merge prod to main

.env

@@ -0,0 +1,180 @@
+#--------------------------------------------------------------------
+# Example Environment Configuration file
+#
+# This file can be used as a starting point for your own
+# custom .env files, and contains most of the possible settings
+# available in a default install.
+#
+# By default, all of the settings are commented out. If you want
+# to override the setting, you must un-comment it by removing the '#'
+# at the beginning of the line.
+#--------------------------------------------------------------------
+
+#--------------------------------------------------------------------
+# ENVIRONMENT
+#--------------------------------------------------------------------
+
+CI_ENVIRONMENT = development
+
+# Which profile to use if none is supplied to sendEmail()
+# Options: default, communication, payment, ...
+MAIL_PROFILE_DEFAULT=default
+
+# ===== DEFAULT (system) =====
+# ---- Legacy fallbacks (kept for compatibility) ----
+SMTP_HOST = smtp.gmail.com
+SMTP_USER = alrahma.sunday.school@gmail.com
+SMTP_PASS = "psnp emdq dykw ypul"
+SMTP_PORT = 587
+SMTP_ENCRYPTION = tls  # was SSL; set to ssl to match 587
+
+# Reply-To for all mail profiles
+MAIL_DEFAULT_REPLY_TO=alrahma.isgl@gmail.com
+MAIL_DEFAULT_REPLY_TO_NAME="Al Rahma Sunday School"
+MAIL_COMMUNICATION_REPLY_TO=alrahma.isgl@gmail.com
+MAIL_COMMUNICATION_REPLY_TO_NAME="School Communications"
+MAIL_PAYMENT_REPLY_TO=alrahma.isgl@gmail.com
+MAIL_PAYMENT_REPLY_TO_NAME="School Payments"
+MAIL_DEFAULT_REPLY_TO="alrahma.isgl@gmail.com"
+
+# Optional sender directory you already use elsewhere
+MAIL_SENDERS="{\"general\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma No-Reply\"},\
+\"registration\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma Register Office\"},\
+\"notifications\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma Notifications\"},\
+\"finance\":{\"email\":\"alrahma.isgl@gmail.com\",\"name\":\"Al Rahma Finance Office\"}}"
+
+# Principal notification recipient for TimeOff requests (comma-separated allowed)
+PRINCIPAL_EMAIL="principal@alrahmaisgl.org"
+
+#--------------------------------------------------------------------
+# APP
+#--------------------------------------------------------------------
+
+# If you have trouble with `.`, you could also use `_`.
+ app_baseURL = 'http://localhost:8080/'
+# app.forceGlobalSecureRequests = true
+# app.CSPEnabled = false
+
+#--------------------------------------------------------------------
+# DATABASE
+#--------------------------------------------------------------------
+database.default.hostname = 127.0.0.1
+database.default.database = school
+database.default.username = root
+database.default.password = root
+database.default.DBDriver = MySQLi
+database.default.DBPrefix =
+database.default.port = 3306
+
+
+#--------------------------------------------------------------------
+# CONTENT SECURITY POLICY
+#--------------------------------------------------------------------
+
+# contentsecuritypolicy.reportOnly = false
+# contentsecuritypolicy.defaultSrc = 'none'
+# contentsecuritypolicy.scriptSrc = 'self'
+# contentsecuritypolicy.styleSrc = 'self'
+# contentsecuritypolicy.imageSrc = 'self'
+# contentsecuritypolicy.baseURI = null
+# contentsecuritypolicy.childSrc = null
+# contentsecuritypolicy.connectSrc = 'self'
+# contentsecuritypolicy.fontSrc = null
+# contentsecuritypolicy.formAction = null
+# contentsecuritypolicy.frameAncestors = null
+# contentsecuritypolicy.frameSrc = null
+# contentsecuritypolicy.mediaSrc = null
+# contentsecuritypolicy.objectSrc = null
+# contentsecuritypolicy.pluginTypes = null
+# contentsecuritypolicy.reportURI = null
+# contentsecuritypolicy.sandbox = false
+# contentsecuritypolicy.upgradeInsecureRequests = false
+# contentsecuritypolicy.styleNonceTag = '{csp-style-nonce}'
+# contentsecuritypolicy.scriptNonceTag = '{csp-script-nonce}'
+# contentsecuritypolicy.autoNonce = true
+
+#--------------------------------------------------------------------
+# COOKIE
+#--------------------------------------------------------------------
+
+# cookie.prefix = ''
+# cookie.expires = 0
+# cookie.path = '/'
+# cookie.domain = ''
+# cookie.secure = false
+# cookie.httponly = false
+# cookie.samesite = 'Lax'
+# cookie.raw = false
+
+#--------------------------------------------------------------------
+# ENCRYPTION
+#--------------------------------------------------------------------
+
+# encryption.key =
+# encryption.driver = OpenSSL
+# encryption.blockSize = 16
+# encryption.digest = SHA512
+
+#--------------------------------------------------------------------
+# HONEYPOT
+#--------------------------------------------------------------------
+
+# honeypot.hidden = 'true'
+# honeypot.label = 'Fill This Field'
+# honeypot.name = 'honeypot'
+# honeypot.template = '<label>{label}</label><input type="text" name="{name}" value=""/>'
+# honeypot.container = '<div style="display:none">{template}</div>'
+
+#--------------------------------------------------------------------
+# SECURITY
+#--------------------------------------------------------------------
+
+# security.csrfProtection = 'cookie'
+# security.tokenRandomize = false
+# security.tokenName = 'csrf_token_name'
+# security.headerName = 'X-CSRF-TOKEN'
+# security.cookieName = 'csrf_cookie_name'
+# security.expires = 7200
+# security.regenerate = true
+# security.redirect = false
+# security.samesite = 'Lax'
+
+#--------------------------------------------------------------------
+# SESSION
+#--------------------------------------------------------------------
+
+# session.driver = 'CodeIgniter\Session\Handlers\FileHandler'
+# session.cookieName = 'ci_session'
+# session.expiration = 7200
+# session.savePath = null
+# session.matchIP = false
+# session.timeToUpdate = 300
+# session.regenerateDestroy = false
+
+#--------------------------------------------------------------------
+# LOGGER
+#--------------------------------------------------------------------
+
+# logger.threshold = 4
+
+#--------------------------------------------------------------------
+# CURLRequest
+#--------------------------------------------------------------------
+
+# curlrequest.shareOptions = false
+
+
+
+
+
+mail.protocol  = smtp
+mail.SMTPHost  = ${SMTP_HOST}
+mail.SMTPUser  = ${SMTP_USER}
+mail.SMTPPass  = ${SMTP_PASS}
+mail.SMTPPort  = ${SMTP_PORT}
+mail.SMTPCrypto = tls
+
+mail.fromEmail = ${SMTP_USER}
+mail.fromName  = "Al Rahma Sunday School"
+mail.mailType  = text
+mail.charset   = UTF-8

.gitignore

@@ -1,54 +0,0 @@
-.env
-.env.*
-!.env.example
-
-/vendor/
-/node_modules/
-
-/writable/cache/*
-/writable/debugbar/*
-/writable/logs/*
-/writable/session/*
-/writable/uploads/*
-/writable/tmp/*
-/writable/*.log
-
-!/writable/.gitkeep
-!/writable/cache/.gitkeep
-!/writable/debugbar/.gitkeep
-!/writable/logs/.gitkeep
-!/writable/session/.gitkeep
-!/writable/uploads/.gitkeep
-!/writable/tmp/.gitkeep
-
-/public/build/
-/public/hot/
-/public/uploads/**
-!/public/uploads/**/index.html
-!/public/uploads/.gitkeep
-
-/uploads/**
-!/uploads/**/index.html
-!/uploads/.gitkeep
-
-docker-compose.override.yml
-docker-compose.local.yml
-
-*.log
-.swp
-.swo
-*~
-.tmp
-.DS_Store
-Thumbs.db
-.idea/
-.vscode/
-.codex/
-
-/coverage/
-/build/
-/builds
-/phpunit.xml.cache
-/.phpunit.result.cache
-/writable/reports/*
-/writable/test.txt

app/Commands/SyncPaypalPayments.php

@@ -36,13 +36,13 @@ class SyncPaypalPayments extends BaseCommand
         $this->invoiceModel   = new InvoiceModel();
         $this->studentModel = new StudentModel();
         $this->enrollmentModel = new EnrollmentModel();
+
+        $this->semester = $this->configModel->getConfig('semester');
+        $this->schoolYear = $this->configModel->getConfig('school_year');
     }
 
     public function run(array $params)
     {
-        $this->semester = (string) ($this->configModel->getConfig('semester') ?? '');
-        $this->schoolYear = (string) ($this->configModel->getConfig('school_year') ?? '');
-
         $dryRun     = CLI::getOption('dry-run');
         $reportOnly = CLI::getOption('report-only');
         $mode       = $reportOnly ? 'REPORT-ONLY' : ($dryRun ? 'DRY-RUN' : 'LIVE');

app/Config/Events.php

@@ -9,7 +9,6 @@ use App\Listeners\SchoolEventListener;
 use App\Listeners\AttendanceConsequenceListener;
 use App\Listeners\WhatsappInviteListener;
 use App\Listeners\BelowSixtyEmailListener;
-use App\Listeners\DecisionEmailListener;
 
 // Create an instance so we can use $this->emailService like your other handlers
 $waListener = new WhatsappInviteListener(service('emailService'));
@@ -119,7 +118,6 @@ Events::on('attendance.follow_up',   [AttendanceConsequenceListener::class, 'fol
 Events::on('attendance.final_warning', [AttendanceConsequenceListener::class, 'finalWarning']);
 Events::on('attendance.dismissal',   [AttendanceConsequenceListener::class, 'dismissal']);
 Events::on('below60.email', [BelowSixtyEmailListener::class, 'handle']);
-Events::on('below60.decision_email', [DecisionEmailListener::class, 'handle']);
 
 //Whatsapp Event listener
 Events::on('whatsapp_invites.send', [$waListener, 'handle']);

app/Config/Filters.php

@@ -24,8 +24,6 @@ class Filters extends BaseConfig
         'honeypot'          => Honeypot::class,
         'invalidchars'      => InvalidChars::class,
         'secureheaders'     => SecureHeaders::class,
-        'sanitizeinput'     => \App\Filters\SanitizeInputFilter::class,
-        'apiratelimit'      => \App\Filters\ApiRateLimitFilter::class,
         'auth'              => \App\Filters\AuthFilter::class, // Define the alias for your auth filter
         'apiAuth'           => \App\Filters\ApiAuthFilter::class, // JWT-based API authentication
         'cleanupScheduler'  => \App\Filters\CleanupScheduler::class,
@@ -44,8 +42,6 @@ class Filters extends BaseConfig
     public array $globals = [
     'before' => [
         'timezone',
-        'sanitizeinput',
-        'invalidchars',
         'csrf' => ['except' => [
             // Webhooks / integrations
             'api/paypal-webhook',
@@ -84,7 +80,6 @@ class Filters extends BaseConfig
         ]],
     ],
     'after' => [
-        'secureheaders',
         'toolbar',
         'cleanupScheduler' => ['except' => ['cleanup/*']],
     ],
@@ -117,7 +112,7 @@ class Filters extends BaseConfig
      * @var array<string, array<string, list<string>>>
      */
     public array $filters = [
-        'apiratelimit' => ['before' => ['api/*', 'index.php/api/*']],
+        
     ];
 
 }

app/Config/Format.php

@@ -9,7 +9,6 @@ use CodeIgniter\Format\XMLFormatter;
 
 class Format extends BaseConfig
 {
-    public int $jsonEncodeDepth = 512;
     /**
      * --------------------------------------------------------------------------
      * Available Response Formats

app/Config/Routes.php

@@ -174,18 +174,6 @@ $routes->group('administrator/subject-curriculum', ['filter' => 'auth:update_cur
     $routes->post('delete/(:num)', 'View\SubjectCurriculumController::delete/$1');
 });
 
-$routes->get('administrator/trophy',              'View\TrophyController::index',   ['filter' => 'auth:admin']);
-$routes->get('administrator/trophy/winners',      'View\TrophyController::winners', ['filter' => 'auth:admin']);
-$routes->get('administrator/trophy/final',        'View\TrophyController::final',   ['filter' => 'auth:admin']);
-
-// Certificates
-$routes->get('administrator/certificates',           'View\CertificateController::index',    ['filter' => 'auth:admin']);
-$routes->get('administrator/certificates/csrf-token', 'View\CertificateController::csrfToken', ['filter' => 'auth:admin']);
-$routes->post('administrator/certificates/generate', 'View\CertificateController::generate', ['filter' => 'auth:admin']);
-$routes->get('administrator/certificates/log',       'View\CertificateController::auditLog',  ['filter' => 'auth:admin']);
-$routes->get('administrator/certificates/reprint/(:any)', 'View\CertificateController::reprint/$1', ['filter' => 'auth:read']);
-$routes->get('verify/(:segment)',                    'View\CertificateController::verify/$1');
-
 
 
 /*
@@ -523,31 +511,13 @@ $routes->post('grading/below-60/email', 'View\GradingController::sendBelowSixtyE
 $routes->post('grading/below-60/status', 'View\GradingController::updateBelowSixtyStatus', ['filter' => 'auth:read']);
 $routes->get('grading/below-60/schedule', 'View\GradingController::scheduleBelowSixty', ['filter' => 'auth:read']);
 $routes->post('grading/below-60/schedule', 'View\GradingController::saveBelowSixtyMeeting', ['filter' => 'auth:read']);
-$routes->get('grading/decisions', 'View\GradingController::allDecisions', ['filter' => 'auth:read']);
-$routes->post('grading/decisions/generate', 'View\GradingController::generateAllDecisions', ['filter' => 'auth:read']);
-$routes->get('grading/below-60/decisions', 'View\GradingController::belowSixtyDecisions', ['filter' => 'auth:read']);
-$routes->post('grading/below-60/decisions/save', 'View\GradingController::saveBelowSixtyDecision', ['filter' => 'auth:read']);
-$routes->get('grading/below-60/decisions/student-details', 'View\GradingController::studentDecisionDetails', ['filter' => 'auth:read']);
-$routes->get(
-    'grading/below-60/decisions/email/preview',
-    'View\GradingController::previewBelowSixtyDecisionEmail',
-    ['filter' => 'auth:read']
-);
 
-$routes->post(
-    'grading/below-60/decisions/email',
-    'View\GradingController::sendBelowSixtyDecisionEmail',
-    ['filter' => 'auth:read']
-);
 
 // Final part
 $routes->get('grading/(:segment)/(:num)/(:num)', 'View\GradingController::show/$1/$2/$3');
 $routes->post('grading/update', 'View\GradingController::update');
 $routes->get('grading', 'View\GradingController::grading');
 $routes->post('grading/toggle-score-lock', 'View\GradingController::toggleScoreLock', ['filter' => 'auth:read']);
-$routes->get('grading/toggle-score-lock', static function () {
-    return 'GET route hit. Something is calling this route incorrectly.';
-});
 $routes->post('grading/lock-all-scores', 'View\GradingController::lockAllScores', ['filter' => 'auth:read']);
 $routes->post('grading/release-scores', 'View\GradingController::toggleParentScoresRelease', ['filter' => 'auth:read']);
 $routes->post('grading/refresh-semester-scores', 'View\GradingController::refreshSemesterScores', ['filter' => 'auth:read']);
@@ -565,7 +535,6 @@ $routes->post('payment/event_charges', 'View\EventController::eventUpdate');
 
 // Parent event participation
 $routes->get('administrator/event-charges', 'View\EventController::eventShow');
-$routes->get('administrator/event-charges/pdf', 'View\EventController::eventChargesPdf');
 $routes->post('administrator/event-charges/remove/(:num)', 'View\EventController::removeCharge/$1');
 $routes->post('administrator/event-charges/payment/(:num)', 'View\EventController::toggleEventPayment/$1');
 $routes->post('administrator/event-charges/waiver/(:num)', 'View\EventController::toggleWaiverStatus/$1');

app/Config/Services.php

@@ -36,7 +36,7 @@ class Services extends BaseService
     /**
      * Override CI Email service to enforce a global Reply-To.
      */
-    public static function email(?array $config = null, bool $getShared = true)
+    public static function email(array $config = null, bool $getShared = true)
     {
         if ($getShared) {
             return static::getSharedInstance('email', $config);

app/Controllers/AuthController.php

@@ -5,6 +5,7 @@ namespace App\Controllers;
 use App\Models\LoginActivityModel;
 use App\Models\UserModel;
 use App\Models\UserRoleModel;
+use CodeIgniter\Controller;
 use CodeIgniter\Events\Events;
 use App\Models\IpAttemptModel;
 use App\Models\PasswordResetModel;
@@ -18,7 +19,7 @@ require_once APPPATH . 'Helpers/pbkdf2_helper.php';
 require_once APPPATH . 'Helpers/jwt_helper.php';
 
 
-class AuthController extends BaseController
+class AuthController extends Controller
 {
     protected $configModel;
     protected $userModel;
@@ -82,23 +83,9 @@ class AuthController extends BaseController
         log_message('info', 'Processing login form submission.');
         $redirectTo = $this->sanitizeRedirectTarget((string) ($this->request->getPost('redirect_to') ?? $this->request->getGet('redirect_to') ?? ''));
 
-        $validator = \Config\Services::validation();
-        $requestData = sanitize_request_value($this->request->getPost(['email', 'password']));
-        $validator->setRules([
-            'email' => 'required|valid_email|max_length[254]',
-            'password' => 'required|max_length[255]',
-        ]);
-
-        if (! $validator->run($requestData)) {
-            return redirect()
-                ->back()
-                ->with('error', 'Please enter a valid email and password.')
-                ->withInput();
-        }
-
         // Step 1: Get email, password, and IP from the request
-        $email = strtolower((string) $requestData['email']);
-        $password = (string) $requestData['password'];
+        $email = $this->request->getPost('email');
+        $password = $this->request->getPost('password');
         $ip = $this->request->getIPAddress();
 
         log_message('info', 'Login attempt from IP: ' . $ip . ' for email: ' . $email);
@@ -152,29 +139,26 @@ class AuthController extends BaseController
     // JSON API: POST /api/login
     public function apiLogin()
     {
-        $requestData = sanitize_request_value($this->request->getJSON(true) ?: [
+        $requestData = $this->request->getJSON(true);
+        if (!$requestData) {
+            // fallback to form vars
+            $requestData = [
                 'email' => $this->request->getPost('email'),
                 'password' => $this->request->getPost('password'),
-        ]);
-
-        $validation = \Config\Services::validation();
-        $validation->setRules([
-            'email' => 'required|valid_email|max_length[254]',
-            'password' => 'required|max_length[255]',
-        ]);
-
-        if (! $validation->run($requestData)) {
-            return $this->response->setStatusCode(422)->setJSON([
-                'status' => false,
-                'message' => 'Validation failed.',
-                'errors' => $validation->getErrors(),
-            ]);
+            ];
         }
 
-        $email = strtolower((string) ($requestData['email'] ?? ''));
-        $password = (string) ($requestData['password'] ?? '');
+        $email = $requestData['email'] ?? '';
+        $password = $requestData['password'] ?? '';
         $ip = $this->request->getIPAddress();
 
+        if (!$email || !$password) {
+            return $this->response->setStatusCode(400)->setJSON([
+                'status' => false,
+                'message' => 'Email and password are required.'
+            ]);
+        }
+
         if ($this->isIpBlocked($ip)) {
             return $this->response->setStatusCode(429)->setJSON([
                 'status' => false,
@@ -236,15 +220,7 @@ class AuthController extends BaseController
             'exp' => $exp,
         ];
 
-        try {
-            $secret = require_env('JWT_SECRET');
-        } catch (\RuntimeException $e) {
-            return $this->response->setStatusCode(500)->setJSON([
-                'status' => false,
-                'message' => 'JWT configuration is missing.',
-            ]);
-        }
-
+        $secret = env('JWT_SECRET', 'change-me-in-env');
         $token = jwt_encode($payload, $secret, 'HS256');
 
         return $this->response->setJSON([
@@ -264,14 +240,18 @@ class AuthController extends BaseController
      */
     public function apiRegister()
     {
-        $requestData = sanitize_request_value($this->request->getJSON(true) ?: $this->request->getPost());
+        $requestData = $this->request->getJSON(true);
+        if (!$requestData) {
+            // fallback to form vars
+            $requestData = $this->request->getPost();
+        }
 
         // Basic validation
         $rules = [
-            'firstname' => "required|regex_match[/^[\\p{L}\\s'\\-]+$/u]|min_length[2]|max_length[30]",
-            'lastname' => "required|regex_match[/^[\\p{L}\\s'\\-]+$/u]|min_length[2]|max_length[30]",
-            'email' => 'required|valid_email|max_length[254]|is_unique[users.email]',
-            'password' => 'required|min_length[8]|max_length[255]',
+            'firstname' => 'required|min_length[2]|max_length[30]',
+            'lastname' => 'required|min_length[2]|max_length[30]',
+            'email' => 'required|valid_email|is_unique[users.email]',
+            'password' => 'required|min_length[8]',
             'cellphone' => 'required|min_length[10]|max_length[20]',
         ];
 
@@ -352,7 +332,7 @@ class AuthController extends BaseController
                 'exp' => $exp,
             ];
 
-            $secret = require_env('JWT_SECRET');
+            $secret = env('JWT_SECRET', 'change-me-in-env');
             $token = jwt_encode($payload, $secret, 'HS256');
 
             return $this->response->setStatusCode(201)->setJSON([

app/Controllers/BaseController.php

@@ -36,7 +36,7 @@ abstract class BaseController extends Controller
      *
      * @var list<string>
      */
-    protected $helpers = ['security'];
+    protected $helpers = [];
 
     /** @var ApiClient */
     protected ApiClient $api;
@@ -73,21 +73,6 @@ abstract class BaseController extends Controller
         // Assuming the user role is stored in the session
         return session()->get('role');
     }
-
-    protected function validated(array $rules, ?array $data = null): array
-    {
-        $validation = service('validation');
-        $payload = $data ?? ($this->request->getJSON(true) ?: $this->request->getPost());
-        $payload = sanitize_request_value($payload);
-
-        $validation->setRules($rules);
-
-        if (! $validation->run($payload)) {
-            throw new \InvalidArgumentException(json_encode($validation->getErrors(), JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES) ?: 'Validation failed');
-        }
-
-        return $payload;
-    }
 }
 
 ?>

app/Controllers/ProofreadController.php

@@ -10,12 +10,7 @@ class ProofreadController extends ResourceController
     {
         // Basic per-IP throttling: 10 requests per minute
         $throttler = service('throttler');
-
-        // Cache/throttler keys cannot contain reserved characters.
-        // Raw IPv6 addresses contain ":", so hash the IP first.
-        $ip = $this->request->getIPAddress();
-        $key = 'proofread-' . hash('sha256', $ip);
-
+        $key = 'proofread-' . $this->request->getIPAddress();
         if (!$throttler->check($key, 10, MINUTE)) {
             return $this->respond([
                 'ok' => false,
@@ -25,51 +20,29 @@ class ProofreadController extends ResourceController
         }
 
         // Accept form-urlencoded payload to play nicely with CSRF protection
-        $payload = sanitize_request_value($this->request->getPost(['text']));
-
-        $validation = service('validation');
-        $validation->setRules([
-            'text' => 'required|min_length[1]|max_length[20000]',
-        ]);
-
-        if (! $validation->run($payload)) {
+        $text = (string) ($this->request->getPost('text') ?? '');
+        if ($text === '' || mb_strlen($text) > 20000) {
             return $this->respond([
                 'ok' => false,
-                'error' => 'Invalid text payload.',
+                'error' => 'Invalid text (empty or too long).',
                 'csrfHash' => csrf_hash(),
             ], 422);
         }
 
-        $text = (string) $payload['text'];
-
-        $client = \Config\Services::curlrequest([
-            'timeout' => 10,
-        ]);
+        $client = \Config\Services::curlrequest(['timeout' => 10]);
 
         try {
             $resp = $client->post('https://api.languagetool.org/v2/check', [
-                'headers' => [
-                    'Content-Type' => 'application/x-www-form-urlencoded',
-                ],
+                'headers' => ['Content-Type' => 'application/x-www-form-urlencoded'],
                 'form_params' => [
                     'text'     => $text,
                     'language' => 'en-US',
                 ],
             ]);
 
-            $result = json_decode($resp->getBody(), true);
-
-            if (json_last_error() !== JSON_ERROR_NONE) {
-                return $this->respond([
-                    'ok' => false,
-                    'error' => 'Invalid response from proofread service.',
-                    'csrfHash' => csrf_hash(),
-                ], 502);
-            }
-
             return $this->respond([
                 'ok' => true,
-                'result' => $result,
+                'result' => json_decode($resp->getBody(), true),
                 'csrfHash' => csrf_hash(),
             ]);
         } catch (\Throwable $e) {

app/Controllers/View/CertificateController.php

@@ -1,664 +0,0 @@
-<?php
-
-namespace App\Controllers\View;
-
-use App\Controllers\BaseController;
-use App\Models\ClassSectionModel;
-use App\Models\ConfigurationModel;
-use App\Models\CertificateRecordModel;
-
-class CertificateController extends BaseController
-{
-    protected $classSectionModel;
-    protected $configModel;
-    protected $certRecordModel;
-    protected $schoolYear;
-
-    public function __construct()
-    {
-        $this->classSectionModel = new ClassSectionModel();
-        $this->configModel       = new ConfigurationModel();
-        $this->certRecordModel   = new CertificateRecordModel();
-        $this->schoolYear        = $this->configModel->getConfig('school_year');
-    }
-
-    // ─── Admin UI ──────────────────────────────────────────────────────────────
-
-    public function index()
-    {
-        $db           = \Config\Database::connect();
-        $selectedCsid = $this->request->getGet('class_section_id');
-        $schoolYear   = $this->request->getGet('school_year') ?? $this->schoolYear;
-
-        // ── All enrolled students across every class section ───────────────────
-        $allEnrolled = $db->table('student_class sc')
-            ->select('s.id AS student_id, s.firstname, s.lastname, sc.class_section_id, cs.class_section_name')
-            ->join('students s', 's.id = sc.student_id')
-            ->join('classSection cs', 'cs.class_section_id = sc.class_section_id')
-            ->where('s.is_active', 1)
-            ->where('sc.school_year', $schoolYear)
-            ->orderBy('s.firstname', 'ASC')
-            ->orderBy('s.lastname', 'ASC')
-            ->get()
-            ->getResultArray();
-
-        $allIds = array_values(array_unique(array_map('intval', array_column($allEnrolled, 'student_id'))));
-
-        // ── Saved generated YEAR decisions from student_decisions ──────────────
-        //
-        // Source of truth:
-        // student_decisions.year_score
-        // student_decisions.decision
-        //
-        // Do NOT recalculate certificate decisions here from semester_scores.
-        $decisionsByStudent = [];
-
-        if (!empty($allIds)) {
-            $decisionRows = $db->table('student_decisions')
-                ->whereIn('student_id', $allIds)
-                ->where('school_year', $schoolYear)
-                ->get()
-                ->getResultArray();
-
-            foreach ($decisionRows as $d) {
-                $sid = (int)($d['student_id'] ?? 0);
-
-                if ($sid <= 0) {
-                    continue;
-                }
-
-                $decision = trim((string)($d['decision'] ?? ''));
-                $source   = trim((string)($d['source'] ?? ''));
-
-                if ($source === '') {
-                    $source = $decision === '' ? 'pending' : 'manual';
-                }
-
-                $decisionsByStudent[$sid]['Year'] = [
-                    'decision'   => $decision,
-                    'source'     => $source,
-                    'notes'      => (string)($d['notes'] ?? ''),
-                    'year_score' => $d['year_score'] ?? null,
-                ];
-            }
-        }
-
-        // ── Certificate records: most recent per student ───────────────────────
-        $certsByStudent = [];
-
-        if (!empty($allIds)) {
-            foreach ($db->table('certificate_records')
-                ->select('student_id, certificate_number, issued_at')
-                ->whereIn('student_id', $allIds)
-                ->where('school_year', $schoolYear)
-                ->orderBy('issued_at', 'DESC')
-                ->get()
-                ->getResultArray() as $c) {
-                $sid = (int)$c['student_id'];
-
-                if (!isset($certsByStudent[$sid])) {
-                    $certsByStudent[$sid] = $c['certificate_number'];
-                }
-            }
-        }
-
-        // ── Build per-class buckets and stats ──────────────────────────────────
-        $studentsByClass = [];
-        $statsPerClass   = [];
-
-        foreach ($allEnrolled as $row) {
-            $sid  = (int)$row['student_id'];
-            $csid = (int)$row['class_section_id'];
-
-            if (!isset($statsPerClass[$csid])) {
-                $statsPerClass[$csid] = [
-                    'name'  => $row['class_section_name'],
-                    'total' => 0,
-                    'pass'  => 0,
-                    'cert'  => 0,
-                ];
-            }
-
-            $statsPerClass[$csid]['total']++;
-
-            // If no generated decision exists yet, explicitly mark pending.
-            if (!isset($decisionsByStudent[$sid])) {
-                $decisionsByStudent[$sid]['Decision'] = [
-                    'decision'   => '',
-                    'source'     => 'pending',
-                    'notes'      => '',
-                    'year_score' => null,
-                ];
-            }
-
-            // Certificate eligibility:
-            // A student is eligible only if the saved final generated decision is Pass.
-            $studentDecisions = $decisionsByStudent[$sid] ?? [];
-            $isPass           = !empty($studentDecisions);
-
-            foreach ($studentDecisions as $decisionRow) {
-                $decision = trim((string)($decisionRow['decision'] ?? ''));
-
-                if (strcasecmp($decision, 'Pass') !== 0) {
-                    $isPass = false;
-                    break;
-                }
-            }
-
-            if ($isPass) {
-                $statsPerClass[$csid]['pass']++;
-            }
-
-            if (isset($certsByStudent[$sid])) {
-                $statsPerClass[$csid]['cert']++;
-            }
-
-            $studentsByClass[$csid][] = $row;
-        }
-
-        // ── Determine default active tab ───────────────────────────────────────
-        $firstCsid = !empty($allEnrolled) ? (int)$allEnrolled[0]['class_section_id'] : null;
-
-        if ($selectedCsid === null && $firstCsid !== null) {
-            $selectedCsid = (string)$firstCsid;
-        }
-
-        return view('admin/certificates/index', [
-            'studentsByClass'    => $studentsByClass,
-            'selectedClassId'    => $selectedCsid,
-            'schoolYear'         => $schoolYear,
-            'certDate'           => date('m/d/Y'),
-            'decisionsByStudent' => $decisionsByStudent,
-            'certsByStudent'     => $certsByStudent,
-            'statsPerClass'      => $statsPerClass,
-        ]);
-    }
-
-    public function auditLog()
-    {
-        $schoolYear  = $this->request->getGet('school_year') ?? $this->schoolYear;
-        $records     = $this->certRecordModel->getAuditLog($schoolYear);
-        $yearSummary = $this->certRecordModel->yearSummary();
-
-        return view('admin/certificates/audit_log', [
-            'records'     => $records,
-            'schoolYear'  => $schoolYear,
-            'yearSummary' => $yearSummary,
-        ]);
-    }
-
-    public function csrfToken()
-    {
-        return $this->response
-            ->setHeader('Cache-Control', 'no-store, no-cache, must-revalidate, max-age=0')
-            ->setHeader('Pragma', 'no-cache')
-            ->setJSON([
-                'csrf_token' => csrf_token(),
-                'csrf_hash'  => csrf_hash(),
-            ]);
-    }
-
-    // ─── Public verification page ──────────────────────────────────────────────
-
-    public function verify(string $certNumber)
-    {
-        $record = \Config\Database::connect()
-            ->table('certificate_records cr')
-            ->select('cr.*, u.firstname AS admin_firstname, u.lastname AS admin_lastname')
-            ->join('users u', 'u.id = cr.issued_by', 'left')
-            ->groupStart()
-                ->where('cr.verification_token', $certNumber)
-                ->orWhere('cr.certificate_number', strtoupper($certNumber))
-            ->groupEnd()
-            ->get()
-            ->getRowArray();
-
-        return view('certificates/verify', [
-            'record' => $record ?: null,
-        ]);
-    }
-
-    // ─── Reprint an existing certificate ──────────────────────────────────────
-
-    public function reprint(string $certNumber)
-    {
-        $record = \Config\Database::connect()
-            ->table('certificate_records')
-            ->where('certificate_number', strtoupper($certNumber))
-            ->get()
-            ->getRowArray();
-
-        if (!$record) {
-            return redirect()->to('administrator/certificates/log')
-                ->with('error', 'Certificate not found: ' . $certNumber);
-        }
-
-        $certDateFormatted = '';
-
-        if (!empty($record['cert_date'])) {
-            $ts = strtotime((string)$record['cert_date']);
-
-            if ($ts) {
-                $certDateFormatted = date('m/d/Y', $ts);
-            }
-        }
-
-        $student = [
-            'firstname'    => (string)($record['student_name'] ?? ''),
-            'lastname'     => '',
-            'grade'        => (string)($record['grade'] ?? ''),
-            'cert_number'  => (string)($record['certificate_number'] ?? ''),
-            'verify_token' => $this->ensureVerificationTokenForRecord($record),
-        ];
-
-        // student_name is stored as "Firstname Lastname" — split for the PDF builder.
-        $parts = explode(' ', trim($student['firstname']), 2);
-
-        if (count($parts) === 2) {
-            $student['firstname'] = $parts[0];
-            $student['lastname']  = $parts[1];
-        }
-
-        $pdfData  = $this->buildPdf([$student], $certDateFormatted ?: date('m/d/Y'));
-        $filename = 'Certificate_' . strtoupper($certNumber) . '.pdf';
-
-        return $this->response
-            ->setHeader('Content-Type', 'application/pdf')
-            ->setHeader('Content-Disposition', 'inline; filename="' . $filename . '"')
-            ->setBody($pdfData);
-    }
-
-    // ─── PDF generation ────────────────────────────────────────────────────────
-
-    public function generate()
-    {
-        $studentIds     = $this->request->getPost('student_ids') ?? [];
-        $certDate       = trim($this->request->getPost('cert_date') ?? date('m/d/Y'));
-        $classSectionId = $this->request->getPost('class_section_id');
-        $schoolYear     = $this->request->getPost('school_year') ?? $this->schoolYear;
-
-        if (empty($studentIds)) {
-            if ($this->request->isAJAX()) {
-                return $this->response
-                    ->setStatusCode(422)
-                    ->setJSON([
-                        'ok'         => false,
-                        'error'      => 'Please select at least one student.',
-                        'csrf_token' => csrf_token(),
-                        'csrf_hash'  => csrf_hash(),
-                    ]);
-            }
-
-            return redirect()->to('administrator/certificates')
-                ->with('error', 'Please select at least one student.');
-        }
-
-        $studentIds = array_filter(array_map('intval', $studentIds));
-        $certDate   = preg_replace('/[^0-9\/\-]/', '', $certDate);
-
-        if (empty($studentIds)) {
-            if ($this->request->isAJAX()) {
-                return $this->response
-                    ->setStatusCode(422)
-                    ->setJSON([
-                        'ok'         => false,
-                        'error'      => 'Invalid student selection.',
-                        'csrf_token' => csrf_token(),
-                        'csrf_hash'  => csrf_hash(),
-                    ]);
-            }
-
-            return redirect()->to('administrator/certificates')
-                ->with('error', 'Invalid student selection.');
-        }
-
-        $db       = \Config\Database::connect();
-        $students = [];
-
-        foreach ($studentIds as $id) {
-            $row = null;
-
-            if ($classSectionId) {
-                $row = $db->table('student_class sc')
-                    ->select('s.id, s.firstname, s.lastname, cs.class_section_name AS grade')
-                    ->join('students s', 's.id = sc.student_id')
-                    ->join('classSection cs', 'cs.class_section_id = sc.class_section_id')
-                    ->where('sc.class_section_id', (int)$classSectionId)
-                    ->where('sc.school_year', $schoolYear)
-                    ->where('s.id', $id)
-                    ->get()
-                    ->getRowArray();
-            }
-
-            if (!$row) {
-                $s = $db->table('students')
-                    ->select('id, firstname, lastname, registration_grade AS grade')
-                    ->where('id', $id)
-                    ->get()
-                    ->getRowArray();
-
-                $row = $s ?: null;
-            }
-
-            if ($row) {
-                $students[] = $row;
-            }
-        }
-
-        if (empty($students)) {
-            if ($this->request->isAJAX()) {
-                return $this->response
-                    ->setStatusCode(422)
-                    ->setJSON([
-                        'ok'         => false,
-                        'error'      => 'No valid students found.',
-                        'csrf_token' => csrf_token(),
-                        'csrf_hash'  => csrf_hash(),
-                    ]);
-            }
-
-            return redirect()->to('administrator/certificates')
-                ->with('error', 'No valid students found.');
-        }
-
-        $issuedAt = date('Y-m-d H:i:s');
-
-        // Load existing certificates for these students this school year.
-        $existingCerts = $db->table('certificate_records')
-            ->select('id, student_id, certificate_number, verification_token')
-            ->whereIn('student_id', array_column($students, 'id'))
-            ->where('school_year', $schoolYear)
-            ->get()
-            ->getResultArray();
-
-        $existingCertMap = [];
-
-        foreach ($existingCerts as $ec) {
-            $existingCertMap[(int)$ec['student_id']] = $ec;
-        }
-
-        foreach ($students as &$student) {
-            $sid = (int)$student['id'];
-
-            if (isset($existingCertMap[$sid])) {
-                // Reuse existing certificate number — do not create a new record.
-                $existing = $existingCertMap[$sid];
-
-                $student['cert_number']  = (string)($existing['certificate_number'] ?? '');
-                $student['verify_token'] = $this->ensureVerificationTokenForRecord($existing);
-            } else {
-                $certNumber  = $this->certRecordModel->nextNumber($schoolYear);
-                $verifyToken = $this->certRecordModel->generateVerificationToken();
-
-                $this->certRecordModel->insert([
-                    'certificate_number' => $certNumber,
-                    'verification_token' => $verifyToken,
-                    'student_id'         => $sid,
-                    'student_name'       => $student['firstname'] . ' ' . $student['lastname'],
-                    'grade'              => $this->formatGrade($student['grade'] ?? ''),
-                    'school_year'        => $schoolYear,
-                    'class_section_id'   => $classSectionId ?: null,
-                    'issued_at'          => $issuedAt,
-                ]);
-
-                $student['cert_number']  = $certNumber;
-                $student['verify_token'] = $verifyToken;
-            }
-        }
-
-        unset($student);
-
-        $pdfData  = $this->buildPdf($students, $certDate);
-        $filename = 'Certificates_' . date('Ymd_His') . '.pdf';
-
-        return $this->response
-            ->setHeader('Content-Type', 'application/pdf')
-            ->setHeader('Content-Disposition', 'inline; filename="' . $filename . '"')
-            ->setHeader('X-CSRF-TOKEN-NAME', csrf_token())
-            ->setHeader('X-CSRF-TOKEN', csrf_hash())
-            ->setBody($pdfData);
-    }
-
-    // ─── Helpers ───────────────────────────────────────────────────────────────
-
-    private function parseCertDate(string $certDate): ?string
-    {
-        if (preg_match('#^(\d{2})/(\d{2})/(\d{4})$#', $certDate, $m)) {
-            return $m[3] . '-' . $m[1] . '-' . $m[2];
-        }
-
-        if (preg_match('#^\d{4}-\d{2}-\d{2}$#', $certDate)) {
-            return $certDate;
-        }
-
-        return null;
-    }
-
-    private function formatGrade(string $raw): string
-    {
-        $clean = trim($raw);
-        $lower = strtolower($clean);
-
-        // Strip section suffix: "Grade 1-A" → "Grade 1", "Grade 2-B" → "Grade 2".
-        if (preg_match('/^grade\s*(\d+)/i', $clean, $m)) {
-            return 'Grade ' . (int)$m[1];
-        }
-
-        if ($lower === 'youth') {
-            return 'Youth';
-        }
-
-        if ($lower === 'kg' || $lower === 'kindergarten') {
-            return 'Kindergarten';
-        }
-
-        // Raw number or number-section: "1", "1-A", "2-B" → keep number only.
-        if (preg_match('/^(\d+)([- ][A-Za-z0-9]+)?$/', $clean, $m)) {
-            return 'Grade ' . (int)$m[1];
-        }
-
-        return $clean;
-    }
-
-    private function ensureVerificationTokenForRecord(array $record): string
-    {
-        $token = trim((string)($record['verification_token'] ?? ''));
-
-        if ($token !== '') {
-            return $token;
-        }
-
-        $recordId = (int)($record['id'] ?? 0);
-
-        if ($recordId <= 0) {
-            return '';
-        }
-
-        $token = $this->certRecordModel->generateVerificationToken();
-
-        $this->certRecordModel->update($recordId, [
-            'verification_token' => $token,
-        ]);
-
-        return $token;
-    }
-
-    // ─── PDF rendering ─────────────────────────────────────────────────────────
-
-    private function buildPdf(array $students, string $certDate): string
-    {
-        $fontDir = FCPATH . 'assets' . DIRECTORY_SEPARATOR . 'certificates' . DIRECTORY_SEPARATOR . 'fonts' . DIRECTORY_SEPARATOR;
-        $imgDir  = FCPATH . 'assets' . DIRECTORY_SEPARATOR . 'certificates' . DIRECTORY_SEPARATOR . 'images' . DIRECTORY_SEPARATOR;
-
-        $edwardianFont = \TCPDF_FONTS::addTTFfont($fontDir . 'Edwardian Script ITC Regular.ttf', 'TrueTypeUnicode', '', 32);
-        $garamondBold  = \TCPDF_FONTS::addTTFfont($fontDir . 'Garamond Bold.ttf', 'TrueTypeUnicode', '', 32);
-        $ebGaramond    = \TCPDF_FONTS::addTTFfont($fontDir . 'EBGaramond-Regular.ttf', 'TrueTypeUnicode', '', 32);
-
-        $pdf = new \TCPDF('L', 'pt', 'A4', true, 'UTF-8', false);
-
-        $pdf->SetCreator('Al Rahma Sunday School');
-        $pdf->SetTitle('Student Certificates');
-        $pdf->SetMargins(0, 0, 0, true);
-        $pdf->SetAutoPageBreak(false, 0);
-        $pdf->setPrintHeader(false);
-        $pdf->setPrintFooter(false);
-        $pdf->SetHeaderMargin(0);
-        $pdf->SetFooterMargin(0);
-
-        $W = $pdf->getPageWidth();
-        $H = $pdf->getPageHeight();
-
-        foreach ($students as $student) {
-            $pdf->AddPage();
-
-            $name        = trim((string)($student['firstname'] ?? '') . ' ' . (string)($student['lastname'] ?? ''));
-            $grade       = $this->formatGrade($student['grade'] ?? '');
-            $certNumber  = $student['cert_number'] ?? '';
-            $verifyToken = $student['verify_token'] ?? '';
-
-            $verifyUrl = $verifyToken !== ''
-                ? site_url('verify/' . rawurlencode($verifyToken))
-                : null;
-
-            $this->drawCertificate(
-                $pdf,
-                $W,
-                $H,
-                $name,
-                $grade,
-                $certDate,
-                $certNumber,
-                $verifyUrl,
-                $imgDir,
-                $edwardianFont,
-                $garamondBold,
-                $ebGaramond
-            );
-        }
-
-        return $pdf->Output('', 'S');
-    }
-
-    /**
-     * Coordinate mapping: iTextSharp origin bottom-left → TCPDF origin top-left.
-     * y_tcpdf ≈ H − y_iTextSharp
-     */
-    private function drawCertificate(
-        \TCPDF $pdf,
-        float $W,
-        float $H,
-        string $name,
-        string $grade,
-        string $certDate,
-        string $certNumber,
-        ?string $verifyUrl,
-        string $imgDir,
-        string $edwardianFont,
-        string $garamondBold,
-        string $ebGaramond
-    ): void {
-        // ── Images
-        $pdf->Image($imgDir . 'title.png', 126, 0, 600);
-        $pdf->Image($imgDir . 'background.png', 280, 176, 291, 340);
-        $pdf->Image($imgDir . 'signature.png', 140, 410, 90, 80);
-
-        // ── "Presented to:"
-        $pdf->SetFont('times', 'B', 24);
-        $pdf->SetTextColor(0, 0, 0);
-        $pdf->SetXY(0, 151);
-        $pdf->Cell($W, 24, 'Presented to:', 0, 0, 'C');
-
-        // ── QR code — left-aligned with "Presented to:", vertically centred on that line.
-        $qrSize = 42;
-
-        if (!empty($verifyUrl)) {
-            $qrX = 120;
-            $qrY = 171 + (24 - $qrSize) / 2;
-
-            $style = [
-                'border'  => false,
-                'padding' => 0,
-                'fgcolor' => [0, 0, 0],
-                'bgcolor' => false,
-            ];
-
-            $pdf->write2DBarcode($verifyUrl, 'QRCODE,L', $qrX, $qrY, $qrSize, $qrSize, $style, 'N');
-        }
-
-        // ── Student name — center based on actual string width.
-        $pdf->SetFont($edwardianFont, '', 38);
-        $nameX = ($W - $pdf->GetStringWidth($name)) / 2;
-        $this->drawGradientText($pdf, $edwardianFont, 38, $name, $nameX, 221.5);
-
-        // ── Line under name
-        $pdf->SetFont('times', '', 20);
-        $pdf->SetXY(0, 236);
-        $pdf->Cell(600, 20, '___________________________________', 0, 0, 'R');
-
-        // ── Description
-        $pdf->SetFont($ebGaramond, '', 20);
-        $pdf->SetXY(0, 273);
-        $pdf->Cell($W, 20, 'for successfully completing the requirements of', 0, 0, 'C');
-
-        // ── Grade
-        $pdf->SetFont($garamondBold, '', 20);
-        $pdf->SetXY(0, 310);
-        $pdf->Cell($W, 20, $grade, 0, 0, 'C');
-
-        // ── "at"
-        $pdf->SetFont('times', '', 20);
-        $pdf->SetXY(0, 343);
-        $pdf->Cell($W, 20, 'at', 0, 0, 'C');
-
-        // ── School name
-        $pdf->SetFont($garamondBold, '', 20);
-        $pdf->SetXY(0, 375);
-        $pdf->Cell($W, 20, 'Al Rahma Sunday School', 0, 0, 'C');
-
-        // ── Date
-        $this->drawGradientText($pdf, $edwardianFont, 26, $certDate, 586, 456);
-
-        // ── Date underline + label
-        $pdf->SetFont('times', '', 20);
-        $pdf->SetXY(0, 463);
-        $pdf->Cell(742, 20, '_________________', 0, 0, 'R');
-        $pdf->SetXY(650, 492);
-        $pdf->Cell(80, 20, 'Date', 0, 0, 'C');
-
-        // ── Signature underline + label
-        $pdf->SetXY(106, 463);
-        $pdf->Cell(200, 20, '_________________', 0, 0, 'L');
-        $pdf->SetXY(106, 492);
-        $pdf->Cell(168, 20, 'Signature', 0, 0, 'C');
-
-        // ── Certificate number — 1.4 cm from bottom, 2.5 cm from left.
-        if ($certNumber !== '') {
-            $pdf->SetFont('helvetica', '', 8);
-            $pdf->SetTextColor(150, 150, 150);
-            $pdf->SetXY(70.86, $H - 39.68);
-            $pdf->Cell(200, 12, 'Certificate No. ' . $certNumber, 0, 0, 'L');
-            $pdf->SetTextColor(0, 0, 0);
-        }
-    }
-
-    private function drawGradientText(
-        \TCPDF $pdf,
-        string $fontName,
-        float $fontSize,
-        string $text,
-        float $x,
-        float $y
-    ): void {
-        $pdf->SetFont($fontName, '', $fontSize);
-
-        for ($i = 0; $i < 6; $i++) {
-            $pdf->setAlpha(($i + 1) * 25 / 255);
-            $pdf->SetTextColor(0, 0, 0);
-            $pdf->Text($x + $i / 4, $y + $i / 4, $text);
-        }
-
-        $pdf->setAlpha(1);
-        $pdf->SetTextColor(0, 0, 0);
-        $pdf->Text($x, $y, $text);
-    }
-}

app/Controllers/View/ContactController.php

@@ -24,10 +24,10 @@ class ContactController extends BaseController
 
         // Define validation rules
         $validation->setRules([
-            'name' => "required|regex_match[/^[\\p{L}\\s'\\-]+$/u]|min_length[3]|max_length[100]",
-            'email' => 'required|valid_email|max_length[254]',
-            'subject' => 'required|min_length[3]|max_length[150]',
-            'message' => 'required|min_length[10]|max_length[5000]'
+            'name' => 'required|min_length[3]',
+            'email' => 'required|valid_email',
+            'subject' => 'required|min_length[3]',
+            'message' => 'required|min_length[10]'
         ]);
 
         if (!$validation->withRequest($this->request)->run()) {
@@ -37,10 +37,10 @@ class ContactController extends BaseController
         }
 
         // Process form data
-        $name = esc((string) $this->request->getPost('name'));
-        $email = esc(strtolower((string) $this->request->getPost('email')));
-        $subject = esc((string) $this->request->getPost('subject'));
-        $message = nl2br(esc((string) $this->request->getPost('message')));
+        $name = $this->request->getPost('name');
+        $email = strtolower($this->request->getPost('email'));
+        $subject = $this->request->getPost('subject');
+        $message = $this->request->getPost('message');
 
         // Initialize the EmailController
         $emailController = new \App\Controllers\View\EmailController();