Zploit 0-Day Shell

:: Editing File: quotation_preview.php

<?php
// Suppress warnings/notices so they don't break JSON output
error_reporting(E_ALL & ~E_NOTICE & ~E_WARNING & ~E_DEPRECATED);
ini_set('display_errors', 0);

include "db.php"; // Database connection file

// ----------------------------------------------------
// 1. HANDLE AJAX POST FILE UPLOAD
// ----------------------------------------------------
if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['action']) && $_POST['action'] === 'upload_pdf') {
    
    if (ob_get_length()) ob_clean();
    header('Content-Type: application/json; charset=utf-8');

$quotation_id = isset($_POST['quotation_id']) ? intval($_POST['quotation_id']) : 0;

if ($quotation_id <= 0) {
        echo json_encode(['status' => 'error', 'message' => 'Invalid Quotation ID passed.']);
        exit;
    }

if (!isset($_FILES['pdf_file']) || $_FILES['pdf_file']['error'] !== UPLOAD_ERR_OK) {
        $uploadError = isset($_FILES['pdf_file']) ? $_FILES['pdf_file']['error'] : 'No file uploaded';
        echo json_encode(['status' => 'error', 'message' => 'File upload error code: ' . $uploadError]);
        exit;
    }

$uploadDir = __DIR__ . '/uploads/quotations/';
    
    if (!is_dir($uploadDir)) {
        if (!@mkdir($uploadDir, 0777, true)) {
            echo json_encode(['status' => 'error', 'message' => 'Failed to create upload directory on server.']);
            exit;
        }
    }

$fileName = 'quotation_' . $quotation_id . '_' . time() . '.pdf';
    $targetFilePath = $uploadDir . $fileName;
    $dbRelativePath = 'uploads/quotations/' . $fileName;

if (move_uploaded_file($_FILES['pdf_file']['tmp_name'], $targetFilePath)) {
        $escapedPath = mysqli_real_escape_string($conn, $dbRelativePath);
        
        $updateSql = "UPDATE quotation_master SET invoice_path = '$escapedPath' WHERE id = '$quotation_id'";
        
        if (mysqli_query($conn, $updateSql)) {
            echo json_encode([
                'status' => 'success', 
                'message' => 'Quotation saved successfully!', 
                'file' => $dbRelativePath
            ]);
        } else {
            echo json_encode(['status' => 'error', 'message' => 'Database error: ' . mysqli_error($conn)]);
        }
    } else {
        echo json_encode(['status' => 'error', 'message' => 'Permission denied: Failed to write PDF to server folder.']);
    }
    exit;
}

// ----------------------------------------------------
// 2. REGULAR GET REQUEST (PAGE VIEW)
// ----------------------------------------------------
$quotation_id = isset($_GET['id']) ? intval($_GET['id']) : 0;

if ($quotation_id <= 0) {
    die("Invalid Quotation ID.");
}

$master_sql = "SELECT * FROM quotation_master WHERE id = '$quotation_id' LIMIT 1";
$master_res = mysqli_query($conn, $master_sql);

if (!$master_res || mysqli_num_rows($master_res) == 0) {
    die("Quotation record not found.");
}

$master = mysqli_fetch_assoc($master_res);

$details_sql = "SELECT * FROM quotation_details WHERE quotation_id = '$quotation_id' ORDER BY id ASC";
$details_res = mysqli_query($conn, $details_sql);

$items = [];
$total_tdr_expense = 0;

while ($row = mysqli_fetch_assoc($details_res)) {
    $items[] = $row;
    if (!empty($row['total_tdr_expense'])) {
        $total_tdr_expense = floatval($row['total_tdr_expense']);
    }
}

$item_count = count($items);
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Quotation Preview - <?php echo htmlspecialchars($master['quotation_no'] ?? ''); ?></title>
    
    
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.2/dist/css/bootstrap.min.css" rel="stylesheet">
    
    <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.2/css/all.min.css">
    
    <script src="https://cdnjs.cloudflare.com/ajax/libs/html2pdf.js/0.10.1/html2pdf.bundle.min.js"></script>

.preview-toolbar {
            max-width: 210mm;
            margin: 15px auto 10px auto;
            display: flex;
            justify-content: space-between;
            align-items: center;
        }

#pdfContent {
            width: 210mm;
            box-sizing: border-box;
            padding: 8mm 12mm;
            margin: 0 auto;
            background: #ffffff;
        }

.company-header {
            border-bottom: 2px solid #333333;
            padding-bottom: 6px;
            margin-bottom: 8px;
        }

.statement-table {
            width: 100%;
            border-collapse: collapse;
            font-size: 11px;
            border: 1px solid #000000;
        }

.statement-table th, 
        .statement-table td {
            border: 1px solid #000000;
            padding: 3px 5px;
            vertical-align: middle;
        }

.statement-table th.table-title {
            text-align: center;
            font-weight: 700;
            font-size: 12.5px;
            text-transform: uppercase;
            letter-spacing: 0.5px;
            background-color: #ffffff;
            padding: 4px;
        }

.statement-table td.fw-bold, 
        .statement-table th.fw-bold {
            font-weight: 700;
        }

.section-subheading {
            text-align: center;
            font-weight: 700;
            background-color: #f2f2f2;
            padding: 3px;
        }

.text-right-amount {
            text-align: right;
            white-space: nowrap;
        }

@media print {
            body { background-color: #ffffff; margin: 0; }
            .preview-toolbar { display: none !important; }
            #pdfContent { width: 100%; padding: 0; margin: 0; }
            @page { size: A4 portrait; margin: 5mm; }
        }
    </style>
</head>
<body>

<div class="preview-toolbar">
        <a href="quotation_list.php" class="btn btn-outline-secondary btn-sm">
            <i class="fa-solid fa-arrow-left me-1"></i> Back to List
        </a>
        <div>
            <button onclick="window.print();" class="btn btn-primary btn-sm px-3 shadow-sm">
                <i class="fa-solid fa-print me-1"></i> Print Statement
            </button>
        </div>
    </div>

<div id="pdfContent">

<div class="company-header d-flex align-items-center justify-content-between">
            
            <div class="ms-3" style="width: 700px;">
                <img src="logo_quotation_sample.png" alt="Logo" class="img-fluid" crossorigin="anonymous" style="width: 700px;">
            </div>
        </div>

<table class="statement-table">
            <thead>
                <tr>
                    <th colspan="<?php echo 2 + $item_count; ?>" class="table-title">
                        STATEMENT OF STAMP DUTY
                    </th>
                </tr>
            </thead>
            <tbody>
                <tr>
                    <td class="fw-bold" style="width: 32%;">Developer Name</td>
                    <td colspan="<?php echo $item_count + 1; ?>" class="fw-bold">
                        <?php echo htmlspecialchars($master['developer_name'] ?? ''); ?>
                    </td>
                </tr>

<tr>
                    <td class="fw-bold">Project Location</td>
                    <td colspan="<?php echo $item_count + 1; ?>" class="fw-bold">
                        <?php echo htmlspecialchars($master['project_location'] ?? ''); ?>
                    </td>
                </tr>

<tr>
                    <td class="fw-bold">Particulars</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="fw-bold text-center">Amount (Rs.)</td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td>Site Ready Reckoner Rate</td>
                    <td class="text-center text-muted">(Sq. Mtr.)</td>
                    <?php foreach ($items as $item): ?>
                        <td class="text-right-amount">₹<?php echo number_format($item['ready_reckoner_rate'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td>Quantity</td>
                    <td class="text-center text-muted">(Sq. Mtr.)</td>
                    <?php foreach ($items as $item): ?>
                        <td class="text-right-amount"><?php echo number_format($item['quantity'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td>Premium Rate</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="text-right-amount"><?php echo number_format($item['premium_rate'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td class="fw-bold">MRP After Premium</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="fw-bold text-right-amount">₹<?php echo number_format($item['mrp_after_premium'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td class="fw-bold">Agreement Value</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="fw-bold text-right-amount">₹<?php echo number_format($item['agreement_value'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td class="fw-bold">Separate Cheque against bill</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="fw-bold text-right-amount">₹<?php echo number_format($item['separate_cheque'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td class="fw-bold">Total Amount Payable</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="fw-bold text-right-amount">₹<?php echo number_format($item['total_amount_payable'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <th colspan="<?php echo 2 + $item_count; ?>" class="section-subheading">Other Expenses:</th>
                </tr>

<tr>
                    <td>Deed of Transfer Stamp Duty (R/Off)</td>
                    <td class="text-center">3%</td>
                    <?php foreach ($items as $item): ?>
                        <td class="text-right-amount">₹<?php echo number_format($item['stamp_duty'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td>Registration Charges (Max Rs.30,000) (R/Off)</td>
                    <td class="text-center">1%</td>
                    <?php foreach ($items as $item): ?>
                        <td class="text-right-amount">₹<?php echo number_format($item['registration_charge'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td>Power Of Attorney Stamp Duty</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="text-right-amount">₹<?php echo number_format($item['power_of_attorney'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td>Document Handling Charges</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="text-right-amount">₹<?php echo number_format($item['document_charge'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td>Advocate Fees</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="text-right-amount">₹<?php echo number_format($item['advocate_fee'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td>Brokerage @ 1%</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="text-right-amount">₹<?php echo number_format($item['brokerage'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td class="fw-bold">Total Other Expenses</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="fw-bold text-right-amount">₹<?php echo number_format($item['total_other_expense'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td class="fw-bold">Grand Total</td>
                    <td></td>
                    <?php foreach ($items as $item): ?>
                        <td class="fw-bold text-right-amount">₹<?php echo number_format($item['grand_total'] ?? 0, 2); ?></td>
                    <?php endforeach; ?>
                </tr>

<tr>
                    <td colspan="<?php echo 1 + $item_count; ?>" class="fw-bold text-uppercase">Total Expenses of TDR</td>
                    <td class="fw-bold text-right-amount">
                        ₹<?php 
                            if ($total_tdr_expense > 0) {
                                echo number_format($total_tdr_expense, 2);
                            } else {
                                $calculated_sum = array_sum(array_column($items, 'grand_total'));
                                echo number_format($calculated_sum, 2);
                            }
                        ?>
                    </td>
                </tr>
            </tbody>
        </table>

</div>

function generateAndSavePDFDirect() {
        const element = document.getElementById('pdfContent');

const opt = {
            margin:       [4, 4, 4, 4],
            filename:     'Quotation_<?php echo $quotation_id; ?>.pdf',
            image:        { type: 'jpeg', quality: 0.98 },
            html2canvas:  { scale: 2, useCORS: true, logging: false },
            jsPDF:        { unit: 'mm', format: 'a4', orientation: 'portrait' }
        };

html2pdf().set(opt).from(element).output('blob').then(function(pdfBlob) {
            let formData = new FormData();
            formData.append('action', 'upload_pdf');
            formData.append('quotation_id', '<?php echo $quotation_id; ?>');
            formData.append('pdf_file', pdfBlob, 'Quotation_<?php echo $quotation_id; ?>.pdf');

fetch('quotation_preview.php', {
                method: 'POST',
                body: formData
            })
            .then(async response => {
                const text = await response.text();
                if (!response.ok) {
                    throw new Error(`Server Error (${response.status}): ${text}`);
                }
                return JSON.parse(text);
            })
            .then(data => {
                window.parent.postMessage(data, '*');
            })
            .catch(error => {
                window.parent.postMessage({ status: 'error', message: error.message }, '*');
            });
        });
    }
    </script>

</body>
</html>