|
Server : LiteSpeed System : Linux terra.hostitbro.com 5.14.0-611.54.3.el9_7.x86_64 #1 SMP PREEMPT_DYNAMIC Thu May 7 16:31:24 EDT 2026 x86_64 User : outerorb ( 1091) PHP Version : 8.1.34 Disable Function : mail Directory : /home/outerorb/emp.outerorbittech.in/ | |
|
Path: //home/outerorb/emp.outerorbittech.in/upload_request.php
Size: 11.07 KB
Permissions: 0666
<?php
require __DIR__ . '/includes/helpers.php';
ensure_employees_table();
ensure_document_requests_table();
$flash = flash();
$errors = [];
$step = 'lookup';
$request = null;
$employee = null;
$requestedDocs = [];
$verified = false;
$pdo = null;
$codeValue = strtoupper(sanitize_text($_POST['code'] ?? ($_GET['code'] ?? '')));
$phoneValue = sanitize_text($_POST['phone_last4'] ?? '');
$config = app_config();
$docMimes = $config['security']['allowed_doc_mimes'];
$photoMimes = $config['security']['allowed_photo_mimes'];
$docRules = [
'aadhaar_front' => ['label' => 'Aadhaar Front', 'mimes' => $docMimes, 'size' => $config['uploads']['max_size'], 'column' => 'aadhaar_path', 'part' => 'front'],
'aadhaar_back' => ['label' => 'Aadhaar Back', 'mimes' => $docMimes, 'size' => $config['uploads']['max_size'], 'column' => 'aadhaar_path', 'part' => 'back'],
'pan' => ['label' => 'PAN Document', 'mimes' => $docMimes, 'size' => $config['uploads']['max_size'], 'column' => 'pan_path'],
'qualification' => ['label' => 'Graduation', 'mimes' => $docMimes, 'size' => $config['uploads']['max_size'], 'column' => 'qualification_path'],
'tenth_marksheet' => ['label' => '10th Marksheet', 'mimes' => $docMimes, 'size' => $config['uploads']['max_size'], 'column' => 'tenth_marksheet_path'],
'twelfth_marksheet' => ['label' => '12th Marksheet', 'mimes' => $docMimes, 'size' => $config['uploads']['max_size'], 'column' => 'twelfth_marksheet_path'],
'bank_proof' => ['label' => 'Bank Proof', 'mimes' => $docMimes, 'size' => $config['uploads']['max_size'], 'column' => 'bank_proof_path'],
'photo' => ['label' => 'Passport Photo', 'mimes' => $photoMimes, 'size' => $config['uploads']['photo_max_size'], 'column' => 'photo_path'],
];
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!isset($_POST['csrf_token']) || !verify_csrf($_POST['csrf_token'])) {
redirect_with_message('upload_request.php', 'Invalid session token. Please retry.', 'error');
}
$codeValue = strtoupper(sanitize_text($_POST['code'] ?? ''));
$phoneValue = sanitize_text($_POST['phone_last4'] ?? '');
$action = $_POST['action'] ?? 'lookup';
$request = get_document_request_by_code($codeValue);
if (!$request) {
$errors['code'] = 'Request code not found.';
} elseif ($request['status'] !== 'pending') {
$errors['code'] = 'This request is not active.';
}
if (!$errors) {
$pdo = db();
$stmt = $pdo->prepare('SELECT * FROM employees WHERE id = ? AND deleted_at IS NULL LIMIT 1');
$stmt->execute([(int) $request['employee_id']]);
$employee = $stmt->fetch();
if (!$employee) {
$errors['code'] = 'Employee record not found.';
}
}
if (!$errors) {
$cleanPhone = preg_replace('/\D+/', '', (string) ($employee['phone'] ?? ''));
$expected = substr($cleanPhone, -4);
$inputLast4 = substr(preg_replace('/\D+/', '', $phoneValue), -4);
if ($expected === '' || $inputLast4 === '' || $expected !== $inputLast4) {
$errors['phone_last4'] = 'Contact number verification failed.';
}
}
if (!$errors) {
$requestedDocs = json_decode($request['requested_docs'] ?? '[]', true) ?: [];
$requestedDocs = array_values(array_intersect(array_keys($docRules), $requestedDocs));
if (empty($requestedDocs)) {
$errors['code'] = 'No documents are required for this request.';
}
}
if (!$errors) {
$verified = true;
}
if (!$errors && $action === 'upload') {
$uploads = [];
$update = [];
$aadhaarPaths = parse_aadhaar_paths($employee['aadhaar_path'] ?? '');
foreach ($requestedDocs as $key) {
$rule = $docRules[$key];
$result = handle_upload($key, $rule['mimes'], $rule['size']);
if (!empty($result['error'])) {
$errors[$key] = $rule['label'] . ': ' . $result['error'];
continue;
}
$uploads[$key] = $result['path'];
}
if (!empty($errors) && !empty($uploads)) {
foreach ($uploads as $path) {
if ($path && file_exists($path)) {
@unlink($path);
}
}
}
if (!$errors) {
try {
// Replace old files only when new uploads succeed
foreach ($uploads as $key => $path) {
$rule = $docRules[$key];
if (($rule['column'] ?? '') === 'aadhaar_path' && !empty($rule['part'])) {
$part = $rule['part'];
$old = $aadhaarPaths[$part] ?? null;
if ($old && file_exists($old)) {
@unlink($old);
}
$aadhaarPaths[$part] = $path;
} else {
$col = $rule['column'];
$old = $employee[$col] ?? '';
if ($old && file_exists($old)) {
@unlink($old);
}
$update[$col] = $path;
}
}
if (isset($aadhaarPaths['front']) || isset($aadhaarPaths['back']) || isset($aadhaarPaths['single'])) {
$update['aadhaar_path'] = compose_aadhaar_value($aadhaarPaths);
}
if (!empty($update)) {
$sets = [];
$params = [];
foreach ($update as $col => $val) {
$sets[] = "{$col} = ?";
$params[] = $val;
}
$params[] = (int) $employee['id'];
$sql = 'UPDATE employees SET ' . implode(', ', $sets) . ' WHERE id = ? LIMIT 1';
$stmt = $pdo->prepare($sql);
$stmt->execute($params);
}
update_document_request_status((int) $request['id'], 'completed');
redirect_with_message('upload_request.php?code=' . urlencode($codeValue), 'Documents uploaded successfully. Thank you!');
} catch (Throwable $e) {
foreach ($uploads as $path) {
if ($path && file_exists($path)) {
@unlink($path);
}
}
redirect_with_message('upload_request.php?code=' . urlencode($codeValue), 'Could not save your documents. Please try again.', 'error');
}
}
}
if ($verified) {
$step = 'upload';
}
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Upload Requested Documents</title>
<link rel="stylesheet" href="assets/css/style.css?v=<?php echo filemtime(__DIR__ . '/assets/css/style.css'); ?>" />
<link rel="stylesheet" href="assets/css/polish.css?v=<?php echo filemtime(__DIR__ . '/assets/css/polish.css'); ?>" />
</head>
<body>
<div class="container">
<div class="header">
<div class="brand">
<div class="brand-title">
<h1 style="margin:0;">Upload Requested Documents</h1>
<p class="helper" style="margin:2px 0 0 0;">Enter your request code and phone (last 4 digits).</p>
</div>
</div>
<div>
<a class="badge" href="onboarding.php">Back to Onboarding</a>
</div>
</div>
<?php if ($flash): ?>
<div class="alert <?php echo $flash['type'] === 'error' ? 'alert-error' : 'alert-success'; ?>">
<?php echo htmlspecialchars($flash['message'], ENT_QUOTES, 'UTF-8'); ?>
</div>
<?php endif; ?>
<div class="card">
<form method="post" action="upload_request.php" enctype="multipart/form-data" novalidate style="display:grid; gap:14px;">
<input type="hidden" name="csrf_token" value="<?php echo csrf_token(); ?>" />
<input type="hidden" name="action" value="<?php echo $step === 'upload' ? 'upload' : 'lookup'; ?>" />
<div class="form-grid" style="grid-template-columns:repeat(auto-fit,minmax(240px,1fr));">
<div>
<label for="code">Request Code</label>
<input id="code" name="code" type="text" required value="<?php echo htmlspecialchars($codeValue, ENT_QUOTES, 'UTF-8'); ?>" />
<p class="error" data-error-for="code"><?php echo htmlspecialchars($errors['code'] ?? '', ENT_QUOTES, 'UTF-8'); ?></p>
</div>
<div>
<label for="phone_last4">Contact Number (last 4 digits)</label>
<input id="phone_last4" name="phone_last4" type="text" inputmode="numeric" pattern="\d{4}" maxlength="4" required value="<?php echo htmlspecialchars($phoneValue, ENT_QUOTES, 'UTF-8'); ?>" />
<p class="error" data-error-for="phone_last4"><?php echo htmlspecialchars($errors['phone_last4'] ?? '', ENT_QUOTES, 'UTF-8'); ?></p>
</div>
</div>
<?php if ($step === 'upload' && $employee && empty($errors)): ?>
<div class="alert alert-success" style="margin:0;">
Hello <?php echo htmlspecialchars($employee['first_name'], ENT_QUOTES, 'UTF-8'); ?>. Please upload the requested documents below.
</div>
<div class="form-grid">
<?php foreach ($requestedDocs as $key): ?>
<?php $rule = $docRules[$key]; ?>
<div class="doc-field">
<label for="<?php echo $key; ?>"><?php echo htmlspecialchars($rule['label'], ENT_QUOTES, 'UTF-8'); ?></label>
<input
id="<?php echo $key; ?>"
name="<?php echo $key; ?>"
type="file"
accept="<?php echo htmlspecialchars(implode(',', $rule['mimes']), ENT_QUOTES, 'UTF-8'); ?>"
required
class="<?php echo !empty($errors[$key]) ? 'input-invalid' : ''; ?>"
/>
<p class="helper">Accepted: <?php echo htmlspecialchars(implode(', ', $rule['mimes']), ENT_QUOTES, 'UTF-8'); ?>. Max size: <?php echo (int) ($rule['size'] / (1024 * 1024)); ?> MB.</p>
<p class="error" data-error-for="<?php echo $key; ?>"><?php echo htmlspecialchars($errors[$key] ?? '', ENT_QUOTES, 'UTF-8'); ?></p>
</div>
<?php endforeach; ?>
</div>
<?php endif; ?>
<div style="display:flex; justify-content:flex-end; gap:10px;">
<button type="submit"><?php echo $step === 'upload' ? 'Upload Documents' : 'Verify Request'; ?></button>
</div>
</form>
</div>
</div>
</body>
</html>