From 907e821952667499af6570584892b37b51bda1e2 Mon Sep 17 00:00:00 2001 From: "venkatesh.r" Date: Fri, 23 Jan 2026 16:41:51 +0530 Subject: [PATCH 1/6] FIX_REUPLOAD_ISSUE --- app/Views/file_list.php | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/app/Views/file_list.php b/app/Views/file_list.php index 0810319..9886ae9 100755 --- a/app/Views/file_list.php +++ b/app/Views/file_list.php @@ -113,7 +113,16 @@ class="mdi mdi-dots-horizontal">
- Re-Upload + Re-Upload ">Download @@ -171,6 +180,8 @@ + + @@ -262,6 +273,9 @@ $('body').on('click', '.upload_button', function() { $('#file_client_id').val(fileId.client_id) $('#file_policy_id').val(fileId.client_policy_id) $('#file_branch_id').val(fileId.client_branch_id) + $('#file_enrollment_open_date').val(fileId.enrollment_open_date) + $('#file_enrollment_close_date').val(fileId.enrollment_close_date) + $('#file_branch_id').val(fileId.client_branch_id) $('#file_upload_actions').val(fileId.action) }) From 838e2bbdda8162363fe8a427e1fcb6fd827f0c0d Mon Sep 17 00:00:00 2001 From: velz Date: Tue, 27 Jan 2026 10:41:22 +0530 Subject: [PATCH 2/6] FIX_ROLE_ISSUE --- app/Helpers/session_helper.php | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/app/Helpers/session_helper.php b/app/Helpers/session_helper.php index eb9eb9a..ccbdd51 100755 --- a/app/Helpers/session_helper.php +++ b/app/Helpers/session_helper.php @@ -118,7 +118,8 @@ if (!function_exists('check_role')) { { // $ci =& get_instance(); $session = \Config\Services::session(); - return $session->get('role'); + return $role_id = isset(get_session_userdata()->role) ? get_session_userdata()->role : null; + } } From 49e179eed4e082514904436edb2b7972e7aa155d Mon Sep 17 00:00:00 2001 From: "venkatesh.r" Date: Tue, 27 Jan 2026 10:43:24 +0530 Subject: [PATCH 3/6] FIX_LIVE_ISSUE --- app/Controllers/EmployeeRestController.php | 2 ++ app/Helpers/utility_helper.php | 14 +++++++------- 2 files changed, 9 insertions(+), 7 deletions(-) diff --git a/app/Controllers/EmployeeRestController.php b/app/Controllers/EmployeeRestController.php index e90be33..ee4a9ca 100755 --- a/app/Controllers/EmployeeRestController.php +++ b/app/Controllers/EmployeeRestController.php @@ -4472,6 +4472,8 @@ class EmployeeRestController extends AdminController ->join('client_policy', 'employee_polices.client_policy_id = client_policy.id') ->where([ 'employees.is_active' => 1, + 'employees.emp_status' => 'draft', + 'employee_polices.status' => 'draft', 'employee_polices.is_active' => 1, 'client_policy.policy_type_id' => 2, 'employees.family_floater_key' => 'self', diff --git a/app/Helpers/utility_helper.php b/app/Helpers/utility_helper.php index e1b8a9b..5a91892 100755 --- a/app/Helpers/utility_helper.php +++ b/app/Helpers/utility_helper.php @@ -557,7 +557,7 @@ if (!function_exists('change_date_format')) { $date = DateTime::createFromFormat($source_format, $date_str); if (!$date) { // throw new Exception("Invalid date string for source format: $source_format"); - log_message('error', "❌ Date format error : Invalid date string | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}"); + // log_message('error', "❌ Date format error : Invalid date string | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}"); return null; } return $date->format($output_format); @@ -568,7 +568,7 @@ if (!function_exists('change_date_format')) { $date = DateTime::createFromFormat($source_format, $date_str); if (!$date) { // throw new Exception("Invalid date string for source format: $source_format"); - log_message('error', "❌ Date format error : Invalid date string | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}"); + // log_message('error', "❌ Date format error : Invalid date string | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}"); return null; } return $date->format('Y-m-d'); // MySQL default format @@ -585,15 +585,15 @@ if (!function_exists('change_date_format')) { // If no format matches, throw an exception $allowed_placeholders = implode(', ', $allowed_formats); // throw new Exception("Invalid date string format. Allowed formats: $allowed_placeholders"); - log_message( - 'error', - "❌ Date format error: Invalid date string. Allowed formats: {$allowed_placeholders} | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}" - ); + // log_message( + // 'error', + // "❌ Date format error: Invalid date string. Allowed formats: {$allowed_placeholders} | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}" + // ); return null; } } catch (Exception $e) { // return "Error: " . $e->getMessage(); - log_message('error', "❌ Date format error: {$e->getMessage()} | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}"); + // log_message('error', "❌ Date format error: {$e->getMessage()} | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}"); return null; } From 4a409692e680ad4d320cdef6d72639d71b67bea6 Mon Sep 17 00:00:00 2001 From: "venkatesh.r" Date: Tue, 27 Jan 2026 11:08:33 +0530 Subject: [PATCH 4/6] FIX_ISSUES --- app/Controllers/EmployeeController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/Controllers/EmployeeController.php b/app/Controllers/EmployeeController.php index 8b9785d..936d914 100755 --- a/app/Controllers/EmployeeController.php +++ b/app/Controllers/EmployeeController.php @@ -500,7 +500,7 @@ class EmployeeController extends AdminController } } - public function getExcelFileErrors($file_id, $retun_type) + public function getExcelFileErrors($file_id, $retun_type = null) { // $file_id = $this->request->uri->getSegment(3); $empServiceController = new EmployeeServiceController(); From 1d74c870337ca8069703a216fa47d937a941e1e5 Mon Sep 17 00:00:00 2001 From: velz Date: Tue, 27 Jan 2026 12:24:42 +0530 Subject: [PATCH 5/6] FIX_SESSION_FP&HTACCESS --- .htaccess | 22 -------------------- app/Controllers/LoginController.php | 4 +--- app/Filters/AuthMVC.php | 4 +--- app/Helpers/utility_helper.php | 31 ++++++++++++++++++++++++++++ public/assets/.htaccess | 25 ++++++++++++++++++++++ public/e_card_imgs/.htaccess | 25 ++++++++++++++++++++++ public/sample_excel/.htaccess | 25 ++++++++++++++++++++++ public/sample_import_excel/.htaccess | 25 ++++++++++++++++++++++ public/writable/.htaccess | 25 ++++++++++++++++++++++ 9 files changed, 158 insertions(+), 28 deletions(-) create mode 100644 public/assets/.htaccess create mode 100644 public/e_card_imgs/.htaccess create mode 100644 public/sample_excel/.htaccess create mode 100644 public/sample_import_excel/.htaccess create mode 100644 public/writable/.htaccess diff --git a/.htaccess b/.htaccess index c9db48e..cf3c184 100755 --- a/.htaccess +++ b/.htaccess @@ -5,28 +5,6 @@ Options -Indexes # Rewrite engine # ---------------------------------------------------------------------- - -## ADDED for - block any script execution inside folder of public - - Deny from all - # Disable PHP engine - - php_flag engine off - - - # Disable CGI and other executable handlers - Options -ExecCGI - AddHandler cgi-script .php .pl .py .jsp .asp .sh .cgi - - # Block access to any script-like files entirely - - ForceType text/plain - #Order allow,deny - Deny from all - - - - # Turning on the rewrite engine is necessary for the following rules and features. # FollowSymLinks must be enabled for this to work. diff --git a/app/Controllers/LoginController.php b/app/Controllers/LoginController.php index aa5d9a8..73f7bb0 100755 --- a/app/Controllers/LoginController.php +++ b/app/Controllers/LoginController.php @@ -61,9 +61,7 @@ class LoginController extends BaseController set_session_data($session_data); // Bind session to device - set_session_data(['fingerprint' => hash('sha256', - ($this->request->getUserAgent()->getAgentString() . '|' . ($this->request->getIPAddress() - )))]); + set_session_data(['fingerprint' => generateFingerprint()]); log_message('error', 'Set The UserId : `'. $user->id .'` in Session'); log_message('error', 'User Login Sucessfully'); diff --git a/app/Filters/AuthMVC.php b/app/Filters/AuthMVC.php index e6c6948..285f586 100755 --- a/app/Filters/AuthMVC.php +++ b/app/Filters/AuthMVC.php @@ -22,9 +22,7 @@ class AuthMVC implements FilterInterface // } // Fingerprint validation - $fp = hash('sha256', - $request->getUserAgent()->getAgentString() . '|' . $request->getIPAddress() - ); + $fp = generateFingerprint(); if (session()->get('fingerprint') !== $fp) { return AuthLogout::logout(); diff --git a/app/Helpers/utility_helper.php b/app/Helpers/utility_helper.php index e1b8a9b..8570a19 100755 --- a/app/Helpers/utility_helper.php +++ b/app/Helpers/utility_helper.php @@ -756,3 +756,34 @@ if (!function_exists('validateExcelFile')) { return true; } } +function getRealClientIP() +{ + $request = service('request'); + + if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) { + return $_SERVER['HTTP_CF_CONNECTING_IP']; + } + + if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) { + return explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0]; + } + + return $request->getIPAddress(); +} + +function generateFingerprint() +{ + $request = service('request'); + + $ua = $request->getUserAgent()->getAgentString(); + $ip = getRealClientIP(); + // echo $ip;die(); + // Use only subnet (first 3 blocks) to tolerate IP change + $ipParts = explode('.', $ip); + $ipSubnet = $ipParts[0] . '.' . $ipParts[1] . '.' . $ipParts[2]; + + // $secret = env('app.sessionFingerprintSalt'); + + // return hash('sha256', $ua . '|' . $ipSubnet . '|' . $secret); + return hash('sha256', $ua . '|' . $ipSubnet ); +} \ No newline at end of file diff --git a/public/assets/.htaccess b/public/assets/.htaccess new file mode 100644 index 0000000..13e218d --- /dev/null +++ b/public/assets/.htaccess @@ -0,0 +1,25 @@ +# =============================== +# ABSOLUTE SCRIPT EXECUTION BLOCK +# =============================== + +# Disable CGI +Options -ExecCGI + +# Disable PHP for mod_php / LiteSpeed + + php_flag engine off + + + + php_flag engine off + + +# Block any script file access + + Require all denied + + +# Block double extensions + + Require all denied + diff --git a/public/e_card_imgs/.htaccess b/public/e_card_imgs/.htaccess new file mode 100644 index 0000000..13e218d --- /dev/null +++ b/public/e_card_imgs/.htaccess @@ -0,0 +1,25 @@ +# =============================== +# ABSOLUTE SCRIPT EXECUTION BLOCK +# =============================== + +# Disable CGI +Options -ExecCGI + +# Disable PHP for mod_php / LiteSpeed + + php_flag engine off + + + + php_flag engine off + + +# Block any script file access + + Require all denied + + +# Block double extensions + + Require all denied + diff --git a/public/sample_excel/.htaccess b/public/sample_excel/.htaccess new file mode 100644 index 0000000..13e218d --- /dev/null +++ b/public/sample_excel/.htaccess @@ -0,0 +1,25 @@ +# =============================== +# ABSOLUTE SCRIPT EXECUTION BLOCK +# =============================== + +# Disable CGI +Options -ExecCGI + +# Disable PHP for mod_php / LiteSpeed + + php_flag engine off + + + + php_flag engine off + + +# Block any script file access + + Require all denied + + +# Block double extensions + + Require all denied + diff --git a/public/sample_import_excel/.htaccess b/public/sample_import_excel/.htaccess new file mode 100644 index 0000000..13e218d --- /dev/null +++ b/public/sample_import_excel/.htaccess @@ -0,0 +1,25 @@ +# =============================== +# ABSOLUTE SCRIPT EXECUTION BLOCK +# =============================== + +# Disable CGI +Options -ExecCGI + +# Disable PHP for mod_php / LiteSpeed + + php_flag engine off + + + + php_flag engine off + + +# Block any script file access + + Require all denied + + +# Block double extensions + + Require all denied + diff --git a/public/writable/.htaccess b/public/writable/.htaccess new file mode 100644 index 0000000..13e218d --- /dev/null +++ b/public/writable/.htaccess @@ -0,0 +1,25 @@ +# =============================== +# ABSOLUTE SCRIPT EXECUTION BLOCK +# =============================== + +# Disable CGI +Options -ExecCGI + +# Disable PHP for mod_php / LiteSpeed + + php_flag engine off + + + + php_flag engine off + + +# Block any script file access + + Require all denied + + +# Block double extensions + + Require all denied + From a9eaf24d8e230f4e1f662bd4fe1277ed153e2392 Mon Sep 17 00:00:00 2001 From: "venkatesh.r" Date: Tue, 27 Jan 2026 14:26:12 +0530 Subject: [PATCH 6/6] FIX_LIVE_ISSUE --- app/Controllers/EmployeeRestController.php | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/app/Controllers/EmployeeRestController.php b/app/Controllers/EmployeeRestController.php index ee4a9ca..d8ffc24 100755 --- a/app/Controllers/EmployeeRestController.php +++ b/app/Controllers/EmployeeRestController.php @@ -4470,21 +4470,22 @@ class EmployeeRestController extends AdminController ") ->join('employee_polices', 'employees.id = employee_polices.employee_id') ->join('client_policy', 'employee_polices.client_policy_id = client_policy.id') + ->whereIn('employees.emp_status', ['draft', 'enrolled']) + ->whereIn('employee_polices.status', ['draft', 'enrolled']) ->where([ 'employees.is_active' => 1, - 'employees.emp_status' => 'draft', - 'employee_polices.status' => 'draft', 'employee_polices.is_active' => 1, 'client_policy.policy_type_id' => 2, 'employees.family_floater_key' => 'self', - 'employees.emp_code' => $emp_code, - 'employees.client_id' => $client_id, - 'employees.client_branch_id' => $client_branch_id, + 'employees.emp_code' => $emp_code ?? null, + 'employees.client_id' => $client_id ?? null, + 'employees.client_branch_id' => $client_branch_id ?? null, ]) + ->orderBy('employee_polices.id', 'desc') ->first(); // dd($data); - // dd( db_connect()->getLastQuery()); + // dd(db_connect()->getLastQuery()); if (!empty($data) && !empty($data['gmc_parent_policy_id'])) {