Zploit 0-Day Shell

:: Editing File: leads.php

<?php
// ==========================================
// lead1.php — FINAL VERSION
// All Filters + Pagination + Same Page Redirect After Edit
// ==========================================

$page_title = "Leads";
include 'header.php';
include 'breadcrumb.php';
include 'menu.php';

/* =========================
   HELPER FUNCTIONS (BADGES)
   ========================= */

function leadStatusBadge($status)
{
    $status_clean = strtolower(trim($status));

switch ($status_clean) {
        case 'pending':
            return '<span class="badge bg-warning text-dark">Pending</span>';
        case 'done':
            return '<span class="badge bg-success">Done</span>';
        case 'no response':
            return '<span class="badge bg-secondary">No Response</span>';
        case 'interested':
            return '<span class="badge bg-primary">Interested</span>';
        case 'not interested':
            return '<span class="badge bg-danger">Not Interested</span>';
        default:
            return '<span class="badge bg-light text-dark">'.htmlspecialchars($status).'</span>';
    }
}

function callStatusBadge($status)
{
    return strtolower($status) === 'completed'
        ? '<span class="badge bg-success">Completed</span>'
        : '<span class="badge bg-danger">Incompleted</span>';
}

// --- Pagination setup ---
$records_per_page = 50;
$current_page = isset($_GET['page']) ? max(1, intval($_GET['page'])) : 1;
$offset = ($current_page - 1) * $records_per_page;

// --- Filters ---
$date_from       = $_GET['date_from'] ?? '';
$date_to         = $_GET['date_to'] ?? '';
$calling_status  = trim($_GET['calling_status'] ?? '');
$enquiry_for     = intval($_GET['enquiry_for'] ?? 0);
$lead_source     = trim($_GET['lead_source'] ?? '');
$call_status     = trim($_GET['call_status'] ?? '');
// NEW FILTER: Generic Search Query
$search_query      = trim($_GET['search_query'] ?? '');

// --- Dropdown Data ---
$work_sections = [];
$res = mysqli_query($conn, "SELECT id, section_name FROM work_sections ORDER BY section_name ASC");
while ($r = mysqli_fetch_assoc($res)) $work_sections[] = $r;

$lead_sources = [];
$res = mysqli_query($conn, "SELECT DISTINCT lead_source FROM leads WHERE lead_source <> '' ORDER BY lead_source ASC");
while ($r = mysqli_fetch_assoc($res)) $lead_sources[] = $r['lead_source'];

$calling_status_options = ['Pending','Done','No Response','Interested','Not Interested'];

// --- WHERE Conditions ---
$where = [];
if ($date_from && $date_to) {
    $d1 = DateTime::createFromFormat('d-m-Y', $date_from);
    $d2 = DateTime::createFromFormat('d-m-Y', $date_to);
    if ($d1 && $d2) $where[] = "DATE(l.lead_date) BETWEEN '{$d1->format('Y-m-d')}' AND '{$d2->format('Y-m-d')}'";
} elseif ($date_from) {
    $d1 = DateTime::createFromFormat('d-m-Y', $date_from);
    if ($d1) $where[] = "DATE(l.lead_date) >= '{$d1->format('Y-m-d')}'";
} elseif ($date_to) {
    $d2 = DateTime::createFromFormat('d-m-Y', $date_to);
    if ($d2) $where[] = "DATE(l.lead_date) <= '{$d2->format('Y-m-d')}'";
}

if ($calling_status) $where[] = "l.calling_status = '" . mysqli_real_escape_string($conn, $calling_status) . "'";
if ($enquiry_for > 0) $where[] = "l.enquiry_for = " . $enquiry_for;
if ($lead_source) $where[] = "l.lead_source = '" . mysqli_real_escape_string($conn, $lead_source) . "'";
if ($call_status) $where[] = "l.call_status = '" . mysqli_real_escape_string($conn, $call_status) . "'";

// NEW: Generic Search Filter - EXPANDED
if ($search_query) {
    $search_safe = mysqli_real_escape_string($conn, "%" . $search_query . "%");
    // Search across Name, Mobile, Business, Source, Status, Comment, Enquiry Name, and Lead Date
    $where[] = "(
        l.name LIKE '{$search_safe}' 
        OR l.mobile LIKE '{$search_safe}' 
        OR l.business_name LIKE '{$search_safe}'
        OR l.lead_source LIKE '{$search_safe}'
        OR l.calling_status LIKE '{$search_safe}'
        OR l.comment LIKE '{$search_safe}'
        OR l.call_status LIKE '{$search_safe}'
        OR l.lead_date LIKE '{$search_safe}'
        OR w.section_name LIKE '{$search_safe}'
    )";
}

$whereSQL = $where ? 'WHERE ' . implode(' AND ', $where) : '';

// --- Count total ---
$count_sql = "SELECT COUNT(l.id) AS total FROM leads l LEFT JOIN work_sections w ON w.id = l.enquiry_for $whereSQL";
$count_res = mysqli_query($conn, $count_sql);
$total_records = ($count_res && mysqli_num_rows($count_res)) ? mysqli_fetch_assoc($count_res)['total'] : 0;
$total_pages = ceil($total_records / $records_per_page);

// --- Fetch Data ---
$sql = "SELECT l.*, w.section_name 
        FROM leads l
        LEFT JOIN work_sections w ON w.id = l.enquiry_for
        $whereSQL
        ORDER BY l.call_time DESC
        LIMIT $records_per_page OFFSET $offset";
$result = mysqli_query($conn, $sql);
?>

<div class="card-header d-flex justify-content-between align-items-center">
            <h2>Lead Management</h2>
            <div>
              <a href="upload_leads_csv.php" class="btn btn-primary btn-sm"><i class="fa fa-upload"></i> Upload Excel</a>
              <a href="lead_add.php" class="btn btn-success btn-sm"><i class="fa fa-plus"></i> Add Lead</a>
            </div>
          </div>

<div class="card-body">
            
            <form method="get" class="row g-2 mb-3">
                
                
               
                <div class="col-sm-2">
                    <label>Search</label>
                    <input type="text" id="search_query" name="search_query" class="form-control"
                        placeholder="Search All Fields" value="<?= htmlspecialchars($search_query); ?>">
                </div>
              
              <div class="col-sm-1">
                <label>Date From</label>
                <input type="text" id="date_from" name="date_from" class="form-control"
                       placeholder="dd-mm-yyyy" value="<?= htmlspecialchars($date_from); ?>">
              </div>
              
              <div class="col-sm-1">
                <label>Date To</label>
                <input type="text" id="date_to" name="date_to" class="form-control"
                       placeholder="dd-mm-yyyy" value="<?= htmlspecialchars($date_to); ?>">
              </div>
              <div class="col-sm-2">
                <label>Lead Status</label>
                <select name="calling_status" class="form-select">
                  <option value="">-- All --</option>
                  <?php foreach ($calling_status_options as $opt): ?>
                    <option value="<?= $opt ?>" <?= $calling_status == $opt ? 'selected' : '' ?>><?= $opt ?></option>
                  <?php endforeach; ?>
                </select>
              </div>
              <div class="col-sm-2">
                <label>Enquiry For</label>
                <select name="enquiry_for" class="form-select">
                  <option value="0">-- All --</option>
                  <?php foreach ($work_sections as $ws): ?>
                    <option value="<?= $ws['id'] ?>" <?= $enquiry_for == $ws['id'] ? 'selected' : '' ?>>
                      <?= htmlspecialchars($ws['section_name']); ?>
                    </option>
                  <?php endforeach; ?>
                </select>
              </div>
              <div class="col-sm-2">
                <label>Lead Source</label>
                <select name="lead_source" class="form-select">
                  <option value="">-- All --</option>
                  <?php foreach ($lead_sources as $src): ?>
                    <option value="<?= htmlspecialchars($src) ?>" <?= $lead_source == $src ? 'selected' : '' ?>>
                      <?= htmlspecialchars($src) ?>
                    </option>
                  <?php endforeach; ?>
                </select>
              </div>
              <div class="col-sm-2">
                <label>Call Status</label>
                <select name="call_status" class="form-select">
                  <option value="">-- All --</option>
                  <option value="completed" <?= $call_status == 'completed' ? 'selected' : '' ?>>Completed</option>
                  <option value="incompleted" <?= $call_status == 'incompleted' ? 'selected' : '' ?>>Incompleted</option>
                </select>
              </div>
              <div class="col-12 text-end mt-2">
                <button type="submit" class="btn btn-info btn-sm"><i class="fa fa-filter"></i> Filter</button>
                <a href="leads.php" class="btn btn-outline-secondary btn-sm">Clear</a>
              </div>
            </form>

<div class="table-responsive">
              <table id="leadsTable" class="table table-bordered table-striped">
                <thead>
                  <tr>
                    <th>ID</th>
                    <th>Lead Date</th>
                    <th>Source</th>
                    <th>Name</th>
                    <th>Mobile</th>
                    <th>Business</th>
                    <th>Enquiry For</th>
                    <th>Lead Status</th>
                    <th>Comment</th>
                    <th>Follow Up</th>
                    <th>Call Status</th>
                    <th>Call Time</th>
                    <th>Action</th>
                  </tr>
                </thead>
                <tbody>
                <?php
                $sr = $offset + 1;
                if ($result && mysqli_num_rows($result) > 0):
                    while ($row = mysqli_fetch_assoc($result)):
                        $current_url = urlencode($_SERVER['REQUEST_URI']);
                        echo "<tr>
                            <td>{$sr}</td>
                            <td>" . ($row['lead_date'] ? date('d-m-Y', strtotime($row['lead_date'])) : '-') . "</td>
                            <td>" . htmlspecialchars($row['lead_source']) . "</td>
                            <td>" . htmlspecialchars($row['name']) . "</td>
                            <td>" . htmlspecialchars($row['mobile']) . "</td>
                            <td>" . htmlspecialchars($row['business_name']) . "</td>
                            <td>" . htmlspecialchars($row['section_name'] ?? $row['enquiry_for']) . "</td>
                            <td>" . leadStatusBadge($row['calling_status']) . "</td>
                            <td>" . htmlspecialchars($row['comment']) . "</td>
                            <td>" . ($row['follow_up_date'] ? date('d-m-Y', strtotime($row['follow_up_date'])) : '-') . "</td>
                            <td>" . callStatusBadge($row['call_status']) . "</td>
                            <td>" . ($row['call_time'] ? date('d-m-Y H:i:s', strtotime($row['call_time'])) : '-') . "</td>
                            <td class='text-center'>
                                <a href='lead_edit.php?id={$row['id']}&return_url={$current_url}' class='btn btn-warning btn-sm'><i class='fa fa-edit'></i></a>";
                        if (isset($_SESSION['user_role']) && $_SESSION['user_role'] === 'admin') {
                            echo " <a href='lead_delete.php?id={$row['id']}' onclick=\"return confirm('Delete this lead?');\" class='btn btn-danger btn-sm'><i class='fa fa-trash'></i></a>";
                        }
                        echo "</td></tr>";
                        $sr++;
                    endwhile;
                else:
                    echo "<tr><td colspan='13' class='text-center text-muted'>No leads found</td></tr>";
                endif;
                ?>
                </tbody>
              </table>
            </div>

<?php if ($total_pages > 1): ?>
              <nav aria-label="Page navigation">
                <ul class="pagination justify-content-center mt-3">
                  <?php if ($current_page > 1): ?>
                    <li class="page-item">
                      <a class="page-link" href="?<?= http_build_query(array_merge($_GET, ['page' => $current_page - 1])) ?>">Previous</a>
                    </li>
                  <?php endif; ?>
                  <?php for ($i = 1; $i <= $total_pages; $i++): ?>
                    <li class="page-item <?= $i == $current_page ? 'active' : '' ?>">
                      <a class="page-link" href="?<?= http_build_query(array_merge($_GET, ['page' => $i])) ?>"><?= $i ?></a>
                    </li>
                  <?php endfor; ?>
                  <?php if ($current_page < $total_pages): ?>
                    <li class="page-item">
                      <a class="page-link" href="?<?= http_build_query(array_merge($_GET, ['page' => $current_page + 1])) ?>">Next</a>
                    </li>
                  <?php endif; ?>
                </ul>
              </nav>
            <?php endif; ?>

</div>
        </div>
      </div>
    </div>
  </div>
</div>

!-- DATATABLE EXPORT -->
<link rel="stylesheet" href="https://cdn.datatables.net/1.13.6/css/jquery.dataTables.min.css">
<link rel="stylesheet" href="https://cdn.datatables.net/buttons/2.4.2/css/buttons.dataTables.min.css">
<script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
<script src="https://cdn.datatables.net/1.13.6/js/jquery.dataTables.min.js"></script>
<script src="https://cdn.datatables.net/buttons/2.4.2/js/dataTables.buttons.min.js"></script>
<script src="https://cdn.datatables.net/buttons/2.4.2/js/buttons.html5.min.js"></script>
<script src="https://cdn.datatables.net/buttons/2.4.2/js/buttons.print.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/pdfmake/0.2.7/pdfmake.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/pdfmake/0.2.7/vfs_fonts.js"></script>

<?php include('footer.php'); ?>