Fix #20: DDL removal from register.php, CORS policy, secret leak

- Removed ALTER TABLE DDL statements from Admin/auth/register.php (belongs in migration scripts)
- Added validated CORS with configurable allowed origins via CORS_ALLOWED_ORIGINS env var
- Removed  assignment in load_env.php (secrets no longer exposed in superglobal)

backend/Admin/auth/register.php

@@ -53,12 +53,6 @@ try {
     $encPhone = $encPhoneInput;
     $encFp    = $encryptionHelper->encryptData($fingerprint);
 
-    // التأكد من وجود عمود phone و status في الجدول
-    try {
-        $con->exec("ALTER TABLE adminUser ADD COLUMN phone VARCHAR(255) NULL AFTER name");
-        $con->exec("ALTER TABLE adminUser ADD COLUMN status VARCHAR(50) DEFAULT 'pending' AFTER role");
-    } catch (Exception $e) { /* الأعمدة موجودة مسبقاً */ }
-
     // 4. الإدخال في قاعدة البيانات بحالة pending
     $sql = "INSERT INTO adminUser (id, fingerprint, fingerprint_hash, name, phone, password, role, status, created_at) 
             VALUES (:id, :fp, :fp_hash, :name, :phone, :pass, 'admin', 'pending', NOW())";

backend/core/bootstrap.php

@@ -34,7 +34,13 @@ header("Permissions-Policy: geolocation=(), microphone=(), camera=()");
 header("X-XSS-Protection: 1; mode=block");
 
 
-// CORS (يجب تخصيصه في endpoints مخصصة إن لزم، لكن هذا افتراضي)
+// CORS مع التحقق من المصدر المسموح
+$allowedOrigins = array_map('trim', explode(',', getenv('CORS_ALLOWED_ORIGINS') ?: 'https://siromove.com,https://admin.siromove.com'));
+$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
+if (in_array($origin, $allowedOrigins)) {
+    header("Access-Control-Allow-Origin: $origin");
+    header('Access-Control-Allow-Credentials: true');
+}
 header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
 header('Access-Control-Allow-Headers: Content-Type, Authorization, X-Device-FP, X-HMAC-Auth, X-Internal-Key');
 

backend/load_env.php

@@ -15,7 +15,6 @@ function loadEnvironment($env_file) {
             $value = trim($value, "\"'");
             putenv("$keyName=$value");
             $_ENV[$keyName] = $value;
-            $_SERVER[$keyName] = $value;
         }
     }