From fa69f2780ce5ada866814d0e2855f299d24c1eed Mon Sep 17 00:00:00 2001
From: velz <velmurugan.s@venbainfotech.com>
Date: Thu, 12 Feb 2026 12:04:33 +0530
Subject: [PATCH] FIX_SQL_INJECT2

---
 app/Config/Acl.php                     | 6 ++++++
 app/Controllers/EmployeeController.php | 2 +-
 app/Controllers/VidalApiController.php | 6 +++---
 3 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/app/Config/Acl.php b/app/Config/Acl.php
index b122e08b..a1b44339 100644
--- a/app/Config/Acl.php
+++ b/app/Config/Acl.php
@@ -36,6 +36,12 @@ class Acl
             'teams' => []
         ],
 
+         // ===================== VIEW INCEPTION PAGE =====================
+        '#^/hrFileList#' => [
+            'roles' => [ ADMIN_ROLE_ID,HEAD_ROLE_ID, MANAGER_ROLE_ID, STAFF_ROLE_ID, ACCOUNT_MANAGER_ROLE_ID],
+            'teams' => []
+        ],
+
         // ===================== USER MANAGEMENT =====================
         '#^/user#' => [
             'roles' => [ HEAD_ROLE_ID,ADMIN_ROLE_ID],
diff --git a/app/Controllers/EmployeeController.php b/app/Controllers/EmployeeController.php
index 66b44c37..f754b918 100755
--- a/app/Controllers/EmployeeController.php
+++ b/app/Controllers/EmployeeController.php
@@ -1905,7 +1905,7 @@ class EmployeeController extends AdminController
                         $query = "
                             UPDATE employee_polices 
                             SET employee_polices.status = 'truncated', employee_polices.is_active = 0 
-                            WHERE employee_polices.file_id == :file_id:  
+                            WHERE employee_polices.file_id = :file_id:  
                         ";
 
                         $binds = ["file_id" => $file_id];
diff --git a/app/Controllers/VidalApiController.php b/app/Controllers/VidalApiController.php
index cba86afd..eac51552 100644
--- a/app/Controllers/VidalApiController.php
+++ b/app/Controllers/VidalApiController.php
@@ -836,9 +836,9 @@ class VidalApiController extends BaseController
                         // log_message('error', "✅ Match found: emp_code={$row['empNo']} policy={$row['policyNumber']}");
 
                         $sql = "UPDATE employee_polices 
-                                SET tpa_id = ? 
-                                WHERE id = ?";
-                        $this->db->query($sql, [$row['enrollmentId'], $policy_data['emp_policy_id']]);
+                                SET tpa_id = :tpa_id:,
+                                WHERE id = :emp_policy_id:";
+                        $this->db->query($sql, ["tpa_id"=>$row['enrollmentId'], "emp_policy_id"=>$policy_data['emp_policy_id']]);
 
                         // for e-card send
                         if(strtolower(trim($policy_data['relationship'])) == 'self'){