JezK

Edit File: addCareers.php

<?php 
$currentPage="careers"; 
include("header.php");
include("app/getCareersDataApp.php");
if(isset($_SESSION['saveFailed']))
{
	echo "<script>alert('Error!!! Unable to save career. Internal server error.');</script>";
	unset($_SESSION['saveFailed']);
}
if(isset($_SESSION['fileUploadFailed']))
{
	echo "<script>alert('Error!!! Unable to save file. Internal server error.');</script>";
	unset($_SESSION['fileUploadFailed']);
}

?>
<style>
	.multi-select-menu { height:200px;
  overflow-y:auto;
}
</style>
<div id="page-wrapper">
	<div class="container-fluid">
		
		<div class="row">
			<div class="col-lg-12">
				<h1 class="page-header text-center">
					<small style="color: #333333;"> Add Careers </small>
				</h1>
			</div>
		</div>
		
		<div class="container main" >
			<div class="col-md-12 ">
				<form method="post" enctype="multipart/form-data" action="app/addCareerApp.php" method="post" onsubmit="return validate()">
					<div class="form-group col-md-12">
						<label class=" col-md-3">Title</label>
						<textarea class="cs-textfield col-md-6" name="title" id="title" rows="5" autofocus></textarea>
					</div>
					<div class="form-group col-md-12">
						<label class=" col-md-3">Description</label>
						<div class="col-md-6">
							<textarea name="description" id="description" style="width: 100%; height:120px" class="form-control"></textarea>
					  </div>
					</div>
					<div class="form-group col-md-12">
						<label class=" col-md-3 ">Position</label>
						<select name="position" id="position"  class="cs-textfield col-md-3">
							<option value="0">Select Position</option>
							<?php echo $positions; ?>
						</select>
					</div>
					<div class="form-group col-md-12">
						<label class=" col-md-3">Location</label>
						<select name="location" id="location"  class="cs-textfield col-md-3">
							<option value="0">Select Location</option>
							<?php echo $locations; ?>
						</select>
					</div>
					<div class="form-group col-md-12">
						<label class=" col-md-3">Last Date to apply</label>
						<div class="input-group date col-md-3" >
							<input type="text" class="form-control" name="lastDate" id="lastDate" placeholder="" value="" style="border-radius: 9px 0px 0px 9px !important;">
							<span class="input-group-addon">
								<span class="glyphicon glyphicon-calendar"></span>
							</span>
					  </div>
					</div>
					

					<div class="form-group col-md-12">
						<label class=" col-md-3">File</label>
						<div class="col-md-6" >
							<input type="hidden" value="1" id="fileStatus">
							<input type="file" value="" id="careerFile" name="careerFile" onchange="ValidateFileUpload()" style="display:inline-block;" accept="application/pdf, .pdf">
							<div id="fileUploadStatus" class="divSuccess" style="display:inline-block;"></div>
					  </div>
					</div>
					<div class="text-center">
						<input type="submit" name="submit" value="Submit" id="submit" class="btn btn-cs">
					</div>
				</form>
			</div>
		</div>	
   
</div>


<div id="myModal" class="modal fade" role="dialog">
  <div class="modal-dialog">

<div class="modal-content">
      <div class="modal-header">
        <button type="button" class="close" data-dismiss="modal">&times;</button>
        <h4 class="modal-title">Status Update</h4>
      </div>
      <div class="modal-body">
        <form name="statusUpade" id="statusUpade" method="POST" action="">
			<div class="col-md-12" style="padding-bottom:20px;">
				<label class="col-md-2 col-md-offset-2">Status:</label>
				<select name="status" id="status"  class=" col-md-6">
					<option value="1">Rejected</option>
					<option value="2">Approved</option>
				</select>
			</div>
			<div class="text-center " >
				<input type="submit" value="Submit" class="btn  btn-cs" name="submit">
			</div>
        </form>
      </div>
    </div>
  </div>
</div>
<script>
$('.input-group.date').datepicker(
{
	calendarWeeks: true,
	todayHighlight: true,
	autoclose: true,
	format:"dd/mm/yyyy",
	orientation:'bottom',
	startDate: new Date(),
}); 
</script>
<?php include"footer.php"?>
<script type="text/javascript" src="js/nicEdit-latest.js"></script>
<script type="text/javascript">
bkLib.onDomLoaded(function()
{
    nicEditors.editors.push(
        new nicEditor().panelInstance(
            document.getElementById('description')
        )
    );
});

function validate()
{
	var title = document.getElementById('title');
	var description = document.getElementById('description');
	var position = document.getElementById('position');
	var location = document.getElementById('location');
	var fileStatus = document.getElementById('fileStatus');
	var careerFile = document.getElementById('careerFile');
	var lastDate = document.getElementById('lastDate');
	var languages = document.getElementById('languages');

// TITLE
if (title.value.trim() == '') {
    alert("Please enter title.");
    title.focus();
    return false;
}

// Allow letters, numbers, space, dot, comma, hyphen, parentheses, colon
var titlePattern = /^[A-Za-z0-9 .,\-():]+$/;
if (!titlePattern.test(title.value.trim())) {
    alert("Title contains invalid characters.");
    title.focus();
    return false;
}

// DESCRIPTION
var descVal = nicEditors.findEditor('description').getContent();
var plainDesc = descVal.replace(/(<([^>]+)>)/gi, "").trim();

if (plainDesc === '') {
    alert("Please enter description.");
    description.focus();
    return false;
}

// Block script injection (HTML-level check)
if (/<\s*script|javascript:/i.test(descVal)) {
    alert("Description contains unsafe script content.");
    return false;
}

// Validate ONLY plain text (NOT HTML)
var badChars = /[{}\[\]\$%\^*=`]/; // < > removed intentionally

if (badChars.test(plainDesc)) {
    alert("Description contains invalid special characters.");
    return false;
}

if(position.value == 0)
	{
		alert("Please enter position.");
		position.focus();
		return false;
	}
	if(location.value == 0)
	{
		alert("Please enter location.");
		location.focus();
		return false;
	}
	if(lastDate.value == 0)
	{
		alert("Please enter last date to apply.");
		lastDate.focus();
		return false;
	}
	if(languages.value.trim() == '')
	{
		alert("Please select atleast one language.");
		languages.focus();
		return false;
	}
	if(fileStatus.value == 0)
	{
		alert("Please upload a pdf file.");
		careerFile.focus();
		return false;
	}
	return true;
}

function ValidateFileUpload() {
    var fuData = document.getElementById('careerFile');
    var fileStatus = document.getElementById('fileStatus');
    var fileUploadStatus = document.getElementById('fileUploadStatus');

if (fuData.files.length === 0) {
        alert("Please upload a PDF file.");
        fileStatus.value = 0;
        fileUploadStatus.innerHTML = '<span class="fail"></span>';
        return;
    }

var file = fuData.files[0];
    var fileName = file.name.toLowerCase();
    var fileSize = file.size;

if (/\.(php|phtml|exe|js|sh|bat|cmd)\.pdf$/i.test(fileName)) {
        alert("Invalid file name. Only pure PDF files are allowed.");
        fuData.value = "";
        fileStatus.value = 0;
        fileUploadStatus.innerHTML = '<span class="fail"></span>';
        return;
    }

if (!/^[a-z0-9_\- ]+\.pdf$/i.test(fileName)) {
        alert("Invalid file name. Use only letters, numbers, space, hyphen, underscore and .pdf");
        fuData.value = "";
        fileStatus.value = 0;
        fileUploadStatus.innerHTML = '<span class="fail"></span>';
        return;
    }

var maxSize = 1048576;
    if (fileSize > maxSize) {
        alert("File too large. Maximum allowed size is 1 MB.");
        fuData.value = "";
        fileStatus.value = 0;
        fileUploadStatus.innerHTML = '<span class="fail"></span>';
        return;
    }

fileStatus.value = 1;
    fileUploadStatus.innerHTML = '<span class="success"></span>';
}

$(function(){
        $('#languages').multiSelect();
    });
</script>