From b1222d1291c3bcb672c97e83d828f0fee4830274 Mon Sep 17 00:00:00 2001
From: "sanjeev.p" <sanjeev.p@venbainfotech.com>
Date: Mon, 2 Feb 2026 17:44:25 +0530
Subject: [PATCH] FIX_InsurerMasterAdditAlerts

---
 app/Controllers/MasterController.php | 29 +++++++++----
 app/Views/insurer_basic_info.php     | 65 +++++++++++++++++++++++-----
 2 files changed, 73 insertions(+), 21 deletions(-)

diff --git a/app/Controllers/MasterController.php b/app/Controllers/MasterController.php
index dc6538d4..7017dd07 100755
--- a/app/Controllers/MasterController.php
+++ b/app/Controllers/MasterController.php
@@ -497,6 +497,9 @@ class MasterController extends AdminController
     {
 
         $this->myLogger->logme('error','Edit Insurer general info function called');
+        $postData = $this->request->getPost();
+        $logoFile = $this->request->getFile('insurer_logo');
+        
         $rules = [
             'name' => [
                 'rules'  => 'required',
@@ -513,22 +516,30 @@ class MasterController extends AdminController
                 ]
             ],
             'insurer_logo' => [
-                'rules' => 'if_exist|is_image[insurer_logo]|max_size[insurer_logo,200]|ext_in[insurer_logo,jpg,jpeg,png]',
+                'rules' => 'permit_empty|is_image[insurer_logo]|max_size[insurer_logo,200]|ext_in[insurer_logo,jpg,jpeg,png]',
                 'errors' => [
                     'is_image' => 'The uploaded file must be an image',
                     'max_size' => 'File size should not exceed 200 KB',
-                    'ext_in'   => 'Allowed file types: jpg, jpeg, png',
+                    'ext_in'   => 'Only JPG, JPEG, and PNG files are allowed.',
                 ]
             ],
         ];
 
-        if (!$this->validate($rules)) {
-            return $this->response->setStatusCode(400)->setJSON([
-                'status' => false,
-                'message' => 'Input validation failed',
-                'code' => 400,
-                'errors' => $this->validator->getErrors()
-            ]);
+        if (!$this->validateData($postData, $rules)) {
+                $errors = $this->validator->getErrors();
+        
+                $mainMessage = 'Input validation failed';
+    
+                if (isset($errors['insurer_logo']) && (strpos($errors['insurer_logo'], 'Security') !== false || strpos($errors['insurer_logo'], 'Forbidden') !== false)) {
+                    $mainMessage = 'File upload rejected: Security policy violation.';
+                }
+
+                return $this->response->setStatusCode(400)->setJSON([
+                    'status'  => false,
+                    'message' => $mainMessage, // This will change based on the error
+                    'code'    => 400,
+                    'errors'  => $this->validator->getErrors()
+                ]);
         }
 
         $uploadFilePath = ROOTPATH . 'public/uploads/logo/';
diff --git a/app/Views/insurer_basic_info.php b/app/Views/insurer_basic_info.php
index aadc43d3..f553b093 100755
--- a/app/Views/insurer_basic_info.php
+++ b/app/Views/insurer_basic_info.php
@@ -70,7 +70,7 @@ input:checked + .slider:before {
             <div class="card-body">
             <div class="custom-form">
             <form role="form" class="parsley-examples" method="post" id="insurer_general_form" enctype="multipart/form-data">
-                <input type="hidden" value="<?= csrf_hash() ?>" name="<?= csrf_token() ?>" />
+                <input type="hidden" value="<?= csrf_hash() ?>" name="<?= csrf_token() ?>" /> 
                 <input type="hidden" name="PrimaryKey" id="insurer_General_PrimaryKey" value="<?= isset($insurer['id']) ? $insurer['id'] : '' ?>" />
                 <input type="hidden" name="insurer_id" id="insurer_id" />
 
@@ -191,18 +191,29 @@ input:checked + .slider:before {
 <script>
     $(document).ready(function() {
 
+        $('#insurer_logo').on('change', function() {
+            PreviewImage(); 
+        });
+
         $("#insurer_general_form").submit(function(events) {
 
             events.preventDefault();
-
-            var isValid = $('#insurer_General_PrimaryKey').parsley().validate();  
+            
+            // var isValid = $('#insurer_General_PrimaryKey').parsley().validate();  
+            var isValid = $('#insurer_general_form').parsley().validate(); 
+            var PrimaryKey = $('#insurer_General_PrimaryKey').val();
             if (!isValid) { 
                 console.log('Form is Empty', 'Warning');
                 return ; 
             }
 
-            var PrimaryKey = $('#insurer_General_PrimaryKey').val();
-            var form_action = '';
+            var formElement = $('#insurer_general_form')[0];
+            var formData = new FormData(formElement);
+
+            // DEBUG: Log formData to see if it's empty
+            for (var pair of formData.entries()) {
+                console.log(pair[0]+ ', ' + pair[1]); 
+            }
             if (isValid) {
 
                 if (PrimaryKey === '') {
@@ -300,16 +311,46 @@ input:checked + .slider:before {
 
     });
 
-    function PreviewImage() 
-    {
+    function PreviewImage() {
+        var fileInput = document.getElementById("insurer_logo");
+        var preview = document.getElementById("uploadPreview");
+        var defaultAvatar = '<?= base_url() . "public/assets/images/avatar_2x.png" ?>';
+
+        // If no file is selected (or cleared by validation), reset preview and stop
+        if (!fileInput.files || !fileInput.files[0]) {
+            preview.src = defaultAvatar;
+            return;
+        }
+
+        var file = fileInput.files[0];
+        var fileName = file.name.toLowerCase();
+        var parts = fileName.split('.');
+        
+        // VALIDATION: Extensions and Double Extensions (e.g. .php.jpeg)
+        var allowedExtensions = /(\.jpg|\.jpeg|\.png)$/i;
+
+        if (!allowedExtensions.exec(fileName) || parts.length > 2) {
+            toastr.error("Security violation: Invalid format or double extension.", "Blocked");
+            fileInput.value = ""; // Clear the field
+            preview.src = defaultAvatar; // RESET PREVIEW
+            return;
+        }
+
+        // VALIDATION: Size (200KB)
+        if ((file.size / 1024) > 200) {
+            toastr.warning("File size exceeds 200 KB limit.", "Warning");
+            fileInput.value = ""; // Clear the field
+            preview.src = defaultAvatar; // RESET PREVIEW
+            return;
+        }
+
+        // SUCCESS: Read and Preview
         var oFReader = new FileReader();
-        oFReader.readAsDataURL(document.getElementById("insurer_logo").files[0]);
-
+        oFReader.readAsDataURL(file);
         oFReader.onload = function(oFREvent) {
-            document.getElementById("uploadPreview").src = oFREvent.target.result;
+            preview.src = oFREvent.target.result;
         };
-    };
-
+    }
     //-----------------------------------------------------------------------------------------------------