From 25cc7cbbe0a218c17d7380da2d232f4410881c8d Mon Sep 17 00:00:00 2001 From: "venkatesh.r" Date: Sat, 31 Jan 2026 12:35:14 +0530 Subject: [PATCH] FIX_HR_RELATED_ISSUE --- app/Config/Routes.php | 2 +- app/Controllers/EmployeeController.php | 2 +- app/Controllers/EmployeeRestController.php | 30 ++++++++++++------- app/Controllers/EmployeeServiceController.php | 15 ++++++++++ app/Filters/GlobalPostFileUploadGuard.php | 4 +-- 5 files changed, 39 insertions(+), 14 deletions(-) diff --git a/app/Config/Routes.php b/app/Config/Routes.php index 129e9d4e..69bf3571 100755 --- a/app/Config/Routes.php +++ b/app/Config/Routes.php @@ -600,7 +600,7 @@ $routes->group("employeeRest", ['filter' => ['appSignature'] ], function ($route }); -$routes->group("employeeRest", ["filter" => ['appSignature' , 'authJWT']], function ($routes) { + $routes->group("employeeRest", ["filter" => ['GlobalPostFileUploadGuard', 'appSignature', 'authJWT']], function ($routes) { $routes->post('logout', 'RestAuthenticationController::logout'); diff --git a/app/Controllers/EmployeeController.php b/app/Controllers/EmployeeController.php index edcae43c..c1d2d717 100755 --- a/app/Controllers/EmployeeController.php +++ b/app/Controllers/EmployeeController.php @@ -335,7 +335,7 @@ class EmployeeController extends AdminController //endof validation process if (isset($result['error_summary']) && count($result['error_summary'])) { if(!empty($post_data)){ - return ['status' => true, 'message' => 'file rejected with errors', 'file_id' => $file_id]; + return ['status' => false, 'message' => 'file rejected with errors', 'file_id' => $file_id]; }else{ return $this->respond(['dataStatus' => false, 'code' => 404, 'message' => 'file rejected with errors'], 200); } diff --git a/app/Controllers/EmployeeRestController.php b/app/Controllers/EmployeeRestController.php index 379fe023..f18b0a1a 100755 --- a/app/Controllers/EmployeeRestController.php +++ b/app/Controllers/EmployeeRestController.php @@ -4521,6 +4521,7 @@ class EmployeeRestController extends AdminController // Handle raw client_id vs MD5 if (is_string($post_data['client_id']) && preg_match('/^[a-f0-9]{32}$/i', $post_data['client_id'])) { $client_data = $this->clientModel->where('MD5(id)', $post_data['client_id'])->first(); + $post_data['client_id'] = $client_data['id']; } else { $client_data = $this->clientModel->where('id', $post_data['client_id'])->first(); } @@ -4529,10 +4530,6 @@ class EmployeeRestController extends AdminController return $this->respondCreated(['status' => false, 'message' => 'Invalid Client Id', 'data' => []]); } - $post_data['client_id'] = $client_data['id']; - - - // print_r($client_data); die; if($client_data['hr_file_processed_by'] == 1){ @@ -4783,13 +4780,14 @@ class EmployeeRestController extends AdminController $data = $this->getDataFromHrFileUploadTable($search_data); $table = "hr_file_upload"; }else{ - $client_data = $this->clientModel->where('id', $search_data['client_id'])->first(); + $client_data = $this->clientModel->where('MD5(id)', $search_data['client_id'])->first(); if($client_data['hr_file_processed_by'] == 1){ - $data = $this->getDataFromHrFileUploadTable($search_data); - $table = "hr_file_upload 2"; - }else{ $data = $this->getDataFromHrFilesTable($search_data); $table = "files"; + }else{ + $data = $this->getDataFromHrFileUploadTable($search_data); + $table = "hr_file_upload 2"; + } } @@ -4800,8 +4798,20 @@ class EmployeeRestController extends AdminController 'table' => $table ]); - } catch (\Exception $e) { - return $this->failServerError($e->getMessage()); + } catch (\Exception $th) { + + $errorData = [ + 'message' => $th->getMessage(), + 'file' => $th->getFile(), + 'line' => $th->getLine(), + 'code' => $th->getCode(), + 'trace' => $th->getTraceAsString(), + 'trace_array' => $th->getTrace(), // full array version (optional) + 'function' => $th->getTrace()[0]['function'] ?? null, + 'class' => $th->getTrace()[0]['class'] ?? null, + ]; + + return $this->failServerError($th->getMessage()); } } diff --git a/app/Controllers/EmployeeServiceController.php b/app/Controllers/EmployeeServiceController.php index 78bf3162..84761c68 100755 --- a/app/Controllers/EmployeeServiceController.php +++ b/app/Controllers/EmployeeServiceController.php @@ -866,6 +866,14 @@ class EmployeeServiceController extends AdminController // get policy and rack details $policy_details = $this->clientPolicyModel->getPolicyDetails($file['client_id'],$file['policy_id']); + + if(empty($policy_details)){ + $message = "Policy configuration is incomplete. Cannot proceed."; + $this->myLogger->logme('error',($message . ' for file id ' . $file_id)); + $this->fileModel->where('id', $file_id)->set(['status' => 'failed','reason' => json_encode(['error_summary' => array_count_values([5]),'error_data' => $message])])->update(); + return array('error_summary' => [5], 'error_data' => $message); + } + $policy_terms = json_decode($policy_details[0]->policy_terms); $policy_terms = (array) $policy_terms;// convert obj to array $default_age_ratio = isset($policy_terms['age_ratio']) ? json_decode(json_encode($policy_terms['age_ratio']),true) : []; @@ -876,6 +884,13 @@ class EmployeeServiceController extends AdminController $slab_details = $this->policiesModel->getPolicySlabRatesForEmpOnboard($file['policy_id'],$file['client_id']); // dd($slab_details); + if(empty($slab_details) || (isset($slab_details['slab_rates']) && empty($slab_details['slab_rates']))){ + $message = "Policy configuration is incomplete. Cannot proceed."; + $this->myLogger->logme('error',($message . ' for file id ' . $file_id)); + $this->fileModel->where('id', $file_id)->set(['status' => 'failed','reason' => json_encode(['error_summary' => array_count_values([5]),'error_data' => $message])])->update(); + return array('error_summary' => [5], 'error_data' => $message); + } + //remove header unset($excel_data[0]); $relationship = $this->general_relationships; diff --git a/app/Filters/GlobalPostFileUploadGuard.php b/app/Filters/GlobalPostFileUploadGuard.php index 4cc82ba8..76117240 100644 --- a/app/Filters/GlobalPostFileUploadGuard.php +++ b/app/Filters/GlobalPostFileUploadGuard.php @@ -39,7 +39,7 @@ class GlobalPostFileUploadGuard implements FilterInterface ]; protected array $blockedExtensions = [ - 'php', 'phtml', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps', + 'php', 'phtml', 'html', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps', 'cgi', 'fcgi', 'pl', 'py', 'rb', 'lua', 'tcl', 'go', 'rs', 'jar', 'class', 'exe', 'dll', 'com', 'bat', 'cmd', 'msi', 'vbs', 'ps1', 'scr', 'sh', 'bash', 'zsh', 'apk', 'app', 'deb', 'rpm', 'bin', 'run', @@ -100,7 +100,7 @@ class GlobalPostFileUploadGuard implements FilterInterface } // --- 2. Double Extension Attack Check --- - if (preg_match('/\.(php|phtml|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) { + if (preg_match('/\.(php|html|phtml|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) { $this->block("Double extension attack", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size); }