From 4766c7c9fab610147b5a59e287cb14dc11cd7911 Mon Sep 17 00:00:00 2001
From: DevSoftTech Server <info.devsofttech@gmail.com>
Date: Tue, 22 Sep 2026 13:03:19 +0530
Subject: [PATCH] fix: safeguard shell_exec with function_exists check in login
 and medical api

---
 app/Controllers/Api/v1/MedicalStoreApi.php | 26 +++++------
 app/Views/auth/login.php                   | 50 +++++++++++-----------
 2 files changed, 40 insertions(+), 36 deletions(-)

diff --git a/app/Controllers/Api/v1/MedicalStoreApi.php b/app/Controllers/Api/v1/MedicalStoreApi.php
index 4de6c7e..8328aa5 100644
--- a/app/Controllers/Api/v1/MedicalStoreApi.php
+++ b/app/Controllers/Api/v1/MedicalStoreApi.php
@@ -6297,19 +6297,21 @@ class MedicalStoreApi extends BaseController
         $ips = [];
 
         // Attempt to detect local LAN IP on Windows / Linux
-        if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
-            $output = shell_exec('ipconfig');
-            if ($output) {
-                preg_match_all('/IPv4 Address[ .:]+([0-9.]+)/i', $output, $matches);
-                if (!empty($matches[1])) {
-                    $ips = array_unique($matches[1]);
+        if (function_exists('shell_exec')) {
+            if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
+                $output = @shell_exec('ipconfig');
+                if ($output) {
+                    preg_match_all('/IPv4 Address[ .:]+([0-9.]+)/i', $output, $matches);
+                    if (!empty($matches[1])) {
+                        $ips = array_unique($matches[1]);
+                    }
+                }
+            } else {
+                $output = @shell_exec("hostname -I 2>/dev/null");
+                if ($output) {
+                    $parts = preg_split('/\s+/', trim($output));
+                    if (!empty($parts)) $ips = array_unique($parts);
                 }
-            }
-        } else {
-            $output = shell_exec("hostname -I 2>/dev/null");
-            if ($output) {
-                $parts = preg_split('/\s+/', trim($output));
-                if (!empty($parts)) $ips = array_unique($parts);
             }
         }
 
diff --git a/app/Views/auth/login.php b/app/Views/auth/login.php
index d0185cd..5e2dbee 100644
--- a/app/Views/auth/login.php
+++ b/app/Views/auth/login.php
@@ -167,33 +167,35 @@
     <?php
     // Detect server network interfaces for LAN QR generation
     $detectedNetworkInterfaces = [];
-    if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
-        $netOutput = @shell_exec('ipconfig');
-        if ($netOutput) {
-            $netLines = explode("\n", $netOutput);
-            $curAdapter = '';
-            foreach ($netLines as $nLine) {
-                $nLine = trim($nLine);
-                if (preg_match('/^(adapter|Wireless LAN adapter|Ethernet adapter|Unknown adapter)\s+([^:]+):/i', $nLine, $adM)) {
-                    $curAdapter = trim($adM[2]);
-                }
-                if (preg_match('/IPv4 Address[ .:]+([0-9.]+)/i', $nLine, $ipM)) {
-                    $foundIp = trim($ipM[1]);
-                    if ($foundIp !== '127.0.0.1') {
-                        $label = $curAdapter ? ($foundIp . ' (' . $curAdapter . ')') : $foundIp;
-                        $detectedNetworkInterfaces[$foundIp] = $label;
+    if (function_exists('shell_exec')) {
+        if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') {
+            $netOutput = @shell_exec('ipconfig');
+            if ($netOutput) {
+                $netLines = explode("\n", $netOutput);
+                $curAdapter = '';
+                foreach ($netLines as $nLine) {
+                    $nLine = trim($nLine);
+                    if (preg_match('/^(adapter|Wireless LAN adapter|Ethernet adapter|Unknown adapter)\s+([^:]+):/i', $nLine, $adM)) {
+                        $curAdapter = trim($adM[2]);
+                    }
+                    if (preg_match('/IPv4 Address[ .:]+([0-9.]+)/i', $nLine, $ipM)) {
+                        $foundIp = trim($ipM[1]);
+                        if ($foundIp !== '127.0.0.1') {
+                            $label = $curAdapter ? ($foundIp . ' (' . $curAdapter . ')') : $foundIp;
+                            $detectedNetworkInterfaces[$foundIp] = $label;
+                        }
                     }
                 }
             }
-        }
-    } else {
-        $netOutput = @shell_exec("hostname -I 2>/dev/null");
-        if ($netOutput) {
-            $parts = preg_split('/\s+/', trim($netOutput));
-            foreach ($parts as $foundIp) {
-                $foundIp = trim($foundIp);
-                if ($foundIp && $foundIp !== '127.0.0.1') {
-                    $detectedNetworkInterfaces[$foundIp] = $foundIp . ' (LAN)';
+        } else {
+            $netOutput = @shell_exec("hostname -I 2>/dev/null");
+            if ($netOutput) {
+                $parts = preg_split('/\s+/', trim($netOutput));
+                foreach ($parts as $foundIp) {
+                    $foundIp = trim($foundIp);
+                    if ($foundIp && $foundIp !== '127.0.0.1') {
+                        $detectedNetworkInterfaces[$foundIp] = $foundIp . ' (LAN)';
+                    }
                 }
             }
         }