Zploit 0-Day Shell

:: Editing File: po_list.php

<?php
error_reporting(E_ALL);
ini_set('display_errors', '1');

include_once("session.php");
include("header.php");
include("db.php");
?>
<link href="assets/vendor/datatable/jquery.dataTables.min.css" rel="stylesheet" type="text/css">

<div class="row m-1">
        <div class="col-9">
            <h4 class="main-title">Purchase Orders</h4>
            <ul class="app-line-breadcrumbs mb-3">
                <li class="active">
                    <a class="f-s-14 f-w-500" href="dashboard.php">
                        <i class="ph-duotone ph-bank f-s-16"></i> Home
                    </a>
                </li>
                <li class="active">
                    <a class="f-s-14 f-w-500" href="#">Purchase Orders</a>
                </li>
            </ul>
        </div>
        <div class="col-3">
            <a href="add_po.php" class="btn btn-primary" style="float: right;">Add Purchase Order</a>
        </div>
    </div>
    <div class="row">
        <div class="col-12">
            <div class="card">
                <div class="card-body p-0">
                    <div class="app-datatable-default overflow-auto">

<table class="display app-data-table default-data-table" id="example2">
    <thead>
        <tr>
            <th>PO No</th>
            <th>PO Date</th>
            <th>Vendor Name</th>
            <th>Billing Company</th>
            <th>Total Amount</th>
            <th>PO</th>
            <th>Actions</th>
        </tr>
    </thead>
    <tbody>
        <?php
        // ⚠️ Updated query to fetch data from the 'purchase' table and related tables
        $sql = "SELECT p.id,
                       p.po_no,
                       p.po_date,
                       p.grand_total,
                       p.remark,
					   p.purchase_receipt,
                       p.po_contact_ref,
					   p.po_status,
                       v.name AS vendor_name,
                       b.company_name AS billing_name
                FROM purchase AS p
                LEFT JOIN party AS v ON p.vendor_id = v.id
                LEFT JOIN billing AS b ON p.billing_id = b.id
                ORDER BY p.id DESC";

$result = mysqli_query($conn, $sql);

if (mysqli_num_rows($result) > 0) {
            while ($row = mysqli_fetch_assoc($result)) {
                echo "<tr>";
                echo "<td>".htmlspecialchars($row['po_no'])."</td>";
                echo "<td>".date('d-m-Y', strtotime($row['po_date']))."</td>";
                echo "<td>".htmlspecialchars($row['vendor_name'] ?? '')."</td>";
                echo "<td>".htmlspecialchars($row['billing_name'])."</td>";
                echo "<td>".number_format((float)$row['grand_total'],2)."</td>";
                echo "<td>".htmlspecialchars($row['po_status'])."</td>";
                echo "<td>";
                
                if (!empty($row['purchase_receipt'])) {
                    echo "
                        <a target='_blank' href='".$row['purchase_receipt']."' 
                           class='btn btn-light-danger icon-btn b-r-4'>
                            <i class='ti ti-file text-danger' aria-hidden='true'></i>
                        </a> ";
                }

echo "
                    <a target='_blank' href='print_po2_invoice.php?id=".$row['id']."' 
                       class='btn btn-light-success icon-btn b-r-4' title='Print/View PO'>
                        <i class='ti ti-printer text-success'></i>
                    </a>

<a href='delete_po.php?id=".$row['id']."' 
                       class='btn btn-light-danger icon-btn b-r-4' title='Delete PO'
                       onclick=\"return confirm('Are you sure you want to delete this Purchase Order?');\">
                        <i class='ti ti-trash text-danger'></i>
                    </a>";
                echo "</td>";

echo "</tr>";
            }
        } else {
            echo "<tr><td colspan='6' class='text-center'>No Purchase Orders found</td></tr>";
        }
        ?>
    </tbody>
</table>

</div>
                </div>
            </div>
        </div>
    </div>
    </div>
</main>

<?php include "footer.php"; ?>