Zploit 0-Day Shell

:: Editing File: leads_old.php

<?php

// leads.php - UPDATED CODE

// ✅ Set breadcrumb variables

$page_title = "Leads";

include 'header.php';

include 'breadcrumb.php';

include 'menu.php';

// --- Configuration for Pagination ---

$records_per_page = 495; // Define how many leads per page

$current_page = isset($_GET['page']) ? max(1, intval($_GET['page'])) : 1;

$offset = ($current_page - 1) * $records_per_page;

// --- Read filter inputs (GET) ---

$date_from = isset($_GET['date_from']) ? trim($_GET['date_from']) : '';

$date_to   = isset($_GET['date_to']) ? trim($_GET['date_to']) : '';

$calling_status = isset($_GET['calling_status']) ? trim($_GET['calling_status']) : '';

// ******* FIX: Ensure enquiry_for is an integer ID *******

$enquiry_for    = isset($_GET['enquiry_for']) ? intval($_GET['enquiry_for']) : 0;

$lead_source    = isset($_GET['lead_source']) ? trim($_GET['lead_source']) : '';

$call_status = isset($_GET['call_status']) ? trim($_GET['call_status']) : '';

// --- End Filter Inputs ---

// --- Prepare filter dropdown data ---

// Work sections (for "Enquiry For") - Fetching both ID and Name

$work_sections = [];

$wsq = mysqli_query($conn, "SELECT id, section_name FROM work_sections ORDER BY section_name ASC");

if ($wsq) {

while ($r = mysqli_fetch_assoc($wsq)) $work_sections[] = $r;

}

// Distinct lead_source values for dropdown

$lead_sources = [];

// Improved ORDER BY

$lsq = mysqli_query($conn, "SELECT DISTINCT lead_source FROM leads WHERE lead_source IS NOT NULL AND lead_source <> '' ORDER BY lead_source ASC");

if ($lsq) {

while ($r = mysqli_fetch_assoc($lsq)) $lead_sources[] = $r['lead_source'];

}

// Calling status options

$calling_status_options = [

'Pending','Done','No Response','Interested','Not Interested'

];

// --- Build WHERE clauses safely (Using mysqli_real_escape_string for safety, but Prepared Statements are still recommended) ---

$whereParts = [];

// Date Filters

if (!empty($date_from) && !empty($date_to)) {

$d1 = DateTime::createFromFormat('d-m-Y', $date_from);

$d2 = DateTime::createFromFormat('d-m-Y', $date_to);

if ($d1 && $d2) {

$dfrom = $d1->format('Y-m-d');

$dto   = $d2->format('Y-m-d');

$whereParts[] = "DATE(l.lead_date) BETWEEN '{$dfrom}' AND '{$dto}'";

} else {

$safe_from = mysqli_real_escape_string($conn, $date_from);

$safe_to   = mysqli_real_escape_string($conn, $date_to);

$whereParts[] = "DATE(l.lead_date) BETWEEN '{$safe_from}' AND '{$safe_to}'";

}

} elseif (!empty($date_from)) {

$d1 = DateTime::createFromFormat('d-m-Y', $date_from);

$dfrom = $d1 ? $d1->format('Y-m-d') : mysqli_real_escape_string($conn, $date_from);

$whereParts[] = "DATE(l.lead_date) >= '{$dfrom}'";

} elseif (!empty($date_to)) {

$d2 = DateTime::createFromFormat('d-m-Y', $date_to);

$dto = $d2 ? $d2->format('Y-m-d') : mysqli_real_escape_string($conn, $date_to);

$whereParts[] = "DATE(l.lead_date) <= '{$dto}'";

}

// Other Filters

if (!empty($calling_status)) {

$safe_cs = mysqli_real_escape_string($conn, $calling_status);

$whereParts[] = "l.calling_status = '{$safe_cs}'";

}

// Enquiry For Filter (Now uses the integer ID $enquiry_for)

if ($enquiry_for > 0) {

$whereParts[] = "l.enquiry_for = " . $enquiry_for;

}

if (!empty($lead_source)) {

$safe_ls = mysqli_real_escape_string($conn, $lead_source);

$whereParts[] = "l.lead_source = '{$safe_ls}'";

}

if (!empty($call_status)) {

$safe_call_status = mysqli_real_escape_string($conn, $call_status);

$whereParts[] = "l.call_status = '{$safe_call_status}'";

}

$whereSQL = '';

if (!empty($whereParts)) {

$whereSQL = "WHERE " . implode(' AND ', $whereParts);

}

// --- Total Records Calculation for Pagination ---

$count_query = "SELECT COUNT(l.id) as total FROM leads l LEFT JOIN work_sections w ON l.enquiry_for = w.id $whereSQL";

$count_result = mysqli_query($conn, $count_query);

$total_records = mysqli_fetch_assoc($count_result)['total'];

$total_pages = ceil($total_records / $records_per_page);

// --- Build the main SQL query with LIMIT and OFFSET ---

$sql = "SELECT l.*, w.section_name

FROM leads l

LEFT JOIN work_sections w ON l.enquiry_for = w.id

$whereSQL

ORDER BY l.call_time DESC

LIMIT $records_per_page OFFSET $offset";

$result = mysqli_query($conn, $sql);

// Build current query string to preserve filters in pagination links

$current_query_params = $_GET;

unset($current_query_params['page']); // Remove old page number

$query_string_for_pagination = http_build_query($current_query_params);

<h2>Lead Management</h2>

</div>

<i class="fa fa-plus"></i> Upload Excel File

</a>

<i class="fa fa-plus"></i> Add New Lead

</a>

</div>

</div>

</div>

<label class="form-label">Lead Status</label>

<?php foreach ($calling_status_options as $opt): ?>

<?= htmlspecialchars($opt); ?>

</option>

<?php endforeach; ?>

</select>

</div>

<label class="form-label">Enquiry For</label>

<?php foreach ($work_sections as $ws): ?>

<?= htmlspecialchars($ws['section_name']); ?>

</option>

<?php endforeach; ?>

</select>

</div>

<label class="form-label">Lead Source</label>

<?php foreach ($lead_sources as $ls): ?>

<?= htmlspecialchars($ls); ?>

</option>

<?php endforeach; ?>

</select>

</div>

<label class="form-label">Call Status</label>

<option value="completed" <?= ($call_status == 'completed') ? 'selected' : ''; ?>>Completed</option>

<option value="incompleted" <?= ($call_status == 'incompleted') ? 'selected' : ''; ?>>Incompleted</option>

</select>

</div>

<button type="submit" class="btn btn-info btn-sm"><i class="fa fa-filter"></i> Filter</button>

<a href="leads.php" class="btn btn-outline-secondary btn-sm">Clear</a>

</div>

</form>

<thead>

<tr>

<th>Lead Source</th>

<th>Mobile</th>

<th>Business</th>

<th>Enquiry For</th>

<th>Lead Status</th>

<th>Comment</th>

<th>Follow Up Date</th>

<th>Call Status</th>

<th>Action</th>

</tr>

</thead>

<tbody>

<?php

$sr_no = $offset + 1; // Start serial number correctly

if ($result && mysqli_num_rows($result) > 0) {

while ($row = mysqli_fetch_assoc($result)) {

echo "<tr>";

echo "<td class='text-center'>" . $sr_no . "</td>";

echo "<td>" . (!empty($row['lead_date']) ? date('d-m-Y', strtotime($row['lead_date'])) : '-') . "</td>";

echo "<td>" . htmlspecialchars($row['lead_source']) . "</td>";

echo "<td>" . htmlspecialchars($row['name']) . "</td>";

echo "<td>" . htmlspecialchars($row['mobile']) . "</td>";

echo "<td>" . htmlspecialchars($row['business_name']) . "</td>";

$enq_label = !empty($row['section_name']) ? $row['section_name'] : htmlspecialchars($row['enquiry_for']);

echo "<td>" . $enq_label . "</td>";

echo "<td>" . htmlspecialchars($row['calling_status']) . "</td>";

echo "<td>" . htmlspecialchars($row['comment']) . "</td>";

echo "<td>" . (!empty($row['follow_up_date']) ? date('d-m-Y', strtotime($row['follow_up_date'])) : '-') . "</td>";

echo "<td>" . htmlspecialchars($row['call_status']) . "</td>";

if (!empty($row['call_time'])) {

$dt = new DateTime($row['call_time'], new DateTimeZone('UTC'));

$dt->setTimezone(new DateTimeZone('Asia/Kolkata'));

echo "<td>" . $dt->format('d-m-Y H:i:s') . "</td>";

} else {

echo "<td>-</td>";

}

echo "<td class='text-center' id='action'>";

// 1. Capture the current page AND filters

// $current_filters = urlencode($_SERVER['REQUEST_URI']); // Replaced with safer approach

$current_filters = urlencode("leads.php?" . http_build_query($_GET));

// 2. Construct the final link for the edit page (lead_edit.php)

$edit_link = "lead_edit.php?id=" . intval($row['id']) . "&return_url=" . $current_filters;

// 3. Echo the HTML anchor tag

echo "<a href='" . $edit_link . "' class='btn btn-warning btn-sm'>

<i class='fa fa-edit'></i> Edit

</a>";

// Show Delete button only for admin

if (isset($_SESSION['user_role']) && $_SESSION['user_role'] === 'admin') {

echo "<a href='lead_delete.php?id=" . intval($row['id']) . "'

class='btn btn-danger btn-sm'

onclick=\"return confirm('Are you sure you want to delete this lead?');\">

</a>";

}

echo "</td>";

echo "</tr>";

$sr_no++;

}

} else {

echo "<tr><td colspan='13' class='text-center text-muted'>No leads found</td></tr>";

}

</tbody>

</table>

</div>

<?php include "footer.php"; ?>