Zploit 0-Day Shell

:: Editing File: quotation.php

<?php 
// ✅ Set page title
$page_title = "Quotations";

// Include common layout files
include 'header.php';
include 'breadcrumb.php';
include 'menu.php';
?>

<style>
.pdf-thumb-container {
  position: relative;
  display: inline-block;
}
.pdf-thumb {
  width: 80px;
  height: 100px;
  object-fit: cover;
  border-radius: 6px;
  border: 1px solid #ddd;
  transition: transform 0.3s ease, box-shadow 0.3s ease;
  cursor: pointer;
}
.pdf-thumb:hover {
  transform: scale(1.6);
  box-shadow: 0 6px 18px rgba(0, 0, 0, 0.25);
  z-index: 999;
}
.pdf-thumb:hover::after {
  content: "";
  position: absolute;
  top: 0;
  left: 0;
  width: 100%;
  height: 100%;
}
</style>

<div class="page-body">
  <div class="container-fluid">
    <div class="row">
      <div class="col-sm-12">
        <div class="card">
          <div class="row">
            <div class="col-sm-8">
              <div class="card-header pb-0 card-no-border">
                <h2>Quotation Management</h2>
              </div>
            </div>
            <div class="col-sm-4">
              <div class="card-header pb-0 card-no-border text-end">
                <a href="quotation_add.php" class="btn btn-primary btn-sm">
                  <i class="fa fa-plus"></i> Add New Quotation
                </a>
              </div>
            </div>
          </div>

<div class="card-body">
            <div class="dt-ext table-responsive">
              <table class="display" id="export-button">
                <thead>
                  <tr>
                    <th>ID</th>
                    <th>Quotation Name</th>
                    <th>PDF Preview</th>
                    <th>Created At</th>
                    <th>Action</th>
                  </tr>
                </thead>
                <tbody>
                  <?php
                  $sr_no = 1; 
                  $sql = "SELECT * FROM qutation ORDER BY id DESC";
                  $result = mysqli_query($conn, $sql);

if (mysqli_num_rows($result) > 0) {
                    while ($row = mysqli_fetch_assoc($result)) {
                      $pdf_path = $row['pdf_path'];
                      $pdf_rel = "uploads/quotation/" . $pdf_path;

// Build absolute paths
                      $scheme = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') ? 'https' : 'http';
                      $base_url = $scheme . '://' . $_SERVER['HTTP_HOST'] . rtrim(dirname($_SERVER['SCRIPT_NAME']), '/') . '/';
                      $full_pdf_url = $base_url . $pdf_rel;
                      $project_root = rtrim(__DIR__, '/');
                      $full_pdf_fs = $project_root . '/' . $pdf_rel;

// Thumbnail setup
                      $thumb_rel = 'uploads/quotation/thumbs/' . pathinfo($pdf_path, PATHINFO_FILENAME) . '.jpg';
                      $full_thumb_fs = $project_root . '/' . $thumb_rel;
                      $thumb_url = $base_url . $thumb_rel;

echo "<tr>";
                      echo "<td class='text-center'>{$sr_no}</td>";
                      echo "<td>" . htmlspecialchars($row['name']) . "</td>";

echo "<td>";
                      if (!empty($pdf_path) && file_exists($full_pdf_fs)) {
                        // Ensure thumbs directory exists
                        $thumb_dir_fs = dirname($full_thumb_fs);
                        if (!is_dir($thumb_dir_fs)) {
                          @mkdir($thumb_dir_fs, 0755, true);
                        }

// Create thumbnail if not exists
                        if (!file_exists($full_thumb_fs) && extension_loaded('imagick')) {
                          try {
                            $im = new Imagick();
                            $im->setResolution(150, 150);
                            $im->readImage($full_pdf_fs . '[0]'); // first page
                            $im->setImageFormat('jpeg');
                            $im->thumbnailImage(300, 0);
                            $im->writeImage($full_thumb_fs);
                            $im->clear();
                            $im->destroy();
                          } catch (Exception $e) {
                            error_log("Imagick error: " . $e->getMessage());
                          }
                        }

// Display thumbnail + button
                        if (file_exists($full_thumb_fs)) {
                          echo "<div style='display:flex;align-items:center;gap:12px;'>";
                            echo "<div class='pdf-thumb-container'>";
                              echo "<a href='" . htmlspecialchars($full_pdf_url, ENT_QUOTES) . "' target='_blank'>";
                                echo "<img src='" . htmlspecialchars($thumb_url, ENT_QUOTES) . "' alt='PDF Preview' class='pdf-thumb'>";
                              echo "</a>";
                            echo "</div>";
                            echo "<div><a href='" . htmlspecialchars($full_pdf_url, ENT_QUOTES) . "' target='_blank' class='btn btn-outline-danger btn-sm'><i class='fa fa-file-pdf'></i> View PDF</a></div>";
                          echo "</div>";
                        } else {
                          echo "<a href='" . htmlspecialchars($full_pdf_url, ENT_QUOTES) . "' target='_blank' class='btn btn-outline-danger btn-sm'><i class='fa fa-file-pdf'></i> View PDF</a>";
                        }
                      } else {
                        echo "<span class='text-muted'>No PDF</span>";
                      }
                      echo "</td>";

echo "<td>" . date('d M Y, h:i A', strtotime($row['created_at'])) . "</td>";

echo "<td class='text-center'>";
 
                        echo "<a href='quotation_send.php?q_id={$row['id']}' class='btn btn-success btn-sm'>
                                    <i class='fa fa-paper-plane'></i> Send
                                </a>";
                                 
                        echo "<a href='quotation_edit.php?id={$row['id']}' class='btn btn-warning btn-sm'>
                                    <i class='fa fa-edit'></i> Edit
                                </a>";
                                 
                        if (isset($_SESSION['user_role']) && $_SESSION['user_role'] === 'admin') {
                            echo "<a href='quotation_delete.php?id={$row['id']}' class='btn btn-danger btn-sm' onclick=\"return confirm('Are you sure you want to delete this quotation?');\">
                                        <i class='fa fa-trash'></i> Delete
                                    </a>";
                        } // <--- This closing brace was missing!
                                 
                    echo "</td>";

echo "</tr>";
                      $sr_no++;
                    }
                  } else {
                    echo "<tr><td colspan='5' class='text-center text-muted'>No quotations found</td></tr>";
                  }
                  ?>
                </tbody>
              </table>
            </div>
          </div>

</div>
      </div>
    </div>
  </div>
</div>

<?php include "footer.php"; ?>