Nhances/nhance
5
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

GWM :VAPT Scan Vulnerabilities

Browse Source
This commit is contained in:
Gowtham M 2026-01-08 16:58:04 +05:30
commit f76c06179c
29 changed files with 1164 additions and 88 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
app/Config/Filters.php
View File

@ -16,6 +16,8 @@ use App\Filters\AuthClientApi;
use App\Filters\CommissionApiFilter;
use App\Filters\VerifyAppSignature;
use App\Filters\Cors;
use App\Filters\SecurityInputFilter;
use App\Filters\GlobalPostFileUploadGuard;
use App\Filters\AuthJWT;
@ -43,6 +45,8 @@ class Filters extends BaseConfig
'CommissionApiFilter'=> CommissionApiFilter::class,
'appSignature' => VerifyAppSignature::class,
'Cors' => Cors::class,
'SecurityInputFilter' => SecurityInputFilter::class,
'GlobalPostFileUploadGuard' => GlobalPostFileUploadGuard::class,
];
/**
@ -56,6 +60,8 @@ class Filters extends BaseConfig
'before' => [
'HttpRequestLog' => ['except' => 'cli/*'],
'Cors',
'SecurityInputFilter',
'GlobalPostFileUploadGuard'
// 'csrf',
// 'invalidchars',
],

6
app/Config/Routes.php
View File

@ -738,6 +738,12 @@ $routes->group("/ticket", ["filter" => "authMVC"], function ($routes) {
$routes->get('getTpaClaimStatus',"ApiServiceController::getClaimStatus");
});
$routes->group("/claim_mis", ["filter" => "authMVC"], function ($routes) {
$routes->get('list','TicketController::claimMisFileList');
$routes->get('download','TicketController::downloadClaimMisFile');
$routes->post('upload','TicketController::uploadClaimMisFile');
});
$routes->group("clientApi",["filter" => "AuthClientApi"], function ($routes){
$routes->post("getPolicyMaster","ClientAPIController::sendPolicyMaster");

5
app/Controllers/ApiServiceController.php
View File

@ -106,10 +106,11 @@ class ApiServiceController extends BaseController
->join('client_policy', 'employee_polices.client_policy_id = client_policy.id', 'left')
->where('employees.emp_code', $emp_code)
->where('employee_polices.client_policy_id', $client_policy_id)
->where('employees.id', $id)
->where('employee_polices.is_active', 1)
->where('employees.is_active', 1)
->where('employee_polices.status', 'active')
->where('employees.emp_status', 'active')
->whereIn('employee_polices.status', ['active', 'expired'])
->whereIn('employees.emp_status', ['active', 'expired'])
->findAll();

1
app/Controllers/ClientController.php
View File

@ -519,6 +519,7 @@ class ClientController extends AdminController
public function updateEmpAndPolicyStatus()
{
$return = $this->clientPolicyModel->updateStatus();
print_rr($return);
$this->myLogger->logme('error', 'Client Policy Status Update Count: {data}', ['data' => $return['client']]);
$this->myLogger->logme('error', 'Employee Policy Status Update Count: {data}', ['data' => $return['emp']]);
}

21
app/Controllers/EmployeeController.php
View File

@ -1517,10 +1517,10 @@ class EmployeeController extends AdminController
->join('client_policy', 'client_policy.id = employee_polices.client_policy_id')
->join('employees', 'employees.id = employee_polices.employee_id')
->join('tpa', 'tpa.id = client_policy.tpa_id')
->where('employees.emp_status', 'active')
->where('employees.is_active', '1')
->where("employee_polices.tpa_id IS NOT NULL AND employee_polices.tpa_id <> ''")
->where('employee_polices.status', 'active')
->whereIn('employee_polices.status', ['active', 'expired'])
->whereIn('employees.emp_status', ['active', 'expired'])
->where('employee_polices.is_active', '1')
->where('employee_polices.rand_string', $rand_string)
->first();
@ -1543,6 +1543,7 @@ class EmployeeController extends AdminController
//new step check in S3 if yes then fetch from S3 bucket
$s3_key = 'ecard_'.$get_emp_code_and_client_policy_id['name'].'('.$get_emp_code_and_client_policy_id['emp_code'].')'.'_'.$get_emp_code_and_client_policy_id['tpa_id'].'.pdf';
$s3_key = $this->sanitizeFilePart($s3_key);
// echo $s3_key;die();
$s3 = \Config\Services::getS3Service();
if($s3->exists($s3_key) && $mode != 2) //2 => for bulk generate so skip s3 check and generate PDF
@ -3397,7 +3398,8 @@ class EmployeeController extends AdminController
public function initiateWellnessOnboard($client_policy_id)
{
$r = Jobs::addJob(['job_name' => 'initiateWellnessOnboardJob','payload' => ['client_policy_id' => $client_policy_id]]);
$r = Jobs::addJob(['job_name' => 'initiateWellnessOnboardJob','payload' => ['client_policy_id' => $client_policy_id]]);
//$this->initiateWellnessOnboardJob(['client_policy_id' => $client_policy_id]);
return $this->respond(['status' => true, 'code' => 200, 'message' => 'Process started'], 200);
}
@ -3428,7 +3430,7 @@ class EmployeeController extends AdminController
// echo '==============================';die();
// $data = '[{"id":12847,"employee_id":"TEST_EMP_001","client_policy_id":null,"tpa_id":null,"uhid":null,"batch_code":null,"status":"active","pre_existing_alignments":null,"age_band":null,"basic_cover_si":"0","date_coverage":"2025-01-01","policy_end_date":"2025-12-31","days":"0","premium":"0","rata_premimum":"0","gst":"0","si_enhancement_date":null,"date_of_exit":null,"reason_for_exit":null,"claim_status":"0","created_by":null,"created_at":null,"updated_by":null,"updated_at":null,"is_active":"1","rand_string":null,"ecard_sent_status":"0","payable_employee":"0","file_id":null,"wellness_onboard":"0","name":"test name","relationship":"SELF","emp_code":"TEST_EMP_001","email_corporate":"test@gmail.com","mobile":"9797976565","dob":"1975-08-09"},{"id":12846,"employee_id":"TEST_EMP_001","client_policy_id":null,"tpa_id":null,"uhid":null,"batch_code":null,"status":"active","pre_existing_alignments":null,"age_band":null,"basic_cover_si":"0","date_coverage":"2025-01-01","policy_end_date":"2025-12-31","days":"0","premium":"0","rata_premimum":"0","gst":"0","si_enhancement_date":null,"date_of_exit":null,"reason_for_exit":null,"claim_status":"0","created_by":null,"created_at":null,"updated_by":null,"updated_at":null,"is_active":"1","rand_string":null,"ecard_sent_status":"0","payable_employee":"0","file_id":null,"wellness_onboard":"0","name":"dependent 1","relationship":"SON","emp_code":"TEST_EMP_001","email_corporate":"dependent1@gmail.com","mobile":"9898989898","dob":"2001-08-09"}]';
// $data = (array)json_decode($data,true);
// print_r($data);
// print_r(count($data));
// echo '==============================';die();
if(is_array($data) && count($data))
{
@ -3457,7 +3459,7 @@ class EmployeeController extends AdminController
$familiesPayload[$empCode] = $this->buildFamilyPayload($empCode, $members);
}
// print_r($familiesPayload);die();
// print_rr($familiesPayload);die();
$apiResponse = $this->sendFamiliesToWellnessApi($familiesPayload);
// print_r($apiResponse);
$updatedData = $this->updateWellnessOnboardResponseToDB($apiResponse);
@ -3490,7 +3492,7 @@ class EmployeeController extends AdminController
{
// Use the first member as primary reference for policy level data
$primary = $members[0];
// print_rr($primary);die();
// Map DB fields to your required "policyDetails" structure
$policyStartDate = $primary['cp_policy_start_date'] ?? null;
// $policyStartDate = '2025-01-01';
@ -3546,6 +3548,7 @@ class EmployeeController extends AdminController
public function sendFamiliesToWellnessApi(array $familiesPayload): array
{
// CI4 HTTP client
// print_rr($familiesPayload);die();
$client = \Config\Services::curlrequest();//die();
$endpointUrl = getenv('WELLNESS_ONBOARD_ENDPOINT_URL');
// Custom headers
@ -3555,7 +3558,7 @@ class EmployeeController extends AdminController
];
foreach ($familiesPayload as $empCode => &$family) {
// print_rr($family);die();
try {
$response = $client->post($endpointUrl, [
'headers' => $headers,
@ -3573,6 +3576,8 @@ class EmployeeController extends AdminController
'rawBody' => $body,
'data' => $decoded,
];
} catch (\Throwable $e) {
// In case of exception, store error info
$family['apiResponse'] = [
@ -3582,6 +3587,8 @@ class EmployeeController extends AdminController
'error' => $e->getMessage(),
];
}
// print_rr($body );die();
}
unset($family); // break reference

24
app/Controllers/EmployeeRestController.php
View File

@ -2929,6 +2929,7 @@ class EmployeeRestController extends AdminController
$data['claim_subject'] = "Claim GTLI";
$data['sum_insured_label'] = "Sum Assured";
} else if ($ClientPolicyValue['policy_type_id'] == 72){
$policyGroup = 'other';
$data['ticket_type_id'] = 72;
$data['ticket_settled_status_id'] = 76;
$data['claim_subject'] = "Claim OPD";
@ -3571,6 +3572,20 @@ class EmployeeRestController extends AdminController
$get_docs_name = $this->request->getPost('claim_doc_names') ?? [];
$policy_transaction_id = $this->request->getPost('policy_transaction_id') ?? null;
$client_policy_data = $this->clientPolicyModel->where('id', $received_data['client_policy_id'] ?? null)->first();
$isduplicate = checkDuplicateClaim([
'doa' => change_date_format($received_data['doa'] ?? '') ?? null,
'emp_code' => $received_data['emp_code'] ?? null,
'claim_amount' => $received_data['claim_amount'] ?? null,
'policy_no' => $client_policy_data['policy_no'] ?? null
]);
if($isduplicate){
$response = ['status' => false, 'code' => 404, 'message' => 'Claim already exist'];
return $this->respond($response, 200);
}
if(!empty($policy_transaction_id)){
$response = $this->retailClaimInitiate($received_data);
return $this->respond($response, 200);
@ -3648,11 +3663,8 @@ class EmployeeRestController extends AdminController
if (!empty($emp_ticket_data)) {
$insured_emp_data = $this->employeeModel->where('id', $insured_emp_id)->first();
unset($received_data['relationship']);
$fetchData = $emp_ticket_data[0];
if(!empty($insured_emp_data)){
$fetchData['relationship'] = strtolower($insured_emp_data['relationship']);
}
$claimStatusQuery = $this->claimStatusModel
->select('id')
@ -3675,7 +3687,9 @@ class EmployeeRestController extends AdminController
$fetchData['claim_type'] = 1;
$fetchData = array_merge($fetchData, $received_data);
$fetchData['relationship'] = strtolower($fetchData['relationship']) ?? $fetchData['relationship'];
// $fetchData['relationship'] = strtolower($fetchData['relationship']) ?? $fetchData['relationship'];
$fetchData['relationship'] = isset($fetchData['relationship']) ? strtolower($fetchData['relationship']) : null;
// print_r($fetchData); die;
$insert_status = $this->ticketMaster->insert($fetchData);
$ticket_id = $this->ticketMaster->insertID();

36
app/Controllers/LoginController.php
View File

@ -11,6 +11,8 @@ use CodeIgniter\API\ResponseTrait;
use App\Models\UserModel;
use App\Models\AuthHistoryModel;
use App\Libraries\AuthLogout;
class LoginController extends BaseController
{
use ResponseTrait;
@ -45,7 +47,7 @@ class LoginController extends BaseController
$user_team = $UserModel->getUserTeamsByUserID($user->id);
// dd($user_team);
session()->regenerate(true);
$session_data = [
'isLoggedIn' => True ,
'userid' => $user->id,
@ -56,9 +58,14 @@ class LoginController extends BaseController
$path = getenv('cookie.Path');
$domain = getenv('cookie.Domain');
$https = getenv('ccokie.secure');
setcookie('session_data', json_encode($session_data), time() + 12 * 60 * 60, $path, $domain, $https, true);
// setcookie('session_data', json_encode($session_data), time() + 12 * 60 * 60, $path, $domain, $https, true);
set_session_data($session_data);
// Bind session to device
set_session_data(['fingerprint' => hash('sha256',
($this->request->getUserAgent()->getAgentString() . '|' . ($this->request->getIPAddress()
)))]);
log_message('error', 'Set The UserId : `'. $user->id .'` in Session');
log_message('error', 'User Login Sucessfully');
@ -91,14 +98,23 @@ class LoginController extends BaseController
public function logout()
{
$path = getenv('cookie.Path');
session()->destroy();
// setcookie('session_data', '', time() - 3600, $path);
$path = getenv('cookie.Path');
$domain = getenv('cookie.Domain');
$https = getenv('cookie.secure');
setcookie('session_data',null, time() -3600, $path, $domain, $https, true);
return redirect()->to(base_url('login'));
// $path = getenv('cookie.Path');
// session()->regenerate(true);
// session()->destroy();
// $path = getenv('cookie.Path');
// $domain = getenv('cookie.Domain');
// $https = getenv('cookie.secure');
// setcookie('session_data',null, time() - 42000, $path, $domain, $https, true);
// // return redirect()->to(base_url('login'));
// return redirect()->to(base_url('login'))
// ->setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
// ->setHeader('Pragma', 'no-cache')
// ->setHeader('Expires', 'Sat, 26 Jul 1997 05:00:00 GMT');
return AuthLogout::logout();
}
public function getUserDeviceInfo($userId, $type_of_user)

1
app/Controllers/MasterController.php
View File

@ -1984,6 +1984,7 @@ class MasterController extends AdminController
'rules' => WRITEPATH . 'uploads/commission/rules',
'claim_sample_forms' => ROOTPATH . 'public/claim_sample_forms/',
'bds_dump_excel' => WRITEPATH . 'uploads/bds_dump_excel/',
'claims_mis' => WRITEPATH . 'uploads/claims_mis/',
];
foreach ($folders as $folderName => $folderPath) {

2
app/Controllers/PayoutController.php
View File

@ -335,7 +335,7 @@ class PayoutController extends BaseController
$invoiceData = [
'invoice_no' => $json['invoice_no'],
'agent_id' => $json['agent_id'],
// 'agent_id' => $json['agent_id'] ?? null,
'invoice_date' => $json['invoice_date'],
'invoice_amount' => $json['invoice_amount'],
];

119
app/Controllers/TicketController.php
View File

@ -24,6 +24,7 @@ use App\Models\ClaimFilesModel;
use App\Models\ClaimDumpFileModel;
use App\Models\VehicleModel;
use App\Models\PartnerPolicyModel;
use App\Models\ClaimMisFileModel;
use DOMDocument;
use DOMXPath;
@ -67,6 +68,7 @@ class TicketController extends BaseController
protected $claimDumpFileModel;
protected $vehicleModel;
protected $partnerPolicyModel;
protected $claimmisFileModel;
public function __construct()
{
@ -398,6 +400,7 @@ class TicketController extends BaseController
$this->claimDumpFileModel = new ClaimDumpFileModel();
$this->vehicleModel = new VehicleModel();
$this->partnerPolicyModel = new PartnerPolicyModel();
$this->claimmisFileModel = new ClaimMisFileModel();
}
public function ticketList()
@ -1124,6 +1127,43 @@ class TicketController extends BaseController
// $ticket_data = $this->getLastMatchedStatus($ticket_data, );
// print_rr($ticket_data); die;
$isduplicate = checkDuplicateClaim([
'doa' => change_date_format($ticket_data['doa'] ?? '') ?? null,
'emp_code' => $ticket_data['emp_code'] ?? null,
'claim_amount' => $ticket_data['claim_amount'] ?? null,
'policy_no' => $ticket_data['policy_no'] ?? null
]);
if ($isduplicate) {
$errorDetails = [];
if (!empty($ticket_data['doa'])) {
$errorDetails[] = 'DOA: ' . change_date_format($ticket_data['doa']);
}
if (!empty($ticket_data['claim_amount'])) {
$errorDetails[] = 'Claim Amount: ₹' . number_format($ticket_data['claim_amount'], 2);
}
if (!empty($ticket_data['emp_code'])) {
$errorDetails[] = 'Emp Code: ' . $ticket_data['emp_code'];
}
if (!empty($ticket_data['policy_no'])) {
$errorDetails[] = 'Policy No: ' . $ticket_data['policy_no'];
}
$response = [
'status' => false,
'code' => 409,
'message' => 'Duplicate claim found for ' . implode(', ', $errorDetails)
];
return $this->respond($response, 200);
}
if ($ticket_data) {
$return_value = $this->ticketMasterModel->insert($ticket_data);
if ($return_value) {
@ -2943,4 +2983,83 @@ class TicketController extends BaseController
return $this->respond(['status' => true, 'code' => 200, 'message' => 'IR docs saved successfully', 'data' => $required_docs], 200);
}
public function claimMisFileList()
{
$data['page_name'] = "Cliam MIS Files";
$data['claim_mis_file_list'] = $this->claimmisFileModel
->select('claims_mis_files.*, user_profiles.first_name as user_name')
->join('user_profiles', 'claims_mis_files.created_by = user_profiles.id')
->where('claims_mis_files.is_active', 1)
->orderBy('claims_mis_files.id', 'desc')
->findAll();
$data['tpa_list'] = $this->TPAModel->where('is_active', 1)->findAll();
return $this->loadLayout('claim_mis_file_list', $data);
}
public function uploadClaimMisFile()
{
$file = $this->request->getFile('file');
$data = $this->request->getPost();
if(isset($data['from_date']) && !empty($data['from_date'])){
$data['from_date'] = change_date_format($data['from_date'], 'd/m/Y', 'Y-m-d');
}
if(isset($data['to_date']) && !empty($data['to_date'])){
$data['to_date'] = change_date_format($data['to_date'], 'd/m/Y', 'Y-m-d');
}
$file_path = WRITEPATH.'uploads/claims_mis';
$file_name = file_Upload_for_lead($file, $file_path);
if(!empty($file_name)){
$data['file_name'] = $file_name;
}
$response = $this->claimmisFileModel->insert($data);
if($response){
return $this->respond(['status'=>true, 'code'=>200, 'message'=>'MIS file uploaded successfully'], 200);
}else{
return $this->respond(['status'=>true, 'code'=>500, 'message'=>'Failed to upload'], 200);
}
}
public function downloadClaimMisFile()
{
try {
$file_id = $this->request->getGet('id');
// Find record
$record = $this->claimmisFileModel->where('id', $file_id)->first();
// dd($record);
if (!$record) {
$data['message'] = 'File record not found';
return view('errors/404', $data);
}
$uploadPath = WRITEPATH . 'uploads/claims_mis/';
$filePath = $uploadPath . $record['file_name'];
// dd($filePath);
if (!file_exists($filePath)) {
$data['message'] = 'The Physical File Not Found';
return view('errors/404', $data);
}
// Force file download
return $this->response->download($filePath, null)->setFileName($record['file_name']);
} catch (\Exception $e) {
// return $this->failServerError($e->getMessage());
$this->myLogger->logme('error', 'Error occoured in downloadClaimMisFile : ' . $e->getMessage());
$data['message'] = 'File record not found';
return view('errors/404', $data);
}
}
}

23
app/Filters/AuthMVC.php
View File

@ -5,13 +5,30 @@ use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use App\Libraries\AuthLogout;
class AuthMVC implements FilterInterface
{
public function before(RequestInterface $request, $arguments = null)
{
if (!check_session() && !check_cookie()) {
return redirect()->to(base_url('/login'));
if (!check_session())
{
return AuthLogout::logout();
}
// if (!check_cookie())
// {
// return AuthLogout::logout();
// }
// Fingerprint validation
$fp = hash('sha256',
$request->getUserAgent()->getAgentString() . '|' . $request->getIPAddress()
);
if (session()->get('fingerprint') !== $fp) {
return AuthLogout::logout();
}
}

56
app/Filters/Cors.php
View File

@ -143,7 +143,7 @@ class Cors implements FilterInterface
// If wildcard present in configuration, allow any origin
if (in_array('*', $this->allowedOrigins, true)) {
$this->log('Origin allowed: wildcard match', ['origin' => $origin]);
// $this->log('Origin allowed: wildcard match', ['origin' => $origin]);
return true;
}
@ -159,10 +159,10 @@ class Cors implements FilterInterface
// 1. Exact match (including scheme and port)
// Example: https://example.com matches https://example.com
if (strcasecmp($allowed, $origin) === 0) {
$this->log('Origin allowed: exact match', [
'origin' => $origin,
'matched_rule' => $allowed
]);
// $this->log('Origin allowed: exact match', [
// 'origin' => $origin,
// 'matched_rule' => $allowed
// ]);
return true;
}
@ -178,11 +178,11 @@ class Cors implements FilterInterface
// Check if origin host ends with the allowed root domain
if ($originHost === $allowedRoot || str_ends_with($originHost, '.' . $allowedRoot)) {
$this->log('Origin allowed: wildcard subdomain match', [
'origin' => $origin,
'matched_rule' => $allowed,
'origin_host' => $originHost
]);
// $this->log('Origin allowed: wildcard subdomain match', [
// 'origin' => $origin,
// 'matched_rule' => $allowed,
// 'origin_host' => $originHost
// ]);
return true;
}
}
@ -191,11 +191,11 @@ class Cors implements FilterInterface
// Example: example.com matches both http://example.com and https://example.com
else {
if (strcasecmp($allowed, $originHost) === 0) {
$this->log('Origin allowed: host match (scheme-less)', [
'origin' => $origin,
'matched_rule' => $allowed,
'origin_host' => $originHost
]);
// $this->log('Origin allowed: host match (scheme-less)', [
// 'origin' => $origin,
// 'matched_rule' => $allowed,
// 'origin_host' => $originHost
// ]);
return true;
}
}
@ -320,11 +320,11 @@ class Cors implements FilterInterface
// Preflight is sent by browsers before actual cross-origin requests
// to check if the actual request is safe to send
if ($method === 'OPTIONS') {
$this->log('Preflight request received', [
'origin' => $origin,
'method' => $method,
'uri' => (string) $request->getUri()
]);
// $this->log('Preflight request received', [
// 'origin' => $origin,
// 'method' => $method,
// 'uri' => (string) $request->getUri()
// ]);
// Validate origin - reject if not allowed
if (empty($origin) || !$this->isOriginAllowed($origin)) {
@ -346,10 +346,10 @@ class Cors implements FilterInterface
$response->setStatusCode(204);
$response->setBody('');
$this->log('Preflight approved', [
'origin' => $origin,
'allowed_methods' => $this->allowedMethods
]);
// $this->log('Preflight approved', [
// 'origin' => $origin,
// 'allowed_methods' => $this->allowedMethods
// ]);
return $response;
}
@ -392,10 +392,10 @@ class Cors implements FilterInterface
// Add CORS headers to the response
$this->addCorsHeaders($response, $request, $origin, false);
$this->log('CORS headers added to response', [
'origin' => $origin,
'status' => $response->getStatusCode()
]);
// $this->log('CORS headers added to response', [
// 'origin' => $origin,
// 'status' => $response->getStatusCode()
// ]);
}
/**

147
app/Filters/GlobalPostFileUploadGuard.php Normal file
View File

@ -0,0 +1,147 @@
<?php
namespace App\Filters;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use CodeIgniter\Filters\FilterInterface;
use Config\Services;
use finfo;
class GlobalPostFileUploadGuard implements FilterInterface
{
/**
* Max file size (in bytes) → 25MB
*/
protected int $maxFileSize = 25 * 1024 * 1024;
/**
* Allowed MIME types mapped to extensions
*/
protected array $allowedMimeMap = [
'image/jpeg' => ['jpg', 'jpeg'],
'image/png' => ['png'],
'image/gif' => ['gif'],
'image/webp' => ['webp'],
'image/svg+xml' => ['svg'],
'application/pdf' => ['pdf'],
'application/msword' => ['doc'],
'application/vnd.openxmlformats-officedocument.wordprocessingml.document' => ['docx'],
'application/vnd.oasis.opendocument.text' => ['odt'],
'text/rtf' => ['rtf'],
'application/rtf' => ['rtf'],
'application/vnd.ms-excel' => ['xls'],
'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet' => ['xlsx'],
'application/vnd.oasis.opendocument.spreadsheet' => ['ods'],
'text/csv' => ['csv'],
'application/csv' => ['csv'],
'text/plain' => ['txt', 'csv'],
];
protected array $blockedExtensions = [
'php', 'phtml', 'pht', 'phar', 'php3', 'php4', 'php5', 'php7', 'php8', 'phps',
'cgi', 'fcgi', 'pl', 'py', 'rb', 'lua', 'tcl', 'go', 'rs', 'jar', 'class',
'exe', 'dll', 'com', 'bat', 'cmd', 'msi', 'vbs', 'ps1', 'scr',
'sh', 'bash', 'zsh', 'apk', 'app', 'deb', 'rpm', 'bin', 'run',
'js', 'mjs', 'jsp', 'asp', 'aspx', 'cer', 'swf',
'env', 'ini', 'user.ini', 'htaccess', 'htpasswd', 'conf', 'config', 'log', 'sql',
'zip', 'rar', '7z', 'tar', 'gz', 'bz2', 'xz', 'iso',
'lnk', 'url', 'reg', 'sys', 'drv', 'vxd', 'tmp', 'bak', 'old', 'backup', 'key', 'pem'
];
public function before(RequestInterface $request, $arguments = null)
{
if ($request->getMethod() !== 'post') {
return;
}
$files = $request->getFiles();
if (empty($files)) {
return;
}
foreach ($files as $inputName => $fileData) {
$this->validateFileInput($fileData, $inputName);
}
}
private function validateFileInput($fileData, string $inputName): void
{
if (is_array($fileData)) {
foreach ($fileData as $file) {
$this->validateSingleFile($file, $inputName);
}
} else {
$this->validateSingleFile($fileData, $inputName);
}
}
private function validateSingleFile($file, string $inputName): void
{
$request = Services::request();
$clientIp = $request->getIPAddress();
$uri = $request->getUri()->getPath();
if (!$file->isValid()) {
if ($file->getError() === UPLOAD_ERR_INI_SIZE || $file->getError() === UPLOAD_ERR_FORM_SIZE) {
$this->block("File exceeds server-side size limit", $clientIp, $uri, $inputName, $file->getClientName(), 'unknown', 'unknown', 0);
}
return;
}
$originalName = $file->getClientName();
$extension = strtolower($file->getExtension());
$mime = $file->getMimeType();
$size = $file->getSize();
// --- 1. Fixed Null Byte & Path Traversal Check ---
if (preg_match('/\0|[\/\\\]/', $originalName)) {
$this->block("Malicious filename characters", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
}
// --- 2. Double Extension Attack Check ---
if (preg_match('/\.(php|phtml|phar|exe|sh|bat|cmd|js|jsp|asp|aspx|py|pl)\./i', $originalName)) {
$this->block("Double extension attack", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
}
// --- 3. Forbidden Extension ---
if (in_array($extension, $this->blockedExtensions, true)) {
$this->block("Forbidden extension", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
}
// --- 4. File Size Limit ---
if ($size > $this->maxFileSize) {
$this->block("File too large", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
}
// --- 5. MIME Allow-list Check ---
if (!array_key_exists($mime, $this->allowedMimeMap)) {
$this->block("MIME type not allowed ($mime)", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
}
// --- 6. MIME-Extension Consistency ---
if (!in_array($extension, $this->allowedMimeMap[$mime], true)) {
$this->block("MIME-extension mismatch", $clientIp, $uri, $inputName, $originalName, $mime, $extension, $size);
}
}
private function block(string $reason, string $ip, string $uri, string $field, string $filename, string $mime, string $ext, int $size): void
{
log_message('critical',
'[UPLOAD_BLOCKED] {reason} | IP: {ip} | URI: {uri} | Field: {field} | File: {file} | MIME: {mime} | EXT: {ext} | SIZE: {size}',
['reason'=>$reason, 'ip'=>$ip, 'uri'=>$uri, 'field'=>$field, 'file'=>$filename, 'mime'=>$mime, 'ext'=>$ext, 'size'=>$size]
);
$response = Services::response();
$response->setStatusCode(403)
->setJSON([
'status' => 'error',
'message' => 'File upload rejected: Security policy violation.',
'debug' => (ENVIRONMENT === 'development') ? $reason : null
])
->send();
exit;
}
public function after(RequestInterface $request, ResponseInterface $response, $arguments = null) {}
}

130
app/Filters/SecurityInputFilter.php Normal file
View File

@ -0,0 +1,130 @@
<?php
namespace App\Filters;
use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\ResponseInterface;
use Config\Services;
class SecurityInputFilter implements FilterInterface
{
/**
* High-confidence XSS patterns only
* (low false-positive set)
**/
protected array $xssPatterns = [
// Script execution
'/<\s*script\b/i',
'/<\/\s*script\s*>/i',
// JavaScript execution vectors
'/javascript\s*:/i',
'/vbscript\s*:/i',
'/data\s*:\s*text\/html/i',
// Inline event handlers (strong signal)
'/on\w+\s*=\s*["\']?/i',
// Dangerous HTML tags
'/<\s*iframe\b/i',
'/<\s*object\b/i',
'/<\s*embed\b/i',
'/<\s*applet\b/i',
'/<\s*img\b/i',
// Image-based execution
'/<\s*img\b[^>]*on\w+/i',
// SVG-based execution (modern bypass)
'/<\s*svg\b/i',
'/<\s*math\b/i',
// Meta refresh redirect
'/<\s*meta\b[^>]*http-equiv\s*=\s*["\']?refresh/i',
// HTML injection via src/href
'/<\s*\w+\b[^>]*(src|href)\s*=\s*["\']?\s*(javascript|data)\s*:/i'
];
public function before(RequestInterface $request, $arguments = null)
{
$logger = Services::mylogger();
$response = Services::response();
// Collect all user-controlled input
$inputs = array_merge(
$request->getGet(),
$request->getPost()
);
if (empty($inputs)) {
return;
}
foreach ($inputs as $field => $value) {
if (is_array($value)) {
$value = json_encode($value);
}
// Step 1: Canonicalization (VERY IMPORTANT)
$canonical = $this->canonicalize($value);
// Step 2: Trim (hygiene)
$canonical = trim($canonical);
// Step 3: Detection (signal-only)
if ($this->detectXss($canonical)) {
// 🔐 Log intent, not data
$logger->logme('critical','SECURITY_BLOCKED_REQUEST - '. json_encode([
'ip' => $request->getIPAddress(),
'method' => $request->getMethod(),
'uri' => current_url(),
'field' => $field,
'attack' => 'XSS_PATTERN',
'length' => strlen($canonical),
'hash' => hash('sha256', $canonical),
]));
// ⛔ Block request
return $response
->setStatusCode(403)
->setJSON([
'status' => 403,
'error' => 'Forbidden',
'message' => 'Malicious input detected'
]);
}
}
}
public function after(RequestInterface $request, ResponseInterface $response, $arguments = null)
{
// no-op
}
/**
* Canonicalization prevents encoded bypass
*/
private function canonicalize(string $value): string
{
$value = urldecode($value);
$value = html_entity_decode($value, ENT_QUOTES | ENT_HTML5, 'UTF-8');
// Remove invisible control characters
return preg_replace('/[\x00-\x1F\x7F]/u', '', $value);
}
private function detectXss(string $value): bool
{
foreach ($this->xssPatterns as $pattern) {
if (preg_match($pattern, $value)) {
return true;
}
}
return false;
}
}

6
app/Helpers/session_helper.php
View File

@ -21,7 +21,7 @@ if(!function_exists('check_cookie')){
'userProfile' => $value['userProfile'],
'user_team' => $user_team,
];
set_session_data($session_data);
// set_session_data($session_data);
// $this->getUserDeviceInfo($user->id, 'NhanceUser');
// return redirect()->to(base_url('/dashboard/view'));
return true;
@ -33,6 +33,7 @@ if(!function_exists('check_cookie')){
}else{
return false;
}
}
}
if (!function_exists('check_session')) {
@ -40,7 +41,7 @@ if (!function_exists('check_session')) {
{
// $ci =& get_instance();
$session = \Config\Services::session();
return $session->get('isLoggedIn');
return $session->get('isLoggedIn') === true;
}
}
@ -201,7 +202,6 @@ if (!function_exists('get_chatbot_session_info')) {
}
}

32
app/Helpers/utility_helper.php
View File

@ -6,6 +6,7 @@ use App\Models\BatchFileModelFileModel;
use App\Controllers\GoogleDriveController;
use App\Models\BatchFileModel;
use App\Controllers\ApiServiceController;
use App\Models\TicketMasterModel;
// File: app/Helpers/Uuid_helper.php
@ -1004,3 +1005,34 @@ if (!function_exists('canSendOtp')) {
}
}
if (!function_exists('checkDuplicateClaim')) {
function checkDuplicateClaim(array $params): bool
{
$ticketMaster = new TicketMasterModel();
$query = $ticketMaster->where('is_active', 1);
if(empty($params['doa']) && empty($params['claim_amount'])){
return false;
}
$hasValidCondition = false;
foreach ($params as $key => $value) {
if ($value !== null && $value !== '') {
$query->where($key, $value);
$hasValidCondition = true;
}
}
if (!$hasValidCondition) {
return false;
}
$result = $query->countAllResults();
// print_r($ticketMaster->getLastQuery()->getQuery()); die;
if($result > 0){ return true; }else{ return false; }
}
}

42
app/Libraries/AuthLogout.php Normal file
View File

@ -0,0 +1,42 @@
<?php
namespace App\Libraries;
use CodeIgniter\HTTP\RedirectResponse;
class AuthLogout
{
public static function logout(): RedirectResponse
{
$session = session();
// Regenerate session ID (kills fixation)
$session->regenerate(true);
// Destroy CI session
$session->destroy();
// Kill PHP session cookie safely
if (ini_get('session.use_cookies')) {
$params = session_get_cookie_params();
setcookie(
session_name(), // DO NOT hardcode cookie name
'',
time() - 42000,
$params['path'],
$params['domain'],
$params['secure'],
$params['httponly']
);
}
session_write_close();
// Redirect with anti-cache headers
return redirect()->to(base_url('login'))
->setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
->setHeader('Pragma', 'no-cache')
->setHeader('Expires', 'Sat, 26 Jul 1997 05:00:00 GMT');
}
}

57
app/Models/ClaimMisFileModel.php Normal file
View File

@ -0,0 +1,57 @@
<?php
namespace App\Models;
use CodeIgniter\Model;
class ClaimMisFileModel extends Model
{
protected $table = 'claims_mis_files';
protected $primaryKey = 'id';
protected $allowedFields = [
'id',
'client_id',
'tpa_id',
'client_policy_id',
'from_date',
'to_date',
'file_name',
'created_by',
'updated_by',
'is_active'
];
// Callbacks
protected $allowCallbacks = true;
protected $beforeInsert = ["checkAndADDCreatedByValue"];
protected $afterInsert = [];
protected $beforeUpdate = ["checkAndUpdateUpdatedByValue"];
protected $afterUpdate = [];
protected $beforeFind = [];
protected $afterFind = [];
protected $beforeDelete = [];
protected $afterDelete = [];
protected function checkAndADDCreatedByValue(array $data)
{
// Check if 'updated_by' value is null or empty
if (empty($data['data']['created_by'])) {
// Set 'updated_by' value to the current session user ID
$data['data']['created_by'] = get_session_userid();
}
return $data;
}
protected function checkAndUpdateUpdatedByValue(array $data)
{
// Check if 'updated_by' value is null or empty
if (empty($data['data']['updated_by'])) {
// Set 'updated_by' value to the current session user ID
$data['data']['updated_by'] = get_session_userid();
}
return $data;
}
}

8
app/Models/EmployeePolicyModel.php
View File

@ -1545,9 +1545,9 @@ class EmployeePolicyModel extends Model
->join('insurer_branch', 'insurer_branch.id = cp.insurer_branch_id')
->join('tpa', 'tpa.id = cp.tpa_id')
->where("ep.tpa_id IS NOT NULL AND ep.tpa_id <> ''")
->where('e.emp_status', 'active')
->where('e.is_active', '1')
->where('ep.status', 'active')
->whereIn('ep.status', ['active', 'expired'])
->whereIn('e.emp_status', ['active', 'expired'])
->where('ep.is_active', '1')
->where('e.emp_code', $emp_code)
->where('ep.client_policy_id', $client_policy_id)
@ -1618,9 +1618,9 @@ class EmployeePolicyModel extends Model
->join('insurer_branch', 'insurer_branch.id = cp.insurer_branch_id')
->join('tpa', 'tpa.id = cp.tpa_id')
->where("ep.tpa_id IS NOT NULL AND ep.tpa_id <> ''")
->where('e.emp_status', 'active')
->where('e.is_active', '1')
->where('ep.status', 'active')
->whereIn('ep.status', ['active', 'expired'])
->whereIn('e.emp_status', ['active', 'expired'])
->where('ep.is_active', '1')
->where('ep.rand_string', $rand_string)
->get()

3
app/Models/InvoiceModel.php
View File

@ -206,9 +206,8 @@ class InvoiceModel extends Model
WHEN payout_status = 2 THEN 'Completed'
END AS status_text,
partner_agent.name as agent_name
")
->join('partner_agent', 'partner_invoice.agent_id = partner_agent.id')
// ->join('partner_agent', 'partner_invoice.agent_id = partner_agent.id')
->where('partner_invoice.is_active', 1)
->where('partner_invoice.id', $invoice_id)
->first();

388
app/Views/claim_mis_file_list.php Normal file
View File

@ -0,0 +1,388 @@
<style>
.reload:hover {
cursor: pointer;
}
.table th,
.table td {
padding: 8px;
}
table.dataTable tbody td {
padding: 4px 4px !important;
}
.addbtnStyle{
margin-left: 20px !important;
}
.dataTables_filter {
position: absolute;
}
.dataTables_length label {height: 21px !important;}
.readonly-select { background-color: #f3f3f3 !important; cursor: not-allowed; pointer-events: none; }
</style>
<div class="col-12">
<div class="card">
<div class="card-body">
<table data-custom-table-css="table" class="table table-hover m-0 table-centered dt-responsive w-100" cellspacing="0" id="tickets-table">
<thead class="bg-light">
<tr>
<th class="font-weight-medium">S.No&nbsp;</th>
<th class="font-weight-medium">File name</th>
<th class="font-weight-medium">User/Time</th>
<th class="font-weight-medium">Action</th>
</tr>
</thead>
<tbody class="font-12">
<?php
if (isset($claim_mis_file_list)) {
foreach ($claim_mis_file_list as $key => $file) {
?>
<tr>
<td class="text-center"><b><?php echo ($key + 1) ?></b></td>
<td class="text-center"><?php echo $file['file_name'] ?></td>
<td><?php echo change_date_format($file['created_at'],'Y-m-d H:i:s', 'd M Y h:i a') . ' by <strong>' . $file['user_name'] . '</strong>' ?>
<td>
<div class="btn-group dropdown">
<a href="javascript: void(0);" class="dropdown-toggle arrow-none btn btn-light btn-sm" data-toggle="dropdown" aria-expanded="false"><i class="mdi mdi-dots-horizontal"></i></a>
<div class="dropdown-menu dropdown-menu-right">
<a target="_blank" class="dropdown-item" href="<?= base_url("claim_mis/download?id=") . $file['id']; ?>"><i class="mdi mdi-download mr-2 text-muted font-18 vertical-middle"></i>Download</a>
</div>
</div>
</td>
</tr>
<?php }
} ?>
</tbody>
</table>
</div>
</div>
</div><!-- end col -->
<!-- Center modal content for upload file-->
<div class="modal fade" id="claim-mis-file-upload-modal" tabindex="-1" role="dialog" aria-hidden="true">
<div class="modal-dialog modal-lg">
<div class="modal-content">
<div class="modal-header">
<h4 class="modal-title" id="myCenterModalLabel">Cliam MIS File upload</h4>
<button type="button" class="close" data-dismiss="modal" aria-hidden="true">×</button>
</div>
<div class="modal-body">
<form class="parsley-examples" id="claim-mis-upload-form" enctype="multipart/form-data">
<div class="form-group">
<div class="form-row">
<div class="form-group col-md-4">
<label>Client<span id="tpa_danger" class="text-danger">*</span></label>
<select name="client_id" class="form-control" id="client_id" required>
<option value="">Select</option>
</select>
</div>
<div class="form-group col-md-4">
<label>Policy <span id="tpa_danger" class="text-danger">*</span></label>
<select name="client_policy_id" class="form-control" id="client_policy_id" required>
<option value="">Select</option>
</select>
</div>
<div class="form-group col-md-4">
<label for="tpa">TPA<span id="tpa_danger" class="text-danger">*</span></label>
<select class="form-control readonly-select" id="tpa_id" name="tpa_id" required>
<option value="">Select TPA</option>
<?php foreach ($tpa_list as $value) { ?>
<option value="<?= $value['id'] ?>"><?= $value['short_name'] ?></option>
<?php } ?>
</select>
</div>
</div>
<div class="form-row">
<div class="form-group col-md-4">
<label>From Date<span id="tpa_danger" class="text-danger">*</span></label>
<input class="form-control" type="text" name="from_date" id="from_date" required>
</div>
<div class="form-group col-md-4">
<label>To Date<span id="tpa_danger" class="text-danger">*</span></label>
<input class="form-control" type="text" name="to_date" id="to_date" required>
</div>
</div>
<div class="form-row" id="file_upload">
<div class="form-group col-md-4">
<label>Upload file</label>
<input type="file" name="file" id="file" accept=".pdf,.xls,.xlsx,application/pdf,application/vnd.ms-excel,application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" required>
</div>
<div class="form-group col-md-3" style="margin-top: 40px;margin-left: 170px;">
<button id="claim_mis_form_submit_button" type="submit" class="btn btn-primary waves-effect waves-light justify-content-end">Upload</button>
</div>
</div>
</div>
</form>
</div>
</div><!-- /.modal-content -->
</div><!-- /.modal-dialog -->
</div><!-- /.modal -->
<script>
let policyListByClient = null;
let client_list = null;
$(document).ready(function() {
getClientAndBranchAndPolicy();
$('#client_id').select2();
$('#client_policy_id').select2();
var from_date = flatpickr("#from_date", {
dateFormat: "d/m/Y",
allowInput: false
});
var to_date = flatpickr("#to_date", {
dateFormat: "d/m/Y",
allowInput: false
});
// AJAX Form Submit Function
$('#claim-mis-upload-form').on('submit', function(e) {
e.preventDefault(); // Prevent default form submission
// Get form data
var formData = new FormData(this);
var fileInput = $('#file')[0];
// Validate file type
var allowedTypes = [
'application/pdf',
'application/vnd.ms-excel',
'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
'application/vnd.oasis.opendocument.spreadsheet'
];
if (!fileInput.files || !fileInput.files.length) {
toastr.warning('Please select a file', 'WARNING');
return false;
}
var selectedFile = fileInput.files[0];
// Some browsers return empty type → fallback to extension
var allowedExtensions = ['pdf', 'xls', 'xlsx', 'ods'];
var fileExtension = selectedFile.name.split('.').pop().toLowerCase();
if (
(!allowedTypes.includes(selectedFile.type)) &&
(!allowedExtensions.includes(fileExtension))
) {
toastr.warning(
'Please upload a valid file (PDF / Excel: .pdf, .xls, .xlsx, .ods)',
'WARNING'
);
return false;
}
//form submit url;
let url = `<?php echo base_url('claim_mis/upload'); ?>`;
// Show loading state
var submitButton = $('#claim_mis_form_submit_button');
var originalText = submitButton.text();
submitButton.prop('disabled', true).text('Uploading...');
// AJAX request
$.ajax({
url: url, // Your route URL
type: 'POST',
data: formData,
processData: false, // CRITICAL: Don't process the data
contentType: false, // CRITICAL: Don't set content-type header
cache: false,
success: function(response) {
// Handle successful response
console.log('Upload successful:', response);
if (response.status == true) {
toastr.success(response.message, "SUCCESS");
} else {
toastr.error(response.message, "ERROR");
}
// Reset form
$('#claim-mis-upload-form')[0].reset();
$('.close').click();
window.location.reload();
},
error: function(xhr, status, error) {
// Handle error response
console.error('Upload failed:', error);
console.error('Upload failed:', error);
},
complete: function() {
// Reset button state
submitButton.prop('disabled', false).text(originalText);
}
});
});
$('#client_id').on('change', function(){
let client_id = $(this).val();
if(policyListByClient != '') {
console.log(policyListByClient[client_id]);
let data = policyListByClient[client_id];
appendPolicies(data);
}
})
$('#client_policy_id').on('change', function(){
let tpa_id = $(this).find(':selected').data('tpaid');
console.log('tpa_id', tpa_id);
if(tpa_id){
$('#tpa_id').val(tpa_id);
}else{
$('#tpa_id').val('');
}
})
});
// Datatable document ready
$(document).ready(function() {
var ticketsTable = $('#tickets-table');
if (ticketsTable.length) {
ticketsTable.DataTable({
scrollX: true,
// dom: "<'row'<'col-sm-7'f><'col-sm-5 text-right'B>>" + // Filter left, buttons right
// "<'row'<'col-sm-12'tr>>" +
// "<'row'<'col-sm-5'i><'col-sm-7'p>>", // Pagination at the bottom, without page length selector
dom: "<'row'<'col-sm-7'f><'col-sm-5 text-right'B>>" + // Filter left, buttons right
"<'row'<'col-sm-12'tr>>" +
"<'row align-items-center'<'col-5 text-start'i><'col-7 d-flex justify-content-end align-items-center'<'me-2'l>p>>",
lengthMenu: [[10, 20, 50, 100], [10, 20, 50, 100]],
buttons: [
{
text: 'Add',
className: 'buttons-html5 addbtnStyle',
action: function (e, dt, node, config) {
openDumpUploadModal();
}
}
],
language: {
search: `
<div class="datatable-search-wrapper" style="position:relative; display:inline-block;">
_INPUT_
<i class="mdi mdi-magnify datatable-search-icon"
style="position:absolute; right:10px; top:50%; transform:translateY(-50%); color:#666;"></i>
<i class="mdi mdi-close-circle datatable-clear-icon"
style="position:absolute; right:10px; top:50%; transform:translateY(-50%); color:#666; display:none;"></i>
</div>`,
searchPlaceholder: "Search",
emptyTable: '<div class="text-center text-muted">No Data found</div>'
},
paging: true, // Enable pagination
pageLength: 15, // Set default number of rows per page (optional)
});
} else {
console.error("Table not found.");
}
});
function openDumpUploadModal() {
var myModal = new bootstrap.Modal(document.getElementById('claim-mis-file-upload-modal'));
myModal.show();
}
function getClientAndBranchAndPolicy() {
$.ajax({
url: '<?= base_url("/util/getClientAndBranchAndPolicy") ?>',
type: "GET",
dataType: 'json',
success: function(res) {
console.log('getClientAndBranchAndPolicy', res);
if (res.status == true) {
policyListByClient = res.policyListByClient;
client_list = res.client_data;
appendClients(res.client_data);
} else {
console.log('No data found');
}
},
error: function(xhr, status, error) {
console.error(xhr.responseText);
console.error(status, error);
}
});
}
function appendClients(data) {
$('#client_id').empty();
$('#client_id').append($('<option>', {
value: '',
text: 'Select Client'
}));
$.each(data, function(index, item) {
if (item.client_policy_count > 0) {
var option = $('<option>', {
value: item.id,
text: item.client_name
});
$('#client_id').append(option);
}
});
}
function appendPolicies(data) {
$('#client_policy_id').empty();
$('#client_policy_id').append($('<option>', {
value: '',
text: 'Select Policy',
}));
$.each(data, function(index, item) {
var option = $('<option>', {
value: item.id,
text: item.policy_type + '-' + item.policy_no,
'data-tpaid': item.id,
});
$('#client_policy_id').append(option);
});
}
</script>

8
app/Views/employee_data_list.php
View File

@ -197,20 +197,20 @@
<?php } ?>
<?php if(in_array($employee['policy_type_id'], [2,3,4,5]) && $employee['emp_status'] == 'active' && $employee['status'] == 'active' && !empty($employee['tpa_id'])) { ?>
<?php if(in_array($employee['policy_type_id'], [2,3,4,5]) && in_array($employee['emp_status'], ['active', 'expired']) && in_array($employee['status'], ['active', 'expired']) && !empty($employee['tpa_id'])) { ?>
<!-- <a href="<?= base_url('download-e-card/'). $employee['rand_string'] . "/0/1" ?>" class="dropdown-item" target="_blank"><i class="mdi mdi-eye mr-2 text-muted font-18 vertical-middle"></i>View E-Card</a> -->
<a class="dropdown-item" onclick="viewEcard(<?= $employee['employee_id'] ?>, '<?= $employee['emp_code'] ?>', <?= $employee['client_policy_id'] ?>, '<?= $employee['policy_no'] ?>')"><i class="mdi mdi-eye mr-2 text-muted font-18 vertical-middle"></i>View E-Card</a>
<?php } ?>
<?php if($employee['relationship'] == 'Self' && in_array($employee['policy_type_id'], [2,3,4,5]) && $employee['email_corporate'] != '' && $employee['emp_status'] == 'active' && $employee['status'] == 'active' && !empty($employee['tpa_id'])) { ?>
<?php if($employee['relationship'] == 'Self' && in_array($employee['policy_type_id'], [2,3,4,5]) && $employee['email_corporate'] != '' && in_array($employee['emp_status'], ['active', 'expired']) && in_array($employee['status'], ['active', 'expired']) && !empty($employee['tpa_id'])) { ?>
<a class="dropdown-item" onclick="send_mail_for_individual_employee_ecard('<?= $employee['id'];?>', '<?= $employee['client_policy_id'];?>')" ><i class="mdi mdi-email-alert mr-2 text-muted font-18 vertical-middle"></i>Send E-Card Mail</a>
<?php } ?>
<?php if($employee['relationship'] == 'Self' && in_array($employee['policy_type_id'], [2,3,4,5]) && $employee['emp_status'] == 'active' && $employee['status'] == 'active' && !empty($employee['tpa_id'])) { ?>
<?php if($employee['relationship'] == 'Self' && in_array($employee['policy_type_id'], [2,3,4,5]) && in_array($employee['emp_status'], ['active', 'expired']) && in_array($employee['status'], ['active', 'expired']) && !empty($employee['tpa_id'])) { ?>
<a class="dropdown-item" onclick="showReGenerateConfirmation('<?= $employee['client_policy_id'];?>', '<?= $employee['emp_code'];?>')" ><i class="mdi mdi-refresh mr-2 text-muted font-18 vertical-middle"></i>Re-Generate E-Card</a>
<?php } ?>
<?php if($employee['is_addon'] == 3 && $employee['policy_type_id'] == 3 && $employee['emp_status'] == 'active' && $employee['status'] == 'active' && !empty($employee['tpa_id'])) { ?>
<?php if($employee['is_addon'] == 3 && $employee['policy_type_id'] == 3 && in_array($employee['emp_status'], ['active', 'expired']) && in_array($employee['status'], ['active', 'expired']) && !empty($employee['tpa_id'])) { ?>
<a class="dropdown-item" onclick="showReGenerateConfirmation('<?= $employee['client_policy_id'];?>', '<?= $employee['emp_code'];?>')" ><i class="mdi mdi-refresh mr-2 text-muted font-18 vertical-middle"></i>Re-Generate E-Card</a>
<?php } ?>

47
app/Views/fedeploy.php
View File

@ -9,35 +9,70 @@
<label for="zip_folder">Zip Folder (inside zip to deploy)</label>
<select name="zip_folder" id="zip_folder">
<option value="web/">web/</option>
<option value="dist/">dist/</option>
<!-- <option value="dist/">dist/</option> -->
</select>
</div>
<div>
<label for="s3_bucket">S3 Bucket</label>
<select name="s3_bucket" id="s3_bucket">
<option value="benefits-app-bucket">benefits-app-bucket</option>
<option value="other-bucket">other-bucket</option>
<option value="uat-benefits-app-bucket">UAT Benefits</option>
<option value="uat-hr-app-bucket">UAT HR</option>
<option value="benefits-app-bucket">Live Benefits</option>
<option value="live-hr-app-bucket">Live HR</option>
</select>
</div>
<div>
<label for="s3_prefix">S3 Prefix</label>
<input type="text" name="s3_prefix" id="s3_prefix" value="hr/">
<input type="text" name="s3_prefix" id="s3_prefix" value="/*">
</div>
<div>
<label for="cf_distribution_id">CloudFront Distribution ID (optional)</label>
<input type="text" name="cf_distribution_id" id="cf_distribution_id" value="E1MKRK4U5MZ3BD">
<!-- <input type="text" name="cf_distribution_id" id="cf_distribution_id" value="E1MKRK4U5MZ3BD"> -->
<select name="cf_distribution_id" id="cf_distribution_id">
<option value="EUBZ8CDSV9KZZ">UAT Benefits</option>
<option value="E9TNPRI9ITM1M">UAT HR</option>
<option value="E1MKRK4U5MZ3BD">Live Benefits</option>
<option value="E3TE01DPKHTD8B">Live HR</option>
</select>
</div>
<div>
<label for="cf_paths">
CloudFront Invalidation Paths (comma or newline separated, e.g. <code>/hr/*,/hr/special/*</code>)
</label>
<input type="text" name="cf_paths" id="cf_paths" value="/hr/*">
<input type="text" name="cf_paths" id="cf_paths" value="/*">
<!-- If you prefer multi-line, use <textarea> instead of <input> -->
</div>
<button type="submit">Deploy</button>
</form>
<script>
document.addEventListener('DOMContentLoaded', function () {
const bucketToDistributionMap = {
'uat-benefits-app-bucket': 'EUBZ8CDSV9KZZ',
'uat-hr-app-bucket': 'E9TNPRI9ITM1M',
'benefits-app-bucket': 'E1MKRK4U5MZ3BD',
'live-hr-app-bucket': 'E3TE01DPKHTD8B'
};
const s3BucketEl = document.getElementById('s3_bucket');
const cfDistributionEl = document.getElementById('cf_distribution_id');
s3BucketEl.addEventListener('change', function () {
const selectedBucket = this.value;
if (bucketToDistributionMap[selectedBucket]) {
cfDistributionEl.value = bucketToDistributionMap[selectedBucket];
} else {
// Optional: reset if no mapping found
cfDistributionEl.value = '';
}
});
// Auto-select on page load (useful for edit forms)
s3BucketEl.dispatchEvent(new Event('change'));
});
</script>

4
app/Views/invoice_policy_mapping.php
View File

@ -525,7 +525,8 @@ table.dataTable tbody td { padding: 4px 4px !important; }
function loadPolicies() {
// const agentId = getEl('agentSelect')?.value || '';
const posId = getEl('posSelect')?.value || '';
console.log('-->',posId);
console.log(':) POS --> ',posId);
console.log(window.allPolicies);
const policyTillDate = getEl('policyTillDate')?.value || '';
const list = getEl('policyListBody');
if (!list) return;
@ -623,7 +624,6 @@ table.dataTable tbody td { padding: 4px 4px !important; }
if (selectedPolicies.size === 0) {
summaryBar.classList.remove('show')
const summaryBar = getEl('summaryBar');;
if (selectedCountBadge) selectedCountBadge.style.display = 'none';
totalPoliciesEl.textContent = '0';
totalAmountEl.textContent = '₹0.00';

3
app/Views/layout/header.php
View File

@ -1863,6 +1863,9 @@
<li>
<a href="<?= base_url('/ticket/claim-upload') ?>">Claim Dump Upload</a>
</li>
<li>
<a href="<?= base_url('/claim_mis/list') ?>">Claim MIS Upload</a>
</li>
<!-- <li>
<a href="<?= base_url('/ticketList?return_type=web') ?>">Ticket List</a>
</li> -->

14
app/Views/payout_list.php
View File

@ -313,13 +313,13 @@
"<'row align-items-center'<'col-5 text-start'i><'col-7 d-flex justify-content-end align-items-center'<'me-2'l>p>>",
lengthMenu: [[10, 20, 50, 100], [10, 20, 50, 100]],
buttons: [
{
text: 'Add',
className: 'btn app-btn-primary mr-2',
action: function (e, dt, node, config) {
window.location.href = "<?= base_url('payout/invoices?type=add') ?>";
}
},
// {
// text: 'Add',
// className: 'btn app-btn-primary mr-2',
// action: function (e, dt, node, config) {
// window.location.href = "<?= base_url('payout/invoices?type=add') ?>";
// }
// },
{
extend: 'collection',
text: '<span class=" btn-custom"> Export </span><i class="mdi mdi-menu-down"></i>',

34
app/Views/policy_transaction_inception_list.php
View File

@ -334,7 +334,7 @@ table.dataTable tbody td {
<div class="btn-group dropdown">
<a href="javascript: void(0);" class="dropdown-toggle arrow-none btn btn-light btn-sm" data-toggle="dropdown" aria-expanded="false"><i class="mdi mdi-dots-horizontal"></i></a>
<div class="dropdown-menu dropdown-menu-right">
<a class="dropdown-item btnEdit" data-id="<?= $row['id'];?>" onclick="getPolicyTransactionDataForEdit('<?= htmlspecialchars($row['id'], ENT_QUOTES) ?>')">
<a class="dropdown-item btnEdit" data-id="<?= $row['id'];?>" onclick="alertEveryFiveSeconds('<?= htmlspecialchars($row['id'], ENT_QUOTES) ?>')">
<i class="mdi mdi-pencil mr-2 text-muted font-18 vertical-middle"></i>Edit
</a>
@ -448,7 +448,7 @@ document.addEventListener("DOMContentLoaded", function () {
// Handle edit button
if (this.classList.contains('btnEdit') && id) {
getPolicyTransactionDataForEdit(id);
alertEveryFiveSeconds(id);
}
// Handle delete button
else if (this.classList.contains('delete') && id) {
@ -490,6 +490,8 @@ var vehicle_list = ''; // local variable for storing the client policy list
var branch_policy = '';
var unit_list = '';
var count = 0
var getClientAndBranchAndPolicySuccess = false
var intervalId = 0;
//for disable all field if client and client branch is empty
$(document).ready(function() {
@ -767,6 +769,9 @@ function getClientAndBranchAndPolicy(appendStatus = true)
error: function(xhr, status, error) {
console.error(xhr.responseText);
console.error(status, error);
},
complete : function(){
getClientAndBranchAndPolicySuccess = true
}
});
}
@ -1595,6 +1600,31 @@ function onlyNumbers(event)
return false;
}
function alertEveryFiveSeconds(id) {
console.log('intervel Started');
$('.loader').fadeIn();
$('.loader-mask').fadeIn();
intervalId = setInterval(function () {
if (getClientAndBranchAndPolicySuccess === true) {
clearInterval(intervalId); // ✅ stop interval
console.log('intervel cleared');
getPolicyTransactionDataForEdit(id)
console.log('getPolicyTransactionDataForEdit function called');
}else{
console.log('intervel not cleared getClientAndBranchAndPolicy is still pending');
}
}, 3000);
}
</script>

8
app/Views/ticket_form_handler.php
View File

@ -770,11 +770,15 @@
if (response.status === true) {
toastr.success(response.message, 'SUCCESS');
window.location.href = '<?= base_url('ticket/list') ?>';
} else {
toastr.error(response.message, 'ERROR');
if(response.code == 409){
toastr.warning(response.message, 'WARNING');
}else{
toastr.error(response.message, 'ERROR');
}
}
window.location.href = '<?= base_url('ticket/list') ?>';
},
error: function(xhr, status, error) {
console.error(xhr.responseText);

21
public/.htaccess
View File

@ -5,6 +5,27 @@ Options -Indexes
# Rewrite engine
# ----------------------------------------------------------------------
## ADDED for - block any script execution inside folder of public
<If "%{REQUEST_URI} =~ m#/(logo|add_image_upload|e_card_imgs|claim_sample_forms|sample_import_excel|writable)/#">
Deny from all
# Disable PHP engine
<IfModule mod_php.c>
php_flag engine off
</IfModule>
# Disable CGI and other executable handlers
Options -ExecCGI
AddHandler cgi-script .php .pl .py .jsp .asp .sh .cgi
# Block access to any script-like files entirely
<FilesMatch "\.(php|php5|php7|phtml|pl|py|cgi|ap|aspx|sh|rb)$">
ForceType text/plain
#Order allow,deny
Deny from all
</FilesMatch>
</If>
# Turning on the rewrite engine is necessary for the following rules and features.
# FollowSymLinks must be enabled for this to work.
<IfModule mod_rewrite.c>