Zploit 0-Day Shell

:: Editing File: genrated_packing_material.php

<?php
// Include your database connection and Composer's autoloader
include("db.php");
// Check if Composer dependencies are available (required for mpdf)
if (file_exists(__DIR__ . '/vendor/autoload.php')) {
    require_once __DIR__ . '/vendor/autoload.php';
} else {
    // Provide a clear error if mpdf dependency is missing
    die("Error: mPDF library not found. Please run 'composer install'.");
}

// Check if an ID is provided and ensure it is an integer
$invoice_id = (int)($_GET['id'] ?? 0);

if ($invoice_id <= 0) {
    die("Error: Invalid Invoice ID.");
}

// --- 1. Fetch Master Invoice Data (Using Prepared Statement with JOIN) ---
// We join packing_materials (PM) with the party (P) table using the party_id 
// in packing_materials, and use aliases to retrieve receiver details.
$sql_invoice = "
    SELECT 
        PM.*,
        P.name AS receiver_name,
        P.address AS receiver_address,
        P.gst_no AS receiver_gstin,
        P.state AS receiver_state,
        P.village AS receiver_state_code
    FROM 
        packing_materials PM
    LEFT JOIN 
        party P ON PM.party_id = P.id
    WHERE 
        PM.id = ?
";
$stmt_invoice = mysqli_prepare($conn, $sql_invoice);
mysqli_stmt_bind_param($stmt_invoice, "i", $invoice_id);
mysqli_stmt_execute($stmt_invoice);
$result_invoice = mysqli_stmt_get_result($stmt_invoice);

if (mysqli_num_rows($result_invoice) == 0) {
    die("Error: No invoice found with this ID.");
}
$invoice = mysqli_fetch_assoc($result_invoice);
mysqli_stmt_close($stmt_invoice);

// --- 2. Fetch Invoice Items Data (Using Prepared Statement) ---
$sql_items = "SELECT * FROM packing_material_items WHERE invoice_id = ? ORDER BY id ASC";
$stmt_items = mysqli_prepare($conn, $sql_items);
mysqli_stmt_bind_param($stmt_items, "i", $invoice_id);
mysqli_stmt_execute($stmt_items);
$result_items = mysqli_stmt_get_result($stmt_items);
// Note: We don't close the stmt yet, as we are iterating over $result_items later

// --- HELPER FUNCTION: Number to Words (DEPENDENCY-FREE IMPLEMENTATION) ---
if (!function_exists('numberToWords')) {
    function numberToWords($number) {
        $decimal = round($number - ($no = floor($number)), 2) * 100;
        $hundred = null;
        $digits_length = strlen($no);
        $i = 0;
        $str = array();
        $words = array(0 => '', 1 => 'One', 2 => 'Two',
            3 => 'Three', 4 => 'Four', 5 => 'Five', 6 => 'Six',
            7 => 'Seven', 8 => 'Eight', 9 => 'Nine',
            10 => 'Ten', 11 => 'Eleven', 12 => 'Twelve',
            13 => 'Thirteen', 14 => 'Fourteen', 15 => 'Fifteen',
            16 => 'Sixteen', 17 => 'Seventeen', 18 => 'Eighteen',
            19 => 'Nineteen', 20 => 'Twenty', 30 => 'Thirty',
            40 => 'Forty', 50 => 'Fifty', 60 => 'Sixty',
            70 => 'Seventy', 80 => 'Eighty', 90 => 'Ninety');
        $digits = array('', 'Hundred', 'Thousand', 'Lakh', 'Crore');

while ($i < $digits_length) {
            $divider = ($i == 2) ? 10 : 100;
            $number = floor($no % $divider);
            $no = floor($no / $divider);
            $i += $divider == 10 ? 1 : 2;
            if ($number) {
                $plural = (($counter = count($str)) && $number > 9) ? 's' : null;
                $hundred = ($counter == 1 && $str[0]) ? ' and ' : null;
                $str [] = ($number < 21) ? $words[$number] . ' ' . $digits[$counter] . $plural . ' ' . $hundred : $words[floor($number / 10) * 10] . ' ' . $words[$number % 10] . ' ' . $digits[$counter] . $plural . ' ' . $hundred;
            } else {
                $str [] = null;
            }
        }
        $Rupees = implode('', array_reverse($str));
        // Handle Paise/Decimal part
        $paise_words = '';
        if ($decimal > 0) {
            $paise_tens = floor($decimal / 10) * 10;
            $paise_ones = $decimal % 10;
            
            if ($decimal < 21) {
                 $paise_words = $words[$decimal];
            } else {
                 $paise_words = $words[$paise_tens] . ' ' . $words[$paise_ones];
            }
            $paise = " AND " . trim($paise_words) . ' PAISE';
        } else {
            $paise = '';
        }

return strtoupper(trim($Rupees) . $paise);
    }
}

// --- 3. Start building the HTML for the PDF ---
ob_start();
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Tax Invoice - #<?php echo htmlspecialchars($invoice['invoice_number']); ?></title>
    <style>
        /* Base Styles */
        body { font-family: 'Arial', sans-serif; font-size: 10px; color: #333; }
        .container { border: 2px solid #333; padding: 0; margin: 0; }
        .clearfix::after { content: ""; clear: both; display: table; }

/* Header Styles */
        .header { text-align: center; padding: 5px 0; border-bottom: 2px solid #333; }
        .header h1 { font-size: 18px; margin: 0; color: #000; }
        .header p { font-size: 9px; margin: 1px 0; }
        .invoice-title { text-align: center; font-size: 14px; font-weight: bold; margin: 5px 0; padding: 3px; background-color: #eee; border-top: 1px solid #333; border-bottom: 1px solid #333; }

/* Address Blocks */
        .address-box { width: 45%; float: left; padding: 5px; min-height: 80px; box-sizing: border-box; }
        .address-box.left { border-right: 1px solid #333; }
        .address-box strong { font-size: 11px; display: block; margin-bottom: 2px; border-bottom: 1px dashed #ccc; padding-bottom: 1px; }
        .address-box p { margin: 0; line-height: 1.4; }

/* Item Table Styles */
        .items-table { width: 100%; border-collapse: collapse; margin: 10px 0; }
        .items-table th, .items-table td { border: 1px solid #333; padding: 5px; text-align: left; vertical-align: top; }
        .items-table thead th { background-color: #f0f0f0; font-weight: bold; text-align: center; font-size: 9px; }
        .items-table .text-right { text-align: right; }
        .items-table .text-center { text-align: center; }

/* Footer/Totals */
        .summary-section { border-top: 1px solid #333; padding-top: 10px; }
        .totals-table { float: right; width: 60%; } /* Adjusted width for better fit */
        .totals-table td { border: none; padding: 2px 5px; }
        .totals-table td:last-child { text-align: right; font-weight: bold; }
        .grand-total-row { background-color: #f0f0f0; border-top: 2px solid #333; }
        .bank-details { float: left; width: 20%; font-size: 9px; padding: 5px 0; }
        
        .signature-section { margin-top: 40px; clear: both; }
        .signature-box { display: inline-block; width: 45%; margin-top: 20px; border-top: 1px solid #333; text-align: center; padding-top: 5px; font-weight: bold; }
        .footer { text-align: center; padding: 10px 0 0; font-size: 8px; color: #777; clear: both; }

</style>
</head>
<body>
    <div class="container">
        
        <div class="header">
            <h1><?php echo htmlspecialchars($invoice['seller_name'] ?? 'RAJMATA ENTERPRISES'); ?></h1>
            <p><?php echo htmlspecialchars($invoice['seller_address'] ?? 'GAT NO 22/1/K, AT/POST-KANDAR, KARMALA, SOLAPUR'); ?></p>
            <p>GSTIN: <?php echo htmlspecialchars($invoice['seller_gstin'] ?? '27EZKPK7345M1ZL'); ?> | Contact: <?php echo htmlspecialchars($invoice['seller_contact'] ?? '9763635393'); ?></p>
        </div>

<div class="invoice-title">TAX INVOICE</div>

<div class="clearfix" style="border-bottom: 1px solid #333;">
            <div class="address-box left">
                <strong>Recipient (Billed To)</strong>
                
                <p>Name: <?php echo htmlspecialchars($invoice['receiver_name']); ?></p>
                <p>Address: <?php echo nl2br(htmlspecialchars($invoice['receiver_address'])); ?></p>
                <p>GSTIN: <?php echo htmlspecialchars($invoice['receiver_gstin']); ?></p>
                <p>State/Village: <?php echo htmlspecialchars($invoice['receiver_state'] . ' - ' . $invoice['receiver_state_code']); ?></p> 
            </div>

<div class="address-box">
                <strong>Invoice Details</strong>
                <p>Invoice No: <strong><?php echo htmlspecialchars($invoice['invoice_number']); ?></strong></p>
                <p>Date: <?php echo date("d-m-Y h:i A", strtotime($invoice['invoice_date'])); ?></p>
                <p>Payment Mode: <?php echo htmlspecialchars($invoice['mode_of_payment']); ?></p>
                <p>Vehicle No: <?php echo htmlspecialchars($invoice['vehicle_number'] ?? 'N/A'); ?></p> 
            </div>
        </div>

<table class="items-table">
            <thead>
                <tr>
                    <th rowspan="2" style="width: 5%;">S.No</th>
                    <th rowspan="2" style="width: 30%;">Description Of Goods</th>
                    <th rowspan="2" style="width: 10%;">HSN/SAC</th>
                    <th rowspan="2" style="width: 8%;">Qty</th>
                    <th rowspan="2" style="width: 8%;">Unit Price (₹)</th>
                    <th rowspan="2" style="width: 12%;">Taxable Amt (₹)</th>
                    <th colspan="2" style="width: 12%;">CGST</th>
                    <th colspan="2" style="width: 12%;">SGST</th>
                    <th rowspan="2" style="width: 12%;">Total Amt (₹)</th>
                </tr>
                <tr>
                    <th style="width: 6%;">Rate %</th>
                    <th style="width: 6%;">Amt (₹)</th>
                    <th style="width: 6%;">Rate %</th>
                    <th style="width: 6%;">Amt (₹)</th>
                </tr>
            </thead>
            <tbody>
                <?php 
                $sn = 1;
                $total_items_taxable_amount = 0;
                $total_items_cgst_amount = 0;
                $total_items_sgst_amount = 0;
                $total_items_gross_amount = 0;

if (mysqli_num_rows($result_items) > 0) {
                    while ($item = mysqli_fetch_assoc($result_items)) { 
                        $total_items_taxable_amount += $item['taxable_amount'];
                        $total_items_cgst_amount += $item['cgst_amount'];
                        $total_items_sgst_amount += $item['sgst_amount'];
                        $total_items_gross_amount += $item['total_amount'];
                        ?>
                        <tr>
                            <td class="text-center"><?php echo $sn++; ?></td>
                            <td><?php echo htmlspecialchars($item['description_of_goods']); ?></td> 
                            <td class="text-center"><?php echo htmlspecialchars($item['hsn_code']); ?></td>
                            <td class="text-right"><?php echo number_format($item['quantity'], 3); ?></td> 
                            <td class="text-right"><?php echo number_format($item['unit_price'], 2); ?></td>
                            <td class="text-right"><?php echo number_format($item['taxable_amount'], 2); ?></td>
                            
                            <td class="text-center"><?php echo number_format($item['cgst_rate'], 1); ?></td>
                            <td class="text-right"><?php echo number_format($item['cgst_amount'], 2); ?></td>
                            
                            <td class="text-center"><?php echo number_format($item['sgst_rate'], 1); ?></td>
                            <td class="text-right"><?php echo number_format($item['sgst_amount'], 2); ?></td>
                            
                            <td class="text-right"><?php echo number_format($item['total_amount'], 2); ?></td>
                        </tr>
                    <?php } 
                } else { ?>
                    <tr>
                        <td colspan="11" class="text-center">No items found for this invoice.</td>
                    </tr>
                <?php } ?>
                
                <tr style="font-weight: bold; background-color: #f2f2f2;">
                    <td colspan="5" class="text-right">Total:</td>
                    <td class="text-right"><?php echo number_format($total_items_taxable_amount, 2); ?></td>
                    <td colspan="2" class="text-right"><?php echo number_format($total_items_cgst_amount, 2); ?></td>
                    <td colspan="2" class="text-right"><?php echo number_format($total_items_sgst_amount, 2); ?></td>
                    <td class="text-right"><?php echo number_format($total_items_gross_amount, 2); ?></td>
                </tr>
            </tbody>
        </table>
        
        <div class="summary-section clearfix">
            
           
			
            <table class="totals-table" style="width: 60%;">
                <tr>
                    <td>Total Taxable Amount:</td>
                    <td><?php echo number_format($invoice['total_taxable_amount'], 2); ?></td>
                </tr>
                <tr>
                    <td>Total CGST:</td>
                    <td><?php echo number_format($invoice['total_cgst_amount'], 2); ?></td>
                </tr>
                <tr>
                    <td>Total SGST:</td>
                    <td><?php echo number_format($invoice['total_sgst_amount'], 2); ?></td>
                </tr>
                 
                <tr class="grand-total-row">
                    <td><strong>Grand Total:</strong></td>
                    <td><strong><?php echo number_format($invoice['total_amount_after_tax'], 2); ?></strong></td>
                </tr>
            </table>
			 	
        </div>
        
        <br style="clear: both;">

<div style="margin-top: 10px; font-size: 11px; font-weight: bold;">
            Amount Chargeable (in words): INR <?php echo numberToWords($invoice['total_amount_after_tax']); ?> ONLY
        </div>

<div class="signature-section clearfix">
            <div class="signature-box" style="float: left;">Receiver Signature</div>
            <div class="signature-box" style="float: right;">For <?php echo htmlspecialchars($invoice['seller_name'] ?? 'RAJMATA ENTERPRISES'); ?></div>
        </div>
        
        <div class="footer">
            <p>This is a computer generated invoice and does not require a signature.</p>
        </div>
    </div>
</body>
</html>

<?php
// Close the statement
mysqli_stmt_close($stmt_items);

// --- 4. Get the captured HTML and generate the PDF ---
$invoiceHTML = ob_get_clean();

// Create a new mPDF instance
$mpdf = new \Mpdf\Mpdf([
    'mode' => 'utf-8',
    'format' => 'A4',
    'margin_left' => 10,
    'margin_right' => 10,
    'margin_top' => 10,
    'margin_bottom' => 10,
]);

// Set document title
$mpdf->SetTitle('Invoice-' . $invoice['invoice_number']);

// Write your HTML to the PDF
$mpdf->WriteHTML($invoiceHTML);

// Output the PDF to the browser for inline display
$mpdf->Output('Invoice-' . $invoice['invoice_number'] . '.pdf', 'I');