nok/wms-app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Complete security audit fixes

Browse Source
This commit is contained in:
Thanakorn S
2026-03-09 14:31:39 +07:00
parent 93d903c4b2
commit 7cb78d013b
33 changed files with 317 additions and 313 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/assets/js/custom.js
+6 -1
View File
@@ -235,7 +235,12 @@ function ajax_request(options) {
dataType: "json",
// These two settings are only triggered when sending files
processData: isSendingFiles ? false : true,
contentType: isSendingFiles ? false : "application/x-www-form-urlencoded; charset=UTF-8"
contentType: isSendingFiles ? false : "application/x-www-form-urlencoded; charset=UTF-8",
// for CSRF validation
headers: {
'X-CSRF-TOKEN': $('meta[name="csrf-token"]').attr('content')
}
})
.then(function (res) {
app/assets/utils/db_auth.php
+88 -22
View File
@@ -3,18 +3,94 @@
require_once __DIR__."/../../config.php";
require_once __DIR__."/../../dbconn.php";
/**
* Check PDO statement for errors
* Logs full error server-side, returns generic message to client
*
* @param PDOStatement $sth - The executed PDO statement
* @param array &$answer - Response array passed by reference
* @param array $options - Optional settings:
* 'message' => Custom client-facing error message
* 'log' => Custom server log label
* 'code' => HTTP response code (default: 500)
* 'before_exit' => Callback function before exit
*
* @example
* // Simple — use all defaults
* db_check($sth, $answer);
*
* @example
* // Custom client message
* db_check($sth, $answer, [
* 'message' => "Contact not found."
* ]);
*
* @example
* // Custom log label + message
* db_check($sth, $answer, [
* 'log' => "Failed to fetch contact",
* 'message' => "Could not load contact. Please try again."
* ]);
*
* @example
* // Custom HTTP status code
* db_check($sth, $answer, [
* 'code' => 403,
* 'message' => "Access denied."
* ]);
*
* @example
* // Cleanup callback before exit
* db_check($sth, $answer, [
* 'message' => "Upload failed.",
* 'before_exit' => function() use ($tmp_file) {
* if(file_exists($tmp_file)) unlink($tmp_file);
* }
* ]);
*/
function db_check($sth, &$answer, $options = []) {
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$trace = debug_backtrace()[0];
$log_message = $options['log'] ?? "DB Error";
error_log($log_message . " in " . $trace['file'] . " line " . $trace['line'] . ": " . $sth->errorInfo()[2]);
$answer["message"] = $options['message'] ?? "A server error occurred. Please try again.";
http_response_code($options['code'] ?? 500);
if(isset($options['before_exit'])) {
call_user_func($options['before_exit']);
}
exit(json_encode($answer));
}
}
if(!empty($_SESSION["login_company_id"])){
// CSRF Validation — add right at the top of the logged-in block
if($_SERVER['REQUEST_METHOD'] === 'POST'){
$csrf_token = $_SERVER['HTTP_X_CSRF_TOKEN'] ?? '';
if(empty($csrf_token) || $csrf_token !== $_SESSION['csrf_token']){
http_response_code(403);
exit(json_encode(["message" => "Invalid request"]));
}
}
// validate otp
$sql = "SELECT `password`
FROM user
WHERE user_id = {$_SESSION["login_user_id"]}";
WHERE user_id = :company_id";
$sth = $pdo1->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $_SESSION["login_user_id"]
]);
db_check($sth, $answer);
$password = $sth->fetchColumn();
/** Generate OTP */
function generateOTP($sercet_key, $time_step = 180, $length = 6){
@@ -35,13 +111,13 @@ if(!empty($_SESSION["login_company_id"])){
}
// check company accessibily
$sql = "SELECT * FROM company_map_user WHERE company_id = {$_SESSION["login_company_id"]} and user_id = {$_SESSION["login_user_id"]}";
$sql = "SELECT * FROM company_map_user WHERE company_id = :login_company_id and user_id = :login_user_id";
$sth = $pdo1->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":login_company_id" => $_SESSION["login_company_id"],
":login_user_id" => $_SESSION["login_user_id"]
]);
db_check($sth, $answer);
$map = $sth->fetchAll(PDO::FETCH_ASSOC);
if( count($map)==0 ){
@@ -51,10 +127,6 @@ if(!empty($_SESSION["login_company_id"])){
}
// set up ANSWER
$answer = array("success"=>0, "message"=>"");
@@ -85,11 +157,5 @@ if(!empty($_SESSION["login_company_id"])){
"login" => date('Y-m-d H:i:s', $_SESSION["otpTime"])
);
}
class db_auth{
}
?>
app/assets/utils/module/mailer.php
+4 -2
View File
@@ -34,10 +34,12 @@ class mailer{
return $input["smtp"];
}
$sql = "SELECT * FROM smtp_setting WHERE company_id = '{$revise["company_id"]}'";
$sql = "SELECT * FROM smtp_setting WHERE company_id = :company_id ";
$sth = $this->pdo2->prepare("$sql");
$sth->execute();
$sth->execute([
":company_id" => $revise["company_id"]
]);
$res = $sth->fetch(PDO::FETCH_ASSOC);
app/contact/api/engine/contact.php
+5 -7
View File
@@ -1,19 +1,17 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$sql = "SELECT *
FROM md_contact
WHERE
company_id = {$company_id}";
company_id = :company_id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetchAll(PDO::FETCH_ASSOC);
$answer["success"] = 1;
app/contact/api/engine/contact_type.php
+5 -7
View File
@@ -1,19 +1,17 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$sql = "SELECT *
FROM md_contact_type
WHERE
company_id = {$company_id}";
company_id = :company_id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetchAll(PDO::FETCH_ASSOC);
$answer["success"] = 1;
app/contact/api/engine/manage_contact.php
+36 -6
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -67,20 +66,51 @@
/** 3. PROCESSING NEW UPLOADS **/
$uploaded_names = [];
// Allowed MIME types whitelist
$allowed_mimes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp', 'application/pdf'];
// Allowed extensions whitelist
$allowed_extensions = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'pdf'];
// Max file size: 5MB
$max_size = 5 * 1024 * 1024;
if (isset($_FILES['contact_files'])) {
foreach ($_FILES['contact_files']['name'] as $key => $name) {
if ($_FILES['contact_files']['error'][$key] === UPLOAD_ERR_OK) {
$tmp_name = $_FILES['contact_files']['tmp_name'][$key];
$extension = pathinfo($name, PATHINFO_EXTENSION);
$tmp_name = $_FILES['contact_files']['tmp_name'][$key];
$file_size = $_FILES['contact_files']['size'][$key];
$extension = strtolower(pathinfo($name, PATHINFO_EXTENSION));
// Assign a unique ID to prevent filename collisions on the server
$file_id = uniqid() . "_" . time() . "." . $extension;
// Check 1: File size
if ($file_size > $max_size) {
error_log("Rejected oversized file: " . $name);
continue;
}
// Check 2: Extension whitelist
if (!in_array($extension, $allowed_extensions)) {
error_log("Rejected extension: " . $name);
continue;
}
// Check 3: Real MIME type (reads actual file bytes, not filename)
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $tmp_name);
finfo_close($finfo);
if (!in_array($mime, $allowed_mimes)) {
error_log("Rejected MIME type: " . $mime . " for file: " . $name);
continue;
}
// Safe unique filename — no original extension trusted
$file_id = uniqid() . "_" . time() . "." . $extension;
$destination = $target_dir . $file_id;
if (move_uploaded_file($tmp_name, $destination)) {
$uploaded_names[] = $file_id;
// Standard readable permission
chmod($destination, 0644);
} else {
error_log("Failed to move uploaded file: " . $name);
app/contact/api/engine/manage_contact_type.php
-1
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
app/contact/api/engine/retrieve_contact.php
+7 -8
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -9,15 +8,15 @@
$sql = "SELECT *
FROM md_contact
WHERE
company_id = {$company_id} and
id = {$id}";
company_id = :company_id and
id = :id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":id" => $id
]);
db_check($sth, $answer);
$target_dir = $include_url."uploads/contact/";
app/contact/api/engine/retrieve_contact_type.php
+7 -8
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -9,15 +8,15 @@
$sql = "SELECT *
FROM md_contact_type
WHERE
company_id = {$company_id} and
id = {$id}";
company_id = :company_id and
id = :id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":id" => $id
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetch(PDO::FETCH_ASSOC);
$answer["success"] = 1;
app/ics/api/engine/product_search.php
+7 -8
View File
@@ -1,22 +1,21 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$sql = "SELECT *
FROM md_product
WHERE
company_id = {$company_id} and
sku like '%{$data["keyword"]}%'
company_id = :company_id and
sku like :keyword
LIMIT 50
";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":keyword" => '%'.$data["keyword"].'%'
]);
db_check($sth, $answer);
$result = $sth->fetchAll(PDO::FETCH_ASSOC);
$answer["result"] = $result;
app/ics/api/engine/retrieve_aisle.php
+9 -9
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -10,17 +9,18 @@
$sql = "SELECT *
FROM md_storage
WHERE
company_id = {$company_id} and
warehouse = {$warehouse} and
`zone` = '{$data["zone"]}'
company_id = :company_id and
warehouse = :warehouse and
`zone` = :zone
";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":warehouse" => $warehouse,
":zone" => $data["zone"]
]);
db_check($sth, $answer);
$pre = $sth->fetchAll(PDO::FETCH_ASSOC);
app/ics/api/engine/retrieve_rack.php
+11 -10
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -10,18 +9,20 @@
$sql = "SELECT *
FROM md_storage
WHERE
company_id = {$company_id} and
warehouse = {$warehouse} and
`zone` = '{$data["zone"]}' and
'{$data["aisle"]}' between aisle_from and aisle_to
company_id = :company_id and
warehouse = :warehouse and
`zone` = :zone and
:aisle between aisle_from and aisle_to
";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":warehouse" => $warehouse,
":zone" => $data["zone"],
":aisle" => $data["aisle"]
]);
db_check($sth, $answer);
$pre = $sth->fetchAll(PDO::FETCH_ASSOC);
app/ics/api/engine/retrieve_zone.php
+5 -6
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -14,11 +13,11 @@
warehouse = {$warehouse}";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":warehouse" => $warehouse
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetchAll(PDO::FETCH_ASSOC);
$answer["success"] = 1;
app/include_header.php
+1
View File
@@ -4,6 +4,7 @@
<head>
<meta charset="UTF-8" />
<title>ThreeWMS</title>
<meta name="csrf-token" content="<?= htmlspecialchars($_SESSION['csrf_token'] ?? '') ?>">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="apple-touch-icon" sizes="180x180" href="<?php echo $server_url?>assets/images/apple-touch-icon.png">
<link rel="icon" type="image/png" sizes="32x32" href="<?php echo $server_url?>assets/images/favicon-32x32.png">
app/inventory/api/engine/manage_category.php
+8 -8
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -10,14 +9,15 @@
$sql = "SELECT `log`
FROM md_product_category
WHERE
company_id = {$company_id} and
id = {$id}";
company_id = :company_id and
id = :id";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":id" => $id
]);
db_check($sth, $answer);
$row = $sth->fetch(PDO::FETCH_ASSOC);
$table_log = json_decode($row['log'] ?? '[]', true);
app/inventory/api/engine/manage_product.php
+8 -8
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -10,14 +9,15 @@
$sql = "SELECT `log`
FROM md_product
WHERE
company_id = {$company_id} and
id = {$id}";
company_id = :company_id and
id = :id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":id" => $id
]);
db_check($sth, $answer);
$row = $sth->fetch(PDO::FETCH_ASSOC);
$table_log = json_decode($row['log'] ?? '[]', true);
app/inventory/api/engine/manage_storage.php
+3 -9
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)($data['id'] ?? 0);
@@ -17,10 +16,8 @@ $sth->execute([
':id' => $id,
]);
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
db_check($sth, $answer);
$row = $sth->fetch(PDO::FETCH_ASSOC);
$table_log = json_decode($row['log'] ?? '[]', true);
@@ -89,10 +86,7 @@ if ($id > 0) {
]);
}
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
db_check($sth, $answer);
$answer["success"] = 1;
exit(json_encode($answer));
app/inventory/api/engine/manage_warehouse.php
+3 -9
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)($data['id'] ?? 0);
@@ -17,10 +16,8 @@ $sth->execute([
':id' => $id,
]);
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
db_check($sth, $answer);
$row = $sth->fetch(PDO::FETCH_ASSOC);
$table_log = json_decode($row['log'] ?? '[]', true);
@@ -76,10 +73,7 @@ if ($id > 0) {
}
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
db_check($sth, $answer);
$answer["success"] = 1;
exit(json_encode($answer));
app/inventory/api/engine/manager.php
+2 -7
View File
@@ -1,19 +1,14 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$sql = "SELECT *
FROM user
WHERE
username not in ('support','extra')";
$sth = $pdo1->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth = $pdo1->query($sql);
db_check($sth, $answer);
$answer["output"] = $sth->fetchAll(PDO::FETCH_ASSOC);
$answer["success"] = 1;
app/inventory/api/engine/product.php
+4 -6
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$sql = "SELECT *
@@ -9,11 +8,10 @@
WHERE
company_id = {$company_id}";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetchAll(PDO::FETCH_ASSOC);
$answer["success"] = 1;
app/inventory/api/engine/product_category.php
+4 -6
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$sql = "SELECT *
@@ -9,11 +8,10 @@
WHERE
company_id = {$company_id}";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetchAll(PDO::FETCH_ASSOC);
$answer["success"] = 1;
app/inventory/api/engine/remove_category.php
+21 -21
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -10,14 +9,14 @@
$sql = "SELECT *
FROM md_product_category
WHERE
company_id = {$company_id} and
id = {$id}";
company_id = :company_id and
id = :id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":id" => $id
]);
db_check($sth, $answer);
$json = $sth->fetch(PDO::FETCH_ASSOC);
$json = json_encode($json);
@@ -26,25 +25,26 @@
// delete data
$sql = "DELETE FROM md_product_category
WHERE
company_id = {$company_id} and
id = {$id}";
company_id = :company_id and
id = :id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $id,
":id" => $id
]);
db_check($sth, $answer);
// insert into archive
$sql = "INSERT INTO archive (`company_id`,`user_id`,`date`,`json`) VALUES ({$company_id},{$user_id},NOW(),'{$jsona}')";
$sql = "INSERT INTO archive (`company_id`,`user_id`,`date`,`json`) VALUES (:company_id,:user_id,NOW(),:json)";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":user_id" => $user_id,
":json" => $json
]);
db_check($sth, $answer);
app/inventory/api/engine/retrieve_category.php
+7 -8
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -9,15 +8,15 @@
$sql = "SELECT *
FROM md_product_category
WHERE
company_id = {$company_id} and
id = {$id}";
company_id = :company_id and
id = :id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":id" => $id
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetch(PDO::FETCH_ASSOC);
$answer["success"] = 1;
app/inventory/api/engine/retrieve_product.php
+7 -8
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -9,15 +8,15 @@
$sql = "SELECT *
FROM md_product
WHERE
company_id = {$company_id} and
id = {$id}";
company_id = :company_id and
id = :id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":id" => $id
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetch(PDO::FETCH_ASSOC);
$answer["success"] = 1;
app/inventory/api/engine/retrieve_storage.php
+7 -8
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -9,15 +8,15 @@
$sql = "SELECT *
FROM md_storage
WHERE
company_id = {$company_id} and
id = {$id}";
company_id = :company_id and
id = :id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":id" => $id
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetch(PDO::FETCH_ASSOC);
$answer["success"] = 1;
app/inventory/api/engine/retrieve_warehouse.php
+7 -8
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$id = (int)$data['id'];
@@ -9,15 +8,15 @@
$sql = "SELECT *
FROM md_warehouse
WHERE
company_id = {$company_id} and
id = {$id}";
company_id = :company_id and
id = :id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id,
":id" => $id
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetch(PDO::FETCH_ASSOC);
$answer["success"] = 1;
app/inventory/api/engine/storage.php
+5 -7
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$sql = "SELECT a.*, b.warehouse_name
@@ -10,13 +9,12 @@
a.company_id = b.company_id and
a.warehouse = b.id
WHERE
a.company_id = {$company_id}";
a.company_id = :company_id ";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetchAll(PDO::FETCH_ASSOC);
app/inventory/api/engine/warehouse.php
+5 -7
View File
@@ -1,19 +1,17 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$sql = "SELECT a.*
FROM md_warehouse a
WHERE
a.company_id = {$company_id}";
a.company_id = :company_id";
$sth = $pdo2->prepare($sql);
$sth->execute();
if ($sth->errorInfo()[0] != "00000" && !empty($sth->errorInfo()[0])) {
$answer["message"] = (empty($sth->errorInfo()[2])) ? $sth->errorInfo()[0] : $sth->errorInfo()[2];
exit(json_encode($answer));
}
$sth->execute([
":company_id" => $company_id
]);
db_check($sth, $answer);
$answer["output"] = $sth->fetchAll(PDO::FETCH_ASSOC);
app/login/api/engine/back.php
-1
View File
@@ -1,7 +1,6 @@
<?php
session_start();
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
sleep(1);
app/login/api/engine/login_confirm.php
+20 -49
View File
@@ -1,14 +1,20 @@
<?php
session_start();
require '../../../config.php';
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$data["username"] = $_SESSION["login_data"]['username'];
$data["password"] = $_SESSION["login_data"]['password'];
$user_id = $_SESSION["login_user_id"];
$password = md5(trim(strtolower($data["password"])));
$salt_password = md5($user_id."_".trim(strtolower($data["password"])));
// get password
$sth = $pdo1->prepare("select * from user where user_id = :user_id limit 1;");
$sth->execute([
":user_id" => $user_id
]);
$temp = $sth->fetch(PDO::FETCH_ASSOC);
/**
* Validate OTP
@@ -24,7 +30,7 @@
return str_pad(strval($otp), $length, '0', STR_PAD_LEFT);
}
$otp = generateOTP($password);
$otp = generateOTP($temp["password"]);
// time diff between $_SESSION["otpTime"] and now() in minutes
$otp_time = isset($_SESSION['otpTime']) ? (int)$_SESSION['otpTime'] : 0;
@@ -44,55 +50,20 @@
exit(json_encode($answer));
}
// get password
$sth = $pdo1->prepare("select * from user where user_id = {$user_id} limit 1;");
$sth->execute();
$temp = $sth->fetch(PDO::FETCH_ASSOC);
session_regenerate_id(true); // ← fixes session fixation
$_SESSION['csrf_token'] = bin2hex(random_bytes(32)); // ← CSRF token
if( strtolower($data["username"]) == "support" ){
if( $data["password"] == strtolower(substr(md5("trcloud".date("Ymd")),0,4)) ){
$support = true;
}else{
$support = false;
}
}else{
$support = false;
}
/**
* validate password
/**
* Create login session
*/
if((($password == $temp["password"]||$salt_password == $temp["password"]) && strtolower($data["username"]) != "support") || $support == true ){
$_SESSION["login_status"] = 1;
$_SESSION["login_username"] = $temp["username"];
$_SESSION["login_name"] = $temp["name"];
$_SESSION["login_surname"] = $temp["surname"];
$_SESSION["login_company_id"] = $temp["default_company"];
// create user session
if( strtolower($data["username"]) == "support" ){
$s = $pdo1->query("select *, 'info@trcloud.co' as email from user where username='support' limit 1;");
$temp = $s->fetch(PDO::FETCH_ASSOC);
}
/**
* Create login session
*/
$_SESSION["login_status"] = 1;
$_SESSION["login_username"] = $temp["username"];
$_SESSION["login_name"] = $temp["name"];
$_SESSION["login_surname"] = $temp["surname"];
$_SESSION["login_company_id"] = $temp["default_company"];
$answer["success"] = 1;
$answer["message"] = "Login Complete!";
exit(json_encode($answer));
}
else
{
$answer["message"] = "Incorrect Password";
setcookie("u", "", time()-1, "/");
setcookie("h1", "", time()-1, "/");
setcookie("h2", "", time()-1, "/");
exit(json_encode($answer));
}
$answer["success"] = 1;
$answer["success"] = 1;
$answer["message"] = "Login Complete!";
exit(json_encode($answer));
?>
app/login/api/engine/login_otp.php
+3 -14
View File
@@ -1,6 +1,7 @@
<?php
session_start();
require '../../../config.php';
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
@@ -10,27 +11,15 @@
$user_id = $sth->fetchColumn();
$username = strtolower($data["username"]);
$password = md5(trim(strtolower($data["password"])));
$salt_password = md5($user_id."_".trim(strtolower($data["password"])));
// get password
$sth = $pdo1->prepare("select password from user where username = ? or email = ? limit 1;");
$sth->execute(array($username,$username));
$temp = $sth->fetch(PDO::FETCH_ASSOC);
if( strtolower($data["username"]) == "support" ){
if( $data["password"] == strtolower(substr(md5("trcloud".date("Ymd")),0,4)) ){
$support = true;
}else{
$support = false;
}
}else{
$support = false;
}
/**
* validate password
*/
if((($password == $temp["password"]||$salt_password == $temp["password"]) && strtolower($data["username"]) != "support") || $support == true ){
if(password_verify(trim($data["password"]), $temp["password"])) {
// create user session
if( strtolower($data["username"]) == "support" ){
@@ -150,7 +139,7 @@
return str_pad($result, 6, 'A', STR_PAD_LEFT);
}
$otp = generateOTP($password);
$otp = generateOTP($temp["password"]);
$reference_number = numberToLetters(generateOTP($otp));
app/login/api/engine/request_new_otp.php
+9 -18
View File
@@ -1,37 +1,28 @@
<?php
session_start();
require '../../../config.php';
require '../../../preset.php';
require '../../../assets/utils/db_auth.php';
$data["username"] = $_SESSION["login_data"]['username'];
$data["password"] = $_SESSION["login_data"]['password'];
$user_id = (int)$_SESSION["login_user_id"];
$password = md5(trim(strtolower($data["password"])));
$salt_password = md5($user_id."_".trim(strtolower($data["password"])));
// get password
$sth = $pdo1->prepare("select * from user where user_id = {$user_id} limit 1;");
$sth->execute();
// get password
$sth = $pdo1->prepare("select * from user where user_id = :user_id limit 1;");
$sth->execute([
":user_id" => $user_id
]);
$temp = $sth->fetch(PDO::FETCH_ASSOC);
// user email
$user_email = $temp["email"];
if( strtolower($data["username"]) == "support" ){
if( $data["password"] == strtolower(substr(md5("trcloud".date("Ymd")),0,4)) ){
$support = true;
}else{
$support = false;
}
}else{
$support = false;
}
/**
/**
* validate password
*/
if((($password == $temp["password"]||$salt_password == $temp["password"]) && strtolower($data["username"]) != "support") || $support == true ){
if(password_verify(trim($data["password"]), $temp["password"])) {
/**
* Generate OTP
@@ -63,7 +54,7 @@
return str_pad($result, 6, 'A', STR_PAD_LEFT);
}
$otp = generateOTP($password);
$otp = generateOTP($temp["password"]);
$reference_number = numberToLetters(generateOTP($otp));
app/preset.php
+1 -14
View File
@@ -3,20 +3,7 @@
//<><><><><><><><> MAIN TRCLOUD <><><><><><><><>//
if(true){
$expire = "2027-01-01";
// unique key
$pinkey = "wms";
/**
* default smtp server
*/
$SMTP = [];
$SMTP['server'] = "smtp.gmail.com";
$SMTP['username'] = "thanakorn.inbox@gmail.com";
$SMTP['port'] = "587";
$SMTP['password'] = "duuo vnad rdax hgpt";
// password encoding
$method = "AES-256-CBC";
$iv = "1234567890123456"; // Must be exactly 16 bytes
$SMTP['password'] = openssl_encrypt($SMTP['password'], $method, $pinkey, 0, $iv);
}