Nhances/nhance
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FIX_Minor Issues

Browse Source
This commit is contained in:
sanjeev.p 2026-03-13 17:31:48 +05:30
parent 0498873ec5
commit b70811dff7
11 changed files with 107 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
app/Controllers/AppContentManagementController.php
View File

@ -247,7 +247,7 @@ class AppContentManagementController extends AdminController
'errors' => [
'required' => 'Type is required',
'max_length' => 'Type cannot exceed 255 characters',
'regex_match' => 'Type contains invalid characters'
'regex_match' => 'Type can contain only letters, numbers, spaces, _ and -'
]
],
'content_section' => [
@ -255,7 +255,7 @@ class AppContentManagementController extends AdminController
'errors' => [
'required' => 'Content Section is required',
'max_length' => 'Content Section cannot exceed 255 characters',
'regex_match' => 'Content Section contains invalid characters'
'regex_match' => 'Content Section can contain only letters, numbers, spaces, _ and -'
]
],
'heading' => [
@ -263,7 +263,7 @@ class AppContentManagementController extends AdminController
'errors' => [
'required' => 'Heading is required',
'max_length' => 'Heading cannot exceed 255 characters',
'regex_match' => 'Heading contains invalid characters. Only letters, numbers, spaces and basic punctuation are allowed'
'regex_match' => 'Heading can contain only letters, numbers, spaces, and these characters: . , ; : ! ? ( ) & / -'
]
],
'content' => [
@ -465,18 +465,22 @@ class AppContentManagementController extends AdminController
if ($method === 'post') {
$rules = [
'category' => [
'rules' => 'required|max_length[100]|alpha_numeric_space',
// Allow letters, numbers, spaces and / - . , " '
'rules' => 'required|max_length[100]|regex_match[/^[a-zA-Z0-9 \\/\\-\\.\,\"\\\']+$/]',
'errors' => [
'required' => 'Category is required',
'max_length' => 'Category cannot exceed 100 characters',
'alpha_numeric_space' => 'Category contains invalid characters'
'required' => 'Category is required',
'max_length' => 'Category cannot exceed 100 characters',
'regex_match' => 'Category can contain only letters, numbers, spaces, and these characters: / - . , " \'',
]
],
'question' => [
'rules' => 'required|max_length[1000]',
// Allow only letters, numbers, spaces and basic punctuation . , ; : ! ? ( ) & / -
'rules' => 'required|max_length[1000]|regex_match[/^[a-zA-Z0-9 _\\-.,;:!?()&\\/]+$/]',
'errors' => [
'required' => 'Question is required',
'max_length' => 'Question cannot exceed 1000 characters',
'regex_match' => 'Question can contain only letters, numbers, spaces, and these characters: . , ; : ! ? ( ) & / -',
]
],
'answer' => [
@ -779,17 +783,18 @@ class AppContentManagementController extends AdminController
* The `/i` flag makes the search case-insensitive.
*/
$dangerous_patterns = [
'/<\s*script/i', // <script
'/<\s*\/\s*script/i', // </script
'/javascript\s*:/i', // javascript:
'/vbscript\s*:/i', // vbscript:
'/<\s*iframe/i', // <iframe>
'/<\s*object/i', // <object>
'/<\s*embed/i', // <embed>
'/<\s*applet/i', // <applet>
'/on\w+\s*=/i', // on...= (e.g., onclick=)
'/<\s*script/i', // <script
'/<\s*\/\s*script/i', // </script
'/javascript\s*:/i', // javascript:
'/vbscript\s*:/i', // vbscript:
'/<\s*iframe/i', // <iframe>
'/<\s*object/i', // <object>
'/<\s*embed/i', // <embed>
'/<\s*applet/i', // <applet>
'/on\w+\s*=/i', // on...= (e.g., onclick=, onmouseover=, onerror=)
'/data\s*:\s*text\/html/i', // data:text/html
'/expression\s*\(/i', // CSS expression()
'/expression\s*\(/i', // CSS expression()
'/\balert\s*\(/i', // alert(...)
];
// Loop through the patterns and check if any of them exist in the decoded string.

2
app/Views/cd_master_add_modal.php
View File

@ -129,7 +129,7 @@
if(res.status == true){
$('#cd_ac_no_for_cd_master_errorr').text(res.message);
// toastr.warning(res.message, 'warning');
// toastr.warning(res.message, 'Warning');
// $('#cd_ac_no').val('');
$('#cd_master_btn_Submit').prop('disabled',true);
return;

6
app/Views/client_branch.php
View File

@ -697,7 +697,7 @@ $('body').on('click', '.btnBranchEdit', function() {
setTimeout(function() {
$('.loader').fadeOut();
$('.loader-mask').delay(350).fadeOut('slow');
toastr.warning('Something Wrong!', 'warning');
toastr.warning('Something Wrong!', 'Warning');
}, 1000);
}
});
@ -916,10 +916,10 @@ function removeClientBranch(element) {
// console.log(res.status == true);
if (res) {
if (res.status == true) {
toastr.success(res.message, 'success');
toastr.success(res.message, 'Success');
location.reload();
} else {
toastr.warning(res.message, 'warning');
toastr.warning(res.message, 'Warning');
}
}
},

2
app/Views/client_kyc.php
View File

@ -377,7 +377,7 @@
setTimeout(function() {
$('.loader').fadeOut();
$('.loader-mask').delay(350).fadeOut('slow');
toastr.warning('Something Wrong!', 'warning');
toastr.warning('Something Wrong!', 'Warning');
}, 1000);
}
});

24
app/Views/faq_list.php
View File

@ -376,6 +376,24 @@
}
// Simple client-side XSS pattern check to give instant feedback
function hasUnsafeHtml(html) {
if (!html) return false;
const decoded = $('<textarea/>').html(html).text().toLowerCase();
const patterns = [
/<\s*script/i,
/on\w+\s*=/i,
/javascript\s*:/i,
/vbscript\s*:/i,
/data\s*:\s*text\/html/i,
/expression\s*\(/i
];
return patterns.some(p => p.test(decoded));
}
$('#FAQForm').on('submit', function(e) {
e.preventDefault();
const form = this;
@ -395,6 +413,12 @@
toastr.warning("Answer is required", 'Warning');
return; // Stop the function here
}
// Block unsafe HTML/JS patterns
if (hasUnsafeHtml(editor.value)) {
toastr.error("Answer contains restricted tags or attributes. Script tags, iframes and event handlers (like onclick, onerror, onmouseover) are not allowed.", "Validation Error");
return;
}
}
// If valid, submit via AJAX

28
app/Views/frontend_content_list.php
View File

@ -532,6 +532,24 @@
openModal();
}
// Simple client-side XSS pattern check to give instant feedback
function hasUnsafeHtml(html) {
if (!html) return false;
const decoded = $('<textarea/>').html(html).text().toLowerCase();
const patterns = [
/<\s*script/i,
/on\w+\s*=/i,
/javascript\s*:/i,
/vbscript\s*:/i,
/data\s*:\s*text\/html/i,
/expression\s*\(/i
];
return patterns.some(p => p.test(decoded));
}
$('#frontEndContentForm').on('submit', function(e) {
e.preventDefault();
const form = this;
@ -548,6 +566,11 @@
toastr.warning("Content is required", 'Warning');
return;
}
if (hasUnsafeHtml(content_editor.value)) {
toastr.error("Content contains restricted tags or attributes. Script tags, iframes and event handlers (like onclick, onerror, onmouseover) are not allowed.", "Validation Error");
return;
}
}
// Notes validation
@ -556,6 +579,11 @@
toastr.warning("Notes is required", 'Warning');
return;
}
if (hasUnsafeHtml(notes_editor.value)) {
toastr.error("Notes contains restricted tags or attributes. Script tags, iframes and event handlers (like onclick, onerror, onmouseover) are not allowed.", "Validation Error");
return;
}
}
// If valid, submit via AJAX

2
app/Views/insurer_branch.php
View File

@ -488,7 +488,7 @@
setTimeout(function() {
$('.loader').fadeOut();
$('.loader-mask').delay(350).fadeOut('slow');
toastr.warning('Something Wrong!', 'warning');
toastr.warning('Something Wrong!', 'Warning');
}, 1000);
},
complete: function() {

24
app/Views/leads_form.php
View File

@ -102,8 +102,12 @@
border-width: 1px !important;
}
</style>
<?php
$isLeadEditEb = isset($lead_edit_data) && ! empty($lead_edit_data);
$ebSubtitle = $isLeadEditEb ? 'Edit Opportunities - (EB)' : 'Add Opportunities - (EB)';
?>
<script>
var pageSubTitle = 'Add Opportunity';
var pageSubTitle = '<?= $ebSubtitle ?>';
var pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
</script>
@ -773,14 +777,11 @@
}
}
hide_list_show_add();
var page_title = 'Edit Opportunity';
var pageSubTitle = 'Edit Opportunity';
var pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
pageSubTitle = 'Edit Opportunities - (EB)';
pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
$('#page_title').text(page_title);
$('#leads_primarykey').val(res.data.id);
$('#actual_lead_id').val(res.data.actual_lead_id || 0);
$('#policy_start_date').val(res.data.policy_end_date);
@ -1617,8 +1618,19 @@
console.log('--- End of calculatePolicyMetrics ---\n');
}
$(document).on("input", "#incept_no_of_lives", function () {
if (this.value.length > 10) {
this.value = this.value.slice(0, 10); // max 10 digits
}
this.value = this.value.replace(/\D/g, '');
});
$(document).on("input", "#incept_emp_count, #incept_dept_count, #renewal_emp_count, #renewal_dept_count, #exp_emp_count, #exp_dept_count", function() {
if (this.value.length > 10) {
this.value = this.value.slice(0, 10); // max 10 digits
}
this.value = this.value.replace(/\D/g, '');
calculateTotalLives(this);
});

6
app/Views/leads_non_eb.php
View File

@ -47,8 +47,12 @@
border-width: 1px !important;
}
</style>
<?php
$isLeadEditNonEb = isset($lead_edit_data) && ! empty($lead_edit_data);
$nonEbSubtitle = $isLeadEditNonEb ? 'Edit Opportunities - (Non EB)' : 'Add Opportunities - (Non EB)';
?>
<script>
var pageSubTitle = 'Add Opportunity';
var pageSubTitle = '<?= $nonEbSubtitle ?>';
var pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
</script>

4
app/Views/policy_transaction_inception_list.php
View File

@ -724,8 +724,8 @@ $(document).ready(function(){
function hide_list_show_add()
{
// $('#page_title').text('Add Policy')
pageSubTitle = 'Add Policy';
pageBackButton = '<a href="<?= base_url("policy_tranction/inception/list"); ?>" aria-label="Back to list"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
var pageSubTitle = 'Add Policy';
var pageBackButton = '<a href="<?= base_url("policy_tranction/inception/list"); ?>" aria-label="Back to list"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
$('#inception_form_id')[0].reset();
$('#client_id').val('').change().prop('disabled', false);
$('#tpa').val('').change().prop('disabled', false);

2
app/Views/ticket_auto_query.php
View File

@ -129,7 +129,7 @@
setTimeout(function() {
$('.loader').fadeOut();
$('.loader-mask').delay(350).fadeOut('slow');
toastr.warning('Something Went Wrong!', 'warning');
toastr.warning('Something Went Wrong!', 'Warning');
}, 1000);
}
})