FIX_Minor Issues

app/Controllers/AppContentManagementController.php

@@ -247,7 +247,7 @@ class AppContentManagementController extends AdminController
                         'errors' => [
                             'required'    => 'Type is required',
                             'max_length'  => 'Type cannot exceed 255 characters',
-                            'regex_match' => 'Type contains invalid characters'
+                            'regex_match' => 'Type can contain only letters, numbers, spaces, _ and -'
                         ]
                     ],
                     'content_section' => [
@@ -255,7 +255,7 @@ class AppContentManagementController extends AdminController
                         'errors' => [
                             'required'    => 'Content Section is required',
                             'max_length'  => 'Content Section cannot exceed 255 characters',
-                            'regex_match' => 'Content Section contains invalid characters'
+                                    'regex_match' => 'Content Section can contain only letters, numbers, spaces, _ and -' 
                         ]
                     ],
                     'heading' => [
@@ -263,7 +263,7 @@ class AppContentManagementController extends AdminController
                         'errors' => [
                             'required'    => 'Heading is required',
                             'max_length'  => 'Heading cannot exceed 255 characters',
-                            'regex_match' => 'Heading contains invalid characters. Only letters, numbers, spaces and basic punctuation are allowed'
+                            'regex_match' => 'Heading can contain only letters, numbers, spaces, and these characters: . , ; : ! ? ( ) & / -'
                         ]
                     ],
                      'content' => [
@@ -465,18 +465,22 @@ class AppContentManagementController extends AdminController
             if ($method === 'post') {
                 $rules = [
                             'category' => [
-                                'rules'  => 'required|max_length[100]|alpha_numeric_space',
+                                // Allow letters, numbers, spaces and / - . , " '
+                                'rules'  => 'required|max_length[100]|regex_match[/^[a-zA-Z0-9 \\/\\-\\.\,\"\\\']+$/]',
                                 'errors' => [
                                     'required'    => 'Category is required',
                                     'max_length'  => 'Category cannot exceed 100 characters',
-                                    'alpha_numeric_space' => 'Category contains invalid characters'
+                                    'regex_match' => 'Category can contain only letters, numbers, spaces, and these characters: / - . , " \'',
+                                    
                                 ]
                             ],
                             'question' => [
-                                'rules'  => 'required|max_length[1000]',
+                                // Allow only letters, numbers, spaces and basic punctuation . , ; : ! ? ( ) & / -
+                                'rules'  => 'required|max_length[1000]|regex_match[/^[a-zA-Z0-9 _\\-.,;:!?()&\\/]+$/]',
                                 'errors' => [
                                     'required'    => 'Question is required',
                                     'max_length'  => 'Question cannot exceed 1000 characters',
+                                    'regex_match' => 'Question can contain only letters, numbers, spaces, and these characters: . , ; : ! ? ( ) & / -',
                                 ]
                             ],
                             'answer' => [
@@ -787,9 +791,10 @@ class AppContentManagementController extends AdminController
             '/<\s*object/i',            // <object>
             '/<\s*embed/i',             // <embed>
             '/<\s*applet/i',            // <applet>
-            '/on\w+\s*=/i',            // on...= (e.g., onclick=)
+            '/on\w+\s*=/i',             // on...= (e.g., onclick=, onmouseover=, onerror=)
             '/data\s*:\s*text\/html/i', // data:text/html
             '/expression\s*\(/i',       // CSS expression()
+            '/\balert\s*\(/i',          // alert(...)
         ];
 
         // Loop through the patterns and check if any of them exist in the decoded string.

app/Views/cd_master_add_modal.php

@@ -129,7 +129,7 @@
                 if(res.status == true){
 
                     $('#cd_ac_no_for_cd_master_errorr').text(res.message);
-                    // toastr.warning(res.message, 'warning');
+                    // toastr.warning(res.message, 'Warning');
                     // $('#cd_ac_no').val('');
                     $('#cd_master_btn_Submit').prop('disabled',true);
                     return;

app/Views/client_branch.php

@@ -697,7 +697,7 @@ $('body').on('click', '.btnBranchEdit', function() {
             setTimeout(function() {
                 $('.loader').fadeOut();
                 $('.loader-mask').delay(350).fadeOut('slow');
-                toastr.warning('Something Wrong!', 'warning');
+                toastr.warning('Something Wrong!', 'Warning');
             }, 1000);
         }
     });
@@ -916,10 +916,10 @@ function removeClientBranch(element) {
                     // console.log(res.status == true);
                     if (res) {
                         if (res.status == true) {
-                            toastr.success(res.message, 'success');
+                            toastr.success(res.message, 'Success');
                             location.reload();
                         } else {
-                            toastr.warning(res.message, 'warning');
+                            toastr.warning(res.message, 'Warning');
                         }
                     }
                 },

app/Views/client_kyc.php

@@ -377,7 +377,7 @@
                 setTimeout(function() {
                     $('.loader').fadeOut();
                     $('.loader-mask').delay(350).fadeOut('slow');
-                    toastr.warning('Something Wrong!', 'warning');
+                    toastr.warning('Something Wrong!', 'Warning');
                 }, 1000);
             }
         });

app/Views/faq_list.php

@@ -376,6 +376,24 @@
     }
 
 
+    // Simple client-side XSS pattern check to give instant feedback
+    function hasUnsafeHtml(html) {
+        if (!html) return false;
+
+        const decoded = $('<textarea/>').html(html).text().toLowerCase();
+
+        const patterns = [
+            /<\s*script/i,
+            /on\w+\s*=/i,
+            /javascript\s*:/i,
+            /vbscript\s*:/i,
+            /data\s*:\s*text\/html/i,
+            /expression\s*\(/i
+        ];
+
+        return patterns.some(p => p.test(decoded));
+    }
+
     $('#FAQForm').on('submit', function(e) {
         e.preventDefault();
         const form = this;
@@ -395,6 +413,12 @@
                 toastr.warning("Answer is required", 'Warning');
                 return; // Stop the function here
             }
+
+            // Block unsafe HTML/JS patterns
+            if (hasUnsafeHtml(editor.value)) {
+                toastr.error("Answer contains restricted tags or attributes. Script tags, iframes and event handlers (like onclick, onerror, onmouseover) are not allowed.", "Validation Error");
+                return;
+            }
         }
 
         // If valid, submit via AJAX

app/Views/frontend_content_list.php

@@ -532,6 +532,24 @@
         openModal();
     }
 
+    // Simple client-side XSS pattern check to give instant feedback
+    function hasUnsafeHtml(html) {
+        if (!html) return false;
+
+        const decoded = $('<textarea/>').html(html).text().toLowerCase();
+
+        const patterns = [
+            /<\s*script/i,
+            /on\w+\s*=/i,
+            /javascript\s*:/i,
+            /vbscript\s*:/i,
+            /data\s*:\s*text\/html/i,
+            /expression\s*\(/i
+        ];
+
+        return patterns.some(p => p.test(decoded));
+    }
+
     $('#frontEndContentForm').on('submit', function(e) {
         e.preventDefault();
         const form = this;
@@ -548,6 +566,11 @@
                 toastr.warning("Content is required", 'Warning');
                 return;
             }
+
+            if (hasUnsafeHtml(content_editor.value)) {
+                toastr.error("Content contains restricted tags or attributes. Script tags, iframes and event handlers (like onclick, onerror, onmouseover) are not allowed.", "Validation Error");
+                return;
+            }
         }
 
         // Notes validation
@@ -556,6 +579,11 @@
                 toastr.warning("Notes is required", 'Warning');
                 return;
             }
+
+            if (hasUnsafeHtml(notes_editor.value)) {
+                toastr.error("Notes contains restricted tags or attributes. Script tags, iframes and event handlers (like onclick, onerror, onmouseover) are not allowed.", "Validation Error");
+                return;
+            }
         }
 
         // If valid, submit via AJAX

app/Views/insurer_branch.php

@@ -488,7 +488,7 @@
                     setTimeout(function() {
                         $('.loader').fadeOut();
                         $('.loader-mask').delay(350).fadeOut('slow');
-                        toastr.warning('Something Wrong!', 'warning');
+                        toastr.warning('Something Wrong!', 'Warning');
                     }, 1000);
                 },
                 complete: function() {

app/Views/leads_form.php

@@ -102,8 +102,12 @@
         border-width: 1px !important;
     }
 </style>
+<?php
+    $isLeadEditEb = isset($lead_edit_data) && ! empty($lead_edit_data);
+    $ebSubtitle   = $isLeadEditEb ? 'Edit Opportunities - (EB)' : 'Add Opportunities - (EB)';
+?>
 <script>
-    var pageSubTitle = 'Add Opportunity';
+    var pageSubTitle = '<?= $ebSubtitle ?>';
     var pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
 </script>
 
@@ -773,14 +777,11 @@
                         }
                     }
 
-
                     hide_list_show_add();
 
-                    var page_title = 'Edit Opportunity';
+                    pageSubTitle = 'Edit Opportunities - (EB)';
-                    var pageSubTitle = 'Edit Opportunity';
+                    pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
-                    var pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
 
-                    $('#page_title').text(page_title);
                     $('#leads_primarykey').val(res.data.id);
                     $('#actual_lead_id').val(res.data.actual_lead_id || 0);
                     $('#policy_start_date').val(res.data.policy_end_date);
@@ -1617,8 +1618,19 @@
         console.log('--- End of calculatePolicyMetrics ---\n');
     }
 
+    $(document).on("input", "#incept_no_of_lives", function () {
+        if (this.value.length > 10) {
+            this.value = this.value.slice(0, 10);   // max 10 digits
+        }
+        this.value = this.value.replace(/\D/g, '');
+    });
+
 
     $(document).on("input", "#incept_emp_count, #incept_dept_count, #renewal_emp_count, #renewal_dept_count, #exp_emp_count, #exp_dept_count", function() {
+        if (this.value.length > 10) {
+            this.value = this.value.slice(0, 10);   // max 10 digits
+        }
+        this.value = this.value.replace(/\D/g, '');
         calculateTotalLives(this);
     });
 

app/Views/leads_non_eb.php

@@ -47,8 +47,12 @@
         border-width: 1px !important;
     }
 </style>
+<?php
+    $isLeadEditNonEb = isset($lead_edit_data) && ! empty($lead_edit_data);
+    $nonEbSubtitle   = $isLeadEditNonEb ? 'Edit Opportunities - (Non EB)' : 'Add Opportunities - (Non EB)';
+?>
 <script>
-var pageSubTitle = 'Add Opportunity';
+var pageSubTitle = '<?= $nonEbSubtitle ?>';
 var pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
 </script>
 

app/Views/policy_transaction_inception_list.php

@@ -724,8 +724,8 @@ $(document).ready(function(){
 function hide_list_show_add() 
 {       
     // $('#page_title').text('Add Policy')
-    pageSubTitle = 'Add Policy';
+    var pageSubTitle = 'Add Policy';
-    pageBackButton = '<a href="<?= base_url("policy_tranction/inception/list"); ?>" aria-label="Back to list"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
+    var pageBackButton = '<a href="<?= base_url("policy_tranction/inception/list"); ?>" aria-label="Back to list"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
     $('#inception_form_id')[0].reset();
     $('#client_id').val('').change().prop('disabled', false);
     $('#tpa').val('').change().prop('disabled', false);

app/Views/ticket_auto_query.php

@@ -129,7 +129,7 @@
                 setTimeout(function() {
                     $('.loader').fadeOut();
                     $('.loader-mask').delay(350).fadeOut('slow');
-                    toastr.warning('Something Went Wrong!', 'warning');
+                    toastr.warning('Something Went Wrong!', 'Warning');
                 }, 1000);
             }
         })