Zploit 0-Day Shell

:: Editing File: stock_report.php

<?php
error_reporting(E_ALL);
ini_set('display_errors', 1);

include_once("session.php");
include("db.php");
include("header.php");

/* ================= FILTER ================= */
$where = "WHERE sm.status = 1";

if (!empty($_GET['from_date'])) {
    $where .= " AND sm.movement_date >= '{$_GET['from_date']}'";
}
if (!empty($_GET['to_date'])) {
    $where .= " AND sm.movement_date <= '{$_GET['to_date']}'";
}
if (!empty($_GET['product_id'])) {
    $where .= " AND sm.product_id = '{$_GET['product_id']}'";
}
if (!empty($_GET['vendor_id'])) {
    $where .= " AND sm.vendor_id = '{$_GET['vendor_id']}'";
}
if (!empty($_GET['movement_type'])) {
    $where .= " AND sm.movement_type = '{$_GET['movement_type']}'";
}

/* ================= LIST QUERY ================= */
$sql = "
SELECT 
    sm.id,
    sm.movement_type,
    sm.movement_date,

pm.product_name,
    p.name AS vendor_name,

sb.box_4H, sb.box_5H, sb.box_6H, sb.box_7H,
    sb.box_8H, sb.box_9H, sb.box_10H, sb.box_CL,
    sb.total_box

FROM stock_movements sm
JOIN packaging_materials pm ON pm.id = sm.product_id
LEFT JOIN party p ON p.id = sm.vendor_id
LEFT JOIN stock_movement_boxes sb ON sb.movement_id = sm.id
$where
ORDER BY sm.movement_date DESC, sm.id DESC
";
$result = mysqli_query($conn, $sql);

/* ================= AVAILABLE STOCK ================= */
$stockSql = "
SELECT
SUM(CASE WHEN sm.movement_type='IN' THEN sb.box_4H ELSE -sb.box_4H END)  AS box_4H,
SUM(CASE WHEN sm.movement_type='IN' THEN sb.box_5H ELSE -sb.box_5H END)  AS box_5H,
SUM(CASE WHEN sm.movement_type='IN' THEN sb.box_6H ELSE -sb.box_6H END)  AS box_6H,
SUM(CASE WHEN sm.movement_type='IN' THEN sb.box_7H ELSE -sb.box_7H END)  AS box_7H,
SUM(CASE WHEN sm.movement_type='IN' THEN sb.box_8H ELSE -sb.box_8H END)  AS box_8H,
SUM(CASE WHEN sm.movement_type='IN' THEN sb.box_9H ELSE -sb.box_9H END)  AS box_9H,
SUM(CASE WHEN sm.movement_type='IN' THEN sb.box_10H ELSE -sb.box_10H END) AS box_10H,
SUM(CASE WHEN sm.movement_type='IN' THEN sb.box_CL ELSE -sb.box_CL END)  AS box_CL,
SUM(CASE WHEN sm.movement_type='IN' THEN sb.total_box ELSE -sb.total_box END) AS total_box
FROM stock_movements sm
JOIN stock_movement_boxes sb ON sb.movement_id = sm.id
$where
";
$available = mysqli_fetch_assoc(mysqli_query($conn, $stockSql));
?>

<main>
    <div class="container-fluid">
        
        <div class="row m-1">
            <div class="col-9">
                <h4 class="main-title">Stock Movement List</h4>
                <ul class="app-line-breadcrumbs mb-3">
                    <li>
                        <a class="f-s-14 f-w-500" href="dashboard.php">
                            <i class="ph-duotone ph-bank f-s-16"></i> Home
                        </a>
                    </li>
                    <li class="active">
                        <a class="f-s-14 f-w-500" href="#">Stock List</a>
                    </li>
                </ul>
            </div>
    
            <div class="col-3">
                <a href="stock_add.php" class="btn btn-primary" style="float:right;">Add Stock Movement</a>
            </div>
        </div>

<form method="GET" class="card mb-3">
<div class="card-body row g-3">

<div class="col-md-3">
<label>Product</label>
<select name="product_id" class="form-select">
<option value="">-- All Products --</option>
<?php
$p = mysqli_query($conn,"SELECT id,product_name FROM packaging_materials WHERE status=1 AND category_id='3'");
while($r=mysqli_fetch_assoc($p)){
    $sel = ($_GET['product_id'] ?? '')==$r['id']?'selected':'';
    echo "<option value='{$r['id']}' $sel>{$r['product_name']}</option>";
}
?>
</select>
</div>

<div class="col-md-3">
<label>Vendor</label>
<select name="vendor_id" class="form-select">
<option value="">-- All Vendors --</option>
<?php
$v = mysqli_query($conn,"SELECT id,name FROM party WHERE type='Vendor'");
while($r=mysqli_fetch_assoc($v)){
    $sel = ($_GET['vendor_id'] ?? '')==$r['id']?'selected':'';
    echo "<option value='{$r['id']}' $sel>{$r['name']}</option>";
}
?>
</select>
</div>

<div class="col-md-2">
<label>Stock Type</label>
<select name="movement_type" class="form-select">
<option value="">-- IN / OUT --</option>
<option value="IN"  <?= (@$_GET['movement_type']=='IN')?'selected':'' ?>>IN</option>
<option value="OUT" <?= (@$_GET['movement_type']=='OUT')?'selected':'' ?>>OUT</option>
</select>
</div>

<div class="col-md-1 d-flex align-items-end">
<button class="btn btn-success w-100">Filter</button>
</div>

<div class="col-md-1 d-flex align-items-end">
<a href="stock_list.php" class="btn btn-secondary w-100">Clear</a>
</div>

</div>
</form>

<div class="card">
<div class="card-body table-responsive">

<table id="stockTable" class="display table table-striped">
<thead>
<tr>
<th>#</th>
<th>Date</th>
<th>Product</th>
<th>Vendor</th>
<th>Type</th>
<th>4H</th>
<th>5H</th>
<th>6H</th>
<th>7H</th>
<th>8H</th>
<th>9H</th>
<th>10H</th>
<th>CL</th>
<th>Total</th>

</tr>
</thead>

</tr>
<?php } ?>
</tbody>

<tfoot>
        <tr>
            <th>TOTAL</th>
             <th></th>
            <th></th>
            <th></th>
            <th></th>
            <th><?= $available['box_4H'] ?></th>
            <th><?= $available['box_5H'] ?></th>
            <th><?= $available['box_6H'] ?></th>
            <th><?= $available['box_7H'] ?></th>
            <th><?= $available['box_8H'] ?></th>
            <th><?= $available['box_9H'] ?></th>
            <th><?= $available['box_10H'] ?></th>
            <th><?= $available['box_CL'] ?></th>
            <th><?= $available['total_box'] ?></th>
            
        </tr>
        </tfoot>
                
</table>

</table>

</div>
</div>

<div class="container salert">
<div class="row mt-3">
<div class="col-md-2"><div class="alert alert-success">4H Available : <?= $available['box_4H'] ?></div></div>

<div class="col-md-2"><div class="alert alert-success">5H Available : <?= $available['box_5H'] ?></div></div>
<div class="col-md-2"><div class="alert alert-success">6H Available : <?= $available['box_6H'] ?></div></div>
<div class="col-md-2"><div class="alert alert-success">7H Available : <?= $available['box_7H'] ?></div></div>
<div class="col-md-2"><div class="alert alert-success">8H Available : <?= $available['box_8H'] ?></div></div>
<div class="col-md-2"><div class="alert alert-success">9H Available : <?= $available['box_9H'] ?></div></div>
<div class="col-md-2"><div class="alert alert-success">10H Available : <?= $available['box_10H'] ?></div></div>
<div class="col-md-2"><div class="alert alert-success">CL Available : <?= $available['box_CL'] ?></div></div>

<div class="col-md-8"><div class="alert alert-primary text-center">
<strong>Total Stock Available : <?= $available['total_box'] ?></strong></div>
</div>
</div>
</div>
</main>

<?php include("footer.php"); ?>

<link rel="stylesheet" href="https://cdn.datatables.net/buttons/2.4.2/css/buttons.dataTables.min.css">
<script src="https://cdn.datatables.net/1.13.6/js/jquery.dataTables.min.js"></script>
<script src="https://cdn.datatables.net/buttons/2.4.2/js/dataTables.buttons.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/pdfmake/0.2.7/pdfmake.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/pdfmake/0.2.7/vfs_fonts.js"></script>
<script src="https://cdn.datatables.net/buttons/2.4.2/js/buttons.html5.min.js"></script>

// ðŸ“— EXCEL
            {
                extend: 'excelHtml5',
                footer: true,
                title: ' Fruits  Report'
            },

// ðŸ“„ CSV
            {
                extend: 'csvHtml5',
                footer: true,
                title: '  Fruits  Report'
            },

// ðŸ§¾ PDF
            {
                extend: 'pdfHtml5',
                footer: true,
                title: '  Fruits  Report',
                orientation: 'landscape',
                pageSize: 'A4',
                customize: function (doc) {

// Center align
                    doc.styles.tableHeader.alignment = 'center';

// Bold TOTAL row
                    let rowCount = doc.content[1].table.body.length;
                    doc.content[1].table.body[rowCount - 1].forEach(function(cell){
                        cell.bold = true;
                    });
                }
            }
        ]
    });

});
</script>