $("#heure").val(),
                        patria: $("#patria:checked").val(),
                        nosLoisirs: $("#nosLoisirs:checked").val(),
                    }, 1
                    );



        });
    </script>

</div>