Zploit 0-Day Shell

:: Editing File: packaging_stock_list.php

<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);

include_once("session.php");
include("db.php");
include("header.php");

/* ---------------- FILTER CONDITIONS ---------------- */
$where = "WHERE ps.status = '1' AND ps.category_id = '1' ";

if (!empty($_GET['from_date'])) {
    $where .= " AND ps.stock_date >= '{$_GET['from_date']}'";
}
if (!empty($_GET['to_date'])) {
    $where .= " AND ps.stock_date <= '{$_GET['to_date']}'";
}
if (!empty($_GET['product_id'])) {
    $where .= " AND ps.product_id = '{$_GET['product_id']}'";
}
if (!empty($_GET['vendor_id'])) {
    $where .= " AND ps.vendor_id = '{$_GET['vendor_id']}'";
}
if (!empty($_GET['stock_type'])) {
    $where .= " AND ps.stock_type = '{$_GET['stock_type']}'";
}

/* ---------------- LIST QUERY ---------------- */
$sql = "
SELECT 
    ps.*,
    pm.product_name,
    pm.unit_type,
    mc.category_name,
    p.name AS vendor_name
FROM packaging_stock ps
JOIN packaging_materials pm ON pm.id = ps.product_id
JOIN material_categories mc ON mc.id = pm.category_id
LEFT JOIN party p ON p.id = ps.vendor_id
$where
ORDER BY ps.stock_date DESC, ps.id DESC
";
$result = mysqli_query($conn, $sql);

/* ---------------- TOTAL CALCULATION ---------------- */
$total = mysqli_fetch_assoc(mysqli_query($conn,"
SELECT
    SUM(CASE WHEN stock_type='IN' THEN quantity ELSE 0 END) AS total_in,
    SUM(CASE WHEN stock_type='OUT' THEN quantity ELSE 0 END) AS total_out
FROM packaging_stock ps
$where
"));

$total_in  = $total['total_in'] ?? 0;
$total_out = $total['total_out'] ?? 0;
$closing   = $total_in - $total_out;
?>

<div class="row m-1">
  <div class="col-md-9">
    <h4 class="main-title">Packaging Stock List</h4>
    <ul class="app-line-breadcrumbs mb-3">
      <li><a href="dashboard.php"><i class="ph-duotone ph-bank"></i> Home</a></li>
      <li class="active">Packaging Stock</li>
    </ul>
  </div>
  <div class="col-md-3 text-end">
    <a href="packaging_stock_add.php" class="btn btn-primary">+ Add Stock</a>
  </div>
</div>

<form method="GET" class="card mb-3">
<div class="card-body row g-3">

<div class="col-md-2">
<label>Product</label>
<select name="product_id" class="form-select">
<option value="">-- All Products --</option>
<?php
$p = mysqli_query($conn,"SELECT id, product_name FROM packaging_materials where status = '1' AND category_id = '1'");
while($row=mysqli_fetch_assoc($p)){
  $sel = ($_GET['product_id'] ?? '')==$row['id']?'selected':'';
  echo "<option value='{$row['id']}' $sel>{$row['product_name']}</option>";
}
?>
</select>
</div>

<div class="col-md-2">
<label>Vendor</label>
<select name="vendor_id" class="form-select">
<option value="">-- All Vendors --</option>
<?php
$v = mysqli_query($conn,"SELECT id, name FROM party where type='Vendor'");
while($row=mysqli_fetch_assoc($v)){
  $sel = ($_GET['vendor_id'] ?? '')==$row['id']?'selected':'';
  echo "<option value='{$row['id']}' $sel>{$row['name']}</option>";
}
?>
</select>
</div>

<div class="col-md-2">
<label>Stock Type</label>
<select name="stock_type" class="form-select">
<option value="">-- IN / OUT --</option>
<option value="IN"  <?= (@$_GET['stock_type']=='IN')?'selected':'' ?>>IN</option>
<option value="OUT" <?= (@$_GET['stock_type']=='OUT')?'selected':'' ?>>OUT</option>
</select>
</div>

<div class="col-md-1 d-flex align-items-end">
<button class="btn btn-success w-100">Filter</button>
</div>

<div class="col-md-1 d-flex align-items-end">
<a href="packaging_stock_list.php" class="btn btn-secondary w-100">Clear</a>
</div>

</div>
</form>

<div class="card">
<div class="card-body p-0">
<div class="table-responsive">

<table class="display table table-striped" id="stockTable">
<thead>
<tr>
<th>No</th>
<th>Date</th>
<th>Category</th>
<th>Product</th>
<th>Vendor</th>
<th>Type</th>
<th>Qty</th>
<th>Unit</th>
<th>Status</th>
<th width="120">Action</th>
</tr>
</thead>
<tbody>

<?php

$no=1;

if ($result && mysqli_num_rows($result) > 0) {
while ($row = mysqli_fetch_assoc($result)) {

$type = ($row['stock_type'] == 'IN')
    ? '<span class="badge bg-success">IN</span>'
    : '<span class="badge bg-warning">OUT</span>';

$status = ($row['status'] == 1)
    ? '<span class="badge bg-success">Active</span>'
    : '<span class="badge bg-danger">Inactive</span>';
?>
<tr>
<td><?= $no++; ?></td>
<td><?= date('d-m-Y', strtotime($row['stock_date'])); ?></td>
<td><?= htmlspecialchars($row['category_name']); ?></td>
<td><?= htmlspecialchars($row['product_name']); ?></td>
<td><?= htmlspecialchars($row['vendor_name'] ?? '-'); ?></td>
<td><?= $type; ?></td>
<td><?= number_format($row['quantity'],3); ?></td>
<td><?= $row['unit_type']; ?></td>
<td><?= $status; ?></td>
<td>
<a href="packaging_stock_edit.php?id=<?= $row['id']; ?>" class="btn btn-light-success btn-sm">
<i class="ti ti-edit"></i>
</a>
<a href="packaging_stock_delete.php?id=<?= $row['id']; ?>"
   onclick="return confirm('Delete this entry?');"
   class="btn btn-light-danger btn-sm">
<i class="ti ti-trash"></i>
</a>
</td>
</tr>
<?php } } else { ?>
<tr><td colspan="10" class="text-center">No records found</td></tr>
<?php } ?>

</tbody>

<tfoot>
        <tr>
            <th>TOTAL</th>
           
            <th>In : <?= number_format($total_in, 3); ?></th>
            <th>Out : <?= number_format($total_out, 3); ?></th>
            <th>Closing : <?= number_format($closing, 3); ?></th>
            <th></th>
            <th></th>
            <th></th>
            <th></th>
             <th></th>
        </tr>
        </tfoot>
                
</table>

</div>
</div>
</div>

<div class="row mt-3">
<div class="col-md-4">
<div class="alert alert-success">
<strong>Total IN:</strong> <?= number_format($total_in,3); ?>
</div>
</div>

<div class="col-md-4">
<div class="alert alert-warning">
<strong>Total OUT:</strong> <?= number_format($total_out,3); ?>
</div>
</div>

<div class="col-md-4">
<div class="alert alert-info">
<strong>Closing Stock:</strong> <?= number_format($closing,3); ?>
</div>
</div>
</div>

</div>
</main>

<?php include("footer.php"); ?>

buttons: [

// ðŸ“— EXCEL
            {
                extend: 'excelHtml5',
                footer: true,
                title: 'Payments Report'
            },

// ðŸ“„ CSV
            {
                extend: 'csvHtml5',
                footer: true,
                title: 'Payments Report'
            },

// ðŸ§¾ PDF
            {
                extend: 'pdfHtml5',
                footer: true,
                title: 'Payments Report',
                orientation: 'landscape',
                pageSize: 'A4',
                customize: function (doc) {

// Center align
                    doc.styles.tableHeader.alignment = 'center';

// Bold TOTAL row
                    let rowCount = doc.content[1].table.body.length;
                    doc.content[1].table.body[rowCount - 1].forEach(function(cell){
                        cell.bold = true;
                    });
                }
            }
        ]
    });

});
</script>