Nhances/nhance
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FIX_HR_RELATED_ISSUE

Browse Source
This commit is contained in:
VENKATESHWARAN 2026-01-31 12:35:14 +05:30
parent 9f35e20e2b
commit 25cc7cbbe0
5 changed files with 39 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
app/Config/Routes.php
View File

@ -600,7 +600,7 @@ $routes->group("employeeRest", ['filter' => ['appSignature'] ], function ($route
});
$routes->group("employeeRest", ["filter" => ['appSignature' , 'authJWT']], function ($routes) {
$routes->group("employeeRest", ["filter" => ['GlobalPostFileUploadGuard', 'appSignature', 'authJWT']], function ($routes) {
$routes->post('logout', 'RestAuthenticationController::logout');

2
app/Controllers/EmployeeController.php
View File

@ -335,7 +335,7 @@ class EmployeeController extends AdminController
//endof validation process
if (isset($result['error_summary']) && count($result['error_summary'])) {
if(!empty($post_data)){
return ['status' => true, 'message' => 'file rejected with errors', 'file_id' => $file_id];
return ['status' => false, 'message' => 'file rejected with errors', 'file_id' => $file_id];
}else{
return $this->respond(['dataStatus' => false, 'code' => 404, 'message' => 'file rejected with errors'], 200);
}

30
app/Controllers/EmployeeRestController.php
View File

@ -4521,6 +4521,7 @@ class EmployeeRestController extends AdminController
// Handle raw client_id vs MD5
if (is_string($post_data['client_id']) && preg_match('/^[a-f0-9]{32}$/i', $post_data['client_id'])) {
$client_data = $this->clientModel->where('MD5(id)', $post_data['client_id'])->first();
$post_data['client_id'] = $client_data['id'];
} else {
$client_data = $this->clientModel->where('id', $post_data['client_id'])->first();
}
@ -4529,10 +4530,6 @@ class EmployeeRestController extends AdminController
return $this->respondCreated(['status' => false, 'message' => 'Invalid Client Id', 'data' => []]);
}
$post_data['client_id'] = $client_data['id'];
// print_r($client_data); die;
if($client_data['hr_file_processed_by'] == 1){
@ -4783,13 +4780,14 @@ class EmployeeRestController extends AdminController
$data = $this->getDataFromHrFileUploadTable($search_data);
$table = "hr_file_upload";
}else{
$client_data = $this->clientModel->where('id', $search_data['client_id'])->first();
$client_data = $this->clientModel->where('MD5(id)', $search_data['client_id'])->first();
if($client_data['hr_file_processed_by'] == 1){
$data = $this->getDataFromHrFileUploadTable($search_data);
$table = "hr_file_upload 2";
}else{
$data = $this->getDataFromHrFilesTable($search_data);
$table = "files";
}else{
$data = $this->getDataFromHrFileUploadTable($search_data);
$table = "hr_file_upload 2";
}
}
@ -4800,8 +4798,20 @@ class EmployeeRestController extends AdminController
'table' => $table
]);
} catch (\Exception $e) {
return $this->failServerError($e->getMessage());
} catch (\Exception $th) {
$errorData = [
'message' => $th->getMessage(),
'file' => $th->getFile(),
'line' => $th->getLine(),
'code' => $th->getCode(),
'trace' => $th->getTraceAsString(),
'trace_array' => $th->getTrace(), // full array version (optional)
'function' => $th->getTrace()[0]['function'] ?? null,
'class' => $th->getTrace()[0]['class'] ?? null,
];
return $this->failServerError($th->getMessage());
}
}

15
app/Controllers/EmployeeServiceController.php
View File

@ -866,6 +866,14 @@ class EmployeeServiceController extends AdminController
// get policy and rack details
$policy_details = $this->clientPolicyModel->getPolicyDetails($file['client_id'],$file['policy_id']);
if(empty($policy_details)){
$message = "Policy configuration is incomplete. Cannot proceed.";
$this->myLogger->logme('error',($message . ' for file id ' . $file_id));
$this->fileModel->where('id', $file_id)->set(['status' => 'failed','reason' => json_encode(['error_summary' => array_count_values([5]),'error_data' => $message])])->update();
return array('error_summary' => [5], 'error_data' => $message);
}
$policy_terms = json_decode($policy_details[0]->policy_terms);
$policy_terms = (array) $policy_terms;// convert obj to array
$default_age_ratio = isset($policy_terms['age_ratio']) ? json_decode(json_encode($policy_terms['age_ratio']),true) : [];
@ -876,6 +884,13 @@ class EmployeeServiceController extends AdminController
$slab_details = $this->policiesModel->getPolicySlabRatesForEmpOnboard($file['policy_id'],$file['client_id']);
// dd($slab_details);
if(empty($slab_details) || (isset($slab_details['slab_rates']) && empty($slab_details['slab_rates']))){
$message = "Policy configuration is incomplete. Cannot proceed.";
$this->myLogger->logme('error',($message . ' for file id ' . $file_id));
$this->fileModel->where('id', $file_id)->set(['status' => 'failed','reason' => json_encode(['error_summary' => array_count_values([5]),'error_data' => $message])])->update();
return array('error_summary' => [5], 'error_data' => $message);
}
//remove header
unset($excel_data[0]);
$relationship = $this->general_relationships;

4
app/Filters/GlobalPostFileUploadGuard.php
View File

@ -39,7 +39,7 @@ class GlobalPostFileUploadGuard implements FilterInterface
];
protected array $blockedExtensions = [
'php', 'phtml', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps',
'php', 'phtml', 'html', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps',
'cgi', 'fcgi', 'pl', 'py', 'rb', 'lua', 'tcl', 'go', 'rs', 'jar', 'class',
'exe', 'dll', 'com', 'bat', 'cmd', 'msi', 'vbs', 'ps1', 'scr',
'sh', 'bash', 'zsh', 'apk', 'app', 'deb', 'rpm', 'bin', 'run',
@ -100,7 +100,7 @@ class GlobalPostFileUploadGuard implements FilterInterface
}
// --- 2. Double Extension Attack Check ---
if (preg_match('/\.(php|phtml|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) {
if (preg_match('/\.(php|html|phtml|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) {
$this->block("Double extension attack", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
}