Nhances/nhance
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FIX_VAPT_ISSUE_FILE_UPLOAD_VALIDTION

Browse Source
This commit is contained in:
velz 2026-02-26 15:47:16 +05:30
parent 9404a7a5bc
commit 83e0595530
13 changed files with 1662 additions and 1718 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

43
app/Config/Constants.php
View File

@ -35,11 +35,11 @@ defined('COMPOSER_PATH') || define('COMPOSER_PATH', ROOTPATH . 'vendor/autoload.
*/
defined('SECOND') || define('SECOND', 1);
defined('MINUTE') || define('MINUTE', 60);
defined('HOUR') || define('HOUR', 3600);
defined('DAY') || define('DAY', 86400);
defined('WEEK') || define('WEEK', 604800);
defined('MONTH') || define('MONTH', 2_592_000);
defined('YEAR') || define('YEAR', 31_536_000);
defined('HOUR') || define('HOUR', 3600);
defined('DAY') || define('DAY', 86400);
defined('WEEK') || define('WEEK', 604800);
defined('MONTH') || define('MONTH', 2_592_000);
defined('YEAR') || define('YEAR', 31_536_000);
defined('DECADE') || define('DECADE', 315_360_000);
/*
@ -67,16 +67,16 @@ defined('DECADE') || define('DECADE', 315_360_000);
| http://tldp.org/LDP/abs/html/exitcodes.html
|
*/
defined('EXIT_SUCCESS') || define('EXIT_SUCCESS', 0); // no errors
defined('EXIT_ERROR') || define('EXIT_ERROR', 1); // generic error
defined('EXIT_CONFIG') || define('EXIT_CONFIG', 3); // configuration error
defined('EXIT_UNKNOWN_FILE') || define('EXIT_UNKNOWN_FILE', 4); // file not found
defined('EXIT_UNKNOWN_CLASS') || define('EXIT_UNKNOWN_CLASS', 5); // unknown class
defined('EXIT_SUCCESS') || define('EXIT_SUCCESS', 0); // no errors
defined('EXIT_ERROR') || define('EXIT_ERROR', 1); // generic error
defined('EXIT_CONFIG') || define('EXIT_CONFIG', 3); // configuration error
defined('EXIT_UNKNOWN_FILE') || define('EXIT_UNKNOWN_FILE', 4); // file not found
defined('EXIT_UNKNOWN_CLASS') || define('EXIT_UNKNOWN_CLASS', 5); // unknown class
defined('EXIT_UNKNOWN_METHOD') || define('EXIT_UNKNOWN_METHOD', 6); // unknown class member
defined('EXIT_USER_INPUT') || define('EXIT_USER_INPUT', 7); // invalid user input
defined('EXIT_DATABASE') || define('EXIT_DATABASE', 8); // database error
defined('EXIT__AUTO_MIN') || define('EXIT__AUTO_MIN', 9); // lowest automatically-assigned error code
defined('EXIT__AUTO_MAX') || define('EXIT__AUTO_MAX', 125); // highest automatically-assigned error code
defined('EXIT_USER_INPUT') || define('EXIT_USER_INPUT', 7); // invalid user input
defined('EXIT_DATABASE') || define('EXIT_DATABASE', 8); // database error
defined('EXIT__AUTO_MIN') || define('EXIT__AUTO_MIN', 9); // lowest automatically-assigned error code
defined('EXIT__AUTO_MAX') || define('EXIT__AUTO_MAX', 125); // highest automatically-assigned error code
/**
* @deprecated Use \CodeIgniter\Events\Events::PRIORITY_LOW instead.
@ -115,4 +115,19 @@ define('ACCOUNT_MANAGER_ROLE_ID', 3);
define('STAFF_ROLE_ID', 4);
define('HEAD_ROLE_ID', 5);
/**
* @Upload Allowed Extensions by Business Context
*/
define('UPLOAD_ALLOWED_EXTENSIONS', [
'jpg', 'jpeg', 'png', 'gif', 'webp', 'svg',
'pdf', 'doc', 'docx', 'odt', 'rtf',
'xls', 'xlsx', 'ods', 'csv', 'txt',
]);
define('UPLOAD_EXT_IMAGES', ['jpg', 'jpeg', 'png']);
define('UPLOAD_EXT_KYC_DOCS', ['pdf', 'jpg', 'jpeg', 'png']);
define('UPLOAD_EXT_CLAIM_DOCS', ['pdf', 'jpg', 'jpeg', 'png']);
define('UPLOAD_EXT_POLICY_DOCS', ['pdf', 'jpg', 'jpeg', 'png', 'xls', 'xlsx']);
define('UPLOAD_EXT_LEAD_FILES', ['xls', 'xlsx', 'pdf', 'jpg', 'jpeg', 'png']);
define('UPLOAD_EXT_EXCEL', ['xls', 'xlsx', 'ods', 'csv']);
define('UPLOAD_EXT_MAIL_ATTACHMENTS', ['pdf', 'jpg', 'jpeg', 'png', 'doc', 'docx', 'xls', 'xlsx']);

17
app/Controllers/AppContentManagementController.php
View File

@ -101,23 +101,22 @@ class AppContentManagementController extends AdminController
$file = $this->request->getFile('advertise_image');
$client_id = $sanitized_post_data['client_id'] ?? null;
//1) original file name for vaildations
$fileName = $file->getClientName(); //original file name for vaildations
$existing = $this->addImgModel->where('name', $fileName)->where('client_id', $fileName)->where('is_active', 1)->first();
if($existing){ return $this->respond(['status' => false, 'message' => 'This file has already been uploaded in active state.'], 400); }
//skip 1) and use this
// $fileName = $file->getRandomName(); // Same Name Multiple time upload means different name
if (!$file || !$file->isValid()) {
return $this->respond(['status' => false, 'message' => 'No file uploaded or invalid file.'], 400);
}
// $uploadPath = WRITEPATH . 'uploads/advertiseImage/';
if (!validate_upload_extension($file, UPLOAD_EXT_IMAGES)) {
return $this->respond(['status' => false, 'message' => 'Only JPG, JPEG, PNG files are allowed.'], 400);
}
$fileName = sanitize_upload_filename($file->getClientName());
$existing = $this->addImgModel->where('name', $fileName)->where('client_id', $client_id)->where('is_active', 1)->first();
if($existing){ return $this->respond(['status' => false, 'message' => 'This file has already been uploaded in active state.'], 400); }
$uploadPath = ROOTPATH . 'public/uploads/add_image_upload/';
if (!is_dir($uploadPath)) mkdir($uploadPath, 0755, true);
$file->move($uploadPath, $fileName);
$id = $sanitized_post_data['add_image_id'] ?? null;

7
app/Controllers/ClaimsUploadController.php
View File

@ -26,6 +26,13 @@ class ClaimsUploadController extends BaseController
], 400);
}
if (!validate_upload_extension($file, UPLOAD_EXT_EXCEL)) {
return $this->respond([
'status' => 'failed',
'message' => 'Only Excel files (xls, xlsx, ods, csv) are allowed.'
], 400);
}
$data = [
'client_id' => $this->request->getPost('client_id'),
'tpa_id' => $this->request->getPost('tpa_id'),

16
app/Controllers/ClientController.php
View File

@ -1051,7 +1051,7 @@ class ClientController extends AdminController
$uploadFilePath = ROOTPATH . 'public/uploads/logo/';
$file_name = file_Upload($this->request->getFile('client_logo'), $uploadFilePath);
$file_name = file_Upload($this->request->getFile('client_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
$data = $this->request->getPost();
$sanitized_post_data = sanitizeInputArrayAdvanced($data);
$sanitized_post_data['created_by'] = get_session_userid();
@ -1149,7 +1149,7 @@ class ClientController extends AdminController
$this->myLogger->logme('error', 'edit client general info function called');
$uploadFilePath = ROOTPATH . 'public/uploads/logo/';
$file_name = file_Upload($this->request->getFile('client_logo'), $uploadFilePath);
$file_name = file_Upload($this->request->getFile('client_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
$id = $this->request->getPost('PrimaryKey');
$data = $this->request->getPost();
@ -1191,7 +1191,7 @@ class ClientController extends AdminController
// print_r($data); die;
unset($data['file_name']);
$uploadFilePath = WRITEPATH . 'uploads/client_kyc_documents';
$File = file_Upload($this->request->getFile('file_name'), $uploadFilePath);
$File = file_Upload($this->request->getFile('file_name'), $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
if (!empty($File)) {
$data['file_name'] = $File;
@ -1257,7 +1257,7 @@ class ClientController extends AdminController
$file = $this->request->getFile('file_name');
$fileName = file_Upload($file, $uploadFilePath);
$fileName = file_Upload($file, $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
if (!empty($fileName)) {
$sanitized_data['file_name'] = $fileName;
@ -1313,7 +1313,7 @@ class ClientController extends AdminController
$file = $this->request->getFile('file_name');
$fileName = file_Upload($file, $uploadFilePath);
$fileName = file_Upload($file, $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
if (!empty($fileName)) {
$sanitized_data['file_name'] = $fileName;
@ -1400,7 +1400,7 @@ class ClientController extends AdminController
$file = $this->request->getFile('file_name');
$uploadFilePath = WRITEPATH . 'uploads/client_kyc_documents';
$fileName = file_Upload($file, $uploadFilePath);
$fileName = file_Upload($file, $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
if (!empty($fileName)) {
$sanitized_data['file_name'] = $fileName;
@ -1472,7 +1472,7 @@ class ClientController extends AdminController
if ($uploadedFile && $uploadedFile->isValid() && !$uploadedFile->hasMoved()) {
$new_file_name = file_Upload($uploadedFile, $uploadFilePath);
$new_file_name = file_Upload($uploadedFile, $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
if (!$new_file_name) {
return $this->respond(['status' => false, 'code' => 500, 'message' => 'New file upload failed on server.'], 200);
}
@ -3479,7 +3479,7 @@ class ClientController extends AdminController
if (!empty($docName) && $file->isValid() && !$file->hasMoved()) {
// Upload the file
$uploadedFileName = file_Upload_for_lead($file, $uploadFilePath);
$uploadedFileName = file_Upload_for_lead($file, $uploadFilePath, UPLOAD_EXT_KYC_DOCS);
if ($uploadedFileName) {
// Prepare data for each document upload

2421
app/Controllers/EmployeeRestController.php
View File

File diff suppressed because it is too large Load Diff

2
app/Controllers/LeadsController.php
View File

@ -1035,7 +1035,7 @@ class LeadsController extends BaseController
$multi_file_data = [];
foreach ($files as $index => $value) {
$file_name = file_Upload_for_lead($value, $uploadFilePath);
$file_name = file_Upload_for_lead($value, $uploadFilePath, UPLOAD_EXT_LEAD_FILES);
$multi_file_data[] = [
'file_name' => $file_name,
'docs_name' => $docs_names[$index],

16
app/Controllers/MasterController.php
View File

@ -367,7 +367,7 @@ class MasterController extends AdminController
}
$uploadFilePath = ROOTPATH . 'public/uploads/logo/';
$file_name = file_Upload($this->request->getFile('insurer_logo'), $uploadFilePath);
$file_name = file_Upload($this->request->getFile('insurer_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
$data = $this->request->getPost();
$sanitized_post_data = sanitizeInputArrayAdvanced($data);
@ -593,7 +593,7 @@ class MasterController extends AdminController
}
$uploadFilePath = ROOTPATH . 'public/uploads/logo/';
$file_name = file_Upload($this->request->getFile('insurer_logo'), $uploadFilePath);
$file_name = file_Upload($this->request->getFile('insurer_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
$data = $this->request->getPost();
$sanitized_post_data = sanitizeInputArrayAdvanced($data);
$id = $sanitized_post_data['PrimaryKey'];
@ -974,11 +974,11 @@ class MasterController extends AdminController
$uploadFilePath = ROOTPATH . 'public/uploads/logo/';
$file_name = file_Upload($this->request->getFile('tpa_logo'), $uploadFilePath);
$file_name = file_Upload($this->request->getFile('tpa_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
$template_bg_path = ROOTPATH . 'public/uploads/template_bg';
$front_card_file_name = file_Upload($this->request->getFile('fc'), $template_bg_path);
$back_card_file_name = file_Upload($this->request->getFile('bc'), $template_bg_path);
$front_card_file_name = file_Upload($this->request->getFile('fc'), $template_bg_path, UPLOAD_EXT_IMAGES);
$back_card_file_name = file_Upload($this->request->getFile('bc'), $template_bg_path, UPLOAD_EXT_IMAGES);
$eCardTemplate = $sanitized_post_data['ecard_content'];
@ -1264,11 +1264,11 @@ class MasterController extends AdminController
$uploadFilePath = ROOTPATH . 'public/uploads/logo/';
$file_name = file_Upload($this->request->getFile('tpa_logo'), $uploadFilePath);
$file_name = file_Upload($this->request->getFile('tpa_logo'), $uploadFilePath, UPLOAD_EXT_IMAGES);
$template_bg_path = ROOTPATH . 'public/uploads/template_bg';
$front_card_file_name = file_Upload($this->request->getFile('fc'), $template_bg_path);
$back_card_file_name = file_Upload($this->request->getFile('bc'), $template_bg_path);
$front_card_file_name = file_Upload($this->request->getFile('fc'), $template_bg_path, UPLOAD_EXT_IMAGES);
$back_card_file_name = file_Upload($this->request->getFile('bc'), $template_bg_path, UPLOAD_EXT_IMAGES);
$id = $sanitized_post_data['PrimaryKey'] ?? null;

2
app/Controllers/NotificationController.php
View File

@ -364,7 +364,7 @@ class NotificationController extends AdminController
// Define upload path and attempt file upload
$uploadFilePath = WRITEPATH . 'uploads/attachments';
$uploadedFile = $this->request->getFile('file');
$fileName = file_Upload_for_lead($uploadedFile, $uploadFilePath); // Assume file_Upload handles file saving
$fileName = file_Upload_for_lead($uploadedFile, $uploadFilePath, UPLOAD_EXT_MAIL_ATTACHMENTS);
if ($fileName) {
// Prepare data for insertion

2
app/Controllers/PolicyTransactionController.php
View File

@ -3411,7 +3411,7 @@ class PolicyTransactionController extends BaseController
if (!empty($docName) && $file->isValid() && !$file->hasMoved()) {
// Upload the file
$uploadedFileName = file_Upload_for_lead($file, $uploadFilePath);
$uploadedFileName = file_Upload_for_lead($file, $uploadFilePath, UPLOAD_EXT_POLICY_DOCS);
if ($uploadedFileName) {
// Prepare data for each document upload

8
app/Controllers/RuleImportController.php
View File

@ -104,6 +104,10 @@ class RuleImportController extends AdminController
return $this->response->setJSON(['status'=>false,'message'=>'No file uploaded or upload error']);
}
if (!validate_upload_extension($file, UPLOAD_EXT_EXCEL)) {
return $this->response->setJSON(['status'=>false,'message'=>'Only Excel/CSV files (xls, xlsx, ods, csv) are allowed.']);
}
// Move uploaded file to writable temp location
$tmpPath = WRITEPATH . 'uploads/' . $file->getRandomName();
$file->move(WRITEPATH . 'uploads', $file->getName()); // keep original name inside uploads
@ -140,6 +144,10 @@ class RuleImportController extends AdminController
return $this->respond(['status' => false, 'code' => 404, 'message' => 'No file uploaded or upload error.'], 200);
}
if (!validate_upload_extension($file, UPLOAD_EXT_EXCEL)) {
return $this->respond(['status' => false, 'code' => 400, 'message' => 'Only Excel/CSV files (xls, xlsx, ods, csv) are allowed.'], 200);
}
// ---------------------------------------------------------
// 2. Read POST fields
// ---------------------------------------------------------

6
app/Controllers/TicketController.php
View File

@ -3237,7 +3237,7 @@ class TicketController extends BaseController
$file_data = [];
if(isset($get_file_data) && !empty($get_file_data)){
$file_path = WRITEPATH . 'uploads/claim_files/';
$file_data = multi_file_Upload($get_file_data, $file_path, $get_docs_name);
$file_data = multi_file_Upload($get_file_data, $file_path, $get_docs_name, UPLOAD_EXT_CLAIM_DOCS);
}
if(!empty($file_data)){
@ -3932,7 +3932,7 @@ class TicketController extends BaseController
if ($is_moved) {
$file_path = WRITEPATH.'uploads/claims_mis';
$filename = file_Upload_for_lead($file, $file_path);
$filename = file_Upload_for_lead($file, $file_path, UPLOAD_EXT_EXCEL);
$fileSize = $file->getSize(); // File size in bytes
$fileSize = $fileSize / (1024 * 1024); // Convert to MB
@ -3983,7 +3983,7 @@ class TicketController extends BaseController
}
$file_path = WRITEPATH.'uploads/claims_mis';
$file_name = file_Upload_for_lead($file, $file_path);
$file_name = file_Upload_for_lead($file, $file_path, UPLOAD_EXT_EXCEL);
if(!empty($file_name)){
$data['file_name'] = $file_name;

11
app/Controllers/UserController.php
View File

@ -1009,8 +1009,15 @@ class UserController extends AdminController
$fileId = $this->request->getPost('id');
if ($file && $file->isValid() && !$file->hasMoved()) {
$originalName = $file->getClientName();
if (!validate_upload_extension($file, UPLOAD_EXT_EXCEL)) {
return $this->response->setJSON([
'status' => 'error',
'message' => 'Only Excel files (xls, xlsx, ods, csv) are allowed.',
])->setStatusCode(400);
}
$originalName = sanitize_upload_filename($file->getClientName());
$extension = $file->getExtension();
$fileName = pathinfo($originalName, PATHINFO_FILENAME) . '_' . date('Ymd_His') . '.' . $extension;

829
app/Helpers/utility_helper.php
View File

File diff suppressed because it is too large Load Diff