Zploit 0-Day Shell

:: Editing File: edit_challan.php

<?php
include_once("session.php");
include("header.php");
include("db.php");

// ---------- 1️⃣ Validate challan ID ----------
if (!isset($_GET['id']) || empty($_GET['id'])) {
    die("Error: Challan ID missing.");
}
$challan_id = (int)$_GET['id'];

// ---------- 2️⃣ Fetch Master Challan ----------
$sql = "SELECT * FROM challan WHERE id = $challan_id";
$result = mysqli_query($conn, $sql);
if (mysqli_num_rows($result) == 0) {
    die("Error: Challan not found.");
}
$challan = mysqli_fetch_assoc($result);

// ---------- 3️⃣ Fetch Box Data ----------
$sql_box = "SELECT * FROM challen_box WHERE challan_id = $challan_id";
$box = mysqli_fetch_assoc(mysqli_query($conn, $sql_box));

// ---------- 4️⃣ Fetch Item Rows ----------
$sql_items = "SELECT * FROM challen_items WHERE challan_id = $challan_id";
$result_items = mysqli_query($conn, $sql_items);
$items = [];
while ($row = mysqli_fetch_assoc($result_items)) {
    $items[] = $row;
}
?>

<main>
    <div class="container-fluid">
        <div class="row m-1">
            <div class="col-12">
                <h4 class="main-title">Edit Farmer Challan</h4>
                <ul class="app-line-breadcrumbs mb-3">
                    <li><a href="dashboard.php">Home</a></li>
                    <li><a href="farmer_challen_list.php">Farmer Challan List</a></li>
                    <li class="active">Edit Challan</li>
                </ul>
            </div>
        </div>

<h5 class="mt-3">Challan Details</h5>
            <div class="col-md-6">
                <label class="form-label">Challan Date</label>
                <input class="form-control" type="date" name="challan_date" 
                       value="<?php echo $challan['challan_date']; ?>" required>
            </div>
            <div class="col-md-6">
                <label class="form-label">Challan No</label>
                <input class="form-control" name="challan_no" 
                       value="<?php echo htmlspecialchars($challan['challan_no']); ?>">
            </div>

<h5 class="mt-3">Farmer Information</h5>
            <div class="col-md-6">
                <label class="form-label">Farmer Name</label>
                <select class="form-control" name="farmer_id" id="farmer_id" required>
                    <option value="">Select Farmer</option>
                    <?php
                    $f_q = mysqli_query($conn, "SELECT id, name FROM party WHERE type='Farmer' ORDER BY name ASC");
                    while ($f = mysqli_fetch_assoc($f_q)) {
                        $sel = ($f['id'] == $challan['farmer_id']) ? "selected" : "";
                        echo "<option value='{$f['id']}' $sel>{$f['name']}</option>";
                    }
                    ?>
                </select>
            </div>
            <div class="col-md-6">
                <label class="form-label">Phone</label>
                <input type="text" class="form-control" name="farmer_contact" 
                       value="<?php echo $challan['farmer_contact']; ?>" readonly>
            </div>
			
			 <div class="col-md-6">
				<label class="form-label">Village</label>
				<input type="text" class="form-control" id="farmer_village" name="farmer_village"  
				value="<?php echo $challan['farmer_village']; ?>" readonly>
			</div>
			<div class="col-md-6">
				<label class="form-label">Location</label>
				<input type="text" class="form-control" id="farmer_location" name="farmer_location"  
				value="<?php echo $challan['farmer_location']; ?>" readonly>
			</div>

<h5 class="mt-3">Vendor Information</h5>
            <div class="col-md-6">
                <label class="form-label">Vendor Name</label>
                <select class="form-control" name="vendor_id" id="vendor_id" required>
                    <option value="">Select Vendor</option>
                    <?php
                    $v_q = mysqli_query($conn, "SELECT id, name FROM party WHERE type='Vendor' ORDER BY name ASC");
                    while ($v = mysqli_fetch_assoc($v_q)) {
                        $sel = ($v['id'] == $challan['vendor_id']) ? "selected" : "";
                        echo "<option value='{$v['id']}' $sel>{$v['name']}</option>";
                    }
                    ?>
                </select>
            </div>
            <div class="col-md-6">
                <label class="form-label">Product Name</label>
                <input type="text" class="form-control" name="product_name" 
                       value="<?php echo $challan['product_name']; ?>" readonly>
            </div>

<h5 class="mt-3">Brand & Box</h5>
            <div class="col-md-12">
                <label class="form-label">Brand Desc</label>
                <input type="text" class="form-control" name="brand_desc" 
                       value="<?php echo $challan['brand_desc']; ?>">
            </div>
            
			
			<?php
			// Fetch box categories from DB
			$query = "SELECT category_name FROM box_category WHERE status = 1 ORDER BY id ASC";
			$result = mysqli_query($conn, $query);

if ($result && mysqli_num_rows($result) > 0) {
				while ($row = mysqli_fetch_assoc($result)) {
					$b = htmlspecialchars($row['category_name']); // safety for output
					echo '
					<div class="col-md-4 mb-3">
						<label class="form-label">'.$b.'</label>
						<input type="number" class="form-control" id="box_'.$b.'" name="'.$b.'" value="'.($box['box_'.$b] ?? 0).'">
					</div>';
				}
			}
			?>
			
			<div class="col-md-4">
				<label class="form-label">Total Box</label>
				<input type="number" class="form-control" id="total_box" name="total_box" value="<?php echo $box['total_box']; ?>" readonly>
			</div>

<h5 class="mt-3">Items</h5>
			<div id="items_container" class="col-12">
				<div class="row g-2 mb-1 fw-bold d-none d-md-flex">
					<div class="col-md-3">Description</div>
					<div class="col-md-2">Types Of Good</div>
					<div class="col-md-2">Total Box</div>
					<div class="col-md-2">Wastage KG</div>
				   
					<div class="col-md-1"></div>
				</div>
			</div>
            <div id="items_container" class="col-12">
                <?php foreach ($items as $it): ?>
                    <div class="row g-2 mb-2 item-row">
                        <div class="col-md-3"><input class="form-control" name="item_desc[]" value="<?php echo $it['description']; ?>"></div>
                        <div class="col-md-2"><input class="form-control" name="item_good[]" value="<?php echo $it['types_of_good']; ?>"></div>
                        <div class="col-md-2"><input type="number" class="form-control item_box" name="item_box[]" value="<?php echo $it['total_box']; ?>"></div>
                        <div class="col-md-2"><input type="number" class="form-control item_wastage" name="item_wastage[]" value="<?php echo $it['wastage_kg']; ?>"></div>
                        <div class="col-md-1"><button type="button" class="btn btn-danger btn-sm remove-item">X</button></div>
                    </div>
                <?php endforeach; ?>
            </div>
            <div class="col-12">
                <button type="button" class="btn btn-sm btn-outline-primary" onclick="addItem()">+ Add Item</button><br><br>
            </div>
			<br><br>
			<div class="row">
				<div class="col-md-4">
					<label class="form-label fw-bold">Grand Total Box</label>
					<input type="text" class="form-control fw-bold" id="grand_total" name="grand_total" value="<?php echo $challan['grand_total_box']; ?>" >
				</div>
				<div class="col-md-4 ">
					<label class="form-label fw-bold">Grand Total Wastage KG</label>
					<input type="text" class="form-control fw-bold" id="grand_wastage_kg" name="grand_wastage_kg" value="<?php echo $challan['grand_wastage_kg']; ?>" >
				</div>
				<div class="col-md-4">
					<label class="form-label">Cold Storage Name</label>
					<select class="form-control" name="farmer_id" id="farmer_id" required>
						<option value="">Select Cold Storage Name</option>
						<?php
						$c_q = mysqli_query($conn, "SELECT id, company_name FROM cold_storage");
						while ($c = mysqli_fetch_assoc($c_q)) {
							$csel = ($c['id'] == $challan['cold_storage_id']) ? "selected" : "";
							echo "<option value='{$c['id']}' $csel>{$c['company_name']}</option>";
						}
						?>
					</select>
				</div>
			</div>
			
			<h5 class="mt-3">Driver & Vehicle Information</h5>
			<div class="col-md-6"><input class="form-control" name="supervisior_name" placeholder="Name Of Supervisior" value="<?php echo $challan['supervisior_name']; ?>" ></div>
			<div class="col-md-6"><input class="form-control" name="vehicle_number" placeholder="Vehicle Number" value="<?php echo $challan['vehicle_number']; ?>" ></div>
			<div class="col-md-6"><input class="form-control" name="driver_number" placeholder="Driver Mobile" value="<?php echo $challan['driver_number']; ?>" ></div>
			<div class="col-md-6"><input class="form-control" name="dispatch_time" placeholder="Dispatch Time" value="<?php echo $challan['dispatch_time']; ?>" ></div>
			
            
            <div class="col-md-12">
                <label class="form-label">Challan Receipt</label>
                <input type="file" name="challan_receipt" class="form-control">
                <?php if (!empty($challan['challan_receipt'])): ?>
                    <p class="mt-1">Current: <a href="uploads/challan_receipts/<?php echo $challan['challan_receipt']; ?>" target="_blank">View Receipt</a></p>
                <?php endif; ?>
            </div>

<div class="col-12 mt-4">
                <button type="submit" class="btn btn-success">Update Challan</button>
            </div>
        </form>
    </div>
</main>

function calculateGrandTotals() {
    let totalBox = 0;
    let totalWastage = 0;

// Sum all box values
    document.querySelectorAll('.item_box').forEach(function (el) {
        const val = parseFloat(el.value);
        if (!isNaN(val)) totalBox += val;
    });

// Sum all wastage values
    document.querySelectorAll('.item_wastage').forEach(function (el) {
        const val = parseFloat(el.value);
        if (!isNaN(val)) totalWastage += val;
    });

// Update the grand total fields
    document.getElementById('grand_total').value = totalBox;
    document.getElementById('grand_wastage_kg').value = totalWastage;
}

// Add one item row by default on page load
document.addEventListener('DOMContentLoaded', addItem);

// jQuery for AJAX calls
$(document).ready(function() {
    // AJAX to get Farmer details
    $("#farmer_id").change(function() {
        var farmerId = $(this).val();
        if (farmerId) {
            $.ajax({
                url: "get_farmer_details.php",
                type: "POST",
                data: { farmer_id: farmerId },
                dataType: "json",
                success: function(data) {
                    $("#farmer_contact").val(data.contact);
                    $("#farmer_village").val(data.village);
                    $("#farmer_location").val(data.state);
                }
            });
        } else {
            $("#farmer_contact, #farmer_village, #farmer_location").val("");
        }
    });

// AJAX to get Vendor details
    $("#vendor_id").change(function() {
        var vendorId = $(this).val();
        if (vendorId) {
            $.ajax({
                url: "get_vendor_details.php",
                type: "POST",
                data: { vendor_id: vendorId },
                dataType: "json",
                success: function(data) {
                    $("#vendor_code").val(data.vendor_code);
                }
            });
        } else {
            $("#vendor_code").val("");
        }
    });
});

function calculateBoxValue(id, value) {
    console.log("Hovered:", id, "Value:", value);
    // 💡 Add any custom logic here (validation, highlight, etc.)
}

function updateTotalBox() {
    let total = 0;
    document.querySelectorAll('input[id^="box_"]').forEach(function(input) {
        const v = input.value.trim();
        if (v !== '' && !isNaN(v)) total += parseFloat(v);
    });
    const totalEl = document.getElementById('total_box');
    if (totalEl) totalEl.value = total;
}

// Delegated event — fires when mouse hovers any box_ input
document.addEventListener('mouseover', function(e) {
    const target = e.target;
    if (target && target.matches('input[id^="box_"]')) {
        const val = target.value.trim();
        calculateBoxValue(target.id, val);
        updateTotalBox();
    }
});
</script>

<?php include("footer.php"); ?>