Merge branch 'dev' of bitbucket.org:jubilian/nhance-enrollment into dev

.htaccess

@@ -5,28 +5,6 @@ Options -Indexes
 # Rewrite engine
 # ----------------------------------------------------------------------
 
-
-## ADDED for  - block any script execution inside folder of public 
-<If "%{REQUEST_URI} =~ m#/(logo|add_image_upload|e_card_imgs|claim_sample_forms|sample_import_excel|writable)/#">
-     Deny from all
-    # Disable PHP engine
-    <IfModule mod_php.c>
-        php_flag engine off
-    </IfModule>
-
-    # Disable CGI and other executable handlers
-    Options -ExecCGI
-    AddHandler cgi-script .php .pl .py .jsp .asp .sh .cgi
-
-    # Block access to any script-like files entirely
-    <FilesMatch "\.(php|php5|php7|phtml|pl|py|cgi|asp|aspx|sh|rb)$">
-        ForceType text/plain
-        #Order allow,deny
-        Deny from all
-    </FilesMatch>
-</If>
-
-
 # Turning on the rewrite engine is necessary for the following rules and features.
 # FollowSymLinks must be enabled for this to work.
 <IfModule mod_rewrite.c>

app/Controllers/EmployeeController.php

@@ -500,7 +500,7 @@ class EmployeeController extends AdminController
         }
     }
 
-    public function getExcelFileErrors($file_id, $retun_type)
+    public function getExcelFileErrors($file_id, $retun_type = null)
     {
         // $file_id = $this->request->uri->getSegment(3);
         $empServiceController = new EmployeeServiceController();

app/Controllers/EmployeeRestController.php

@@ -4470,19 +4470,22 @@ class EmployeeRestController extends AdminController
             ")
             ->join('employee_polices', 'employees.id = employee_polices.employee_id')
             ->join('client_policy', 'employee_polices.client_policy_id = client_policy.id')
+            ->whereIn('employees.emp_status', ['draft', 'enrolled'])
+            ->whereIn('employee_polices.status', ['draft', 'enrolled'])
             ->where([
                 'employees.is_active'              => 1,
                 'employee_polices.is_active'       => 1,
                 'client_policy.policy_type_id'     => 2,
                 'employees.family_floater_key'     => 'self',
-                'employees.emp_code'               => $emp_code,
+                'employees.emp_code'               => $emp_code ?? null,
-                'employees.client_id'              => $client_id,
+                'employees.client_id'              => $client_id ?? null,
-                'employees.client_branch_id'       => $client_branch_id,
+                'employees.client_branch_id'       => $client_branch_id ?? null,
             ])
+            ->orderBy('employee_polices.id', 'desc')
             ->first();
 
         // dd($data);
-        // dd( db_connect()->getLastQuery()); 
+        // dd(db_connect()->getLastQuery()); 
 
         if (!empty($data) && !empty($data['gmc_parent_policy_id'])) {
 

app/Controllers/LoginController.php

@@ -61,9 +61,7 @@ class LoginController extends BaseController
                         set_session_data($session_data);
 
                          // Bind session to device
-                        set_session_data(['fingerprint' =>  hash('sha256',
+                        set_session_data(['fingerprint' => generateFingerprint()]);
-                            ($this->request->getUserAgent()->getAgentString() . '|' . ($this->request->getIPAddress()
-                        )))]);
                         log_message('error', 'Set The UserId : `'. $user->id .'` in Session');
                         log_message('error', 'User Login Sucessfully');
 

app/Filters/AuthMVC.php

@@ -22,9 +22,7 @@ class AuthMVC implements FilterInterface
         // }
 
         // Fingerprint validation
-        $fp = hash('sha256', 
+        $fp = generateFingerprint();
-            $request->getUserAgent()->getAgentString() . '|' . $request->getIPAddress()
-        );
 
         if (session()->get('fingerprint') !== $fp) {
             return AuthLogout::logout();

app/Helpers/session_helper.php

@@ -118,7 +118,8 @@ if (!function_exists('check_role')) {
     {
         // $ci =& get_instance();
         $session = \Config\Services::session();
-        return $session->get('role');
+        return $role_id = isset(get_session_userdata()->role) ? get_session_userdata()->role : null;
+        
     }
 }
 

app/Helpers/utility_helper.php

@@ -557,7 +557,7 @@ if (!function_exists('change_date_format')) {
                 $date = DateTime::createFromFormat($source_format, $date_str);
                 if (!$date) {
                     // throw new Exception("Invalid date string for source format: $source_format");
-                    log_message('error', "❌ Date format error : Invalid date string | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}");
+                    // log_message('error', "❌ Date format error : Invalid date string | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}");
                     return null;
                 }
                 return $date->format($output_format);
@@ -568,7 +568,7 @@ if (!function_exists('change_date_format')) {
                 $date = DateTime::createFromFormat($source_format, $date_str);
                 if (!$date) {
                     // throw new Exception("Invalid date string for source format: $source_format");
-                    log_message('error', "❌ Date format error : Invalid date string | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}");
+                    // log_message('error', "❌ Date format error : Invalid date string | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}");
                     return null;
                 }
                 return $date->format('Y-m-d'); // MySQL default format
@@ -585,15 +585,15 @@ if (!function_exists('change_date_format')) {
                 // If no format matches, throw an exception
                 $allowed_placeholders = implode(', ', $allowed_formats);
                 // throw new Exception("Invalid date string format. Allowed formats: $allowed_placeholders");
-                log_message(
+                // log_message(
-                    'error',
+                //     'error',
-                    "❌ Date format error: Invalid date string. Allowed formats: {$allowed_placeholders} | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}"
+                //     "❌ Date format error: Invalid date string. Allowed formats: {$allowed_placeholders} | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}"
-                );
+                // );
                 return null;
             }
         } catch (Exception $e) {
             // return "Error: " . $e->getMessage();
-            log_message('error', "❌ Date format error: {$e->getMessage()} | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}");
+            // log_message('error', "❌ Date format error: {$e->getMessage()} | Params => date_str: {$date_str}, source_format: {$source_format}, output_format: {$output_format}");
             return null;
         }
 
@@ -756,3 +756,34 @@ if (!function_exists('validateExcelFile')) {
         return true;
     }
 }
+function getRealClientIP()
+{
+    $request = service('request');
+
+    if (!empty($_SERVER['HTTP_CF_CONNECTING_IP'])) {
+        return $_SERVER['HTTP_CF_CONNECTING_IP'];
+    }
+
+    if (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) {
+        return explode(',', $_SERVER['HTTP_X_FORWARDED_FOR'])[0];
+    }
+
+    return $request->getIPAddress();
+}
+
+function generateFingerprint()
+{
+    $request = service('request');
+
+    $ua = $request->getUserAgent()->getAgentString();
+    $ip = getRealClientIP();
+    // echo $ip;die();
+    // Use only subnet (first 3 blocks) to tolerate IP change
+    $ipParts = explode('.', $ip);
+    $ipSubnet = $ipParts[0] . '.' . $ipParts[1] . '.' . $ipParts[2];
+
+    // $secret = env('app.sessionFingerprintSalt');
+
+    // return hash('sha256', $ua . '|' . $ipSubnet . '|' . $secret);
+    return hash('sha256', $ua . '|' . $ipSubnet );
+}

app/Views/file_list.php

@@ -113,7 +113,16 @@
                                         class="mdi mdi-dots-horizontal"></i></a>
                                 <div class="dropdown-menu dropdown-menu-right">
                                     <?php if ($file['status'] == 'failed') { ?>
-                                        <a data-id="<?= htmlspecialchars(json_encode(['client_id' => $file['client_id'], 'client_policy_id' => $file['client_policy_id'], 'client_branch_id' => $file['client_branch_id'], 'action' => $file['action']])) ?>" data-toggle="modal" data-target="#file-upload-modal" class="dropdown-item upload_button" href="#"><i class="mdi mdi-upload mr-2 text-muted font-18 vertical-middle"></i>Re-Upload</a>
+                                        <a data-id="<?= 
+                                            htmlspecialchars(json_encode([
+                                                'client_id' => $file['client_id'], 
+                                                'client_policy_id' => $file['client_policy_id'], 
+                                                'client_branch_id' => $file['client_branch_id'], 
+                                                'enrollment_open_date' => change_date_format($file['enrollment_open_date'] , 'Y-m-d', 'd/m/Y'), 
+                                                'enrollment_close_date' => change_date_format($file['enrollment_close_date'], 'Y-m-d', 'd/m/Y' ), 
+                                                'action' => $file['action']
+                                            ])) 
+                                            ?>" data-toggle="modal" data-target="#file-upload-modal" class="dropdown-item upload_button" href="#"><i class="mdi mdi-upload mr-2 text-muted font-18 vertical-middle"></i>Re-Upload</a>
                                     <?php } ?>
 
                                     <a class="dropdown-item" href="<?= base_url("util/download-file-list/") . $file['id']; ?>"><i class="mdi mdi-download mr-2 text-muted font-18 vertical-middle"></i>Download</a>
@@ -171,6 +180,8 @@
                     <input type="hidden" id="file_client_id" name="client_id">
                     <input type="hidden" id="file_policy_id" name="policy_id">
                     <input type="hidden" id="file_branch_id" name="branch_id">
+                    <input type="hidden" id="file_enrollment_open_date" name="enrollment_open_date">
+                    <input type="hidden" id="file_enrollment_close_date" name="enrollment_close_date">
                     <input type="hidden" id="file_upload_actions" name="upload-action-type">
                     <input type="file" id="fileInput" name="emplist" required
                         accept=" application/vnd.openxmlformats-officedocument.spreadsheetml.sheet, application/vnd.ms-excel,application/vnd.oasis.opendocument.spreadsheet">
@@ -262,6 +273,9 @@ $('body').on('click', '.upload_button', function() {
     $('#file_client_id').val(fileId.client_id)
     $('#file_policy_id').val(fileId.client_policy_id)
     $('#file_branch_id').val(fileId.client_branch_id)
+    $('#file_enrollment_open_date').val(fileId.enrollment_open_date)
+    $('#file_enrollment_close_date').val(fileId.enrollment_close_date)
+    $('#file_branch_id').val(fileId.client_branch_id)
     $('#file_upload_actions').val(fileId.action)
 })
 

public/assets/.htaccess

@@ -0,0 +1,25 @@
+# ===============================
+# ABSOLUTE SCRIPT EXECUTION BLOCK
+# ===============================
+
+# Disable CGI
+Options -ExecCGI
+
+# Disable PHP for mod_php / LiteSpeed
+<IfModule mod_php.c>
+    php_flag engine off
+</IfModule>
+
+<IfModule lsapi_module>
+    php_flag engine off
+</IfModule>
+
+# Block any script file access
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar|pl|py|cgi|asp|aspx|jsp|sh|rb)$">
+    Require all denied
+</FilesMatch>
+
+# Block double extensions
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar)\.">
+    Require all denied
+</FilesMatch>

public/e_card_imgs/.htaccess

@@ -0,0 +1,25 @@
+# ===============================
+# ABSOLUTE SCRIPT EXECUTION BLOCK
+# ===============================
+
+# Disable CGI
+Options -ExecCGI
+
+# Disable PHP for mod_php / LiteSpeed
+<IfModule mod_php.c>
+    php_flag engine off
+</IfModule>
+
+<IfModule lsapi_module>
+    php_flag engine off
+</IfModule>
+
+# Block any script file access
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar|pl|py|cgi|asp|aspx|jsp|sh|rb)$">
+    Require all denied
+</FilesMatch>
+
+# Block double extensions
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar)\.">
+    Require all denied
+</FilesMatch>

public/sample_excel/.htaccess

@@ -0,0 +1,25 @@
+# ===============================
+# ABSOLUTE SCRIPT EXECUTION BLOCK
+# ===============================
+
+# Disable CGI
+Options -ExecCGI
+
+# Disable PHP for mod_php / LiteSpeed
+<IfModule mod_php.c>
+    php_flag engine off
+</IfModule>
+
+<IfModule lsapi_module>
+    php_flag engine off
+</IfModule>
+
+# Block any script file access
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar|pl|py|cgi|asp|aspx|jsp|sh|rb)$">
+    Require all denied
+</FilesMatch>
+
+# Block double extensions
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar)\.">
+    Require all denied
+</FilesMatch>

public/sample_import_excel/.htaccess

@@ -0,0 +1,25 @@
+# ===============================
+# ABSOLUTE SCRIPT EXECUTION BLOCK
+# ===============================
+
+# Disable CGI
+Options -ExecCGI
+
+# Disable PHP for mod_php / LiteSpeed
+<IfModule mod_php.c>
+    php_flag engine off
+</IfModule>
+
+<IfModule lsapi_module>
+    php_flag engine off
+</IfModule>
+
+# Block any script file access
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar|pl|py|cgi|asp|aspx|jsp|sh|rb)$">
+    Require all denied
+</FilesMatch>
+
+# Block double extensions
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar)\.">
+    Require all denied
+</FilesMatch>

public/writable/.htaccess

@@ -0,0 +1,25 @@
+# ===============================
+# ABSOLUTE SCRIPT EXECUTION BLOCK
+# ===============================
+
+# Disable CGI
+Options -ExecCGI
+
+# Disable PHP for mod_php / LiteSpeed
+<IfModule mod_php.c>
+    php_flag engine off
+</IfModule>
+
+<IfModule lsapi_module>
+    php_flag engine off
+</IfModule>
+
+# Block any script file access
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar|pl|py|cgi|asp|aspx|jsp|sh|rb)$">
+    Require all denied
+</FilesMatch>
+
+# Block double extensions
+<FilesMatch "\.(php|php5|php7|php8|phtml|phar)\.">
+    Require all denied
+</FilesMatch>