FIX_HR_RELATED_ISSUE

app/Config/Routes.php

@@ -600,7 +600,7 @@ $routes->group("employeeRest", ['filter' => ['appSignature'] ], function ($route
 
 });
 
-$routes->group("employeeRest", ["filter" => ['appSignature' , 'authJWT']], function ($routes) {
+ $routes->group("employeeRest", ["filter" => ['GlobalPostFileUploadGuard', 'appSignature', 'authJWT']], function ($routes) {
 
     $routes->post('logout', 'RestAuthenticationController::logout');
 

app/Controllers/EmployeeController.php

@@ -335,7 +335,7 @@ class EmployeeController extends AdminController
                     //endof validation process
                     if (isset($result['error_summary']) && count($result['error_summary'])) {
                         if(!empty($post_data)){
-                            return ['status' => true, 'message' => 'file rejected with errors', 'file_id' => $file_id];
+                            return ['status' => false, 'message' => 'file rejected with errors', 'file_id' => $file_id];
                         }else{
                             return $this->respond(['dataStatus' => false, 'code' => 404, 'message' => 'file rejected with errors'], 200);
                         }

app/Controllers/EmployeeRestController.php

@@ -4521,6 +4521,7 @@ class EmployeeRestController extends AdminController
              // Handle raw client_id vs MD5
             if (is_string($post_data['client_id']) && preg_match('/^[a-f0-9]{32}$/i', $post_data['client_id'])) {
                 $client_data = $this->clientModel->where('MD5(id)',  $post_data['client_id'])->first();
+                $post_data['client_id'] = $client_data['id'];
             } else {
                 $client_data = $this->clientModel->where('id',  $post_data['client_id'])->first();
             }
@@ -4529,10 +4530,6 @@ class EmployeeRestController extends AdminController
                 return $this->respondCreated(['status' => false, 'message' => 'Invalid Client Id', 'data' => []]);
             }
 
-            $post_data['client_id'] = $client_data['id'];
-            
-
-            
             // print_r($client_data); die;
 
             if($client_data['hr_file_processed_by'] == 1){
@@ -4783,13 +4780,14 @@ class EmployeeRestController extends AdminController
                 $data = $this->getDataFromHrFileUploadTable($search_data);
                 $table = "hr_file_upload";
             }else{
-                $client_data = $this->clientModel->where('id', $search_data['client_id'])->first();
+                $client_data = $this->clientModel->where('MD5(id)', $search_data['client_id'])->first();
                 if($client_data['hr_file_processed_by'] == 1){
-                    $data = $this->getDataFromHrFileUploadTable($search_data);
-                    $table = "hr_file_upload 2";
-                }else{
                     $data = $this->getDataFromHrFilesTable($search_data);
                     $table = "files";
+                }else{
+                    $data = $this->getDataFromHrFileUploadTable($search_data);
+                    $table = "hr_file_upload 2";
+
                 }
             }
 
@@ -4800,8 +4798,20 @@ class EmployeeRestController extends AdminController
                 'table'   => $table
             ]);
 
-        } catch (\Exception $e) {
+        } catch (\Exception $th) {
-            return $this->failServerError($e->getMessage());
+
+            $errorData = [
+                'message' => $th->getMessage(),
+                'file'    => $th->getFile(),
+                'line'    => $th->getLine(),
+                'code'    => $th->getCode(),
+                'trace'   => $th->getTraceAsString(),
+                'trace_array' => $th->getTrace(), // full array version (optional)
+                'function' => $th->getTrace()[0]['function'] ?? null,
+                'class' => $th->getTrace()[0]['class'] ?? null,
+            ];
+
+            return $this->failServerError($th->getMessage());
         }
     }
 

app/Controllers/EmployeeServiceController.php

@@ -866,6 +866,14 @@ class EmployeeServiceController extends AdminController
 
         // get policy and rack details
         $policy_details = $this->clientPolicyModel->getPolicyDetails($file['client_id'],$file['policy_id']);
+
+        if(empty($policy_details)){
+            $message = "Policy configuration is incomplete. Cannot proceed.";
+            $this->myLogger->logme('error',($message . ' for file id ' . $file_id));
+            $this->fileModel->where('id', $file_id)->set(['status' => 'failed','reason' => json_encode(['error_summary' => array_count_values([5]),'error_data' => $message])])->update();
+            return  array('error_summary' => [5], 'error_data' => $message); 
+        }
+
         $policy_terms = json_decode($policy_details[0]->policy_terms);
         $policy_terms = (array) $policy_terms;// convert obj to array
         $default_age_ratio = isset($policy_terms['age_ratio']) ? json_decode(json_encode($policy_terms['age_ratio']),true) : [];
@@ -876,6 +884,13 @@ class EmployeeServiceController extends AdminController
         $slab_details = $this->policiesModel->getPolicySlabRatesForEmpOnboard($file['policy_id'],$file['client_id']);
         // dd($slab_details);
 
+        if(empty($slab_details) || (isset($slab_details['slab_rates']) && empty($slab_details['slab_rates']))){
+            $message = "Policy configuration is incomplete. Cannot proceed.";
+            $this->myLogger->logme('error',($message . ' for file id ' . $file_id));
+            $this->fileModel->where('id', $file_id)->set(['status' => 'failed','reason' => json_encode(['error_summary' => array_count_values([5]),'error_data' => $message])])->update();
+            return  array('error_summary' => [5], 'error_data' => $message); 
+        }
+
         //remove header
         unset($excel_data[0]);
         $relationship = $this->general_relationships;

app/Filters/GlobalPostFileUploadGuard.php

@@ -39,7 +39,7 @@ class GlobalPostFileUploadGuard implements FilterInterface
     ];
 
     protected array $blockedExtensions = [
-        'php', 'phtml', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps',
+        'php', 'phtml', 'html', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps',
         'cgi', 'fcgi', 'pl', 'py', 'rb', 'lua', 'tcl', 'go', 'rs', 'jar', 'class',
         'exe', 'dll', 'com', 'bat', 'cmd', 'msi', 'vbs', 'ps1', 'scr',
         'sh', 'bash', 'zsh', 'apk', 'app', 'deb', 'rpm', 'bin', 'run',
@@ -100,7 +100,7 @@ class GlobalPostFileUploadGuard implements FilterInterface
         }
 
         // --- 2. Double Extension Attack Check ---
-        if (preg_match('/\.(php|phtml|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) {
+        if (preg_match('/\.(php|html|phtml|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) {
             $this->block("Double extension attack", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
         }