MERGE_UAT_SECURITY&MINIOR_ISSUES

app/Controllers/EmployeeRestController.php

@@ -687,7 +687,7 @@ class EmployeeRestController extends AdminController
     public function getEmployeeAndDependenceByClientId()
     {
         try {
-            $empData =   $this->employeePolicyModel->getEmployeePolicy( client_id:$this->request->getGet('client_id'),policy_id: $this->request->getGet('client_policy_id'),status:0,branch_id:$this->request->getGet('client_branch_id'));
+            $empData =   $this->employeePolicyModel->getEmployeePolicy( client_id:$this->request->getGet('client_id'),policy_id: $this->request->getGet('client_policy_id'),status:0,branch_id:$this->request->getGet('client_branch_id'), status_type: 'hr');
          
             if ($empData) {
                 return $this->respond(['status' => 'success', 'code' => 200, 'data' => $empData], 200);

app/Models/EmployeePolicyModel.php

@@ -82,10 +82,19 @@ class EmployeePolicyModel extends Model
     }
 
     // ----------------------------------------------------------------------------------------------------------
-    public function getEmployeePolicy($client_id = 0, $policy_id = 0, $status = [], $branch_id = 0, $emp_code = "", $emp_name = "")
+    public function getEmployeePolicy($client_id = 0, $policy_id = 0, $status = [], $branch_id = 0, $emp_code = "", $emp_name = "", $status_type = "")
     {
         // dd($status);
 
+        $status_query = "employee_polices.status"; // Default fallback
+
+        if ($status_type == "hr") {
+            $status_query = "CASE 
+                                WHEN employee_polices.status = 'enrolled' THEN 'under process' 
+                                ELSE employee_polices.status 
+                            END as status";
+        }
+
         $result = $this->select([
             'employee_polices.*',
             'policy_type.policy_type as policy_name',
@@ -147,8 +156,8 @@ class EmployeePolicyModel extends Model
                 THEN "Newly Added" 
                 ELSE NULL 
             END) AS newly_added',
-             
-        ])
+            $status_query
+        ], false)
             ->join('employees emp', 'employee_polices.employee_id = emp.id')
             ->join('client_policy cp', 'employee_polices.client_policy_id = cp.id') //cp - client policy
             ->join('policies pm', 'cp.policy_id = pm.id', 'left') //pm - policy master

app/Views/employee_list.php

@@ -302,14 +302,51 @@ function init() {
     function handleItemClick(e, item) {
         e.preventDefault(); 
         
-        // Execute the stored onclick handler
         const onclickAttr = item.getAttribute('data-onclick');
         if (onclickAttr) {
-            eval(onclickAttr);
+            // Regex to separate function name from the inside of the parentheses
+            // Example: myFunc(this, '123') -> match[1]="myFunc", match[2]="this, '123'"
+            const match = onclickAttr.match(/^(\w+)\((.*)\)$/);
+            
+            if (match) {
+                const funcName = match[1];
+                const argsRaw = match[2];
+
+                if (typeof window[funcName] === 'function') {
+                    // Parse the arguments string into a real array
+                    const args = argsRaw.split(',').map(arg => {
+                        let cleaned = arg.trim();
+                        
+                        // 1. Handle the 'this' keyword
+                        if (cleaned === 'this') return item;
+                        
+                        // 2. Handle 'event' keyword
+                        if (cleaned === 'event') return e;
+                        
+                        // 3. Handle strings (remove single or double quotes)
+                        if ((cleaned.startsWith("'") && cleaned.endsWith("'")) || 
+                            (cleaned.startsWith('"') && cleaned.endsWith('"'))) {
+                            return cleaned.substring(1, cleaned.length - 1);
+                        }
+                        
+                        // 4. Handle numbers
+                        if (!isNaN(cleaned) && cleaned !== "") {
+                            return Number(cleaned);
+                        }
+                        
+                        return cleaned;
+                    });
+
+                    // Execute function: 
+                    // .apply(item, args) sets the 'this' inside the function to the clicked element
+                    window[funcName].apply(item, args);
+                }
+            }
         }
         
+        // Handle standard navigation if it's a link
         const href = item.getAttribute('href');
-        if (href && href !== '#') {
+        if (href && href !== '#' && !href.includes('javascript:void(0)')) {
             window.location.href = href;
         }
 

app/Views/employee_upload.php

@@ -38,7 +38,7 @@ option:disabled {
 
                                         <div class="form-group col-md-4">
                                             <label>Branch</label> <br />
-                                            <select name="branch_id" class="form-control" id="branch_id" required>
+                                            <select name="client_branch_id" class="form-control" id="branch_id" required>
                                                 <option value="0">Select</option>
                                             </select>
                                         </div>

app/Views/file_list.php

@@ -179,7 +179,7 @@
                     enctype="multipart/form-data">
                     <input type="hidden" id="file_client_id" name="client_id">
                     <input type="hidden" id="file_policy_id" name="policy_id">
-                    <input type="hidden" id="file_branch_id" name="branch_id">
+                    <input type="hidden" id="file_branch_id" name="client_branch_id">
                     <input type="hidden" id="file_enrollment_open_date" name="enrollment_open_date">
                     <input type="hidden" id="file_enrollment_close_date" name="enrollment_close_date">
                     <input type="hidden" id="file_upload_actions" name="upload-action-type">