Update: 2026-07-09 05:02:10

backend/auth/syria/driver/register_driver_and_car.php

@@ -10,6 +10,11 @@ $allowRegistration = true;
 require_once __DIR__ . '/../../../connect.php';
 header('Content-Type: application/json; charset=utf-8');
 
+// Rate Limiting: الحماية من التسجيل العشوائي وهجمات الـ Bots
+$rateLimiter = new RateLimiter($redis);
+$rateLimiter->enforce(RateLimiter::identifier(), 'register_driver');
+
+
 try {
     if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
         jsonError("Invalid method.");
@@ -120,6 +125,25 @@ try {
     }
     /* ================== 🔴 END PHONE FORMATTING LOGIC 🔴 ================== */
 
+    // ======================================================
+    // Step 1.5: التحقق الفعلي من ملكية رقم الهاتف قبل إكمال المعالجة (سد الثغرة)
+    // ======================================================
+    require_once __DIR__ . '/../../../core/Auth/EncryptionHelper.php';
+    $tempEncryptionHelper = new EncryptionHelper($redis);
+    $phoneNumber_encrypted_check = $tempEncryptionHelper->encryptData($data['phone']);
+
+    $verifyCheckStmt = $con->prepare(
+        "SELECT id FROM phone_verification_driver
+         WHERE phone_number = ? AND verified = 1 AND created_at > DATE_SUB(NOW(), INTERVAL 30 MINUTE)
+         LIMIT 1"
+    );
+    $verifyCheckStmt->execute([$phoneNumber_encrypted_check]);
+    if ($verifyCheckStmt->rowCount() === 0) {
+        error_log("[Register_Debug_driver] Error: Phone number not verified via OTP.");
+        jsonError("Phone number must be verified before registration.");
+        exit();
+    }
+    // ======================================================
 
     // تجهيز تاريخ الميلاد قبل التشفير
     if (!empty($data['birthdate'])) {