diff --git a/app/Config/Filters.php b/app/Config/Filters.php index ecf5672..9f28a05 100755 --- a/app/Config/Filters.php +++ b/app/Config/Filters.php @@ -62,7 +62,7 @@ class Filters extends BaseConfig 'HttpRequestLog' => ['except' => 'cli/*'], 'AclFilter' => ['except' => ['login', 'logout', 'auth/*', 'oauth2callback','claim-form-download', 'claims-feedback-form', 'autobookstackLogin','/employeeRest/*','processjob']], 'Cors', - 'SecurityInputFilter' => ['except' => ['notification/create','test_mail'] ], + 'SecurityInputFilter' => ['except' => ['/client/notification/create','test_mail'] ], 'GlobalPostFileUploadGuard', // 'invalidchars', ], diff --git a/app/Config/Routes.php b/app/Config/Routes.php index cccdc3d..f61965e 100755 --- a/app/Config/Routes.php +++ b/app/Config/Routes.php @@ -454,7 +454,7 @@ $routes->group("/api", ["filter" => "authJWT"], function ($routes) { // $routes->post("employeeRest/createOrUpdateEmployeePolicySiAmount", "EmployeeRestController::createOrUpdateEmployeePolicySiAmount"); // $routes->post("employeeRest/calculatePremium", "EmployeeRestController::calculatePremium"); // $routes->post("updateMpin", "RestAuthenticationController::updateMpin"); -$routes->group("employeeRest", ['filter' => ['appSignature' , 'authJWT'] ], function ($routes) { +$routes->group("employeeRest", ['filter' => ['GlobalPostFileUploadGuard', 'appSignature' , 'authJWT'] ], function ($routes) { $routes->post('logout', 'RestAuthenticationController::logout'); @@ -503,6 +503,7 @@ $routes->group("employeeRest", ['filter' => ['appSignature' , 'authJWT'] ], func $routes->post("hrFileUpload", "EmployeeRestController::hrFileUpload"); $routes->get("copyActiveEmployeeAndDependentDetails", "EmployeeRestController::copyActiveEmployeeAndDependentDetails"); + $routes->get("getExcelFileErrors/(:any)", "EmployeeController::getExcelFileErrors/$1"); }); diff --git a/app/Controllers/EmployeeController.php b/app/Controllers/EmployeeController.php index 936d914..17bd959 100755 --- a/app/Controllers/EmployeeController.php +++ b/app/Controllers/EmployeeController.php @@ -181,6 +181,9 @@ class EmployeeController extends AdminController //handles employee & dependent bulk upload with events like inception,addition,deletion, correction and SI enhancements public function employeesUplodWithEvents($post_data = []) { + if(empty($post_data)){ + $post_data = $this->request->getPost(); + } // $empDataServiceController = new EmpDataServiceController(); // !dd($empDataServiceController->importInceptionUpdateTPAandUHID(['file_id' => 79])); @@ -370,12 +373,21 @@ class EmployeeController extends AdminController //process post variable entry in file table $loggedInUserID = $post_data['created_by'] ?? get_session_userid(); - $client_id = isset($post_data['client_id']) ? $post_data['client_id'] : $this->request->getPost('client_id'); - $policy_id = isset($post_data['policy_id']) ? $post_data['policy_id'] : $this->request->getPost('policy_id'); - $branch_id = isset($post_data['client_branch_id']) ? $post_data['client_branch_id'] : $this->request->getPost('branch_id'); - $action = isset($post_data['file_action']) ? $post_data['file_action'] : $this->request->getPost('upload-action-type'); - $enrollment_open_date = isset($post_data['enrollment_open_date']) ? $post_data['enrollment_open_date'] : $this->request->getPost('enrollment_open_date') ?? null; - $enrollment_close_date = isset($post_data['enrollment_close_date']) ? $post_data['enrollment_close_date'] : $this->request->getPost('enrollment_close_date') ?? null; + // $client_id = isset($post_data['client_id']) ? $post_data['client_id'] : $this->request->getPost('client_id'); + // $policy_id = isset($post_data['policy_id']) ? $post_data['policy_id'] : $this->request->getPost('policy_id'); + // $branch_id = isset($post_data['client_branch_id']) ? $post_data['client_branch_id'] : $this->request->getPost('branch_id'); + // $action = isset($post_data['file_action']) ? $post_data['file_action'] : $this->request->getPost('upload-action-type'); + // $enrollment_open_date = isset($post_data['enrollment_open_date']) ? $post_data['enrollment_open_date'] : $this->request->getPost('enrollment_open_date') ?? null; + // $enrollment_close_date = isset($post_data['enrollment_close_date']) ? $post_data['enrollment_close_date'] : $this->request->getPost('enrollment_close_date') ?? null; + // $status = 'inprogress'; + // $hr_id = $post_data['created_by'] ?? null; + + $client_id = $post_data['client_id'] ?? null; + $policy_id = $post_data['policy_id'] ?? null; + $branch_id = $post_data['client_branch_id'] ?? null; + $action = $post_data['file_action'] ?? null; + $enrollment_open_date = $post_data['enrollment_open_date'] ?? null; + $enrollment_close_date = $post_data['enrollment_close_date'] ?? null; $status = 'inprogress'; $hr_id = $post_data['created_by'] ?? null; @@ -394,7 +406,7 @@ class EmployeeController extends AdminController //endof validation process if (isset($result['error_summary']) && count($result['error_summary'])) { if(!empty($post_data)){ - return ['status' => true, 'message' => 'file rejected with errors', 'file_id' => $file_id]; + return ['status' => false, 'message' => 'file rejected with errors', 'file_id' => $file_id]; }else{ return $this->respond(['dataStatus' => false, 'code' => 404, 'message' => 'file rejected with errors'], 200); } @@ -495,13 +507,39 @@ class EmployeeController extends AdminController // dd($data['fileList']);die(); - if ($this->request->getMethod() == "get") { + if ($_SERVER('REQUEST_METHOD') == "GET") { $this->loadLayout('import_export', $data); } } public function getExcelFileErrors($file_id, $retun_type = null) - { + { + + $file_data = $this->fileModel->where('id', $file_id)->first(); + $error = json_decode($file_data['reason'] ?? '{}', true); + if(!empty($error) && $retun_type == 'api' && $file_data['status'] == 'failed'){ + $send = isset($error['error_summary'][5]) || isset($error['error_summary'][6]) ? true : false; + if($send){ + + $string = $error['error_data'] ?? 'System error'; + + $errorMap = [ + "Column order conflict" => "Invalid file format. Please use the sample file.", + ]; + + $message = $string; // Default to the original error + + foreach ($errorMap as $keyword => $friendlyMessage) { + if (strpos($string, $keyword) !== false) { + $message = $friendlyMessage; + break; // Stop looking once we find a match + } + } + + return $this->respond(['status' => false, 'code' => 404, 'message' => $message, 'data' => []], 200); + } + } + // $file_id = $this->request->uri->getSegment(3); $empServiceController = new EmployeeServiceController(); diff --git a/app/Controllers/EmployeeRestController.php b/app/Controllers/EmployeeRestController.php index d8ffc24..aa7cd9e 100755 --- a/app/Controllers/EmployeeRestController.php +++ b/app/Controllers/EmployeeRestController.php @@ -826,9 +826,16 @@ class EmployeeRestController extends AdminController 'enrollment_open_date' => $this->request->getPost('enrollment_open_date'), 'enrollment_close_date' => $this->request->getPost('enrollment_close_date'), 'file_action' => "enrollment", - 'created_by' => $this->request->getPost('created_by'), + 'created_by' => $this->request->getPost('created_by') ?? null, 'emplist' => $this->request->getFile('file') ]; + + if (is_string($post_data['client_id']) && preg_match('/^[a-f0-9]{32}$/i', $post_data['client_id'])) { + $client_data = $this->clientModel->where('MD5(id)', $post_data['client_id'])->first(); + $post_data['client_id'] = $client_data['id']; + } + + // print_r($post_data); die; if(empty($post_data['client_id'])){ @@ -839,14 +846,16 @@ class EmployeeRestController extends AdminController $responce = $employeeController->employeesUplodWithEvents($post_data); // print_r($responce); die; - if($responce['status']){ - $file_data = $this->getDataFromFilesTable(['file_id' => $responce['file_id']]); - $responce['data'] = $file_data; - return $this->respond($responce, 200); - }else{ - $responce['data'] = []; - return $this->respond($responce, 200); - } + return $this->respond($responce, 200); + + // if(!$responce['status']){ + // $file_data = $this->getDataFromFilesTable(['file_id' => $responce['file_id']]); + // $responce['data'] = $file_data; + // return $this->respond($responce, 200); + // }else{ + // $responce['data'] = []; + // return $this->respond($responce, 200); + // } @@ -864,6 +873,11 @@ class EmployeeRestController extends AdminController $client_branch_id = $this->request->getPost('client_branch_id'); $policy_id = $this->request->getPost('policy_id'); + if (is_string($client_id) && preg_match('/^[a-f0-9]{32}$/i', $client_id)) { + $client_data = $this->clientModel->where('MD5(id)', $client_id)->first(); + $client_id = $client_data['id']; + } + $client_data = $this->clientModel->where('id', $client_id)->first(); $notification = $this->notificationModel->where('client_id',$client_id)->where('template_name','member_welcome_mail')->first(); @@ -1227,7 +1241,7 @@ class EmployeeRestController extends AdminController files.policy_id, cp.policy_no, files.file_name, - files.action, + files.action as file_action, files.created_at, files.created_by, files.updated_at, @@ -1261,7 +1275,11 @@ class EmployeeRestController extends AdminController } if (isset($search_data['client_id']) && !empty($search_data['client_id'])) { - $builder->where("files.client_id", $search_data['client_id']); + if (is_string($search_data['client_id']) && preg_match('/^[a-f0-9]{32}$/i', $search_data['client_id'])) { + $builder->where("MD5(files.client_id)", $search_data['client_id']); + } else { + $builder->where("files.client_id", $search_data['client_id']); + } } if (isset($search_data['file_id']) && !empty($search_data['file_id'])) { @@ -1279,6 +1297,11 @@ class EmployeeRestController extends AdminController return []; } + public function getHrFileUploadErrorDetails($file_id) + { + + } + //------------------------------------- public function getAgeRange($terms,$familyFloatesValue) @@ -4246,6 +4269,28 @@ class EmployeeRestController extends AdminController public function hrFileList() { try { + + $request = service('request'); + $search_data = $request->getGetPost() ?? []; + + // Fetch results + $data = $this->getDataFromFilesTable($search_data); + + return $this->respond([ + 'status' => true, + 'message' => 'File list fetched successfully', + 'data' => $data + ]); + + } catch (\Exception $e) { + return $this->failServerError($e->getMessage()); + } + } + + public function hrFileListOld() + { + try { + $request = service('request'); $builder = $this->hrFileUploadModel; diff --git a/app/Controllers/EmployeeServiceController.php b/app/Controllers/EmployeeServiceController.php index c52ebd7..69c1d0f 100755 --- a/app/Controllers/EmployeeServiceController.php +++ b/app/Controllers/EmployeeServiceController.php @@ -765,6 +765,14 @@ class EmployeeServiceController extends AdminController // get policy and rack details $policy_details = $this->clientPolicyModel->getPolicyDetails($file['client_id'],$file['policy_id']); + + if(empty($policy_details)){ + $message = "Policy configuration is incomplete. Cannot proceed."; + $this->myLogger->logme('error',($message . ' for file id ' . $file_id)); + $this->fileModel->where('id', $file_id)->set(['status' => 'failed','reason' => json_encode(['error_summary' => array_count_values([5]),'error_data' => $message])])->update(); + return array('error_summary' => [5], 'error_data' => $message); + } + $policy_terms = json_decode($policy_details[0]->policy_terms); $policy_terms = (array) $policy_terms;// convert obj to array $default_age_ratio = isset($policy_terms['age_ratio']) ? json_decode(json_encode($policy_terms['age_ratio']),true) : []; @@ -775,6 +783,13 @@ class EmployeeServiceController extends AdminController $slab_details = $this->policiesModel->getPolicySlabRatesForEmpOnboard($file['policy_id'],$file['client_id']); // dd($slab_details); + if(empty($slab_details) || (isset($slab_details['slab_rates']) && empty($slab_details['slab_rates']))){ + $message = "Policy configuration is incomplete. Cannot proceed."; + $this->myLogger->logme('error',($message . ' for file id ' . $file_id)); + $this->fileModel->where('id', $file_id)->set(['status' => 'failed','reason' => json_encode(['error_summary' => array_count_values([5]),'error_data' => $message])])->update(); + return array('error_summary' => [5], 'error_data' => $message); + } + //remove header unset($excel_data[0]); $relationship = $this->general_relationships; diff --git a/app/Filters/GlobalPostFileUploadGuard.php b/app/Filters/GlobalPostFileUploadGuard.php index 4cc82ba..35476b6 100644 --- a/app/Filters/GlobalPostFileUploadGuard.php +++ b/app/Filters/GlobalPostFileUploadGuard.php @@ -39,7 +39,7 @@ class GlobalPostFileUploadGuard implements FilterInterface ]; protected array $blockedExtensions = [ - 'php', 'phtml', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps', + 'php', 'phtml', 'html', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps', 'cgi', 'fcgi', 'pl', 'py', 'rb', 'lua', 'tcl', 'go', 'rs', 'jar', 'class', 'exe', 'dll', 'com', 'bat', 'cmd', 'msi', 'vbs', 'ps1', 'scr', 'sh', 'bash', 'zsh', 'apk', 'app', 'deb', 'rpm', 'bin', 'run', @@ -100,7 +100,7 @@ class GlobalPostFileUploadGuard implements FilterInterface } // --- 2. Double Extension Attack Check --- - if (preg_match('/\.(php|phtml|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) { + if (preg_match('/\.(php|phtml|html|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) { $this->block("Double extension attack", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size); } diff --git a/app/Helpers/utility_helper.php b/app/Helpers/utility_helper.php index d1f858b..71eeb49 100755 --- a/app/Helpers/utility_helper.php +++ b/app/Helpers/utility_helper.php @@ -739,12 +739,14 @@ if (!function_exists('validateExcelFile')) { function validateExcelFile($file) { - $allowed = [ - 'application/vnd.ms-excel', + $allowed = [ + 'application/vnd.ms-excel','application/vnd', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', - 'application/vnd.oasis.opendocument.spreadsheet' + 'application/vnd.oasis.opendocument.spreadsheet', + 'application/octet-stream' ]; + // if ($file->getError() !== UPLOAD_ERR_OK) return 'Upload error'; // if ($file->getSize() > (16 * 1024 * 1024)) return 'File too large'; // if (!in_array($file->getClientMimeType(), $allowed, true)) return 'Invalid file type'; diff --git a/app/Views/layout/footer.php b/app/Views/layout/footer.php index ec1ca32..a412cef 100755 --- a/app/Views/layout/footer.php +++ b/app/Views/layout/footer.php @@ -62,69 +62,88 @@ - +
- - - - + + - - - - + + + + - - - - - - - - - - - - - + + + + + + + + + + + + + + + - + + + - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - + + - - - - + + + - - - + + + + - - - - - - - - + + + + + + + - - - - + + + + - - - - - - - - - - - - - - - + + + + + + + + + + + + + - - - + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - - + + + + + - - - + + + + - - - - + + + + + + + - - - + + + + + + - - + + - - + + - - + + @@ -77,7 +77,7 @@ --> - + diff --git a/app/Views/layout/header_new.php b/app/Views/layout/header_new.php index 297f7f2..e021d8a 100644 --- a/app/Views/layout/header_new.php +++ b/app/Views/layout/header_new.php @@ -50,34 +50,34 @@ /assets/css/jodit.css" rel="stylesheet" type="text/css" /> - - + + - - + + - - + + - - + + - + - + @@ -329,84 +329,8 @@ }); - - @@ -420,24 +344,219 @@ -
+
+ +
+
+ + + +
+ + + +
+ + +
+
+
+
+ + +
+ + + +
+