Zploit 0-Day Shell

:: Editing File: quotations_send_list.php

<?php
ob_start();
include 'header.php';

// ✅ Page setup
$page_parent = "Quotation";
$page_parent_link = "quotation.php";
$page_title = "Sent Quotations List";

include 'breadcrumb.php';
include 'menu.php';
?>

<style>
.pdf-thumb-container {
  position: relative;
  display: inline-block;
}
.pdf-thumb {
  width: 80px;
  height: 100px;
  object-fit: cover;
  border-radius: 6px;
  border: 1px solid #ddd;
  transition: transform 0.3s ease, box-shadow 0.3s ease;
  cursor: pointer;
}
.pdf-thumb:hover {
  transform: scale(1.6);
  box-shadow: 0 6px 18px rgba(0, 0, 0, 0.25);
  z-index: 999;
}
.pdf-thumb:hover::after {
  content: "";
  position: absolute;
  top: 0;
  left: 0;
  width: 100%;
  height: 100%;
}
</style>

<div class="page-body">
    <div class="container-fluid">
        <div class="row">
            <div class="col-sm-12">
                <div class="card">
                    <div class="card-header d-flex justify-content-between align-items-center">
                        <h2>Sent Quotations List</h2>
                    </div>
                    <div class="card-body">
                        <div class="dt-ext table-responsive">
                            <table class="display" id="export-button">
                                <thead>
                                    <tr>
                                        <th>#</th>
                                        <th>Mobile No</th>
                                        <th>PDF</th>
                                        <th>Date</th>
                                        <th>Resend</th>
                                        <?php if (isset($_SESSION['user_role']) && $_SESSION['user_role'] === 'admin'): ?>
                                            <th>Action</th>
                                        <?php endif; ?>
                                    </tr>
                                </thead>
                                <tbody>
                                    <?php
                                    $sql = "SELECT qs.*, q.name AS quotation_name, q.pdf_path 
                                            FROM qutation_send qs
                                            LEFT JOIN qutation q ON qs.q_id = q.id
                                            ORDER BY qs.id DESC";
                                    $result = mysqli_query($conn, $sql);
                                    $i = 1;

if (mysqli_num_rows($result) > 0) {
                                        while ($row = mysqli_fetch_assoc($result)) {
                                            $pdf_path = "uploads/quotation/" . $row['pdf_path'];
                                            $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') ? 'https' : 'http';
                                            $script_dir = rtrim(dirname($_SERVER['SCRIPT_NAME']), '/');
                                            $base_url = $scheme . '://' . $_SERVER['HTTP_HOST'] . $script_dir . '/';
                                            $full_pdf_url = $base_url . $pdf_path;

$project_root = rtrim(__DIR__, '/');
                                            $full_pdf_fs = $project_root . '/' . $pdf_path;

$thumb_rel = 'uploads/quotation/thumbs/' . pathinfo($row['pdf_path'], PATHINFO_FILENAME) . '.jpg';
                                            $full_thumb_fs = $project_root . '/' . $thumb_rel;
                                            $thumb_url = $base_url . $thumb_rel;

echo "<tr>";
                                            echo "<td>{$i}</td>";
                                            echo "<td>" . htmlspecialchars($row['mobile']) . "</td>";

echo "<td>";
                                            if (!empty($row['pdf_path']) && file_exists($full_pdf_fs)) {

// Ensure thumbs directory exists
                                                $thumb_dir_fs = dirname($full_thumb_fs);
                                                if (!is_dir($thumb_dir_fs)) {
                                                    @mkdir($thumb_dir_fs, 0755, true);
                                                }

// Create thumbnail if not exists
                                                if (!file_exists($full_thumb_fs) && extension_loaded('imagick')) {
                                                    try {
                                                        $im = new Imagick();
                                                        $im->setResolution(150, 150);
                                                        $im->readImage($full_pdf_fs . '[0]');
                                                        $im->setImageFormat('jpeg');
                                                        $im->thumbnailImage(300, 0);
                                                        $im->writeImage($full_thumb_fs);
                                                        $im->clear();
                                                        $im->destroy();
                                                    } catch (Exception $e) {
                                                        error_log("Imagick error: " . $e->getMessage());
                                                    }
                                                }

// Show thumbnail + View PDF
                                                if (file_exists($full_thumb_fs)) {
                                                    echo "<div style='display:flex;align-items:center;gap:12px;'>";
                                                        echo "<div class='pdf-thumb-container'>";
                                                            echo "<a href='" . htmlspecialchars($full_pdf_url, ENT_QUOTES) . "' target='_blank'>";
                                                                echo "<img src='" . htmlspecialchars($thumb_url, ENT_QUOTES) . "' alt='PDF Thumb' class='pdf-thumb'>";
                                                            echo "</a>";
                                                        echo "</div>";
                                                        echo "<div><a href='" . htmlspecialchars($full_pdf_url, ENT_QUOTES) . "' target='_blank' class='btn btn-outline-danger btn-sm'><i class='fa fa-file-pdf'></i> View PDF</a></div>";
                                                    echo "</div>";
                                                } else {
                                                    echo "<a href='" . htmlspecialchars($full_pdf_url, ENT_QUOTES) . "' target='_blank' class='btn btn-outline-danger btn-sm'><i class='fa fa-file-pdf'></i> View PDF</a>";
                                                }
                                            } else {
                                                echo "<span class='text-muted'>No PDF</span>";
                                            }
                                            echo "</td>";

echo "<td>" . date("d M Y, h:i A", strtotime($row['created_at'])) . "</td>";

// WhatsApp resend link
                                            echo "<td>
                                                    <a href='https://wa.me/{$row['mobile']}?text=Hello,%0A%0APlease find your quotation below:%0A" . urlencode($full_pdf_url) . "' target='_blank' class='btn btn-success btn-sm'>
                                                        <i class='fa fa-whatsapp'></i> Resend
                                                    </a>
                                                  </td>";

// Admin-only Delete
                                            if (isset($_SESSION['user_role']) && $_SESSION['user_role'] === 'admin') {
                                                echo "<td>
                                                        <a href='quotation_send_delete.php?id={$row['id']}' class='btn btn-danger btn-sm' onclick=\"return confirm('Are you sure you want to delete this quotation?');\">
                                                            <i class='fa fa-trash'></i> Delete
                                                        </a>
                                                      </td>";
                                            }

echo "</tr>";
                                            $i++;
                                        }
                                    } else {
                                        echo '<tr><td colspan="6" class="text-center">No quotations sent yet.</td></tr>';
                                    }
                                    ?>
                                </tbody>
                            </table>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>