Zploit 0-Day Shell

:: Editing File: quotations_send_list_issue.php

<?php
ob_start();
include 'header.php';

// Page setup
$page_parent = "Quotation";
$page_parent_link = "quotation.php";
$page_title = "Sent Quotations List";

include 'breadcrumb.php';
include 'menu.php';
?>

<div class="page-body">
    <div class="container-fluid">
        <div class="row">
            <div class="col-sm-12">
                <div class="card">
                    <div class="card-header d-flex justify-content-between align-items-center">
                        <h2>Sent Quotations List</h2>
                        <a href="quotation_send_module.php" class="btn btn-primary">
                            <i class="fa fa-plus"></i> Send New Quotation
                        </a>
                    </div>

<div class="card-body">
                        <div class="dt-ext table-responsive">
                            <table class="display" id="export-button">
                                <thead>
                                    <tr>
                                        <th>#</th>
                                        <th>Mobile No</th>
                                        <th>PDF</th>
                                        <th>Sent Date</th>
                                        <th>Actions</th>
                                    </tr>
                                </thead>
                                <tbody>
<?php
// DB query
$sql = "SELECT qs.*, q.name AS quotation_name, q.pdf_path 
        FROM qutation_send qs
        LEFT JOIN qutation q ON qs.q_id = q.id
        ORDER BY qs.id DESC";
$result = mysqli_query($conn, $sql);
$i = 1;

// Build base URL and docroot
$scheme = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') ? 'https' : 'http';
$base_dir = rtrim(dirname($_SERVER['SCRIPT_NAME']), '/') . '/';
$base_url = $scheme . '://' . $_SERVER['HTTP_HOST'] . $base_dir;
$docroot = rtrim($_SERVER['DOCUMENT_ROOT'], '/');

if ($result && mysqli_num_rows($result) > 0) {
    while ($row = mysqli_fetch_assoc($result)) {
        $pdf_filename = $row['pdf_path'] ?? '';
        $pdf_rel = 'uploads/quotation/' . $pdf_filename;
        $full_pdf_fs = $docroot . '/' . ltrim($pdf_rel, '/'); // server filesystem path
        $full_pdf_url = $base_url . $pdf_rel;                 // browser URL

// Thumb paths
        $thumb_rel = 'uploads/quotation/thumbs/' . pathinfo($pdf_filename, PATHINFO_FILENAME) . '.jpg';
        $full_thumb_fs = $docroot . '/' . ltrim($thumb_rel, '/');
        $thumb_url = $base_url . $thumb_rel;

// sanitized mobile for display & whatsapp
        $mobile_raw = $row['mobile'] ?? '';
        $mobile_for_wa = preg_replace('/[^\d]/', '', $mobile_raw); // digits only

echo "<tr>";
        echo "<td>" . $i++ . "</td>";
        echo "<td>" . htmlspecialchars($mobile_raw, ENT_QUOTES) . "</td>";

// PDF column
        echo "<td>";
        if (!empty($pdf_filename) && file_exists($full_pdf_fs)) {
            // If thumb missing, attempt to create using Imagick (on-demand)
            if (!file_exists($full_thumb_fs)) {
                // try to create thumbs directory
                $thumb_dir_fs = dirname($full_thumb_fs);
                if (!is_dir($thumb_dir_fs)) {
                    @mkdir($thumb_dir_fs, 0755, true);
                }

if (extension_loaded('imagick')) {
                    try {
                        $im = new Imagick();
                        $im->setResolution(150, 150);
                        // read first page
                        $im->readImage($full_pdf_fs . '[0]');
                        $im->setImageFormat('jpeg');
                        // resize to width 400px (adjust if needed)
                        $im->thumbnailImage(400, 0);
                        $im->writeImage($full_thumb_fs);
                        $im->clear();
                        $im->destroy();
                    } catch (Exception $e) {
                        // fail silently, fallback will show No Thumb
                        error_log("Imagick thumb creation failed for $full_pdf_fs: " . $e->getMessage());
                    }
                }
                // If imagick not available or creation failed, we leave it and show No Thumb fallback
            }

// Show thumbnail if now exists
            if (file_exists($full_thumb_fs)) {
                echo "<div style='display:flex;align-items:center;gap:12px;'>";
                echo "<a href='" . htmlspecialchars($full_pdf_url, ENT_QUOTES) . "' target='_blank' style='display:block;'>";
                echo "<img src='" . htmlspecialchars($thumb_url, ENT_QUOTES) . "' alt='PDF Thumb' style='width:80px;height:100px;object-fit:cover;border-radius:6px;border:1px solid #ddd;'>";
                echo "</a>";
                echo "<div><a href='" . htmlspecialchars($full_pdf_url, ENT_QUOTES) . "' target='_blank' class='btn btn-outline-danger btn-sm'><i class='fa fa-file-pdf'></i> View PDF</a></div>";
                echo "</div>";
            } else {
                // No thumb fallback
                echo "<div style='display:flex;align-items:center;gap:12px;'>";
                echo "<div style='width:80px;height:100px;display:flex;align-items:center;justify-content:center;border:1px solid #ccc;border-radius:6px;color:#888;font-size:12px;'>No Thumb</div>";
                echo "<div><a href='" . htmlspecialchars($full_pdf_url, ENT_QUOTES) . "' target='_blank' class='btn btn-outline-danger btn-sm'><i class='fa fa-file-pdf'></i> View PDF</a></div>";
                echo "</div>";
            }
        } else {
            echo "<span class='text-muted'>No PDF</span>";
        }
        echo "</td>";

// Sent Date
        echo "<td>" . (!empty($row['created_at']) ? htmlspecialchars(date("d M Y, h:i A", strtotime($row['created_at'])), ENT_QUOTES) : '-') . "</td>";

// Actions (Resend / Delete)
        echo "<td>";
        if (!empty($pdf_filename) && file_exists($full_pdf_fs) && !empty($mobile_for_wa)) {
            $msg = "Hello,%0A%0APlease find your quotation below:%0A" . urlencode($full_pdf_url);
            $wa_link = "https://wa.me/" . htmlspecialchars($mobile_for_wa, ENT_QUOTES) . "?text=" . $msg;
            echo "<a href='" . $wa_link . "' target='_blank' class='btn btn-success btn-sm' style='margin-right:6px;'><i class='fa fa-whatsapp'></i> Resend</a>";
        } else {
            echo "<button class='btn btn-secondary btn-sm' disabled style='margin-right:6px;'><i class='fa fa-whatsapp'></i> Resend</button>";
        }

echo "<a href='quotation_send_delete.php?id=" . intval($row['id']) . "' class='btn btn-danger btn-sm' onclick=\"return confirm('Are you sure you want to delete this quotation?');\"><i class='fa fa-trash'></i> Delete</a>";

echo "</td>";
        echo "</tr>";
    }
} else {
    echo '<tr><td colspan="5" class="text-center text-muted">No quotations sent yet.</td></tr>';
}
?>
                                </tbody>
                            </table>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>