Zploit 0-Day Shell

:: Editing File: leads_13_01_2026.php

<?php
$page_title = "Leads";
include 'header.php';
include 'breadcrumb.php';
include 'menu.php';

/* =========================
   HELPER FUNCTIONS (BADGES)
   ========================= */

function leadStatusBadge($status)
{
    $status_clean = strtolower(trim($status));

switch ($status_clean) {
        case 'pending':
            return '<span class="badge bg-warning text-dark">Pending</span>';
        case 'done':
            return '<span class="badge bg-success">Done</span>';
        case 'no response':
            return '<span class="badge bg-secondary">No Response</span>';
        case 'interested':
            return '<span class="badge bg-primary">Interested</span>';
        case 'not interested':
            return '<span class="badge bg-danger">Not Interested</span>';
        default:
            return '<span class="badge bg-light text-dark">'.htmlspecialchars($status).'</span>';
    }
}

function callStatusBadge($status)
{
    return strtolower($status) === 'completed'
        ? '<span class="badge bg-success">Completed</span>'
        : '<span class="badge bg-danger">Incompleted</span>';
}

/* =========================
   PAGINATION
   ========================= */
$records_per_page = 50;
$current_page = isset($_GET['page']) ? max(1, intval($_GET['page'])) : 1;
$offset = ($current_page - 1) * $records_per_page;

/* =========================
   DATE PARSER
   ========================= */
function parse_user_date($s) {
    $s = trim((string)$s);
    if ($s === '') return false;

$d = DateTime::createFromFormat('Y-m-d', $s);
    if ($d) return $d;

$d = DateTime::createFromFormat('d-m-Y', $s);
    if ($d) return $d;

return false;
}

/* =========================
   FILTER INPUTS
   ========================= */
$date_from_raw   = $_GET['date_from'] ?? '';
$date_to_raw     = $_GET['date_to'] ?? '';
$calling_status  = trim($_GET['calling_status'] ?? '');
$enquiry_for     = intval($_GET['enquiry_for'] ?? 0);
$call_status     = trim($_GET['call_status'] ?? '');
$search_query    = trim($_GET['search_query'] ?? '');
$assigned_to     = intval($_GET['assigned_to'] ?? 0);

$date_from_dt = parse_user_date($date_from_raw);
$date_to_dt   = parse_user_date($date_to_raw);

$date_from_sql = $date_from_dt ? $date_from_dt->format('Y-m-d') : null;
$date_to_sql   = $date_to_dt ? $date_to_dt->format('Y-m-d') : null;

/* =========================
   DROPDOWNS DATA
   ========================= */
$work_sections = [];
$res = mysqli_query($conn, "SELECT id, section_name FROM work_sections ORDER BY section_name");
while ($r = mysqli_fetch_assoc($res)) $work_sections[] = $r;

$team_members = [];
$res = mysqli_query($conn, "SELECT id, name FROM team_members WHERE status = 1");
while ($r = mysqli_fetch_assoc($res)) $team_members[] = $r;

$calling_status_options = ['Pending','Done','No Response','Interested','Not Interested'];

/* =========================
   WHERE CONDITIONS
   ========================= */
$where = [];

if ($date_from_sql && $date_to_sql) {
    $where[] = "DATE(l.lead_date) BETWEEN '$date_from_sql' AND '$date_to_sql'";
}
if ($calling_status) $where[] = "l.calling_status = '".mysqli_real_escape_string($conn,$calling_status)."'";
if ($enquiry_for > 0) $where[] = "l.enquiry_for = $enquiry_for";
if ($call_status) $where[] = "l.call_status = '".mysqli_real_escape_string($conn,$call_status)."'";
if ($assigned_to > 0) $where[] = "l.assigned_to = $assigned_to";

if ($search_query) {
    $q = mysqli_real_escape_string($conn,"%$search_query%");
    $where[] = "(l.name LIKE '$q' OR l.mobile LIKE '$q' OR l.comment LIKE '$q')";
}

$whereSQL = $where ? 'WHERE '.implode(' AND ',$where) : '';

/* =========================
   COUNT & FETCH
   ========================= */
$count_sql = "SELECT COUNT(*) total FROM leads l $whereSQL";
$total_records = mysqli_fetch_assoc(mysqli_query($conn,$count_sql))['total'];
$total_pages = ceil($total_records / $records_per_page);

$sql = "SELECT l.*, w.section_name, t.name team_name
        FROM leads l
        LEFT JOIN work_sections w ON w.id=l.enquiry_for
        LEFT JOIN team_members t ON t.id=l.assigned_to
        $whereSQL
        ORDER BY l.call_time DESC
        LIMIT $records_per_page OFFSET $offset";

$result = mysqli_query($conn,$sql);
?>

<div class="page-body">
<div class="container-fluid">
<div class="card">
<div class="card-header d-flex justify-content-between">
<h2>Lead Management</h2>
<div>
<a href="upload_leads_csv.php" class="btn btn-primary btn-sm">Upload Excel</a>
<a href="lead_add.php" class="btn btn-success btn-sm">Add Lead</a>
</div>
</div>

<div class="card-body table-responsive">
<table class="table table-bordered table-striped" id="leadsTable">
<thead>
<tr>
<th>#</th>
<th>Date</th>
<th>Name</th>
<th>Mobile</th>
<th>Enquiry</th>
<th>Assign</th>
<th>Lead Status</th>
<th>Comment</th>
<th>Call Status</th>
<th>Call Time</th>
<th>Action</th>
</tr>
</thead>
<tbody>

<?php
$sr = $offset + 1;
if ($result && mysqli_num_rows($result)):
while ($row = mysqli_fetch_assoc($result)):

$call_time = $row['call_time']
    ? date('d-m-Y h:i A',strtotime($row['call_time']))
    : '-';
?>

<td class="text-center"><?= leadStatusBadge($row['calling_status']) ?></td>
<td><?= htmlspecialchars($row['comment']) ?></td>
<td class="text-center"><?= callStatusBadge($row['call_status']) ?></td>

<td><?= $call_time ?></td>
<td class="text-center">
<a href="lead_edit.php?id=<?= $row['id'] ?>" class="btn btn-warning btn-sm">
<i class="fa fa-edit"></i>
</a>
<a href="lead_delete.php?id=<?= $row['id'] ?>"
onclick="return confirm('Delete lead?')"
class="btn btn-danger btn-sm">
<i class="fa fa-trash"></i>
</a>
</td>
</tr>

<?php endwhile; else: ?>
<tr><td colspan="11" class="text-center text-muted">No Leads Found</td></tr>
<?php endif; ?>

</tbody>
</table>
</div>
</div>
</div>
</div>

<?php include 'footer.php'; ?>