Zploit 0-Day Shell

:: Editing File: delete_po.php

<?php
include 'db.php';
include_once("session.php");

// ✅ Validate the request
if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
    $_SESSION['error'] = "Invalid request.";
    header("Location: purchase_list.php"); // Redirect to the PO list
    exit;
}

$po_id = (int)$_GET['id']; // ID now refers to the Purchase Order ID

mysqli_begin_transaction($conn);

try {
    // ⚠️ IMPORTANT: Ensure the 'purchase_items' table has a foreign key constraint
    // with ON DELETE CASCADE set up to the 'purchase' table. If not, you must
    // explicitly delete from 'purchase_items' first to avoid errors.

// 1. Explicitly delete child rows (optional if CASCADE is set)
    // $sql_items = "DELETE FROM purchase_items WHERE purchase_id = $po_id";
    // if (!mysqli_query($conn, $sql_items)) {
    //     throw new Exception("Delete PO items failed: " . mysqli_error($conn));
    // }

// 2. Delete the master PO record
    $sql = "DELETE FROM purchase WHERE id = $po_id";
    if (!mysqli_query($conn, $sql)) {
        throw new Exception("Delete PO failed: " . mysqli_error($conn));
    }

mysqli_commit($conn);
    $_SESSION['success'] = "Purchase Order deleted successfully.";
    header("Location: po_list.php"); // Redirect to the PO list
    exit;

} catch (Exception $e) {
    mysqli_rollback($conn);
    $_SESSION['error'] = "Error deleting Purchase Order: " . $e->getMessage();
    header("Location: po_list.php"); // Redirect back to the PO list
    exit;
}
?>