Zploit 0-Day Shell

:: Editing File: lead_edit_old.php

<?php
ob_start();

include 'header.php';

// ✅ Set breadcrumb variables
$page_title = "Edit Lead";
$page_parent = "Leads";
$page_parent_link = "leads.php";
include 'breadcrumb.php';
include 'menu.php';

$message = "";

// ✅ Get Lead ID
if (!isset($_GET['id']) || empty($_GET['id'])) {
    header("Location: leads.php?msg=Invalid Lead ID");
    exit;
}

$lead_id = intval($_GET['id']);

// ✅ Determine the return URL for redirect after successful update
// Check if a 'return_url' was passed in the GET request (from leads.php) or
// if it's available in the POST request (after form submission).
$return_url = '';
if (isset($_GET['return_url'])) {
    $return_url = htmlspecialchars($_GET['return_url']);
} elseif (isset($_POST['return_url'])) {
    // If the form was submitted and failed, or for the success redirect
    $return_url = htmlspecialchars($_POST['return_url']);
}

// Default redirect if no return URL is set (should include 'leads.php')
$default_redirect = 'leads.php?msg=Lead updated successfully';

// If a return_url exists, append the success message to it.
// We clean the return_url to ensure it only contains the path and query parameters
if (!empty($return_url)) {
    // Strip everything before the path, and any existing message parameter
    $parsed_url = parse_url($return_url);
    $path = $parsed_url['path'] ?? 'leads.php';
    $query = $parsed_url['query'] ?? '';
    
    // Remove any existing 'msg' parameter from the query
    $query = preg_replace('/(&|\?)msg=[^&]+/', '', $query);

// Reconstruct the URL and append the new success message
    $redirect_to = $path . '?' . $query . (empty($query) ? '' : '&') . 'msg=Lead updated successfully';
} else {
    $redirect_to = $default_redirect;
}

// ✅ Fetch Lead Data
$query = "SELECT * FROM leads WHERE id = $lead_id";
$result = mysqli_query($conn, $query);
if (mysqli_num_rows($result) === 0) {
    // We redirect to the base leads page if the lead is not found
    header("Location: leads.php?msg=Lead not found");
    exit;
}
$lead = mysqli_fetch_assoc($result);

// ✅ Handle Form Submission
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // ... (Your form processing code remains here) ...
	$lead_date = mysqli_real_escape_string($conn, $_POST['lead_date']);
    $lead_source = mysqli_real_escape_string($conn, $_POST['lead_source']);
    $name = mysqli_real_escape_string($conn, $_POST['name']);
    $mobile = mysqli_real_escape_string($conn, $_POST['mobile']);
    $location = mysqli_real_escape_string($conn, $_POST['location']);
    $email = mysqli_real_escape_string($conn, $_POST['email']);
    $business_name = mysqli_real_escape_string($conn, $_POST['business_name']);
    $enquiry_for = mysqli_real_escape_string($conn, $_POST['enquiry_for']);
    $enquiry_content = mysqli_real_escape_string($conn, $_POST['enquiry_content']);
    $comment = mysqli_real_escape_string($conn, $_POST['comment']);
    $follow_up_date = mysqli_real_escape_string($conn, $_POST['follow_up_date']);
    $calling_status = mysqli_real_escape_string($conn, $_POST['calling_status']);
    $call_status = mysqli_real_escape_string($conn, $_POST['call_status']);

$sql = "UPDATE leads SET 
                lead_date = '$lead_date',
                lead_source = '$lead_source',
                name = '$name',
                mobile = '$mobile',
                location = '$location',
                email = '$email',
                business_name = '$business_name',
                enquiry_for = '$enquiry_for',
                enquiry_content = '$enquiry_content',
                comment = '$comment',
                follow_up_date = '$follow_up_date',
                calling_status = '$calling_status',
                call_status = '$call_status',
                call_time = NOW()
            WHERE id = $lead_id";

if (mysqli_query($conn, $sql)) {
        // ✅ CHANGE: Redirect to the constructed URL with filters
        header("Location: " . $redirect_to);
        exit;
    } else {
        $message = "Error updating lead: " . mysqli_error($conn);
        // Note: If update fails, $redirect_to is still set, but we fall through to display the form.
    }
}
// ----------------------------------------------------------------------------------
// IMPORTANT: You need to add an input field to your form to pass the return URL:
// ----------------------------------------------------------------------------------
?>

<?php if ($message) echo "<div class='alert alert-danger'>$message</div>"; ?>

<form method="POST" action="">
                            <div class="row">
                                
                                <input type="hidden" name="assigned_to" class="form-control" value="<?php echo $lead['assigned_to'] ?>">
                                <input type="hidden" name="created_by" class="form-control" value="<?php echo $lead['created_by'] ?>">
                                
                                <input type="hidden" name="return_url" value="<?= htmlspecialchars($return_url) ?>">
                                
                                
                                
                                <div class="col-md-4">
                                    <label class="form-label">Name</label>
                                    <input type="text" name="name" class="form-control"
                                         value="<?= htmlspecialchars($lead['name']) ?>" required>
                                </div>

<div class="col-md-4">
                                    <label class="form-label">Mobile</label>
                                    <input type="text" name="mobile" class="form-control"
                                         value="<?= htmlspecialchars($lead['mobile']) ?>" required>
                                </div>

<div class="col-md-4">
                                    <label class="form-label">Location</label>
                                    <input type="text" name="location" class="form-control"
                                         value="<?= htmlspecialchars($lead['location']) ?>">
                                </div>
                                
                                <div class="col-md-6">
                                    <label class="form-label">Lead Date</label>
                                    <input type="date" name="lead_date" class="form-control"
                                         value="<?php echo isset($lead['lead_date']) ? date('Y-m-d', strtotime($lead['lead_date'])) : ''; ?>">
                                </div>
                                
                                
                                <div class="col-md-6">
                                    <label class="form-label">Lead Source</label>
                                    <select name="lead_source" class="form-select" required>
                                        
                                        <option value="Facebook" <?= ($lead['lead_source'] == 'Facebook') ? 'selected' : '' ?>>Facebook</option>
                                        <option value="Instagram" <?= ($lead['lead_source'] == 'Instagram') ? 'selected' : '' ?>>Instagram</option>
                                        <option value="Referral" <?= ($lead['lead_source'] == 'Referral') ? 'selected' : '' ?>>Referral</option>
                                        <option value="Others" <?= ($lead['lead_source'] == 'Others') ? 'selected' : '' ?>>Others</option>
                                    </select>
                                </div>
                                
                                <div class="col-md-6">
                                    <label class="form-label">Email</label>
                                    <input type="email" name="email" class="form-control"
                                         value="<?= htmlspecialchars($lead['email']) ?>">
                                </div>

<div class="col-md-6">
                                    <label class="form-label">Business Name</label>
                                    <input type="text" name="business_name" class="form-control"
                                         value="<?= htmlspecialchars($lead['business_name']) ?>">
                                </div>
                                
                                <div class="col-md-6">
                                    <label class="form-label">Enquiry For (Service)</label>
                                    <select name="enquiry_for" class="form-select" required>
                                        <?php
                                        $services = [
                                            'STATIC WEBSITE', 'DYNAMIC WEBSITE', 'E-COMMERCE WEBSITE', 'DIGITAL MARKETING',
                                            'GRAPHIC DESIGNING', 'VIDEO EDITING', 'SEO', 'CRM', 'BULK WHATSAPP', 'WEBSITE'
                                        ];
                                        foreach ($services as $service) {
                                            $selected = ($lead['enquiry_for'] == $service) ? 'selected' : '';
                                            echo "<option value='$service' $selected>$service</option>";
                                        }
                                        ?>
                                    </select>
                                </div>

<div class="col-md-6">
                                    <label class="form-label">Follow Up Date</label>
                                    <input type="date" name="follow_up_date" class="form-control"
                                         value="<?= htmlspecialchars($lead['follow_up_date']) ?>">
                                </div>

<div class="col-md-6 mb-3">
                                    <label class="form-label">Enquiry Content</label>
                                    <textarea name="enquiry_content" class="form-control"
                                         rows="3"><?= htmlspecialchars($lead['enquiry_content']) ?></textarea>
                                </div>

<div class="col-md-6 mb-3">
                                    <label class="form-label">Comment</label>
                                    <textarea name="comment" class="form-control"
                                         rows="3"><?= htmlspecialchars($lead['comment']) ?></textarea>
                                </div>
                                
                                <div class="col-md-6 mb-3">
                                    <label class="form-label">Call Status</label>
                                    <select name="call_status" class="form-control">
                                        <option value="Incompleted" <?= ($lead['call_status']=='Incompleted')?'selected':''; ?>>Incompleted</option>
                                        <option value="Completed" <?= ($lead['call_status']=='Completed')?'selected':''; ?>>Completed</option>
                                    </select>
                                </div>
                                
                                
                                <div class="col-md-6">
                                    <label class="form-label">Lead Status</label>
                                    <select name="calling_status" class="form-select">
                                        <?php
                                        $statuses = ['Pending', 'Done', 'No Response', 'Interested', 'Not Interested'];
                                        foreach ($statuses as $s) {
                                            $selected = ($lead['calling_status'] == $s) ? "selected" : "";
                                            echo "<option value='$s' $selected>$s</option>";
                                        }
                                        ?>
                                    </select>
                                </div>

</div>
                            <br>

<div class="text-start">
                                <button type="submit" class="btn btn-success">Update Lead</button>
                                <button type="button" onclick="history.back()" class="btn btn-secondary">Cancel</button>
                            </div>
                        </form>

</div>
                </div>
            </div>
        </div>
    </div>
</div>

<?php include 'footer.php'; ob_end_flush(); ?>