diff --git a/app/Config/Routes.php b/app/Config/Routes.php index cccdc3d..6b133ac 100755 --- a/app/Config/Routes.php +++ b/app/Config/Routes.php @@ -454,7 +454,7 @@ $routes->group("/api", ["filter" => "authJWT"], function ($routes) { // $routes->post("employeeRest/createOrUpdateEmployeePolicySiAmount", "EmployeeRestController::createOrUpdateEmployeePolicySiAmount"); // $routes->post("employeeRest/calculatePremium", "EmployeeRestController::calculatePremium"); // $routes->post("updateMpin", "RestAuthenticationController::updateMpin"); -$routes->group("employeeRest", ['filter' => ['appSignature' , 'authJWT'] ], function ($routes) { +$routes->group("employeeRest", ['filter' => ['GlobalPostFileUploadGuard', 'appSignature' , 'authJWT'] ], function ($routes) { $routes->post('logout', 'RestAuthenticationController::logout'); diff --git a/app/Controllers/EmployeeController.php b/app/Controllers/EmployeeController.php index 936d914..df12f29 100755 --- a/app/Controllers/EmployeeController.php +++ b/app/Controllers/EmployeeController.php @@ -181,6 +181,9 @@ class EmployeeController extends AdminController //handles employee & dependent bulk upload with events like inception,addition,deletion, correction and SI enhancements public function employeesUplodWithEvents($post_data = []) { + if(empty($post_data)){ + $post_data = $this->request->getPost(); + } // $empDataServiceController = new EmpDataServiceController(); // !dd($empDataServiceController->importInceptionUpdateTPAandUHID(['file_id' => 79])); @@ -370,12 +373,21 @@ class EmployeeController extends AdminController //process post variable entry in file table $loggedInUserID = $post_data['created_by'] ?? get_session_userid(); - $client_id = isset($post_data['client_id']) ? $post_data['client_id'] : $this->request->getPost('client_id'); - $policy_id = isset($post_data['policy_id']) ? $post_data['policy_id'] : $this->request->getPost('policy_id'); - $branch_id = isset($post_data['client_branch_id']) ? $post_data['client_branch_id'] : $this->request->getPost('branch_id'); - $action = isset($post_data['file_action']) ? $post_data['file_action'] : $this->request->getPost('upload-action-type'); - $enrollment_open_date = isset($post_data['enrollment_open_date']) ? $post_data['enrollment_open_date'] : $this->request->getPost('enrollment_open_date') ?? null; - $enrollment_close_date = isset($post_data['enrollment_close_date']) ? $post_data['enrollment_close_date'] : $this->request->getPost('enrollment_close_date') ?? null; + // $client_id = isset($post_data['client_id']) ? $post_data['client_id'] : $this->request->getPost('client_id'); + // $policy_id = isset($post_data['policy_id']) ? $post_data['policy_id'] : $this->request->getPost('policy_id'); + // $branch_id = isset($post_data['client_branch_id']) ? $post_data['client_branch_id'] : $this->request->getPost('branch_id'); + // $action = isset($post_data['file_action']) ? $post_data['file_action'] : $this->request->getPost('upload-action-type'); + // $enrollment_open_date = isset($post_data['enrollment_open_date']) ? $post_data['enrollment_open_date'] : $this->request->getPost('enrollment_open_date') ?? null; + // $enrollment_close_date = isset($post_data['enrollment_close_date']) ? $post_data['enrollment_close_date'] : $this->request->getPost('enrollment_close_date') ?? null; + // $status = 'inprogress'; + // $hr_id = $post_data['created_by'] ?? null; + + $client_id = $post_data['client_id'] ?? null; + $policy_id = $post_data['policy_id'] ?? null; + $branch_id = $post_data['client_branch_id'] ?? null; + $action = $post_data['file_action'] ?? null; + $enrollment_open_date = $post_data['enrollment_open_date'] ?? null; + $enrollment_close_date = $post_data['enrollment_close_date'] ?? null; $status = 'inprogress'; $hr_id = $post_data['created_by'] ?? null; @@ -394,7 +406,7 @@ class EmployeeController extends AdminController //endof validation process if (isset($result['error_summary']) && count($result['error_summary'])) { if(!empty($post_data)){ - return ['status' => true, 'message' => 'file rejected with errors', 'file_id' => $file_id]; + return ['status' => false, 'message' => 'file rejected with errors', 'file_id' => $file_id]; }else{ return $this->respond(['dataStatus' => false, 'code' => 404, 'message' => 'file rejected with errors'], 200); } @@ -495,13 +507,23 @@ class EmployeeController extends AdminController // dd($data['fileList']);die(); - if ($this->request->getMethod() == "get") { + if ($_SERVER('REQUEST_METHOD') == "GET") { $this->loadLayout('import_export', $data); } } public function getExcelFileErrors($file_id, $retun_type = null) - { + { + + $file_data = $this->fileModel->where('id', $file_id)->first(); + $error = json_decode($file_data['reason'] ?? '{}', true); + if(!empty($error) && $retun_type == 'api'){ + $send = isset($error['error_summary'][5]) || isset($error['error_summary'][6]) ? true : false; + if($send){ + return $this->respond(['status' => false, 'code' => 404, 'message' => $error['error_data'], 'data' => []], 200); + } + } + // $file_id = $this->request->uri->getSegment(3); $empServiceController = new EmployeeServiceController(); diff --git a/app/Controllers/EmployeeRestController.php b/app/Controllers/EmployeeRestController.php index d8ffc24..bdb7a23 100755 --- a/app/Controllers/EmployeeRestController.php +++ b/app/Controllers/EmployeeRestController.php @@ -826,9 +826,16 @@ class EmployeeRestController extends AdminController 'enrollment_open_date' => $this->request->getPost('enrollment_open_date'), 'enrollment_close_date' => $this->request->getPost('enrollment_close_date'), 'file_action' => "enrollment", - 'created_by' => $this->request->getPost('created_by'), + 'created_by' => $this->request->getPost('created_by') ?? null, 'emplist' => $this->request->getFile('file') ]; + + if (is_string($post_data['client_id']) && preg_match('/^[a-f0-9]{32}$/i', $post_data['client_id'])) { + $client_data = $this->clientModel->where('MD5(id)', $post_data['client_id'])->first(); + $post_data['client_id'] = $client_data['id']; + } + + // print_r($post_data); die; if(empty($post_data['client_id'])){ @@ -839,7 +846,7 @@ class EmployeeRestController extends AdminController $responce = $employeeController->employeesUplodWithEvents($post_data); // print_r($responce); die; - if($responce['status']){ + if(!$responce['status']){ $file_data = $this->getDataFromFilesTable(['file_id' => $responce['file_id']]); $responce['data'] = $file_data; return $this->respond($responce, 200); @@ -864,6 +871,11 @@ class EmployeeRestController extends AdminController $client_branch_id = $this->request->getPost('client_branch_id'); $policy_id = $this->request->getPost('policy_id'); + if (is_string($client_id) && preg_match('/^[a-f0-9]{32}$/i', $client_id)) { + $client_data = $this->clientModel->where('MD5(id)', $client_id)->first(); + $client_id = $client_data['id']; + } + $client_data = $this->clientModel->where('id', $client_id)->first(); $notification = $this->notificationModel->where('client_id',$client_id)->where('template_name','member_welcome_mail')->first(); @@ -1279,6 +1291,11 @@ class EmployeeRestController extends AdminController return []; } + public function getHrFileUploadErrorDetails($file_id) + { + + } + //------------------------------------- public function getAgeRange($terms,$familyFloatesValue) diff --git a/app/Controllers/EmployeeServiceController.php b/app/Controllers/EmployeeServiceController.php index c52ebd7..69c1d0f 100755 --- a/app/Controllers/EmployeeServiceController.php +++ b/app/Controllers/EmployeeServiceController.php @@ -765,6 +765,14 @@ class EmployeeServiceController extends AdminController // get policy and rack details $policy_details = $this->clientPolicyModel->getPolicyDetails($file['client_id'],$file['policy_id']); + + if(empty($policy_details)){ + $message = "Policy configuration is incomplete. Cannot proceed."; + $this->myLogger->logme('error',($message . ' for file id ' . $file_id)); + $this->fileModel->where('id', $file_id)->set(['status' => 'failed','reason' => json_encode(['error_summary' => array_count_values([5]),'error_data' => $message])])->update(); + return array('error_summary' => [5], 'error_data' => $message); + } + $policy_terms = json_decode($policy_details[0]->policy_terms); $policy_terms = (array) $policy_terms;// convert obj to array $default_age_ratio = isset($policy_terms['age_ratio']) ? json_decode(json_encode($policy_terms['age_ratio']),true) : []; @@ -775,6 +783,13 @@ class EmployeeServiceController extends AdminController $slab_details = $this->policiesModel->getPolicySlabRatesForEmpOnboard($file['policy_id'],$file['client_id']); // dd($slab_details); + if(empty($slab_details) || (isset($slab_details['slab_rates']) && empty($slab_details['slab_rates']))){ + $message = "Policy configuration is incomplete. Cannot proceed."; + $this->myLogger->logme('error',($message . ' for file id ' . $file_id)); + $this->fileModel->where('id', $file_id)->set(['status' => 'failed','reason' => json_encode(['error_summary' => array_count_values([5]),'error_data' => $message])])->update(); + return array('error_summary' => [5], 'error_data' => $message); + } + //remove header unset($excel_data[0]); $relationship = $this->general_relationships; diff --git a/app/Filters/GlobalPostFileUploadGuard.php b/app/Filters/GlobalPostFileUploadGuard.php index 4cc82ba..35476b6 100644 --- a/app/Filters/GlobalPostFileUploadGuard.php +++ b/app/Filters/GlobalPostFileUploadGuard.php @@ -39,7 +39,7 @@ class GlobalPostFileUploadGuard implements FilterInterface ]; protected array $blockedExtensions = [ - 'php', 'phtml', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps', + 'php', 'phtml', 'html', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps', 'cgi', 'fcgi', 'pl', 'py', 'rb', 'lua', 'tcl', 'go', 'rs', 'jar', 'class', 'exe', 'dll', 'com', 'bat', 'cmd', 'msi', 'vbs', 'ps1', 'scr', 'sh', 'bash', 'zsh', 'apk', 'app', 'deb', 'rpm', 'bin', 'run', @@ -100,7 +100,7 @@ class GlobalPostFileUploadGuard implements FilterInterface } // --- 2. Double Extension Attack Check --- - if (preg_match('/\.(php|phtml|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) { + if (preg_match('/\.(php|phtml|html|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) { $this->block("Double extension attack", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size); }