Nhances/nhance
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FIX_BE_VALIDATION_FAQ&APP_CONTENT_MGMT

Browse Source
This commit is contained in:
velz 2026-02-27 13:03:30 +05:30
parent f1860e80e2
commit 0037133f8a
1 changed files with 209 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

282
app/Controllers/AppContentManagementController.php
View File

@ -62,32 +62,40 @@ class AppContentManagementController extends AdminController
$data = $this->request->getPost(); $data = $this->request->getPost();
$sanitized_post_data = sanitizeInputArrayAdvanced($data); $sanitized_post_data = sanitizeInputArrayAdvanced($data);
$id = ((int) $sanitized_post_data['add_image_id']) ?? null; $id = (int)($sanitized_post_data['add_image_id'] ?? 0);
$rules = [ $rules = [
'client_id' => [ 'add_image_id' => [
'rules' => 'required|integer', 'rules' => 'permit_empty|integer|is_natural',
'errors' => [ 'errors' => [
'required' => 'Client is required', 'integer' => 'Image ID must be a valid number',
'integer' => 'Invalid client selected' 'is_natural' => 'Image ID must be a non-negative number'
]
],
'client_id' => [
'rules' => 'required|integer|is_natural_no_zero',
'errors' => [
'required' => 'Client is required',
'integer' => 'Invalid client selected',
'is_natural_no_zero' => 'Invalid client selected'
]
],
'advertise_image' => [
'rules' => ($id === 0 ? 'uploaded[advertise_image]|' : '')
. 'is_image[advertise_image]'
. '|mime_in[advertise_image,image/jpg,image/jpeg,image/png]'
. '|max_size[advertise_image,200]'
. '|min_dims[advertise_image,1640,664]'
. '|max_dims[advertise_image,1640,664]',
'errors' => [
'uploaded' => 'Image is required',
'is_image' => 'File must be an image',
'mime_in' => 'Only JPG, JPEG, PNG allowed',
'max_size' => 'Image size must not exceed 200 KB',
'min_dims' => 'Image dimensions must be exactly 1640x664 pixels',
'max_dims' => 'Image dimensions must be exactly 1640x664 pixels',
] ]
], ],
];
$rules['advertise_image'] = [
'rules' => ($id === 0 ? 'uploaded[advertise_image]|' : '') // required only for ADD
. 'is_image[advertise_image]'
. '|mime_in[advertise_image,image/jpg,image/jpeg,image/png]'
. '|max_size[advertise_image,200]'
. '|min_dims[advertise_image,1640,664]'
. '|max_dims[advertise_image,1640,664]',
'errors' => [
'uploaded' => 'Image is required',
'is_image' => 'File must be an image',
'mime_in' => 'Only JPG, JPEG, PNG allowed',
'max_size' => 'Image size must not exceed 200 KB',
'min_dims' => 'Image dimensions must be exactly 1640x664 pixels',
'max_dims' => 'Image dimensions must be exactly 1640x664 pixels',
]
]; ];
if (!$this->validate($rules)) { if (!$this->validate($rules)) {
return $this->response->setStatusCode(400)->setJSON([ return $this->response->setStatusCode(400)->setJSON([
@ -100,7 +108,12 @@ class AppContentManagementController extends AdminController
$file = $this->request->getFile('advertise_image'); $file = $this->request->getFile('advertise_image');
$client_id = $sanitized_post_data['client_id'] ?? null; $client_id = (int)($sanitized_post_data['client_id'] ?? 0);
$clientExists = $this->clientModel->where('id', $client_id)->where('is_active', 1)->first();
if (!$clientExists) {
return $this->respond(['status' => false, 'message' => 'Invalid client selected.'], 400);
}
if (!$file || !$file->isValid()) { if (!$file || !$file->isValid()) {
return $this->respond(['status' => false, 'message' => 'No file uploaded or invalid file.'], 400); return $this->respond(['status' => false, 'message' => 'No file uploaded or invalid file.'], 400);
@ -119,12 +132,15 @@ class AppContentManagementController extends AdminController
$file->move($uploadPath, $fileName); $file->move($uploadPath, $fileName);
$id = $sanitized_post_data['add_image_id'] ?? null;
$details = ['name' => $fileName,'client_id'=>$client_id]; $details = ['name' => $fileName,'client_id'=>$client_id];
if ($id == 0) { if ($id === 0) {
$this->addImgModel->insert($details); $this->addImgModel->insert($details);
} else { } else {
$existingRecord = $this->addImgModel->find($id);
if (!$existingRecord) {
return $this->respond(['status' => false, 'message' => 'Record not found for update.'], 404);
}
$this->addImgModel->update($id, $details); $this->addImgModel->update($id, $details);
} }
@ -138,14 +154,34 @@ class AppContentManagementController extends AdminController
public function remove_advertise_image() public function remove_advertise_image()
{ {
try { try {
$id = $this->request->getPost('add_image_id'); $rules = [
'add_image_id' => [
'rules' => 'required|integer|is_natural_no_zero',
'errors' => [
'required' => 'Image ID is required',
'integer' => 'Image ID must be a valid number',
'is_natural_no_zero' => 'Image ID must be a positive number'
]
]
];
if (!$id) { if (!$this->validate($rules)) {
return $this->respond(['status' => false, 'message' => 'ID missing'], 400); return $this->response->setStatusCode(400)->setJSON([
'status' => false,
'message' => 'Input validation failed',
'code' => 400,
'errors' => $this->validator->getErrors()
]);
} }
$data = ['is_active' => 0]; $id = (int)$this->request->getPost('add_image_id');
$this->addImgModel->update($id, $data);
$existing = $this->addImgModel->find($id);
if (!$existing) {
return $this->respond(['status' => false, 'message' => 'Record not found'], 404);
}
$this->addImgModel->update($id, ['is_active' => 0]);
return $this->respond(['status' => true, 'message' => 'Deleted successfully']); return $this->respond(['status' => true, 'message' => 'Deleted successfully']);
@ -158,19 +194,27 @@ class AppContentManagementController extends AdminController
// Preview image Went Edit. // Preview image Went Edit.
public function showAdvertiseImage($filename) public function showAdvertiseImage($filename)
{ {
// $path = WRITEPATH . 'uploads/advertiseImage/' . $filename; $filename = basename($filename);
$path = ROOTPATH . 'public/uploads/add_image_upload/' . $filename;
if (!file_exists($path)) { if (!preg_match('/^[a-zA-Z0-9_\-]+\.(jpg|jpeg|png|gif|webp)$/i', $filename)) {
throw \CodeIgniter\Exceptions\PageNotFoundException::forPageNotFound(); throw \CodeIgniter\Exceptions\PageNotFoundException::forPageNotFound();
// return $this->response->setStatusCode(404, 'File not found');
} }
$mime = mime_content_type($path); $path = ROOTPATH . 'public/uploads/add_image_upload/' . $filename;
// header('Content-Type: ' . $mimeType); $realPath = realpath($path);
// readfile($path); $allowedDir = realpath(ROOTPATH . 'public/uploads/add_image_upload');
// exit;
return $this->response->setHeader('Content-Type', $mime)->setBody(file_get_contents($path)); if (!$realPath || strpos($realPath, $allowedDir) !== 0 || !file_exists($realPath)) {
throw \CodeIgniter\Exceptions\PageNotFoundException::forPageNotFound();
}
$mime = mime_content_type($realPath);
$allowedMimes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
if (!in_array($mime, $allowedMimes, true)) {
throw \CodeIgniter\Exceptions\PageNotFoundException::forPageNotFound();
}
return $this->response->setHeader('Content-Type', $mime)->setBody(file_get_contents($realPath));
} }
@ -183,39 +227,51 @@ class AppContentManagementController extends AdminController
if ($this->request->getMethod() === 'post') { if ($this->request->getMethod() === 'post') {
$rules = [ $rules = [
'type' => [ 'fe_id' => [
'rules' => 'required|max_length[255]', 'rules' => 'permit_empty|integer|is_natural',
'errors' => [ 'errors' => [
'required' => 'Type is required', 'integer' => 'ID must be a valid number',
'max_length' => 'Type cannot exceed 255 characters' 'is_natural' => 'ID must be a non-negative number'
]
],
'type' => [
'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \-]+$/]',
'errors' => [
'required' => 'Type is required',
'max_length' => 'Type cannot exceed 255 characters',
'regex_match' => 'Type contains invalid characters'
] ]
], ],
'content_section' => [ 'content_section' => [
'rules' => 'required|max_length[255]', 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9_ \-]+$/]',
'errors' => [ 'errors' => [
'required' => 'Content Section is required', 'required' => 'Content Section is required',
'max_length' => 'Content Section cannot exceed 255 characters' 'max_length' => 'Content Section cannot exceed 255 characters',
'regex_match' => 'Content Section contains invalid characters'
] ]
], ],
'heading' => [ 'heading' => [
'rules' => 'required|max_length[255]', 'rules' => 'required|max_length[255]|regex_match[/^[a-zA-Z0-9 _\-.,;:!?()&\/]+$/]',
'errors' => [ 'errors' => [
'required' => 'Heading is required', 'required' => 'Heading is required',
'max_length' => 'Heading cannot exceed 255 characters' 'max_length' => 'Heading cannot exceed 255 characters',
'regex_match' => 'Heading contains invalid characters. Only letters, numbers, spaces and basic punctuation are allowed'
] ]
], ],
'content' => [ 'content' => [
'rules' => 'required|max_length[5000]', 'rules' => 'required|max_length[5000]|regex_match[/^[a-zA-Z0-9 _\-.,;:!?()&\/\r\n]+$/]',
'errors' => [ 'errors' => [
'required' => 'Content is required', 'required' => 'Content is required',
'max_length' => 'Content cannot exceed 5000 characters' 'max_length' => 'Content cannot exceed 5000 characters',
'regex_match' => 'Content contains invalid characters. Only letters, numbers, spaces and basic punctuation are allowed'
] ]
], ],
'notes' => [ 'notes' => [
'rules' => 'required|max_length[1500]', 'rules' => 'required|max_length[1500]|regex_match[/^[a-zA-Z0-9 _\-.,;:!?()&\/\r\n]+$/]',
'errors' => [ 'errors' => [
'required' => 'Notes are required', 'required' => 'Notes are required',
'max_length' => 'Notes cannot exceed 1500 characters' 'max_length' => 'Notes cannot exceed 1500 characters',
'regex_match' => 'Notes contains invalid characters. Only letters, numbers, spaces and basic punctuation are allowed'
] ]
] ]
]; ];
@ -230,8 +286,14 @@ class AppContentManagementController extends AdminController
} }
$request_post_data = $this->request->getPost(); $request_post_data = $this->request->getPost();
$data = sanitizeInputArrayAdvanced($request_post_data); $data = sanitizeInputArrayAdvanced($request_post_data);
$id = $data['fe_id']; $id = $data['fe_id'] ?? null;
if (!empty($id) && (!ctype_digit((string)$id) || (int)$id <= 0)) {
return $this->response->setStatusCode(400)->setJSON([
'status' => false, 'message' => 'Invalid ID format', 'code' => 400
]);
}
$id = !empty($id) ? (int)$id : null;
unset($data['fe_id']); unset($data['fe_id']);
@ -244,6 +306,12 @@ class AppContentManagementController extends AdminController
$status = $this->feContentModel->insert($data); $status = $this->feContentModel->insert($data);
$text = "Created"; $text = "Created";
} else { } else {
$existing = $this->feContentModel->find($id);
if (!$existing) {
return $this->response->setStatusCode(404)->setJSON([
'status' => false, 'message' => 'Record not found', 'code' => 404
]);
}
$status = $this->feContentModel->update($id, $data); $status = $this->feContentModel->update($id, $data);
$text = "Updated"; $text = "Updated";
} }
@ -261,6 +329,13 @@ class AppContentManagementController extends AdminController
if (!empty($id)) { if (!empty($id)) {
if (!ctype_digit((string)$id) || (int)$id <= 0) {
return $this->response->setStatusCode(400)->setJSON([
'status' => false, 'code' => 400, 'message' => 'Invalid ID format'
]);
}
$id = (int)$id;
$data['fe_list'] = $this->feContentModel->where('id', $id)->orderBy('id', 'DESC')->findAll(); $data['fe_list'] = $this->feContentModel->where('id', $id)->orderBy('id', 'DESC')->findAll();
if (!empty($data)) { if (!empty($data)) {
@ -276,16 +351,24 @@ class AppContentManagementController extends AdminController
} elseif ($method === 'delete') { } elseif ($method === 'delete') {
// $input = $this->request->getRawInput(); $id = $this->request->getGet('fe_id') ?? null;
$id = $this->request->getGet('fe_id'); // ✅ THIS
$id = $id ?? null;
if (empty($id)) { if (empty($id) || !ctype_digit((string)$id) || (int)$id <= 0) {
return $this->respond([
'status' => false,
'code' => 400,
'message' => 'Valid numeric ID is required for deletion'
], 400);
}
$id = (int)$id;
$existing = $this->feContentModel->find($id);
if (!$existing) {
return $this->respond([ return $this->respond([
'status' => false, 'status' => false,
'code' => 404, 'code' => 404,
'message' => 'No ID provided for deletion' 'message' => 'Record not found'
], 200); ], 404);
} }
$update_status = $this->feContentModel->where('id', $id)->set(['is_active' => 0])->update(); $update_status = $this->feContentModel->where('id', $id)->set(['is_active' => 0])->update();
@ -309,10 +392,15 @@ class AppContentManagementController extends AdminController
} }
private const ALLOWED_RETURN_TYPES = ['api', 'web'];
public function FAQ() public function FAQ()
{ {
$method = strtolower($this->request->getMethod()); $method = strtolower($this->request->getMethod());
$returnType = strtolower($this->request->getGet('return_type') ?? 'api'); $returnType = strtolower($this->request->getGet('return_type') ?? 'api');
if (!in_array($returnType, self::ALLOWED_RETURN_TYPES, true)) {
$returnType = 'api';
}
$ref = ['timestamp' => date('Y-m-d H:i:s')]; $ref = ['timestamp' => date('Y-m-d H:i:s')];
try { try {
@ -320,33 +408,64 @@ class AppContentManagementController extends AdminController
if ($method === 'post') { if ($method === 'post') {
$rules = [ $rules = [
'category' => [ 'category' => [
'rules' => 'required', 'rules' => 'required|max_length[100]|alpha_numeric_space',
'errors' => [ 'errors' => [
'required' => 'Category is required' 'required' => 'Category is required',
'max_length' => 'Category cannot exceed 100 characters',
'alpha_numeric_space' => 'Category contains invalid characters'
] ]
], ],
'question' => [ 'question' => [
'rules' => 'required', 'rules' => 'required|max_length[1000]|regex_match[/^[a-zA-Z0-9 _\-.,;:!?()&\/\r\n]+$/]',
'errors' => [ 'errors' => [
'required' => 'Question is required' 'required' => 'Question is required',
'max_length' => 'Question cannot exceed 1000 characters',
'regex_match' => 'Question contains invalid characters. Only letters, numbers, spaces and basic punctuation are allowed'
] ]
], ],
'answer' => [ 'answer' => [
'rules' => 'required', 'rules' => 'required|max_length[5000]|regex_match[/^[a-zA-Z0-9 _\-.,;:!?()&\/\r\n]+$/]',
'errors' => [ 'errors' => [
'required' => 'Answer is required' 'required' => 'Answer is required',
'max_length' => 'Answer cannot exceed 5000 characters',
'regex_match' => 'Answer contains invalid characters. Only letters, numbers, spaces and basic punctuation are allowed'
] ]
] ]
]; ];
if (!$this->validate($rules)) {
return $this->response->setStatusCode(400)->setJSON([
'status' => 'error',
'message' => 'Input validation failed',
'code' => 400,
'errors' => $this->validator->getErrors(),
'ref' => $ref
]);
}
$request_post_data = $this->request->getPost(); $request_post_data = $this->request->getPost();
$sanitized_post_data = sanitizeInputArrayAdvanced($request_post_data); $sanitized_post_data = sanitizeInputArrayAdvanced($request_post_data);
$data = array_filter($sanitized_post_data, fn($v) => $v !== '' && $v !== null); $data = array_filter($sanitized_post_data, fn($v) => $v !== '' && $v !== null);
$id = $data['faq_id']; $id = $data['faq_id'] ?? null;
if (!empty($id) && (!ctype_digit((string)$id) || (int)$id <= 0)) {
return $this->response->setStatusCode(400)->setJSON([
'status' => 'error', 'message' => 'Invalid FAQ ID format', 'code' => 400, 'ref' => $ref
]);
}
$id = !empty($id) ? (int)$id : null;
unset($data['faq_id']);
if (empty($id)) { if (empty($id)) {
$status = $this->faqModel->insert($data); $status = $this->faqModel->insert($data);
$msg = "Created"; $msg = "Created";
} else { } else {
$existing = $this->faqModel->find($id);
if (!$existing) {
return $this->response->setStatusCode(404)->setJSON([
'status' => 'error', 'message' => 'FAQ not found', 'code' => 404, 'ref' => $ref
]);
}
$status = $this->faqModel->update($id, $data); $status = $this->faqModel->update($id, $data);
$msg = "Updated"; $msg = "Updated";
} }
@ -372,10 +491,17 @@ class AppContentManagementController extends AdminController
$id = $this->request->getGet('faq_id'); $id = $this->request->getGet('faq_id');
if (!empty($id)) { if (!empty($id)) {
if (!ctype_digit((string)$id) || (int)$id <= 0) {
return $this->response->setStatusCode(400)->setJSON([
'status' => 'error', 'message' => 'Invalid FAQ ID format', 'code' => 400, 'ref' => $ref
]);
}
$id = (int)$id;
if($returnType === 'web'){ if($returnType === 'web'){
$row = $this->faqModel->find((int)$id); $row = $this->faqModel->find($id);
}else{ }else{
$row = $this->faqModel->where('is_active', 1)->find((int)$id); $row = $this->faqModel->where('is_active', 1)->find($id);
} }
$data['faq_list'] = $row ? [$row] : []; $data['faq_list'] = $row ? [$row] : [];
@ -417,7 +543,15 @@ class AppContentManagementController extends AdminController
// --- 3. DELETE: SOFT DELETE --- // --- 3. DELETE: SOFT DELETE ---
elseif ($method === 'delete') { elseif ($method === 'delete') {
$id = $this->request->getGet('faq_id'); $id = $this->request->getGet('faq_id');
$status = (!empty($id)) ? $this->faqModel->update($id, ['is_active' => 0]) : false;
if (empty($id) || !ctype_digit((string)$id) || (int)$id <= 0) {
return $this->response->setJSON([
'status' => 'error', 'message' => 'Valid numeric FAQ ID is required', 'code' => 400, 'ref' => $ref
])->setStatusCode(400);
}
$id = (int)$id;
$status = $this->faqModel->find($id) ? $this->faqModel->update($id, ['is_active' => 0]) : false;
return $this->response->setJSON([ return $this->response->setJSON([
'status' => $status ? ($returnType === 'web' ? true : 'success') : ($returnType === 'web' ? false : 'error'), 'status' => $status ? ($returnType === 'web' ? true : 'success') : ($returnType === 'web' ? false : 'error'),
@ -429,12 +563,12 @@ class AppContentManagementController extends AdminController
} }
} catch (\Throwable $e) { } catch (\Throwable $e) {
$msg = $e->getMessage(); log_message('error', 'FAQ error: ' . $e->getMessage() . ' in ' . $e->getFile() . ':' . $e->getLine());
return $this->response->setJSON([ return $this->response->setJSON([
'status' => $returnType === 'web' ? false : 'error', 'status' => $returnType === 'web' ? false : 'error',
'code' => 500, 'code' => 500,
'message' => $msg, 'message' => 'An internal error occurred. Please try again later.',
'ref' => ['file' => $e->getFile(), 'line' => $e->getLine()] 'ref' => $ref
])->setStatusCode(500); ])->setStatusCode(500);
} }
} }