security fix and fix parent pages

app/Http/Controllers/Api/Family/FamilyAdminController.php

@@ -28,7 +28,7 @@ class FamilyAdminController extends BaseApiController
     public function index(FamilyAdminIndexRequest $request): JsonResponse
     {
         $payload = $request->validated();
-        $schoolYear = trim((string) (Configuration::getConfig('school_year') ?? ''));
+        $schoolYear = $this->requestedSchoolYear($request, $payload);
 
         $data = $this->queryService->adminIndexData(
             $payload['student_id'] ?? null,
@@ -63,7 +63,7 @@ class FamilyAdminController extends BaseApiController
     public function card(FamilyAdminCardRequest $request): JsonResponse
     {
         $payload = $request->validated();
-        $schoolYear = trim((string) (Configuration::getConfig('school_year') ?? ''));
+        $schoolYear = $this->requestedSchoolYear($request, $payload);
 
         $family = $this->queryService->familyCard(
             $payload['student_id'] ?? null,
@@ -79,6 +79,26 @@ class FamilyAdminController extends BaseApiController
         return $this->success(new FamilyResource($family));
     }
 
+    private function requestedSchoolYear($request, array $payload): string
+    {
+        $candidates = [
+            $payload['school_year'] ?? null,
+            $request->query('school_year'),
+            $request->header('X-School-Year'),
+            $request->header('X-Selected-School-Year'),
+            Configuration::getConfig('school_year'),
+        ];
+
+        foreach ($candidates as $candidate) {
+            $value = trim((string) ($candidate ?? ''));
+            if ($value !== '') {
+                return $value;
+            }
+        }
+
+        return '';
+    }
+
     public function composeEmail(FamilyComposeEmailRequest $request): JsonResponse
     {
         $payload = $request->validated();