HAQQANIA | BATCH 01 | 20 October 2026

YE SIRF BATCH 01 UPDATE HAI, POORA SYSTEM NAHI.

UPLOAD (pehle test area mein):
1. Maujooda admin folder ka backup download kar lein.
2. Haqqania_Batch_01_Updated.zip ko /public_html/test/H/ mein upload aur extract karein.
3. ZIP ka admin folder aapke /test/H/admin/ mein merge hona chahiye.
   /admin/admin/ na banayein. Existing admin folder ya assets ko delete na karein.
4. Matching files overwrite karein. Naya batch_boot.php aur assets/batch01 poora zaroor upload ho.
5. /test/H/admin/login.php kholein. Ctrl+Shift+R se reload karein.
6. Purana username aur password hi istemal karein. Password ab hash ki shakal mein hai.
7. Dashboard numbers ko original system se compare karein. Search, drawer aur print check karein.

DB:
Is ZIP mein db.php, SQL, demo records ya database migrations nahi hain.
Aapki existing admin/db.php apni jagah rehni chahiye. Kisi real record ko modify nahi kiya gaya.

FILES:
Updated: index.php, login.php, leter.php, sidebar.php, _footer.php.
New required: batch_boot.php, assets/batch01/ (CSS, JS, Urdu fonts, Chart.js and licenses).
_footer.php ke naam ke aakhir ki extra spaces hata di gayi hain.
Insaf Beef Shop wali insaf.php shamil nahi hai; server se usay delete karne ki zaroorat nahi.

CHANGES:
- Single header document; duplicate includes and competing sidebar scripts removed.
- White content background, current green identity, restrained 3D cards and buttons.
- RTL drawer, close button, Escape, focus handling, mobile overlay, menu search.
- Desktop sidebar closed/open preference remembered. Navigation collapses it.
- Color settings via header gear. Colors persist IN THE SAME BROWSER.
  All-user default colors: edit six variables at the start of assets/batch01/theme.css.
  Browser settings override defaults; use Asal Rang to reset.
  Existing colors from a different older theme's settings are not automatically imported.
- Urdu fonts and Chart.js bundled locally; primary layout no longer needs Google fonts/CDN.
- Login: password hash, CSRF, session regeneration, session-cookie protection,
  generic failure messages and a per-session 5-attempt/5-minute cooldown.
  This cooldown is not a server-wide/IP-based brute-force firewall.
- Existing authentication session keys and password preserved.
- Logout link uses token; old bookmarks to index.php?logout=1 must be replaced by sidebar logout.
- Student search uses prepared parameters; chart labels use safe JSON encoding.
- Active-student totals share the same class aggregation. Duplicate scans count once.
  Present has priority over leave, so one student is not counted in both buckets.
  Leave eligibility is unchanged: rows on that date in student_leaves are treated as leave.
- Current-day absent count is provisional until attendance is complete.
  The 3-day absence warning excludes today's incomplete day.
- Database failure shows an error instead of misleading zero statistics.
- Dashboard print CSS, reduced-motion support, and safe small-screen scrolling.

IMPORTANT SCOPE:
The supplied leter.php contains shared HEADER code, not a letter-report form.
Its incorrect 'Hazri Khat' sidebar link is disabled until the real report page is supplied.
Other sidebar targets were preserved. Their source files were not in this batch,
so their individual functionality/security and any uses of old _header.php/_sidebar.php
still require review in later batches. Do not delete those existing files.
This batch does not alter .htaccess or remove .php from URLs.
No claim is made that the entire system is ready for production.

VERIFICATION:
All six PHP files pass PHP syntax checks. JavaScript syntax checked.
Local login tests: valid login, wrong password, invalid CSRF and locked session.
Fixture tests: active-only totals, repeated scans, overlapping present/leave, class whitespace.
Rendered tests: 1440px desktop, 390px and 360px mobile, drawer open/close,
color persistence after reload, no horizontal overflow or browser JS errors.
Missing-db flow tested without a fatal error or fake zero statistics.
Layout tests used MOCK DATA, not your live database. Live MySQL/hosting checks are pending.

ROLLBACK:
Restore the backed-up five PHP files. Leave original db.php and records untouched.
The new batch files can remain unused; remove only after checking no page includes them.