Zploit 0-Day Shell

:: Editing File: leads_08_01_2026.php

<?php
// ==========================================
// lead1.php — FINAL VERSION (fixed date handling)
// All Filters + Pagination + Same Page Redirect After Edit
// ==========================================

$page_title = "Leads";
include 'header.php';
include 'breadcrumb.php';
include 'menu.php';

// --- Pagination setup ---
$records_per_page = 50;
$current_page = isset($_GET['page']) ? max(1, intval($_GET['page'])) : 1;
$offset = ($current_page - 1) * $records_per_page;

// --- Helper: parse user date (accepts YYYY-MM-DD or DD-MM-YYYY) ---
function parse_user_date($s) {
    $s = trim((string)$s);
    if ($s === '') return false;
    // Try YYYY-MM-DD first (HTML5 date)
    $d = DateTime::createFromFormat('Y-m-d', $s);
    if ($d && $d->format('Y-m-d') === $s) return $d;
    // Try DD-MM-YYYY
    $d = DateTime::createFromFormat('d-m-Y', $s);
    if ($d && $d->format('d-m-Y') === $s) return $d;
    // Try generic strtotime parse as last resort
    $ts = strtotime($s);
    if ($ts !== false) return (new DateTime())->setTimestamp($ts);
    return false;
}

// --- Filters (raw inputs) ---
$date_from_raw   = $_GET['date_from'] ?? '';
$date_to_raw     = $_GET['date_to'] ?? '';
$calling_status  = trim($_GET['calling_status'] ?? '');
$enquiry_for     = intval($_GET['enquiry_for'] ?? 0);
$lead_source     = trim($_GET['lead_source'] ?? '');
$call_status     = trim($_GET['call_status'] ?? '');
// NEW FILTER: Generic Search Query
$search_query    = trim($_GET['search_query'] ?? '');
// NEW FILTER: Assigned To Team Member
$assigned_to     = intval($_GET['assigned_to'] ?? 0);

// --- Parse dates into DateTime objects (safe) ---
$date_from_dt = parse_user_date($date_from_raw);
$date_to_dt   = parse_user_date($date_to_raw);

// --- Values to use in WHERE (Y-m-d) ---
$date_from_sql = $date_from_dt ? $date_from_dt->format('Y-m-d') : null;
$date_to_sql   = $date_to_dt   ? $date_to_dt->format('Y-m-d')   : null;

// --- Value to show inside <input type="date"> (must be YYYY-MM-DD) ---
$date_from_input = $date_from_dt ? $date_from_dt->format('Y-m-d') : '';
$date_to_input   = $date_to_dt   ? $date_to_dt->format('Y-m-d')   : '';

// --- Dropdown Data ---
$work_sections = [];
$res = mysqli_query($conn, "SELECT id, section_name FROM work_sections ORDER BY section_name ASC");
while ($r = mysqli_fetch_assoc($res)) $work_sections[] = $r;

$lead_sources = [];
$res = mysqli_query($conn, "SELECT DISTINCT lead_source FROM leads WHERE lead_source <> '' ORDER BY lead_source ASC");
while ($r = mysqli_fetch_assoc($res)) $lead_sources[] = $r['lead_source'];

$calling_status_options = ['Pending','Done','No Response','Interested','Not Interested'];

// NEW DROPDOWN DATA: Active Team Members (status = 1)
$team_members = [];
$res = mysqli_query($conn, "SELECT id, name FROM team_members WHERE status = 1 ORDER BY name ASC");
while ($r = mysqli_fetch_assoc($res)) $team_members[] = $r;

// --- WHERE Conditions ---
$where = [];

// Date filters (use the parsed Y-m-d vars)
if ($date_from_sql && $date_to_sql) {
    // BETWEEN inclusive
    $where[] = "DATE(l.lead_date) BETWEEN '" . mysqli_real_escape_string($conn, $date_from_sql) . "' AND '" . mysqli_real_escape_string($conn, $date_to_sql) . "'";
} elseif ($date_from_sql) {
    $where[] = "DATE(l.lead_date) >= '" . mysqli_real_escape_string($conn, $date_from_sql) . "'";
} elseif ($date_to_sql) {
    $where[] = "DATE(l.lead_date) <= '" . mysqli_real_escape_string($conn, $date_to_sql) . "'";
}

if ($calling_status) $where[] = "l.calling_status = '" . mysqli_real_escape_string($conn, $calling_status) . "'";
if ($enquiry_for > 0) $where[] = "l.enquiry_for = " . intval($enquiry_for);
if ($lead_source) $where[] = "l.lead_source = '" . mysqli_real_escape_string($conn, $lead_source) . "'";
if ($call_status) $where[] = "l.call_status = '" . mysqli_real_escape_string($conn, $call_status) . "'";

// NEW WHERE CONDITION: Assigned To
if ($assigned_to > 0) $where[] = "l.assigned_to = " . intval($assigned_to);

// NEW: Generic Search Filter - EXPANDED
if ($search_query) {
    $search_safe = mysqli_real_escape_string($conn, "%" . $search_query . "%");
    $where[] = "(
        l.name LIKE '{$search_safe}' 
        OR l.mobile LIKE '{$search_safe}' 
        OR l.business_name LIKE '{$search_safe}'
        OR l.lead_source LIKE '{$search_safe}'
        OR l.calling_status LIKE '{$search_safe}'
        OR l.comment LIKE '{$search_safe}'
        OR l.call_status LIKE '{$search_safe}'
        OR l.lead_date LIKE '{$search_safe}'
        OR w.section_name LIKE '{$search_safe}'
        OR t.name LIKE '{$search_safe}'
    )";
}

$whereSQL = $where ? 'WHERE ' . implode(' AND ', $where) : '';

// --- Count total ---
/*$count_sql = "SELECT COUNT(l.id) AS total FROM leads l LEFT JOIN work_sections w ON w.id = l.enquiry_for $whereSQL";
$count_res = mysqli_query($conn, $count_sql);
*/

// --- Count total ---
// Added the LEFT JOIN for team_members (t) so the search filter works
$count_sql = "SELECT COUNT(l.id) AS total 
              FROM leads l 
              LEFT JOIN work_sections w ON w.id = l.enquiry_for 
              LEFT JOIN team_members t ON t.id = l.assigned_to 
              $whereSQL";
$count_res = mysqli_query($conn, $count_sql);

$total_records = ($count_res && mysqli_num_rows($count_res)) ? mysqli_fetch_assoc($count_res)['total'] : 0;
$total_pages = ceil($total_records / $records_per_page);

// --- Fetch Data ---
$sql = "SELECT l.*, w.section_name, t.name AS team_name
        FROM leads l
        LEFT JOIN work_sections w ON w.id = l.enquiry_for
        LEFT JOIN team_members t ON t.id = l.assigned_to
        $whereSQL
        ORDER BY l.call_time DESC
        LIMIT $records_per_page OFFSET $offset";
$result = mysqli_query($conn, $sql);
?>

<div class="card-header d-flex justify-content-between align-items-center">
            <h2>Lead Management</h2>
            <div>
              <a href="upload_leads_csv.php" class="btn btn-primary btn-sm"><i class="fa fa-upload"></i> Upload Excel</a>
              <a href="lead_add.php" class="btn btn-success btn-sm"><i class="fa fa-plus"></i> Add Lead</a>
            </div>
          </div>

<div class="col-sm-2">
                    <label>Search</label>
                    <input type="text" id="search_query" name="search_query" class="form-control"
                        placeholder="Search All Fields" value="<?= htmlspecialchars($search_query); ?>">
                </div>

<div class="col-sm-2">
                <label>Lead Status</label>
                <select name="calling_status" class="form-select">
                  <option value="">-- All --</option>
                  <?php foreach ($calling_status_options as $opt): ?>
                    <option value="<?= htmlspecialchars($opt) ?>" <?= $calling_status == $opt ? 'selected' : '' ?>><?= htmlspecialchars($opt) ?></option>
                  <?php endforeach; ?>
                </select>
              </div>

<div class="col-sm-2">
                <label>Enquiry For</label>
                <select name="enquiry_for" class="form-select">
                  <option value="0">-- All --</option>
                  <?php foreach ($work_sections as $ws): ?>
                    <option value="<?= intval($ws['id']) ?>" <?= $enquiry_for == $ws['id'] ? 'selected' : '' ?>>
                      <?= htmlspecialchars($ws['section_name']); ?>
                    </option>
                  <?php endforeach; ?>
                </select>
              </div>

<div class="col-sm-2">
                <label>Assign To</label>
                 <select name="assigned_to" class="form-select">
                 <option value="0">-- All --</option>
                 <?php foreach ($team_members as $member): ?>
                 <option value="<?= intval($member['id']) ?>" <?= $assigned_to == $member['id'] ? 'selected' : '' ?>>
                 <?= htmlspecialchars($member['name']); ?>
                 </option>
                 <?php endforeach; ?>
                 </select>
            </div>

<div class="col-sm-2">
                <label>Call Status</label>
                <select name="call_status" class="form-select">
                  <option value="">-- All --</option>
                  <option value="completed" <?= $call_status == 'completed' ? 'selected' : '' ?>>Completed</option>
                  <option value="incompleted" <?= $call_status == 'incompleted' ? 'selected' : '' ?>>Incompleted</option>
                </select>
              </div>

<div class="col-12 text-end mt-2">
                <button type="submit" class="btn btn-info btn-sm"><i class="fa fa-filter"></i> Filter</button>
                <a href="leads.php" class="btn btn-outline-secondary btn-sm">Clear</a>
              </div>

</form>

<div class="table-responsive">
              <table id="leadsTable" class="table table-bordered table-striped">
                <thead>
                  <tr>
                    <th>ID</th>
                    <th>Lead Date</th>
                    <th>Source</th>
                    <th>Name</th>
                    <th>Mobile</th>
                    <th>Business</th>
                    <th>Enquiry For</th>
                    <th>Assign</th>
                    <th>Lead Status</th>
                    <th>Comment</th>
                    <th>Call Status</th>
                    <th>Call Time</th>
                    <th>Action</th>
                  </tr>
                </thead>
                <tbody>
                <?php
                $sr = $offset + 1;
                if ($result && mysqli_num_rows($result) > 0):
                    while ($row = mysqli_fetch_assoc($result)):
                        $current_url = urlencode($_SERVER['REQUEST_URI']);
                        
                        date_default_timezone_set('Asia/Kolkata');
                        
                        if (!empty($row['call_time'])) {
                            try {
                                $dt = new DateTime($row['call_time'], new DateTimeZone('UTC')); 
                                $dt->setTimezone(new DateTimeZone('Asia/Kolkata'));
                                $call_time_display = $dt->format('d-m-Y h:i A');
                            } catch (Exception $e) {
                                $call_time_display = '-';
                            }
                        } else {
                            $call_time_display = '-';
                        }
    
                        echo "<tr>
                            <td>{$sr}</td>
                            <td>" . ($row['lead_date'] ? date('d-m-Y', strtotime($row['lead_date'])) : '-') . "</td>
                            <td>" . htmlspecialchars($row['lead_source']) . "</td>
                            <td>" . htmlspecialchars($row['name']) . "</td>
                            <td>" . htmlspecialchars($row['mobile']) . "</td>
                            <td>" . htmlspecialchars($row['business_name']) . "</td>
                            <td>" . htmlspecialchars($row['section_name'] ?? $row['enquiry_for']) . "</td>
                            <td>" . htmlspecialchars($row['team_name']) . "</td>
                            <td>" . htmlspecialchars($row['calling_status']) . "</td>
                            <td>" . htmlspecialchars($row['comment']) . "</td>
                            <td>" . htmlspecialchars($row['call_status']) . "</td>
                            <td>" . $call_time_display . "</td>
                            <td class='text-center'>
                                <a href='lead_edit.php?id=" . intval($row['id']) . "&return_url={$current_url}' class='btn btn-warning btn-sm'><i class='fa fa-edit'></i></a>";
                        if (isset($_SESSION['user_role']) && $_SESSION['user_role'] === 'admin') {
                            echo " <a href='lead_delete.php?id=" . intval($row['id']) . "' onclick=\"return confirm('Delete this lead?');\" class='btn btn-danger btn-sm'><i class='fa fa-trash'></i></a>";
                        }
                        echo "</td></tr>";
                        $sr++;
                    endwhile;
                else:
                    echo "<tr><td colspan='13' class='text-center text-muted'>No leads found</td></tr>";
                endif;
                ?>
                </tbody>
              </table>
            </div>

<?php if ($total_pages > 1): ?>
              <nav aria-label="Page navigation">
                <ul class="pagination justify-content-center mt-3">
                  <?php if ($current_page > 1): ?>
                    <li class="page-item">
                      <a class="page-link" href="?<?= http_build_query(array_merge($_GET, ['page' => $current_page - 1])) ?>">Previous</a>
                    </li>
                  <?php endif; ?>
                  <?php for ($i = 1; $i <= $total_pages; $i++): ?>
                    <li class="page-item <?= $i == $current_page ? 'active' : '' ?>">
                      <a class="page-link" href="?<?= http_build_query(array_merge($_GET, ['page' => $i])) ?>"><?= $i ?></a>
                    </li>
                  <?php endfor; ?>
                  <?php if ($current_page < $total_pages): ?>
                    <li class="page-item">
                      <a class="page-link" href="?<?= http_build_query(array_merge($_GET, ['page' => $current_page + 1])) ?>">Next</a>
                    </li>
                  <?php endif; ?>
                </ul>
              </nav>
            <?php endif; ?>

</div>
        </div>
      </div>
    </div>
  </div>
</div>

<link rel="stylesheet" href="https://cdn.datatables.net/1.13.6/css/jquery.dataTables.min.css">
<link rel="stylesheet" href="https://cdn.datatables.net/buttons/2.4.2/css/buttons.dataTables.min.css">
<script src="https://code.jquery.com/jquery-3.6.0.min.js"></script>
<script src="https://cdn.datatables.net/1.13.6/js/jquery.dataTables.min.js"></script>
<script src="https://cdn.datatables.net/buttons/2.4.2/js/dataTables.buttons.min.js"></script>
<script src="https://cdn.datatables.net/buttons/2.4.2/js/buttons.html5.min.js"></script>
<script src="https://cdn.datatables.net/buttons/2.4.2/js/buttons.print.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/jszip/3.10.1/jszip.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/pdfmake/0.2.7/pdfmake.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/pdfmake/0.2.7/vfs_fonts.js"></script>

<?php include('footer.php'); ?>