Zploit 0-Day Shell

:: Editing File: leads1.php

<?php
$page_title = "Leads";
include 'header.php';
include 'breadcrumb.php';
include 'menu.php';

/* =========================
   HELPER FUNCTIONS (BADGES)
   ========================= 
*/
function leadStatusBadge($status)
{
    $status_clean = strtolower(trim($status));

switch ($status_clean) {
        case 'pending':
            return '<span class="badge bg-warning text-dark">Pending</span>';
        case 'done':
            return '<span class="badge bg-success">Done</span>';
        case 'no response':
            return '<span class="badge bg-secondary">No Response</span>';
        case 'interested':
            return '<span class="badge bg-primary">Interested</span>';
        case 'not interested':
            return '<span class="badge bg-danger">Not Interested</span>';
        default:
            return '<span class="badge bg-light text-dark">'.htmlspecialchars($status).'</span>';
    }
}

/*
function leadStatusBadge($status)
{
    $status_clean = strtolower(trim($status));

switch ($status_clean) {

case 'pending':
            return '<span class="badge bg-warning text-dark">Pending</span>';

case 'interested':
            return '<span class="badge bg-primary">Interested</span>';

case 'no response':
            return '<span class="badge bg-secondary">No Response</span>';

case 'quotation sent':
            return '<span class="badge bg-info text-dark">Quotation Sent</span>';

case 'sales done':
            return '<span class="badge bg-success">Sales Done</span>';

case 'follow-up':
        case 'follow up':
            return '<span class="badge bg-dark">Follow-Up</span>';

default:
            return '<span class="badge bg-light text-dark">'
                 . htmlspecialchars($status) .
                 '</span>';
    }
}
*/

function callStatusBadge($status)
{
    return strtolower($status) === 'completed'
        ? '<span class="badge bg-success">Completed</span>'
        : '<span class="badge bg-danger">Incompleted</span>';
}

/* =========================
   PAGINATION
   ========================= */
$records_per_page = 50;
$current_page = isset($_GET['page']) ? max(1, intval($_GET['page'])) : 1;
$offset = ($current_page - 1) * $records_per_page;

/* =========================
   DATE PARSER
   ========================= */
function parse_user_date($s) {
    $s = trim((string)$s);
    if ($s === '') return false;

$d = DateTime::createFromFormat('Y-m-d', $s);
    if ($d) return $d;

$d = DateTime::createFromFormat('d-m-Y', $s);
    if ($d) return $d;

return false;
}

/* =========================
   FILTER INPUTS
   ========================= */
$date_from_raw   = $_GET['date_from'] ?? '';
$date_to_raw     = $_GET['date_to'] ?? '';
$calling_status  = trim($_GET['calling_status'] ?? '');
$enquiry_for     = intval($_GET['enquiry_for'] ?? 0);
$call_status     = trim($_GET['call_status'] ?? '');
$search_query    = trim($_GET['search_query'] ?? '');
$assigned_to     = intval($_GET['assigned_to'] ?? 0);

$date_from_dt = parse_user_date($date_from_raw);
$date_to_dt   = parse_user_date($date_to_raw);

$date_from_sql = $date_from_dt ? $date_from_dt->format('Y-m-d') : null;
$date_to_sql   = $date_to_dt ? $date_to_dt->format('Y-m-d') : null;

/* =========================
   DROPDOWNS DATA
   ========================= */
$work_sections = [];
$res = mysqli_query($conn, "SELECT id, section_name FROM work_sections ORDER BY section_name");
while ($r = mysqli_fetch_assoc($res)) $work_sections[] = $r;

$team_members = [];
$res = mysqli_query($conn, "SELECT id, name FROM team_members WHERE status = 1");
while ($r = mysqli_fetch_assoc($res)) $team_members[] = $r;

$calling_status_options = [
    'Pending',
    'Done',
    'No Response',
    'Interested',
    'Not Interested'
];

/* =========================
   WHERE CONDITIONS
   ========================= */
$where = [];

if ($date_from_sql && $date_to_sql) {
    $where[] = "DATE(l.lead_date) BETWEEN '$date_from_sql' AND '$date_to_sql'";
}
if ($calling_status) $where[] = "l.calling_status = '".mysqli_real_escape_string($conn,$calling_status)."'";
if ($enquiry_for > 0) $where[] = "l.enquiry_for = $enquiry_for";
if ($call_status) $where[] = "l.call_status = '".mysqli_real_escape_string($conn,$call_status)."'";
if ($assigned_to > 0) $where[] = "l.assigned_to = $assigned_to";

if ($search_query) {
    $q = mysqli_real_escape_string($conn,"%$search_query%");
    $where[] = "(l.name LIKE '$q' OR l.mobile LIKE '$q' OR l.comment LIKE '$q')";
}

$whereSQL = $where ? 'WHERE '.implode(' AND ',$where) : '';

/* =========================
   COUNT & FETCH
   ========================= */
$count_sql = "SELECT COUNT(*) total FROM leads l $whereSQL";
$total_records = mysqli_fetch_assoc(mysqli_query($conn,$count_sql))['total'];
$total_pages = ceil($total_records / $records_per_page);

$sql = "SELECT l.*, w.section_name, t.name team_name
        FROM leads l
        LEFT JOIN work_sections w ON w.id=l.enquiry_for
        LEFT JOIN team_members t ON t.id=l.assigned_to
        $whereSQL
        ORDER BY l.call_time DESC
        LIMIT $records_per_page OFFSET $offset";

$result = mysqli_query($conn,$sql);
?>

<div class="page-body">
<div class="container-fluid">
<div class="card">
<div class="card-header d-flex justify-content-between">
<h2>Lead Management</h2>
<div>
<a href="upload_leads_csv.php" class="btn btn-primary btn-sm">Upload Excel</a>
<a href="lead_add.php" class="btn btn-success btn-sm">Add Lead</a>
</div>
</div>

<div class="card-body table-responsive">
    
    
            <form method="get" class="row g-2 mb-3">
                
                
               
                <div class="col-sm-2">
                    <label>Search</label>
                    <input type="text" id="search_query" name="search_query" class="form-control"
                        placeholder="Search All Fields" value="<?= htmlspecialchars($search_query); ?>">
                </div>
              
              <div class="col-sm-1">
                <label>Date From</label>
                <input type="text" id="date_from" name="date_from" class="form-control"
                       placeholder="dd-mm-yyyy" value="<?= htmlspecialchars($date_from); ?>">
              </div>
              
              <div class="col-sm-1">
                <label>Date To</label>
                <input type="text" id="date_to" name="date_to" class="form-control"
                       placeholder="dd-mm-yyyy" value="<?= htmlspecialchars($date_to); ?>">
              </div>
              <div class="col-sm-2">
                <label>Lead Status</label>
                <select name="calling_status" class="form-select">
                  <option value="">-- All --</option>
                  <?php foreach ($calling_status_options as $opt): ?>
                    <option value="<?= $opt ?>" <?= $calling_status == $opt ? 'selected' : '' ?>><?= $opt ?></option>
                  <?php endforeach; ?>
                </select>
              </div>
              <div class="col-sm-2">
                <label>Enquiry For</label>
                <select name="enquiry_for" class="form-select">
                  <option value="0">-- All --</option>
                  <?php foreach ($work_sections as $ws): ?>
                    <option value="<?= $ws['id'] ?>" <?= $enquiry_for == $ws['id'] ? 'selected' : '' ?>>
                      <?= htmlspecialchars($ws['section_name']); ?>
                    </option>
                  <?php endforeach; ?>
                </select>
              </div>
              
              
              <div class="col-sm-2">
                <label> Team Member</label>
              
              <select name="assigned_to" class="form-select" >
<option value="">-- Select Team Member --</option>
<?php               
                    $teamMembers = mysqli_query($conn, "SELECT id, name FROM team_members  where status='1' ORDER BY name ASC");
                        mysqli_data_seek($teamMembers, 0); // Reset pointer if $teamMembers is a result object
                        while ($tm = mysqli_fetch_assoc($teamMembers)) { 
                    ?>
<option value="<?php echo $tm['id']; ?>"><?php echo htmlspecialchars($tm['name']); ?></option>
<?php } ?>
 </select>
 </div>
 
              <div class="col-sm-2">
                <label>Call Status</label>
                <select name="call_status" class="form-select">
                  <option value="">-- All --</option>
                  <option value="completed" <?= $call_status == 'completed' ? 'selected' : '' ?>>Completed</option>
                  <option value="incompleted" <?= $call_status == 'incompleted' ? 'selected' : '' ?>>Incompleted</option>
                </select>
              </div>
              <div class="col-12 text-end mt-2">
                <button type="submit" class="btn btn-info btn-sm"><i class="fa fa-filter"></i> Filter</button>
                <a href="leads.php" class="btn btn-outline-secondary btn-sm">Clear</a>
              </div>
            </form>

<th>Lead Source</th>

<th>Name</th>
<th>Mobile</th>
<th>Enquiry</th>
<th>Assign</th>
<th>Lead Status</th>
<th>Comment</th>
<th>Call Status</th>

<th>Action</th>
</tr>
</thead>
<tbody>

<?php
$sr = $offset + 1;
if ($result && mysqli_num_rows($result)):
while ($row = mysqli_fetch_assoc($result)):

$call_time = $row['call_time']
    ? date('d-m-Y h:i A',strtotime($row['call_time']))
    : '-';
?>

<td class="text-center"><?= leadStatusBadge($row['calling_status']) ?></td>
<td><?php  htmlspecialchars($row['comment']) ?></td>
<td class="text-center"><?= callStatusBadge($row['call_status']) ?></td>

<td class="text-center">
<a href="lead_edit.php?id=<?= $row['id'] ?>" class="btn btn-warning btn-sm">
<i class="fa fa-edit"></i>
</a>
<a href="lead_delete.php?id=<?= $row['id'] ?>"
onclick="return confirm('Delete lead?')"
class="btn btn-danger btn-sm">
<i class="fa fa-trash"></i>
</a>
</td>
</tr>

<?php endwhile; else: ?>
<tr><td colspan="11" class="text-center text-muted">No Leads Found</td></tr>
<?php endif; ?>

</tbody>
</table>
</div>
</div>
</div>
</div>

<?php include 'footer.php'; ?>