From 42f6d33efde2b4845644e7382fd65aded50d247e Mon Sep 17 00:00:00 2001
From: Hamza-Ayed <hamzaayedflutter@gmail.com>
Date: Sat, 25 Jul 2026 14:44:30 +0300
Subject: [PATCH] Update: 2026-07-25 14:44:30

---
 backend/Admin/driver/deleteCaptain.php         | 12 ++++++++++++
 backend/Admin/driver/remove_from_blacklist.php | 10 ++++++++++
 backend/Admin/passenger/admin_unblacklist.php  | 10 ++++++++++
 dashboard/siro-admin/js/app.js                 |  6 +++---
 4 files changed, 35 insertions(+), 3 deletions(-)

diff --git a/backend/Admin/driver/deleteCaptain.php b/backend/Admin/driver/deleteCaptain.php
index 2ba433d5..8bbdaa6d 100644
--- a/backend/Admin/driver/deleteCaptain.php
+++ b/backend/Admin/driver/deleteCaptain.php
@@ -1,6 +1,18 @@
 <?php
 require_once __DIR__ . '/../../connect.php';
 
+// حارس الصلاحيات: هذه النقطة تحذف سجلاً نهائياً من قاعدة البيانات.
+// connect.php يتحقق من صحة التوكن فقط، فبدون هذا الفحص كان أي توكن صالح
+// (سائق أو راكب) قادراً على حذف السائقين.
+if ($role !== 'super_admin') {
+    http_response_code(403);
+    echo json_encode([
+        'status'  => 'failure',
+        'message' => 'Forbidden. Super Admin access required.',
+    ], JSON_UNESCAPED_UNICODE);
+    exit;
+}
+
 $driver_id = filterRequest("driver_id");
 $phone     = filterRequest("phone");
 $reason    = filterRequest("reason"); // يمكن أن يأتي من البارامتر أو نخليه افتراضي
diff --git a/backend/Admin/driver/remove_from_blacklist.php b/backend/Admin/driver/remove_from_blacklist.php
index 3496a15b..eaefb343 100644
--- a/backend/Admin/driver/remove_from_blacklist.php
+++ b/backend/Admin/driver/remove_from_blacklist.php
@@ -1,6 +1,16 @@
 <?php
 require_once __DIR__ . '/../../connect.php';
 
+// حارس الصلاحيات: رفع الحظر عملية إدارية، وكانت هذه النقطة بلا أي فحص دور.
+if ($role !== 'admin' && $role !== 'super_admin') {
+    http_response_code(403);
+    echo json_encode([
+        'status'  => 'failure',
+        'message' => 'Forbidden. Admin access required.',
+    ], JSON_UNESCAPED_UNICODE);
+    exit;
+}
+
 $phone = filterRequest("phone");
 
 if (empty($phone)) {
diff --git a/backend/Admin/passenger/admin_unblacklist.php b/backend/Admin/passenger/admin_unblacklist.php
index 07102168..086d54e4 100644
--- a/backend/Admin/passenger/admin_unblacklist.php
+++ b/backend/Admin/passenger/admin_unblacklist.php
@@ -1,6 +1,16 @@
 <?php
 require_once __DIR__ . '/../../connect.php';
 
+// حارس الصلاحيات: رفع الحظر عملية إدارية، وكانت هذه النقطة بلا أي فحص دور.
+if ($role !== 'admin' && $role !== 'super_admin') {
+    http_response_code(403);
+    echo json_encode([
+        'status'  => 'failure',
+        'message' => 'Forbidden. Admin access required.',
+    ], JSON_UNESCAPED_UNICODE);
+    exit;
+}
+
 function normalize_phone($s) { return preg_replace('/\D+/', '', (string)$s); }
 
 $phone = filterRequest("phone");
diff --git a/dashboard/siro-admin/js/app.js b/dashboard/siro-admin/js/app.js
index 6fcf9928..1a57a4d7 100644
--- a/dashboard/siro-admin/js/app.js
+++ b/dashboard/siro-admin/js/app.js
@@ -882,9 +882,9 @@
       panels: [{ title: 'Invoice totals', path: '/Admin/adminUser/invoice_total.php' }],
     },
     {
-      id: 'quality', group: 'Quality', icon: 'ph-prohibit', title: 'Blacklist',
-      subtitle: 'Blocked captains and passengers',
-      panels: [{ title: 'Blacklist', path: '/Admin/v2/quality/blacklist_manager.php', params: { action_type: 'get_all' } }],
+      id: 'quality', superOnly: true, group: 'Quality', icon: 'ph-prohibit', title: 'Blacklist & Removal',
+      subtitle: 'Blocked accounts, permanent removals and lifting a block',
+      custom: renderBlacklist,
     },
     {
       id: 'scorecard', group: 'Quality', icon: 'ph-medal', title: 'Driver Scorecard',