Zploit 0-Day Shell

:: Editing File: dryfruits_stock_edit.php

<?php
ob_start();
error_reporting(E_ALL);
ini_set('display_errors', 1);

include_once("session.php");
include("db.php");

$user_id = $_SESSION['user_id'];

/* ---------------- VALIDATE ID ---------------- */
$id = isset($_GET['id']) ? (int)$_GET['id'] : 0;
if ($id <= 0) {
    header("Location: dryfruits_stock_list.php");
    exit;
}

/* ---------------- FETCH CURRENT STOCK ROW ---------------- */
$stock = mysqli_fetch_assoc(mysqli_query($conn,"
    SELECT *
    FROM packaging_stock
    WHERE id = '$id'
"));

if (!$stock) {
    header("Location: dryfruits_stock_list.php");
    exit;
}

/* ---------------- PRODUCTS (DRY FRUITS = category_id 2) ---------------- */
$product_res = mysqli_query($conn,"
    SELECT id, product_name
    FROM packaging_materials
    WHERE status = 1 AND category_id = 2
    ORDER BY product_name
");

/* ---------------- VENDORS ---------------- */
$vendor_res = mysqli_query($conn,"
    SELECT id, name FROM party ORDER BY name
");

/* ---------------- UPDATE LOGIC ---------------- */
if ($_SERVER['REQUEST_METHOD'] === 'POST') {

$product_id = (int)$_POST['product_id'];
    $vendor_id  = !empty($_POST['vendor_id']) ? (int)$_POST['vendor_id'] : NULL;
    $stock_type = $_POST['stock_type'];
    $quantity   = (float)$_POST['quantity'];
    $stock_date = $_POST['stock_date'];
    $status     = (int)$_POST['status'];
    $unit_type  = mysqli_real_escape_string($conn,$_POST['unit_type']);
    $remark     = mysqli_real_escape_string($conn,$_POST['remark']);

/* ---------- GET PREVIOUS AVAILABLE STOCK ---------- */
    $prev = mysqli_fetch_assoc(mysqli_query($conn,"
        SELECT available_stock
        FROM packaging_stock
        WHERE product_id = '$product_id'
          AND status = 1
          AND id <> '$id'
        ORDER BY id DESC
        LIMIT 1
    "));

$base_stock = $prev ? (float)$prev['available_stock'] : 0;

/* ---------- RESTORE OLD ROW EFFECT ---------- */
    if ($stock['stock_type'] === 'IN') {
        $base_stock -= (float)$stock['quantity'];
    } else {
        $base_stock += (float)$stock['quantity'];
    }

/* ---------- CHECK OUT ---------- */
    if ($stock_type === 'OUT' && $quantity > $base_stock) {
        $_SESSION['error'] =
            "❌ Insufficient stock! Available: $base_stock $unit_type";
        header("Location: dryfruits_stock_edit.php?id=$id");
        exit;
    }

/* ---------- CALCULATE NEW AVAILABLE STOCK ---------- */
    $new_available_stock = ($stock_type === 'IN')
        ? $base_stock + $quantity
        : $base_stock - $quantity;

/* ---------------- UPDATE QUERY ---------------- */
    $update = "
        UPDATE packaging_stock SET
            product_id       = '$product_id',
            vendor_id        = ".($vendor_id ? "'$vendor_id'" : "NULL").",
            stock_type       = '$stock_type',
            quantity         = '$quantity',
            available_stock  = '$new_available_stock',
            unit_type        = '$unit_type',
            stock_date       = '$stock_date',
            status           = '$status',
            remark           = '$remark'
        WHERE id = '$id'
    ";

if (mysqli_query($conn,$update)) {
        $_SESSION['success'] = "✅ Stock updated successfully!";
        header("Location: dryfruits_stock_list.php");
        exit;
    } else {
        $_SESSION['error'] = mysqli_error($conn);
    }
}

include("header.php");
?>

<main>
    <div class="container-fluid">
        <div class="row m-1">
            <div class="col-12">
                <h4 class="main-title">Edit Dryfruits Stock</h4>
                <ul class="app-line-breadcrumbs mb-3">
                    <li><a href="dashboard.php">Home</a></li>
                    <li><a href="dryfruits_stock_list.php">Dryfruits Stock List</a></li>
                    <li class="active"><a href="#">Edit Dryfruits Stock</a></li>
                </ul>
            </div>
        </div>

<?php
if (!empty($_SESSION['success'])) {
    echo "<div class='alert alert-success'>{$_SESSION['success']}</div>";
    unset($_SESSION['success']);
}
if (!empty($_SESSION['error'])) {
    echo "<div class='alert alert-danger'>{$_SESSION['error']}</div>";
    unset($_SESSION['error']);
}
?>

<div class="col-md-3">
<label>Vendor</label>
<select name="vendor_id" class="form-select">
<option value="">-- Optional --</option>
<?php while ($v=mysqli_fetch_assoc($vendor_res)) { ?>
<option value="<?= $v['id']; ?>" <?= $stock['vendor_id']==$v['id']?'selected':''; ?>>
<?= htmlspecialchars($v['name']); ?>
</option>
<?php } ?>
</select>
</div>

<div class="col-md-3">
<label>Product *</label>
<select name="product_id" class="form-select" required>
<?php while ($p=mysqli_fetch_assoc($product_res)) { ?>
<option value="<?= $p['id']; ?>" <?= $stock['product_id']==$p['id']?'selected':''; ?>>
<?= htmlspecialchars($p['product_name']); ?>
</option>
<?php } ?>
</select>
</div>

<div class="col-md-3">
<label>Unit</label>
<input type="text" name="unit_type" value="<?= $stock['unit_type']; ?>" class="form-control" readonly>
</div>

<div class="col-md-3">
<label>Available Stock (After Save)</label>
<input type="text" class="form-control" value="<?= $stock['available_stock'].' '.$stock['unit_type']; ?>" readonly>
</div>

<div class="col-md-3">
<label>Quantity *</label>
<input type="number" step="0.001" name="quantity" value="<?= $stock['quantity']; ?>" class="form-control" required>
</div>

<div class="col-md-3">
<label>Stock Type</label>
<select name="stock_type" class="form-select">
<option value="IN"  <?= $stock['stock_type']=='IN'?'selected':''; ?>>IN</option>
<option value="OUT" <?= $stock['stock_type']=='OUT'?'selected':''; ?>>OUT</option>
</select>
</div>

<div class="col-md-3">
<label>Date</label>
<input type="date" name="stock_date" value="<?= $stock['stock_date']; ?>" class="form-control">
</div>

<div class="col-md-3">
<label>Status</label>
<select name="status" class="form-select">
<option value="1" <?= $stock['status']==1?'selected':''; ?>>Active</option>
<option value="0" <?= $stock['status']==0?'selected':''; ?>>Inactive</option>
</select>
</div>

<div class="col-12">
<label>Remark</label>
<textarea name="remark" class="form-control"><?= htmlspecialchars($stock['remark']); ?></textarea>
</div>

<div class="col-12">
<button class="btn btn-primary">Update</button>
<a href="dryfruits_stock_list.php" class="btn btn-secondary">Back</a>
</div>

</form>

</div>
</div>
</div>
</main>

<?php include("footer.php"); ?>
<?php ob_end_flush(); ?>