Nhances/nhance
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sql injecter issue test : GWM

Browse Source
This commit is contained in:
Gowtham M 2026-02-12 12:39:53 +05:30
parent 1fa120779d
commit 4ebf2cb54a
4 changed files with 37 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
app/Controllers/ICICILombardController.php
View File

@ -121,28 +121,28 @@ class ICICILombardController extends AdminController
$body = [
"PolicyNumber" => "4016/PPN/A/O/53185987/00/000",
"CDBGAccountNumber" => "CD-MUM-0026",
"CorrelationId" => "550e8400-e29b-41d4-a716-446655440018",
"CorrelationId" => "550e8400-e29b-41d4-a716-446655440021",
"MemberDetails" => [
[
"MemberEmpId" => "EMPID3625562",
"MemberEmpId" => "EMPID3625564",
"DOJ" => "21-MAR-2019",
"InsuredName" => "Jeeva",
"DOB" => "7-JUL-1993",
"Relationship" => "SELF",
"Gender" => "MALE",
"DOC" => '19-Nov-2025',
"DOC" => '18-Nov-2025',
"SumInsured" => "500000",
"EmailId" => "Jeeva@GMAIL.COM",
"FlagStatus" => "A"
],
[
"MemberEmpId" => "EMPID3625562",
"MemberEmpId" => "EMPID3625564",
"DOJ" => "21-MAR-2019",
"InsuredName" => "Muthu",
"DOB" => "8-AUG-1970",
"Relationship" => "MOTHER",
"Gender" => "FEMALE",
"DOC" => '19-Nov-2025',
"DOC" => '18-Nov-2025',
"EmailId" => "Muthu@GMAIL.COM",
"FlagStatus" => "A"
],
@ -180,8 +180,8 @@ class ICICILombardController extends AdminController
$body = [
"PolicyNumber" => "4016/PPN/A/O/53185987/00/000",
"BatchId" => "3725147",
"CorrelationId" => "550e8400-e29b-41d4-a716-446655440018"
"BatchId" => "3727144",
"CorrelationId" => "550e8400-e29b-41d4-a716-446655440021"
];
$response = call_third_party_api($url, 'POST', $headers, $body, true);
@ -213,9 +213,9 @@ class ICICILombardController extends AdminController
];
$body = [
"PolicyNumber" => "4016/PPN/A/O/53167743/00/000",
"PolicyNumber" => "4016/PPN/A/O/53185987/00/000",
"IMID" => "201580517901",
"CorrelationId" => "550e8400-e29b-41d4-a716-446655440018"
"CorrelationId" => "550e8400-e29b-41d4-a716-446655440020"
];
$response = call_third_party_api($url, 'POST', $headers, $body, true);

16
app/Models/EmployeePolicyModel.php
View File

@ -1114,9 +1114,9 @@ class EmployeePolicyModel extends Model
public function getDeletionEmployeeDataForExportExcel($ref_data, $return_type = 0)
{
$client_id = $ref_data['client_id'];
$client_policy_id = $ref_data['client_policy_id'];
$client_branch_id = $ref_data['client_branch_id'];
$client_id = (string) "'".$ref_data['client_id']."'";
$client_policy_id = (string) "'".$ref_data['client_policy_id']."'";
$client_branch_id = (string) "'".$ref_data['client_branch_id']."'";
$insurer_or_tpa = $ref_data['insurer_or_tpa'];
$get_insurer_id_from_client_policy = $this->db->table('client_policy')
@ -1929,6 +1929,8 @@ class EmployeePolicyModel extends Model
public function getDeletionDataForTruncated($file_id)
{
$file_id = (int)$file_id;
// Fetch the necessary details in a single query using JOINs
$result = $this->db->table('files f')
->select('i.deletion_add_day')
@ -2064,6 +2066,8 @@ class EmployeePolicyModel extends Model
$action = "da";
}
$file_id = (int)$file_id;
$query = $this->db->query("
SELECT
@ -2086,6 +2090,7 @@ class EmployeePolicyModel extends Model
// dd($this->db->getLastQuery(), $result);
// dd($result);
return $result[0];
}
@ -2096,6 +2101,8 @@ class EmployeePolicyModel extends Model
log_message('error', 'updateEmployeePolicyTruncateReverse model function called');
log_message('error', 'FILE ID : {data}', ['data' => $file_id]);
$file_id = (int)$file_id;
$this->db->query("
UPDATE employee_polices
SET
@ -2137,6 +2144,9 @@ class EmployeePolicyModel extends Model
//calculate the CD Transaction sum of the amount for the inception, addition, dependent addition, missed inception
public function calculateCdTranctionAmount($file_id)
{
$file_id = (int)$file_id;
$query = $this->db->query("
SELECT

2
app/Models/MessageModel.php
View File

@ -73,6 +73,6 @@ class MessageModel extends Model
$query = $builder->get();
return $query->getResult();
dd($this->db->getLastQuery());
// dd($this->db->getLastQuery());
}
}

14
app/Models/PolicyTransactionModel.php
View File

@ -2432,6 +2432,9 @@
return $result;
}
//not in use function due to complexity of query and union, so writing raw query with bindings to avoid sql injection
public function getBDSReportListSingleUnion($start_date = 0, $end_date = 0, $client_id = 0, $insurer_id = 0, $policy_type_id = 0, $date_type = 0, $issuer = 0, $client_branch_id = 0, $insurer_branch_id = 0, $client_policy_id = 0, $user_id = 0, $where = [])
{
@ -3015,6 +3018,15 @@
public function getBDSReportList($start_date = 0, $end_date = 0, $client_id = 0, $insurer_id = 0, $policy_type_id = 0, $date_type = 0, $issuer = 0, $client_branch_id = 0, $insurer_branch_id = 0, $client_policy_id = 0, $user_id = 0, $where = [])
{
$client_id = (int)$client_id;
$insurer_id = (int)$insurer_id;
$policy_type_id = (int)$policy_type_id;
$client_branch_id = (int)$client_branch_id;
$insurer_branch_id = (int)$insurer_branch_id;
$client_policy_id = (int)$client_policy_id;
$user_id = (int)$user_id;
$issuer = (int)$issuer;
$whereAdded = false;
$statement_month_condition = '';
if ($date_type == 'statement_month' && $start_date != 0 && $end_date != 0) {
@ -3689,6 +3701,8 @@
";
$query = $this->db->query($sql);
$result = $query->getResultArray();
// $countofalldata = count($result);
// dd($result);
// dd($this->db->getLastQuery()->getQuery());