Nhances/nhance
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MERGE_TEST_SECURITY

Browse Source
This commit is contained in:
Ubuntu 2026-03-13 17:37:57 +05:30
commit bc7c431605
18 changed files with 277 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
.env.sample
View File

@ -138,3 +138,11 @@ LEAD_CLIENT_FROM_MAIL_ID =
# BDS Daily Report Emails Configuration
bds.dailyReportEmails =
#--------------------------------------------------------------------
# MEDI ASSIST WELLNESS SSO Configuration
#--------------------------------------------------------------------
MEDIASSIST_WELLNESS_KEY =
MEDIASSIST_WELLNESS_IV =
MEDIASSIST_WELLNESS_LOGIN_URL =

1
app/Config/Routes.php
View File

@ -451,6 +451,7 @@ $routes->group("/util", ["filter" => "authMVC"], function ($routes) {
$routes->get('croneDailyActivityReport', 'DashboardController::croneDailyActivityReport');
$routes->get('insertSampleTpaApiData/(:any)', 'TestingController::insertSampleTpaApiData/$1');
$routes->get('listEmployeeCountByClientPolicy', 'TestingController::listEmployeeCountByClientPolicy');
$routes->get('testMediAssistWellness','TestingController::testMediAssistWellness');
});
$routes->post("policy_tranction/sendInstallmentRemainderMail","PolicyTransactionController::sendInstallmentRemainderMail");

8
app/Controllers/ApiServiceController.php
View File

@ -425,13 +425,17 @@ class ApiServiceController extends BaseController
$userParams = [];
foreach ($data as $row) {
if($row['wellness_vendor_id'] != null)
if($row['wellness_vendor_id'] == $this->vidal_primary_key)
{
$vidalApiController = new VidalApiController();
return $vidalApiController->getWellnessSSORedirectUrl($row['email']);
}else if ($row['wellness_vendor_id'] == $this->medi_assist_primary_key)
{
$mediAssistController = new MediAssistApiController();
return $mediAssistController->getWellnessSSORedirectUrl($row['planId'], $row['memberId']);
}
else if ($row['planId'] != null) // VISIT
else if ($row['planId'] != null && empty($row['wellness_vendor_id'])) // VISIT
{
$userParams['name'] = $row['name'];
$userParams['email'] = $row['email'];

41
app/Controllers/AppContentManagementController.php
View File

@ -247,7 +247,7 @@ class AppContentManagementController extends AdminController
'errors' => [
'required' => 'Type is required',
'max_length' => 'Type cannot exceed 255 characters',
'regex_match' => 'Type contains invalid characters'
'regex_match' => 'Type can contain only letters, numbers, spaces, _ and -'
]
],
'content_section' => [
@ -255,7 +255,7 @@ class AppContentManagementController extends AdminController
'errors' => [
'required' => 'Content Section is required',
'max_length' => 'Content Section cannot exceed 255 characters',
'regex_match' => 'Content Section contains invalid characters'
'regex_match' => 'Content Section can contain only letters, numbers, spaces, _ and -'
]
],
'heading' => [
@ -263,7 +263,7 @@ class AppContentManagementController extends AdminController
'errors' => [
'required' => 'Heading is required',
'max_length' => 'Heading cannot exceed 255 characters',
'regex_match' => 'Heading contains invalid characters. Only letters, numbers, spaces and basic punctuation are allowed'
'regex_match' => 'Heading can contain only letters, numbers, spaces, and these characters: . , ; : ! ? ( ) & / -'
]
],
'content' => [
@ -465,18 +465,22 @@ class AppContentManagementController extends AdminController
if ($method === 'post') {
$rules = [
'category' => [
'rules' => 'required|max_length[100]|alpha_numeric_space',
// Allow letters, numbers, spaces and / - . , " '
'rules' => 'required|max_length[100]|regex_match[/^[a-zA-Z0-9 \\/\\-\\.\,\"\\\']+$/]',
'errors' => [
'required' => 'Category is required',
'max_length' => 'Category cannot exceed 100 characters',
'alpha_numeric_space' => 'Category contains invalid characters'
'required' => 'Category is required',
'max_length' => 'Category cannot exceed 100 characters',
'regex_match' => 'Category can contain only letters, numbers, spaces, and these characters: / - . , " \'',
]
],
'question' => [
'rules' => 'required|max_length[1000]',
// Allow only letters, numbers, spaces and basic punctuation . , ; : ! ? ( ) & / -
'rules' => 'required|max_length[1000]|regex_match[/^[a-zA-Z0-9 _\\-.,;:!?()&\\/]+$/]',
'errors' => [
'required' => 'Question is required',
'max_length' => 'Question cannot exceed 1000 characters',
'regex_match' => 'Question can contain only letters, numbers, spaces, and these characters: . , ; : ! ? ( ) & / -',
]
],
'answer' => [
@ -779,17 +783,18 @@ class AppContentManagementController extends AdminController
* The `/i` flag makes the search case-insensitive.
*/
$dangerous_patterns = [
'/<\s*script/i', // <script
'/<\s*\/\s*script/i', // </script
'/javascript\s*:/i', // javascript:
'/vbscript\s*:/i', // vbscript:
'/<\s*iframe/i', // <iframe>
'/<\s*object/i', // <object>
'/<\s*embed/i', // <embed>
'/<\s*applet/i', // <applet>
'/on\w+\s*=/i', // on...= (e.g., onclick=)
'/<\s*script/i', // <script
'/<\s*\/\s*script/i', // </script
'/javascript\s*:/i', // javascript:
'/vbscript\s*:/i', // vbscript:
'/<\s*iframe/i', // <iframe>
'/<\s*object/i', // <object>
'/<\s*embed/i', // <embed>
'/<\s*applet/i', // <applet>
'/on\w+\s*=/i', // on...= (e.g., onclick=, onmouseover=, onerror=)
'/data\s*:\s*text\/html/i', // data:text/html
'/expression\s*\(/i', // CSS expression()
'/expression\s*\(/i', // CSS expression()
'/\balert\s*\(/i', // alert(...)
];
// Loop through the patterns and check if any of them exist in the decoded string.

65
app/Controllers/MediAssistApiController.php
View File

@ -1349,7 +1349,72 @@ class MediAssistApiController extends BaseController
}
public function getWellnessSSORedirectUrl($planId, $emp_code)
{
log_message('error', 'MEDI_ASSIST - Wellness SSO URL generation | Plan ID: ' . $planId . ' | Employee code: ' . $emp_code);
if (empty($planId) || empty($emp_code)) {
log_message('error', 'MEDI_ASSIST - Wellness SSO URL generation | Plan ID and employee code are required.');
return [
'status' => 'failed',
'message' => 'Coming soon........!',
];
}
// Configuration – prefer environment variables, fall back to demo values
$keyString = env('MEDIASSIST_WELLNESS_KEY');
$ivString = env('MEDIASSIST_WELLNESS_IV');
$loginUrlTemplate = env('MEDIASSIST_WELLNESS_LOGIN_URL');
$cipher_algorithm = 'AES-256-CBC';
if (empty($keyString) || empty($ivString) || empty($loginUrlTemplate)) {
log_message('error', 'MEDI_ASSIST - Wellness SSO URL generation | Key string, IV string and login URL are required.');
return [
'status' => 'failed',
'message' => 'Key string, IV string and login URL are required.',
];
}
// Plain SSO JSON payload, as per Medi Assist sample
$payload = [
'Id' => $emp_code,
'expiryTime' => time() + (10 * 60), // 10 minutes
'CPartnerId' => $planId,
];
$plainJson = json_encode($payload, JSON_UNESCAPED_SLASHES);
// Derive a 32‑byte key (AES‑256) and 16‑byte IV from the provided strings
// $key = substr(hash('sha256', $keyString, true), 0, 32);
// $iv = substr(hash('md5', $ivString, true), 0, 16);
// Encrypt with AES‑256‑CBC + PKCS7 padding (OpenSSL default)
$cipherTextRaw = openssl_encrypt($plainJson, $cipher_algorithm, $keyString, OPENSSL_RAW_DATA, $ivString);
if ($cipherTextRaw === false) {
log_message('error', 'MEDI_ASSIST - Wellness SSO URL generation | Encryption failed while generating Medi Assist wellness token.');
return [
'status' => 'failed',
'message' => 'Encryption failed while generating Medi Assist wellness token.',
];
}
// Base64 encode and URL‑encode for use as EncryptedSSO
$encryptedSSO = urlencode(base64_encode($cipherTextRaw));
// $encryptedSSO = rtrim(strtr(base64_encode($cipherTextRaw), '+/', '-_'), '=');
// Build the final login URL
$loginUrl = str_replace(['{0}', '{1}'], [$planId, $encryptedSSO], $loginUrlTemplate);
log_message('error', 'MEDI_ASSIST - Wellness SSO URL generation | Medi Assist wellness SSO URL generated successfully.');
return [
'status' => 'success',
'message' => 'Medi Assist wellness SSO URL generated successfully.',
'data' => $loginUrl
];
}

70
app/Controllers/TestingController.php
View File

@ -1304,4 +1304,74 @@ class TestingController extends BaseController
'data' => $list,
], 200);
}
/**
* Test Wellness SSO token generation for Medi Assist (MediBuddy).
*
* This uses the token-based authentication details shared by Medi Assist:
* - Cipher: AES-256-CBC
* - Padding: PKCS7 (OpenSSL default)
* - Login URL: https://login.mediassist.in/SSOLogon.aspx?PartnerCorpId={0}&EncryptedSSO={1}
*
* Environment variables (recommended):
* - MEDIASSIST_WELLNESS_KEY
* - MEDIASSIST_WELLNESS_IV
* - MEDIASSIST_WELLNESS_PARTNER_CORP_ID
* - MEDIASSIST_WELLNESS_LOGIN_URL
*
* If env values are not present, sensible dummy defaults are used so that
* the function can still be exercised.
*/
public function testMediAssistWellness()
{
// Configuration – prefer environment variables, fall back to demo values
$keyString = env('MEDIASSIST_WELLNESS_KEY');
$ivString = env('MEDIASSIST_WELLNESS_IV');
$loginUrlTemplate = env('MEDIASSIST_WELLNESS_LOGIN_URL' );
$partnerCorpId = '15963';
$cipher_algorithm = 'AES-256-CBC';
// Plain SSO JSON payload, as per Medi Assist sample
$payload = [
'Id' => '15022',
'expiryTime' => time() + (10 * 60), // 10 minutes
'CPartnerId' => $partnerCorpId,
];
$plainJson = json_encode($payload, JSON_UNESCAPED_SLASHES);
// Derive a 32‑byte key (AES‑256) and 16‑byte IV from the provided strings
// $key = substr(hash('sha256', $keyString, true), 0, 32);
// $iv = substr(hash('md5', $ivString, true), 0, 16);
// Encrypt with AES‑256‑CBC + PKCS7 padding (OpenSSL default)
$cipherTextRaw = openssl_encrypt( $plainJson, $cipher_algorithm, $keyString, OPENSSL_RAW_DATA, $ivString);
if ($cipherTextRaw === false) {
return $this->respond([
'status' => false,
'message' => 'Encryption failed while generating Medi Assist wellness token.',
], 500);
}
// Base64 encode and URL‑encode for use as EncryptedSSO
$encryptedSSO = urlencode(base64_encode($cipherTextRaw));
// $encryptedSSO = rtrim(strtr(base64_encode($cipherTextRaw), '+/', '-_'), '=');
// Build the final login URL
$loginUrl = str_replace(['{0}', '{1}'], [$partnerCorpId, $encryptedSSO], $loginUrlTemplate);
return $this->respond([
'status' => true,
'message' => 'Medi Assist wellness test URL generated successfully.',
'data' => [
'loginUrl' => $loginUrl,
'encryptedSSO' => $encryptedSSO,
'plainPayload' => $payload,
],
], 200);
}
}

6
app/Controllers/TicketController.php
View File

@ -3549,9 +3549,13 @@ class TicketController extends BaseController
claim_dump_files.file_name,
claim_dump_files.status,
claim_dump_files.created_at,
up.first_name as user_name
up.first_name as user_name,
c.client_name,
cp.policy_no
')
->join('user_profiles as up', 'claim_dump_files.created_by = up.id', 'left')
->join('client_policy as cp', 'claim_dump_files.client_policy_id = cp.id', 'left')
->join('clients as c', 'cp.client_id = c.id', 'left')
->where('claim_dump_files.is_active', 1)
->orderBy('claim_dump_files.id', 'desc')
->findAll();

2
app/Views/cd_master_add_modal.php
View File

@ -129,7 +129,7 @@
if(res.status == true){
$('#cd_ac_no_for_cd_master_errorr').text(res.message);
// toastr.warning(res.message, 'warning');
// toastr.warning(res.message, 'Warning');
// $('#cd_ac_no').val('');
$('#cd_master_btn_Submit').prop('disabled',true);
return;

21
app/Views/claim_dump_file_list.php
View File

@ -135,6 +135,8 @@
<thead class="bg-light">
<tr>
<th class="font-weight-medium">S.No&nbsp;</th>
<th class="font-weight-medium">Client</th>
<th class="font-weight-medium">Policy</th>
<th class="font-weight-medium">File name</th>
<th class="font-weight-medium">User/Time</th>
<th class="font-weight-medium">Status</th>
@ -150,6 +152,8 @@
<tr>
<td class="text-center"><b><?php echo ($key + 1) ?></b></td>
<td><?php echo $file['client_name'] ?></td>
<td><?php echo $file['policy_no'] ?></td>
<td style="overflow: hidden;" class="reload truncate" data-toggle="tooltip" data-placement="top" title="<?php echo $file['file_name'] ?>">
<?php echo $file['file_name'] ?>
</td>
@ -740,13 +744,18 @@
}));
$.each(data, function(index, item) {
var option = $('<option>', {
value: item.id,
text: item.policy_type + '-' + item.policy_no,
'data-tpaid': item.tpa_id,
});
$('#client_policy_id').append(option);
if(item.policy_type_id == 2 || item.policy_type_id == 3 || item.policy_type_id == 4 || item.policy_type_id == 5) {
var option = $('<option>', {
value: item.id,
text: item.policy_type + '-' + item.policy_no,
'data-tpaid': item.tpa_id,
});
$('#client_policy_id').append(option);
}
});
}

6
app/Views/client_branch.php
View File

@ -697,7 +697,7 @@ $('body').on('click', '.btnBranchEdit', function() {
setTimeout(function() {
$('.loader').fadeOut();
$('.loader-mask').delay(350).fadeOut('slow');
toastr.warning('Something Wrong!', 'warning');
toastr.warning('Something Wrong!', 'Warning');
}, 1000);
}
});
@ -916,10 +916,10 @@ function removeClientBranch(element) {
// console.log(res.status == true);
if (res) {
if (res.status == true) {
toastr.success(res.message, 'success');
toastr.success(res.message, 'Success');
location.reload();
} else {
toastr.warning(res.message, 'warning');
toastr.warning(res.message, 'Warning');
}
}
},

2
app/Views/client_kyc.php
View File

@ -377,7 +377,7 @@
setTimeout(function() {
$('.loader').fadeOut();
$('.loader-mask').delay(350).fadeOut('slow');
toastr.warning('Something Wrong!', 'warning');
toastr.warning('Something Wrong!', 'Warning');
}, 1000);
}
});

24
app/Views/faq_list.php
View File

@ -376,6 +376,24 @@
}
// Simple client-side XSS pattern check to give instant feedback
function hasUnsafeHtml(html) {
if (!html) return false;
const decoded = $('<textarea/>').html(html).text().toLowerCase();
const patterns = [
/<\s*script/i,
/on\w+\s*=/i,
/javascript\s*:/i,
/vbscript\s*:/i,
/data\s*:\s*text\/html/i,
/expression\s*\(/i
];
return patterns.some(p => p.test(decoded));
}
$('#FAQForm').on('submit', function(e) {
e.preventDefault();
const form = this;
@ -395,6 +413,12 @@
toastr.warning("Answer is required", 'Warning');
return; // Stop the function here
}
// Block unsafe HTML/JS patterns
if (hasUnsafeHtml(editor.value)) {
toastr.error("Answer contains restricted tags or attributes. Script tags, iframes and event handlers (like onclick, onerror, onmouseover) are not allowed.", "Validation Error");
return;
}
}
// If valid, submit via AJAX

28
app/Views/frontend_content_list.php
View File

@ -532,6 +532,24 @@
openModal();
}
// Simple client-side XSS pattern check to give instant feedback
function hasUnsafeHtml(html) {
if (!html) return false;
const decoded = $('<textarea/>').html(html).text().toLowerCase();
const patterns = [
/<\s*script/i,
/on\w+\s*=/i,
/javascript\s*:/i,
/vbscript\s*:/i,
/data\s*:\s*text\/html/i,
/expression\s*\(/i
];
return patterns.some(p => p.test(decoded));
}
$('#frontEndContentForm').on('submit', function(e) {
e.preventDefault();
const form = this;
@ -548,6 +566,11 @@
toastr.warning("Content is required", 'Warning');
return;
}
if (hasUnsafeHtml(content_editor.value)) {
toastr.error("Content contains restricted tags or attributes. Script tags, iframes and event handlers (like onclick, onerror, onmouseover) are not allowed.", "Validation Error");
return;
}
}
// Notes validation
@ -556,6 +579,11 @@
toastr.warning("Notes is required", 'Warning');
return;
}
if (hasUnsafeHtml(notes_editor.value)) {
toastr.error("Notes contains restricted tags or attributes. Script tags, iframes and event handlers (like onclick, onerror, onmouseover) are not allowed.", "Validation Error");
return;
}
}
// If valid, submit via AJAX

2
app/Views/insurer_branch.php
View File

@ -488,7 +488,7 @@
setTimeout(function() {
$('.loader').fadeOut();
$('.loader-mask').delay(350).fadeOut('slow');
toastr.warning('Something Wrong!', 'warning');
toastr.warning('Something Wrong!', 'Warning');
}, 1000);
},
complete: function() {

24
app/Views/leads_form.php
View File

@ -102,8 +102,12 @@
border-width: 1px !important;
}
</style>
<?php
$isLeadEditEb = isset($lead_edit_data) && ! empty($lead_edit_data);
$ebSubtitle = $isLeadEditEb ? 'Edit Opportunities - (EB)' : 'Add Opportunities - (EB)';
?>
<script>
var pageSubTitle = 'Add Opportunity';
var pageSubTitle = '<?= $ebSubtitle ?>';
var pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
</script>
@ -773,14 +777,11 @@
}
}
hide_list_show_add();
var page_title = 'Edit Opportunity';
var pageSubTitle = 'Edit Opportunity';
var pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
pageSubTitle = 'Edit Opportunities - (EB)';
pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
$('#page_title').text(page_title);
$('#leads_primarykey').val(res.data.id);
$('#actual_lead_id').val(res.data.actual_lead_id || 0);
$('#policy_start_date').val(res.data.policy_end_date);
@ -1617,8 +1618,19 @@
console.log('--- End of calculatePolicyMetrics ---\n');
}
$(document).on("input", "#incept_no_of_lives", function () {
if (this.value.length > 10) {
this.value = this.value.slice(0, 10); // max 10 digits
}
this.value = this.value.replace(/\D/g, '');
});
$(document).on("input", "#incept_emp_count, #incept_dept_count, #renewal_emp_count, #renewal_dept_count, #exp_emp_count, #exp_dept_count", function() {
if (this.value.length > 10) {
this.value = this.value.slice(0, 10); // max 10 digits
}
this.value = this.value.replace(/\D/g, '');
calculateTotalLives(this);
});

6
app/Views/leads_non_eb.php
View File

@ -47,8 +47,12 @@
border-width: 1px !important;
}
</style>
<?php
$isLeadEditNonEb = isset($lead_edit_data) && ! empty($lead_edit_data);
$nonEbSubtitle = $isLeadEditNonEb ? 'Edit Opportunities - (Non EB)' : 'Add Opportunities - (Non EB)';
?>
<script>
var pageSubTitle = 'Add Opportunity';
var pageSubTitle = '<?= $nonEbSubtitle ?>';
var pageBackButton = '<a href="<?= base_url('leads/list') ?>" data-toggle="tooltip" data-placement="top" title="Back"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
</script>

4
app/Views/policy_transaction_inception_list.php
View File

@ -724,8 +724,8 @@ $(document).ready(function(){
function hide_list_show_add()
{
// $('#page_title').text('Add Policy')
pageSubTitle = 'Add Policy';
pageBackButton = '<a href="<?= base_url("policy_tranction/inception/list"); ?>" aria-label="Back to list"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
var pageSubTitle = 'Add Policy';
var pageBackButton = '<a href="<?= base_url("policy_tranction/inception/list"); ?>" aria-label="Back to list"><i class="mdi mdi-arrow-left" style="font-size: 17px;"></i></a>';
$('#inception_form_id')[0].reset();
$('#client_id').val('').change().prop('disabled', false);
$('#tpa').val('').change().prop('disabled', false);

2
app/Views/ticket_auto_query.php
View File

@ -129,7 +129,7 @@
setTimeout(function() {
$('.loader').fadeOut();
$('.loader-mask').delay(350).fadeOut('slow');
toastr.warning('Something Went Wrong!', 'warning');
toastr.warning('Something Went Wrong!', 'Warning');
}, 1000);
}
})