Zploit 0-Day Shell

:: Editing File: print_vendor_invoice.php

<?php
// print_vendor_invoice.php
// Include your database connection and Composer's autoloader
include("db.php");
require_once __DIR__ . '/vendor/autoload.php';

// Check if an ID is provided in the URL
if (!isset($_GET['id']) || empty($_GET['id'])) {
    die("Error: Vendor Invoice ID is missing.");
}
$invoice_id = (int)$_GET['id'];

// --- 1. Fetch Master Invoice Data (prepared) ---
// Use party table for vendor details and billing table for billing company
$sql_invoice = "
    SELECT vi.*, p.name AS vendor_name, p.address AS vendor_address, p.phone AS vendor_contact, 
           b.company_name AS billing_name
    FROM vendor_invoice AS vi
    LEFT JOIN party AS p ON vi.vendor_id = p.id
    LEFT JOIN billing AS b ON vi.billing_id = b.id
    WHERE vi.id = ?
    LIMIT 1
";

$stmt = mysqli_prepare($conn, $sql_invoice);
if (!$stmt) {
    die("Database error: " . mysqli_error($conn));
}
mysqli_stmt_bind_param($stmt, "i", $invoice_id);
mysqli_stmt_execute($stmt);
$res = mysqli_stmt_get_result($stmt);
if (!$res || mysqli_num_rows($res) === 0) {
    die("Error: No invoice found with this ID.");
}
$invoice = mysqli_fetch_assoc($res);
mysqli_stmt_close($stmt);

// --- 2. Fetch Invoice Items Data (prepared) ---
$sql_items = "SELECT * FROM vendor_invoice_items WHERE vendor_invoice_id = ? ORDER BY id ASC";
$stmt2 = mysqli_prepare($conn, $sql_items);
if (!$stmt2) {
    die("Database error (items): " . mysqli_error($conn));
}
mysqli_stmt_bind_param($stmt2, "i", $invoice_id);
mysqli_stmt_execute($stmt2);
$result_items = mysqli_stmt_get_result($stmt2);
$items = [];
while ($item = mysqli_fetch_assoc($result_items)) $items[] = $item;
mysqli_stmt_close($stmt2);

// --- 3. Fetch selected tax names & percentages (if tax IDs present) ---
$cgst = ['name' => '', 'perc' => 0.0];
$sgst = ['name' => '', 'perc' => 0.0];

if (!empty($invoice['tax_cgst_id'])) {
    $tstmt = mysqli_prepare($conn, "SELECT tax_name, tax_percentage FROM taxes WHERE id = ? LIMIT 1");
    if ($tstmt) {
        mysqli_stmt_bind_param($tstmt, "i", $invoice['tax_cgst_id']);
        mysqli_stmt_execute($tstmt);
        mysqli_stmt_bind_result($tstmt, $tname, $tperc);
        if (mysqli_stmt_fetch($tstmt)) {
            $cgst['name'] = $tname;
            $cgst['perc'] = (float)$tperc;
        }
        mysqli_stmt_close($tstmt);
    }
}

if (!empty($invoice['tax_sgst_id'])) {
    $tstmt = mysqli_prepare($conn, "SELECT tax_name, tax_percentage FROM taxes WHERE id = ? LIMIT 1");
    if ($tstmt) {
        mysqli_stmt_bind_param($tstmt, "i", $invoice['tax_sgst_id']);
        mysqli_stmt_execute($tstmt);
        mysqli_stmt_bind_result($tstmt, $tname2, $tperc2);
        if (mysqli_stmt_fetch($tstmt)) {
            $sgst['name'] = $tname2;
            $sgst['perc'] = (float)$tperc2;
        }
        mysqli_stmt_close($tstmt);
    }
}

// Fall back: ensure numeric values exist
$sub_total   = isset($invoice['sub_total']) ? (float)$invoice['sub_total'] : 0.00;
$cgst_amount = isset($invoice['cgst_amount']) ? (float)$invoice['cgst_amount'] : 0.00;
$sgst_amount = isset($invoice['sgst_amount']) ? (float)$invoice['sgst_amount'] : 0.00;
$grand_total = isset($invoice['grand_total']) ? (float)$invoice['grand_total'] : ($sub_total + $cgst_amount + $sgst_amount);

// --- 4. Build the HTML for the PDF using an output buffer ---
ob_start();
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Invoice - #<?php echo htmlspecialchars($invoice['invoice_no']); ?></title>
    <style>
        body { font-family: Calibri, sans-serif; font-size: 11px; color: #000; }
        .page-container { border: 1px solid #000; padding: 8px; }
        h2 { font-size: 16px; margin: 0; padding: 0; }
        table { width: 100%; border-collapse: collapse; }
        .header-table td { vertical-align: top; padding: 6px; }
        .vendor-details { text-align: left; border: 1px solid #000; padding:6px; }
        .invoice-meta { text-align: right; border: 1px solid #000; padding:6px; }
        .meta-box td { padding: 4px 8px; }
        .items-table { margin-top: 10px; width:100%; }
        .items-table th, .items-table td { border: 1px solid #000; padding: 6px; font-size: 11px; }
        .items-table thead th { font-weight: bold; text-align: center; }
        .col-amount, .col-rate, .col-qty, .col-netwt { text-align: right; }
        .col-desc { text-align: left; }
        .col-sno { text-align: center; }
        .footer-table { margin-top: 10px; width:100%; }
        .grand-total-box { border: 1px solid #000; display: inline-block; padding: 8px; }
        .grand-total-box td { padding: 4px 10px; }
        .signature-section { padding-top: 30px; font-weight: bold; }
        .small { font-size: 10px; }
    </style>
</head>
<body>
    <div class="page-container">
        <h3 style="text-align: center; border-bottom: 2px solid #000; padding-bottom: 6px;">INVOICE</h3>

<table class="header-table" style="margin-bottom:8px;">
            <tr>
                <td style="width:65%; vertical-align: top;">
                    <div style="font-size:14px; font-weight:bold; text-transform:uppercase;"><?php echo htmlspecialchars($invoice['vendor_name'] ?? ''); ?></div>
                    <div class="small" style="margin-top:6px;"><?php echo nl2br(htmlspecialchars($invoice['vendor_address'] ?? '')); ?></div>
                    <div style="margin-top:6px;">Phone: <?php echo htmlspecialchars($invoice['vendor_contact'] ?? ''); ?></div>
                    <?php /*if (!empty($invoice['vendor_code'])): ?>
                        <div style="margin-top:6px;">Vendor Code: <?php echo htmlspecialchars($invoice['vendor_code']); ?></div>
                    <?php endif; */ ?>
                </td>
                <td style="width:35%; vertical-align: top;">
                    <table class="meta-box" style="float:right;">
                        <tr>
                            <td class="label"><strong>Invoice Date:</strong></td>
                            <td><?php echo htmlspecialchars(date("d-m-Y", strtotime($invoice['invoice_date'] ?? 'now'))); ?></td>
                        </tr>
                        <tr>
                            <td class="label"><strong>Invoice No:</strong></td>
                            <td><?php echo htmlspecialchars($invoice['invoice_no'] ?? ''); ?></td>
                        </tr>
                        <tr>
                            <td class="label"><strong>Vehicle No:</strong></td>
                            <td><?php echo htmlspecialchars($invoice['vehicle_number'] ?? ''); ?></td>
                        </tr>
                        <?php if (!empty($invoice['product_name'])): ?>
                        <tr>
                            <td class="label"><strong>Product:</strong></td>
                            <td><?php echo htmlspecialchars($invoice['product_name']); ?></td>
                        </tr>
                        <?php endif; ?>
                    </table>
                </td>
            </tr>
        </table>

<table class="header-table" style="margin-bottom:8px;">
            <tr>
                <td style="width:65%;" class="vendor-details">
                    <strong>Bill To:</strong><br>
                    <?php echo nl2br(htmlspecialchars($invoice['billing_name'] ?? '')); ?>
                </td>
                <td style="width:35%;" class="vendor-details">
                    <strong>Terms Of Delivery</strong><br>
                    <?php /* echo nl2br(htmlspecialchars($invoice['terms_of_delivery'] ?? ''));*/ ?>
                </td>
			
				
				
            </tr>
        </table>

<table class="items-table">
            <thead>
                <tr>
                    <th style="width:5%;">Sr. no</th>
                    <th style="width:35%;">Description</th>
                    <th>Pack Type</th>
                    <th style="width:8%;">Box Qty</th>
                    <th style="width:10%;">Net. Weight</th>
                    <th style="width:6%;">Unit</th>
                    <th style="width:9%;">Rate</th>
                    <th style="width:12%;">Amount</th>
                </tr>
            </thead>
            <tbody>
                <?php
                $sn = 1;
                $rowCount = count($items);
                foreach ($items as $item) {
                    echo '<tr>';
                    echo '<td class="col-sno">' . $sn++ . '</td>';
                    echo '<td class="col-desc">' . htmlspecialchars($item['description'] ?? '') . '</td>';
                    echo '<td class="col-sno">' . htmlspecialchars($item['pack_type'] ?? '') . '</td>';
                    echo '<td class="col-qty">' . (isset($item['qty']) ? number_format((float)$item['qty'], 2) : '') . '</td>';
                    echo '<td class="col-netwt">' . (isset($item['net_weight']) ? number_format((float)$item['net_weight'], 2) : '') . '</td>';
                    echo '<td class="col-sno">' . htmlspecialchars($item['unit'] ?? '') . '</td>';
                    echo '<td class="col-rate">' . (isset($item['rate']) ? number_format((float)$item['rate'], 2) : '') . '</td>';
                    echo '<td class="col-amount">' . (isset($item['amount']) ? number_format((float)$item['amount'], 2) : '') . '</td>';
                    echo '</tr>';
                }

// Add minimal empty rows for consistent height (optional)
                $minRows = 3;
                if ($rowCount < $minRows) {
                    for ($i = 0; $i < ($minRows - $rowCount); $i++) {
                        echo '<tr><td>&nbsp;</td><td></td><td></td><td></td><td></td><td></td><td></td><td></td></tr>';
                    }
                }
                ?>
            </tbody>
        </table>

<table class="footer-table">
            <tr>
                <td style="width:58%;" class="signature-section">
                    M/S <?php echo htmlspecialchars(strtoupper($invoice['vendor_name'] ?? '')); ?>
                    <br><br><br>
                    Authorized Signatory
                </td>
                <td style="width:42%; vertical-align: top;">
                    <table class="grand-total-box" style="float:right;">
                        <tr>
                            <td class="small">Sub Total</td>
                            <td style="text-align:right;"><?php echo number_format($sub_total, 2); ?></td>
                        </tr>
                        <?php if ($cgst['perc'] > 0 || $cgst_amount > 0): ?>
                        <tr>
                            <td class="small"><?php echo htmlspecialchars($cgst['name'] ? $cgst['name'] . ' (' . $cgst['perc'] . '%)' : 'CGST'); ?></td>
                            <td style="text-align:right;"><?php echo number_format($cgst_amount, 2); ?></td>
                        </tr>
                        <?php endif; ?>

<?php if ($sgst['perc'] > 0 || $sgst_amount > 0): ?>
                        <tr>
                            <td class="small"><?php echo htmlspecialchars($sgst['name'] ? $sgst['name'] . ' (' . $sgst['perc'] . '%)' : 'SGST'); ?></td>
                            <td style="text-align:right;"><?php echo number_format($sgst_amount, 2); ?></td>
                        </tr>
                        <?php endif; ?>

<tr>
                            <td class="label" style="font-weight:bold;">Grand Total</td>
                            <td style="text-align:right; font-weight:bold;"><?php echo number_format($grand_total, 2); ?></td>
                        </tr>
                    </table>
                </td>
            </tr>
        </table>

</div>
</body>
</html>
<?php
// --- 5. Get the captured HTML content and generate the PDF ---
$invoiceHTML = ob_get_clean();

$mpdf = new \Mpdf\Mpdf([
    'mode' => 'utf-8',
    'format' => 'A4',
    'margin_left' => 10,
    'margin_right' => 10,
    'margin_top' => 10,
    'margin_bottom' => 10,
]);

$mpdf->WriteHTML($invoiceHTML);

// Output inline
$filename = 'Invoice-' . ($invoice['invoice_no'] ?? $invoice_id) . '.pdf';
$mpdf->Output($filename, 'I');