MERGE_TEST_SEC_RATE_LIMIT_OT_MINOR_ISSUES

app/Config/Filters.php

@@ -19,6 +19,7 @@ use App\Filters\Cors;
 use App\Filters\GlobalPostFileUploadGuard;
 use App\Filters\SecurityInputFilter;
 use App\Filters\AclFilter;
+use App\Filters\RateLimitFilter;
 
 
 
@@ -47,6 +48,7 @@ class Filters extends BaseConfig
         'GlobalPostFileUploadGuard'       => GlobalPostFileUploadGuard::class,
         'SecurityInputFilter'       => SecurityInputFilter::class,
         'AclFilter'       => AclFilter::class,
+        'ratelimit' => RateLimitFilter::class,
         
     ];
 

app/Config/Routes.php

@@ -442,7 +442,7 @@ $routes->cli('cli/check_env', 'MasterController::checkEnv');
 
 
 
-$routes->group("/api", ["filter" => "authJWT"], function ($routes) {
+$routes->group("/api", ["filter" => [ 'ratelimit'  , 'authJWT' ] ], function ($routes) {
     $routes->post("logined", "RestAuthenticationController::logined");
     $routes->post("getId", "RestAuthenticationController::getUserIdFromToken");
 });
@@ -454,7 +454,7 @@ $routes->group("/api", ["filter" => "authJWT"], function ($routes) {
 // $routes->post("employeeRest/createOrUpdateEmployeePolicySiAmount", "EmployeeRestController::createOrUpdateEmployeePolicySiAmount");
 // $routes->post("employeeRest/calculatePremium", "EmployeeRestController::calculatePremium");
  // $routes->post("updateMpin", "RestAuthenticationController::updateMpin");
-$routes->group("employeeRest", ['filter' => ['GlobalPostFileUploadGuard', 'appSignature' , 'authJWT'] ], function ($routes) {
+$routes->group("employeeRest", ['filter' => [ 'GlobalPostFileUploadGuard', 'ratelimit' , 'appSignature' , 'authJWT' ] ], function ($routes) {
 
     $routes->post('logout', 'RestAuthenticationController::logout');
 
@@ -507,7 +507,7 @@ $routes->group("employeeRest", ['filter' => ['GlobalPostFileUploadGuard', 'appSi
 
 });
 
-$routes->group("employeeRest", ['filter' => ['appSignature'] ], function ($routes) {
+$routes->group("employeeRest", ['filter' => ['ratelimit' , 'appSignature'] ], function ($routes) {
 
     //Employee login api's
     $routes->post("verifyEmployeeNumber", "RestAuthenticationController::verifyEmployeeWithMobileNumber");
@@ -540,7 +540,7 @@ $routes->group("employeeRest", ['filter' => ['appSignature'] ], function ($route
 
 });
 
-$routes->post("getPreEmployeePolicyCount","EmployeeRestController::getPreEmployeePolicyCount", ['filter' => ['appSignature']]);
+$routes->post("getPreEmployeePolicyCount","EmployeeRestController::getPreEmployeePolicyCount", ['filter' => ['ratelimit','appSignature']]);
 
 $routes->get("getEmployeeActiveOrInactivePolicy", "EmployeeRestController::getEmployeeActiveOrInactivePolicy");
 $routes->get("sendPushNotification", "EmployeeRestController::sendPushNotification");

app/Controllers/EmployeeController.php

@@ -180,9 +180,13 @@ class EmployeeController extends AdminController
 
     //handles employee & dependent  bulk upload with events like inception,addition,deletion, correction and SI enhancements
     public function employeesUplodWithEvents($post_data = [])
-    {
+    {   
         if(empty($post_data)){
             $post_data = $this->request->getPost();
+            $post_data = array_merge($post_data, $this->request->getFiles());
+            $is_post_request = true;
+        }else{
+            $is_post_request = false;
         }
 
         // $empDataServiceController = new EmpDataServiceController();
@@ -339,7 +343,7 @@ class EmployeeController extends AdminController
                 $avatar = isset($post_data['emplist']) ? $post_data['emplist'] : $this->request->getFile('emplist');
                 if (!$avatar) {
                     $this->myLogger->logme("error", 'File not found');
-                    if (!empty($post_data)) {
+                    if (!$is_post_request) {
                         return ['status' => false, 'message' => 'File not found'];
                     } else {
                         return $this->respond(['dataStatus' => false, 'code' => 400, 'message' => 'File not found'], 400);
@@ -355,7 +359,7 @@ class EmployeeController extends AdminController
                     $this->myLogger->logme("error", 'File move successful');
                 } else {
                     $this->myLogger->logme("error", 'File move failed');
-                    if (!empty($post_data)) {
+                    if (!$is_post_request) {
                         return ['status' => false, 'message' => 'File move failed'];
                     } else {
                         return $this->respond(['dataStatus' => false, 'code' => 500, 'message' => 'File move failed'], 500);
@@ -363,7 +367,7 @@ class EmployeeController extends AdminController
                 }
             } else {
                 $this->myLogger->logme("error", 'Upload failed Invalid file');
-                if (!empty($post_data)) {
+                if (!$is_post_request) {
                     return ['status' => false, 'message' => 'Invalid file'];
                 } else {
                     return $this->respond(['dataStatus' => false, 'code' => 404, 'message' => 'Invalid file'], 404);
@@ -385,7 +389,7 @@ class EmployeeController extends AdminController
             $client_id             = $post_data['client_id'] ?? null;
             $policy_id             = $post_data['policy_id'] ?? null;
             $branch_id             = $post_data['client_branch_id'] ?? null;
-            $action                = $post_data['file_action'] ?? null;
+            $action                = "enrollment";
             $enrollment_open_date  = $post_data['enrollment_open_date'] ?? null;
             $enrollment_close_date = $post_data['enrollment_close_date'] ?? null;
             $status                = 'inprogress';
@@ -405,7 +409,7 @@ class EmployeeController extends AdminController
                 $this->myLogger->logme("error", '{file_id} is less than 1MB, validating on the fly', ['file_id' => $file_id]);
                 //endof validation process
                 if (isset($result['error_summary']) && count($result['error_summary'])) {
-                    if(!empty($post_data)){
+                    if(!$is_post_request){
                         return ['status' => false, 'message' => 'file rejected with errors', 'file_id' => $file_id];
                     }else{
                         return $this->respond(['dataStatus' => false, 'code' => 404, 'message' => 'file rejected with errors'], 200);
@@ -418,7 +422,7 @@ class EmployeeController extends AdminController
                 $this->myLogger->logme("error", '{file_id} is greather than 1MB, validating with job queue', ['file_id' => $file_id]);
             }
 
-            if (!empty($post_data)) {
+            if (!$is_post_request) {
                 return ['status' => true, 'message' => 'File upload successs, Data validation is in-progress', 'file_id' => $file_id];
             } else {
                 return $this->respond(['dataStatus' => true, 'code' => 200, 'data' => 'file upload success'], 200);
@@ -507,7 +511,7 @@ class EmployeeController extends AdminController
 
 
         // dd($data['fileList']);die();
-        if ($_SERVER('REQUEST_METHOD') == "GET") {
+        if ($_SERVER['REQUEST_METHOD'] == "GET") {
             $this->loadLayout('import_export', $data);
         }
     }

app/Controllers/EmployeeRestController.php

@@ -4245,13 +4245,13 @@ class EmployeeRestController extends AdminController
             $file_id = $this->request->getGet('id') ?? $id;
 
             // Find record
-            $record = $this->hrFileUploadModel->find($file_id);
+            $record = $this->fileModel->where('id', $file_id)->first();
 
             if (!$record) {
                 return $this->failNotFound("File record not found");
             }
 
-            $uploadPath = WRITEPATH . 'uploads/hr_files/';
+            $uploadPath = WRITEPATH . 'uploads/excel/';
             $filePath   = $uploadPath . $record['file_name'];
 
             if (!file_exists($filePath)) {
@@ -4259,8 +4259,8 @@ class EmployeeRestController extends AdminController
             }
 
             // Force file download
-            return $this->response->download($filePath, null)
+            return $this->response->download($filePath, null)->setFileName($record['file_name']);
-                                ->setFileName($record['file_name']);
+            
         } catch (\Exception $e) {
             return $this->failServerError($e->getMessage());
         }

app/Filters/Cors.php

@@ -38,7 +38,7 @@ class Cors implements FilterInterface
      * 
      * @var string
      */
-    protected string $allowedMethods = 'GET,POST,PUT,PATCH,DELETE,OPTIONS';
+    protected string $allowedMethods = 'GET,POST,OPTIONS';
 
     /**
      * HTTP headers allowed in CORS requests

app/Filters/RateLimitFilter.php

@@ -0,0 +1,34 @@
+<?php
+
+namespace App\Filters;
+
+use CodeIgniter\HTTP\RequestInterface;
+use CodeIgniter\HTTP\ResponseInterface;
+use CodeIgniter\Filters\FilterInterface;
+
+class RateLimitFilter implements FilterInterface
+{
+
+    public function before(RequestInterface $request, $arguments = null)
+    {
+        $throttler = service('throttler');
+
+        // sanitize IP for cache
+        $key = preg_replace('/[^a-zA-Z0-9_]/', '_', $request->getIPAddress());
+
+        if ($throttler->check($key, 25, MINUTE) === false) {
+            return service('response')
+                ->setStatusCode(429)
+                ->setJSON([
+                    'status'  => 'error',
+                    'message' => 'Too many requests. Try again later.'
+                ]);
+        }
+    }
+
+
+    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
+    {
+        // nothing
+    }
+}

app/Helpers/JWTToken.php

@@ -31,16 +31,16 @@ class JWTToken
         try{
             $token =  JWT::encode($request_data ,$secret_Key,'HS512');
             $id = $request_data['id'];
-            $data["token_time_out"] = time() + getenv('TOKENTIMEOUT');
+            $update["token_time_out"] = time() + getenv('TOKENTIMEOUT');
            
             if(isset($data['emp_code'])){
                 $model = new EmployeeModel();
-                $model->update($id, $data);
+                $model->update($id, $update);
            
             }else{
                 $models = new LevelContactModel();
                 $id = $request_data['pre_hr_id'];
-                $models->update($id, $data);
+                $models->update($id, $update);
 
             }
             

app/Views/layout/header.php

@@ -51,7 +51,7 @@
 
 
     <!-- JQuery CDN -->
-    <script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
+    <script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
 
     <!-- Sweet Alert CDN -->
     <script src="https://cdn.jsdelivr.net/npm/sweetalert2@11.10.4/dist/sweetalert2.all.min.js"></script>
@@ -59,7 +59,7 @@
     <!-- select2 -->
     <link href="https://cdn.jsdelivr.net/npm/select2@4.1.0-beta.1/dist/css/select2.min.css" rel="stylesheet" type="text/css">
 
-    <script src="https://code.jquery.com/jquery-3.5.1.slim.min.js"></script>
+    <script src="https://code.jquery.com/jquery-3.7.1.slim.min.js"></script>
 <script src="https://cdn.jsdelivr.net/npm/@popperjs/core@2.5.3/dist/umd/popper.min.js"></script>
 
     <!-- <link rel="manifest" href="../manifest.json"> -->