fix(security): add .gitignore, remove PEM keys and debug endpoints from tracking
This commit is contained in:
Hamza-Ayed
96
.gitignore
vendored
Normal file
96
.gitignore
vendored
Normal file
@@ -0,0 +1,96 @@
|
||||
# ============================================================
|
||||
# Siro Project - .gitignore
|
||||
# ============================================================
|
||||
|
||||
# --- Environment & Secrets ---
|
||||
.env
|
||||
.env.*
|
||||
!.env.example
|
||||
**/*.env
|
||||
**/private_key.pem
|
||||
**/public_key.pem
|
||||
*.pem
|
||||
service-account.json
|
||||
**/service-account.json
|
||||
|
||||
# --- IDE & OS ---
|
||||
.DS_Store
|
||||
Thumbs.db
|
||||
*.swp
|
||||
*.swo
|
||||
*~
|
||||
.vscode/
|
||||
.idea/
|
||||
*.iml
|
||||
.ruby-lsp/
|
||||
.kilo/
|
||||
|
||||
# --- Build Artifacts ---
|
||||
node_modules/
|
||||
vendor/
|
||||
**/vendor/
|
||||
build/
|
||||
dist/
|
||||
*.js.map
|
||||
*.css.map
|
||||
|
||||
# --- Flutter/Dart ---
|
||||
.dart_tool/
|
||||
.packages
|
||||
.pub-cache/
|
||||
pubspec.lock
|
||||
*.g.dart
|
||||
**/env.g.dart
|
||||
*.freezed.dart
|
||||
*.config.dart
|
||||
|
||||
# --- Android ---
|
||||
*.apk
|
||||
*.aab
|
||||
*.dex
|
||||
*.class
|
||||
*.keystore
|
||||
local.properties
|
||||
android/.gradle/
|
||||
android/captures/
|
||||
|
||||
# --- iOS ---
|
||||
*.ipa
|
||||
*.dSYM.zip
|
||||
*.dSYM
|
||||
Pods/
|
||||
DerivedData/
|
||||
*.xcworkspace
|
||||
xcuserdata/
|
||||
|
||||
# --- Composer / PHP ---
|
||||
/composer.lock
|
||||
**/composer.lock
|
||||
|
||||
# --- Logs ---
|
||||
*.log
|
||||
logs/
|
||||
**/logs/
|
||||
|
||||
# --- Uploads ---
|
||||
uploads/
|
||||
**/uploads/
|
||||
portrate_captain_image/
|
||||
card_image/
|
||||
imageForUsingApp/
|
||||
new_driver_car/
|
||||
upload_audio/
|
||||
|
||||
# --- Python ---
|
||||
__pycache__/
|
||||
*.pyc
|
||||
.venv/
|
||||
venv/
|
||||
|
||||
# --- Firebase ---
|
||||
.google-services.json
|
||||
GoogleService-Info.plist
|
||||
|
||||
# --- Audit/Scan Output ---
|
||||
semgrep_*.json
|
||||
nuclei_results.txt
|
||||
@@ -1,10 +0,0 @@
|
||||
# 🔒 SECURITY: Block all access to debug files
|
||||
# This directory contains sensitive debugging scripts
|
||||
# DO NOT remove this file in production
|
||||
|
||||
<RequireAll>
|
||||
Require all denied
|
||||
</RequireAll>
|
||||
|
||||
# Alternative for older Apache:
|
||||
# Deny from all
|
||||
@@ -1,13 +0,0 @@
|
||||
<?php
|
||||
require_once 'connect.php';
|
||||
|
||||
try {
|
||||
$stmt = $con->query("SELECT phone FROM driver LIMIT 10");
|
||||
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
||||
foreach ($rows as $row) {
|
||||
echo "Raw: " . $row['phone'] . " | Decrypted: " . $encryptionHelper->decryptData($row['phone']) . "\n";
|
||||
}
|
||||
} catch (Exception $e) {
|
||||
echo "An error occurred.";
|
||||
}
|
||||
?>
|
||||
@@ -1,11 +0,0 @@
|
||||
<?php
|
||||
require_once 'connect.php';
|
||||
|
||||
try {
|
||||
$stmt = $con->query("DESCRIBE users");
|
||||
$cols = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
||||
echo json_encode($cols, JSON_PRETTY_PRINT);
|
||||
} catch (Exception $e) {
|
||||
echo "An error occurred.";
|
||||
}
|
||||
?>
|
||||
@@ -1,23 +0,0 @@
|
||||
<?php
|
||||
require_once __DIR__ . '/connect.php';
|
||||
|
||||
$searchPhone = '0992952235';
|
||||
echo "Searching for: $searchPhone\n";
|
||||
|
||||
$variants = [$searchPhone, '963' . substr($searchPhone, 1), '+963' . substr($searchPhone, 1)];
|
||||
|
||||
foreach ($variants as $v) {
|
||||
echo "Checking variant: $v\n";
|
||||
$enc = $encryptionHelper->encryptData($v);
|
||||
|
||||
$stmt = $con->prepare("SELECT id, phone, first_name FROM driver WHERE phone = ? OR phone = ?");
|
||||
$stmt->execute([$v, $enc]);
|
||||
$res = $stmt->fetch();
|
||||
|
||||
if ($res) {
|
||||
echo "FOUND! ID: {$res['id']}, Name: {$res['first_name']}, Phone in DB: {$res['phone']}\n";
|
||||
exit;
|
||||
}
|
||||
}
|
||||
|
||||
echo "NOT FOUND in driver table.\n";
|
||||
@@ -1,57 +0,0 @@
|
||||
<?php
|
||||
// env_test.php - أداة مخصصة لاختبار جميع متغيرات البيئة
|
||||
require_once __DIR__ . '/core/bootstrap.php'; // لتحميل الـ .env
|
||||
|
||||
header('Content-Type: text/plain; charset=utf-8');
|
||||
|
||||
echo "=== فحص متغيرات البيئة (Environment Variables) ===\n\n";
|
||||
|
||||
$keysToCheck = [
|
||||
'PASSENGER_SOCKET_URL',
|
||||
'LOCATION_SOCKET_URL',
|
||||
'INTERNAL_SOCKET_KEY_PATH',
|
||||
'SECRET_KEY_PAY_PATH',
|
||||
'SECRET_KEY_HMAC',
|
||||
'allowed1',
|
||||
'allowed2',
|
||||
'passwordnewpassenger',
|
||||
'FP_PEPPER'
|
||||
];
|
||||
|
||||
foreach ($keysToCheck as $key) {
|
||||
$val = getenv($key);
|
||||
if ($val !== false && $val !== '') {
|
||||
// إخفاء جزء من القيم الحساسة مثل كلمات المرور
|
||||
if (strpos(strtolower($key), 'password') !== false || strpos(strtolower($key), 'secret') !== false || strpos(strtolower($key), 'hmac') !== false) {
|
||||
$hiddenVal = substr($val, 0, 3) . '***' . substr($val, -3);
|
||||
echo "[OK] $key = $hiddenVal\n";
|
||||
} else {
|
||||
echo "[OK] $key = $val\n";
|
||||
}
|
||||
} else {
|
||||
echo "[ERROR] $key = (مفقود أو فارغ!)\n";
|
||||
}
|
||||
}
|
||||
|
||||
echo "\n\n=== فحص الملفات المباشرة ===\n\n";
|
||||
|
||||
$filesToCheck = [
|
||||
'/home/siro-api/.internal_socket_key',
|
||||
'/home/siro-api/.secret_key_pay'
|
||||
];
|
||||
|
||||
foreach ($filesToCheck as $file) {
|
||||
if (file_exists($file)) {
|
||||
$content = trim(file_get_contents($file));
|
||||
if (!empty($content)) {
|
||||
$hidden = substr($content, 0, 3) . '***' . substr($content, -3);
|
||||
echo "[OK] File ($file) exists and has content: $hidden\n";
|
||||
} else {
|
||||
echo "[WARNING] File ($file) exists but is EMPTY!\n";
|
||||
}
|
||||
} else {
|
||||
echo "[ERROR] File ($file) DOES NOT EXIST!\n";
|
||||
}
|
||||
}
|
||||
|
||||
echo "\n=== انتهى الفحص ===\n";
|
||||
@@ -1,78 +0,0 @@
|
||||
<?php
|
||||
include 'connect.php';
|
||||
|
||||
// نضمن أن الرد دائماً JSON
|
||||
header('Content-Type: application/json; charset=utf-8');
|
||||
|
||||
// 1) قراءة الـ body كـ JSON (من Flutter)
|
||||
$raw = file_get_contents('php://input');
|
||||
$data = json_decode($raw, true);
|
||||
|
||||
if (!is_array($data)) {
|
||||
// fallback لو أرسلت form-data أو x-www-form-urlencoded
|
||||
$data = $_POST;
|
||||
}
|
||||
|
||||
// 2) التحقق من رقم هاتف الأدمن المصرّح له
|
||||
|
||||
// قراءة الأرقام المسموح لها من الـ ENV
|
||||
$phonesRaw = getenv('ADMIN_PHONE_NUMBERS') ?: '';
|
||||
$ALLOWED_TOOL_PHONES = array_values(
|
||||
array_filter(
|
||||
array_map(function ($p) {
|
||||
// إزالة أي رموز غير رقمية (مسافات، +، - إلخ)
|
||||
return preg_replace('/\D+/', '', $p);
|
||||
}, explode(',', $phonesRaw))
|
||||
)
|
||||
);
|
||||
|
||||
// رقم الهاتف القادم من Flutter (parameter جديد)
|
||||
$adminPhoneParam = isset($data['admin_phone'])
|
||||
? preg_replace('/\D+/', '', $data['admin_phone'])
|
||||
: '';
|
||||
|
||||
// إذا لم يُرسل رقم أو لم يكن ضمن القائمة → منع الوصول
|
||||
if ($adminPhoneParam === '' || !in_array($adminPhoneParam, $ALLOWED_TOOL_PHONES, true)) {
|
||||
http_response_code(403);
|
||||
echo json_encode([
|
||||
'status' => 'error',
|
||||
'message' => 'Access denied for this admin phone.',
|
||||
]);
|
||||
exit;
|
||||
}
|
||||
|
||||
// 3) التحقق من بقية المدخلات (action + text)
|
||||
$action = $data['action'] ?? '';
|
||||
$text = trim($data['text'] ?? '');
|
||||
|
||||
if ($text === '' || ($action !== 'encrypt' && $action !== 'decrypt')) {
|
||||
http_response_code(400);
|
||||
echo json_encode([
|
||||
'status' => 'error',
|
||||
'message' => 'Invalid input: need action=encrypt|decrypt and non-empty text.',
|
||||
]);
|
||||
exit;
|
||||
}
|
||||
|
||||
// 4) تنفيذ التشفير / الفك
|
||||
try {
|
||||
// require_once __DIR__ . '/encrypt_decrypt.php';
|
||||
|
||||
if ($action === 'encrypt') {
|
||||
$result = $encryptionHelper->encryptData($text);
|
||||
} else { // decrypt
|
||||
$result = $encryptionHelper->decryptData($text);
|
||||
}
|
||||
|
||||
echo json_encode([
|
||||
'status' => 'success',
|
||||
'action' => $action,
|
||||
'result' => (string) $result,
|
||||
]);
|
||||
} catch (Exception $e) {
|
||||
http_response_code(500);
|
||||
echo json_encode([
|
||||
'status' => 'error',
|
||||
'message' => 'Operation failed.',
|
||||
]);
|
||||
}
|
||||
@@ -1,23 +0,0 @@
|
||||
<?php
|
||||
require_once 'connect.php';
|
||||
|
||||
echo "--- ADMIN TABLE ---\n";
|
||||
try {
|
||||
$stmt = $con->prepare("SELECT id, name, role FROM admin");
|
||||
$stmt->execute();
|
||||
$admins = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
||||
print_r($admins);
|
||||
} catch (Exception $e) {
|
||||
echo "Error: " . $e->getMessage() . "\n";
|
||||
}
|
||||
|
||||
echo "\n--- DATABASES ---\n";
|
||||
try {
|
||||
$stmt = $con->prepare("SHOW DATABASES");
|
||||
$stmt->execute();
|
||||
$dbs = $stmt->fetchAll(PDO::FETCH_COLUMN);
|
||||
print_r($dbs);
|
||||
} catch (Exception $e) {
|
||||
echo "Error: " . $e->getMessage() . "\n";
|
||||
}
|
||||
?>
|
||||
@@ -1,2 +0,0 @@
|
||||
<?php
|
||||
echo ini_get('error_log');
|
||||
@@ -1,13 +0,0 @@
|
||||
<?php
|
||||
require_once __DIR__ . '/../core/bootstrap.php';
|
||||
require_once __DIR__ . '/../functions.php';
|
||||
|
||||
$con = Database::get('main');
|
||||
$lat = 32.11171;
|
||||
$lng = 36.06737;
|
||||
$carType = 'Fixed Price';
|
||||
|
||||
echo "Testing findBestDrivers...\n";
|
||||
$drivers = findBestDrivers($con, $lat, $lng, $carType);
|
||||
print_r($drivers);
|
||||
echo "Done.\n";
|
||||
@@ -1,10 +0,0 @@
|
||||
<?php
|
||||
require_once __DIR__ . '/../core/bootstrap.php';
|
||||
$redis = getRedis(); // or however it's connected in bootstrap
|
||||
if (!$redis) {
|
||||
echo "No redis\n"; exit;
|
||||
}
|
||||
$redis->geoadd('geo:rides:waiting', 36.0, 32.0, 'test_ride');
|
||||
$res = $redis->georadius('geo:rides:waiting', 36.0, 32.0, 10, 'km', ['WITHDIST' => true]);
|
||||
print_r($res);
|
||||
echo json_encode($res) . "\n";
|
||||
@@ -1,15 +0,0 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIICXwIBAAKBgQDOhVAdUyxFpVNSyjRndMWEPAN9vJEetMzLbjF9DTn2lPVuRj/M
|
||||
kwq9wCNhy+tdeX2lIn4K3EkONBvYJubBhxnYOoQuMchPW5vG7VnmpLjZ7TkpM2n9
|
||||
fcMu8u1GkLatLblDI4LTfvn3851+nhpnYlUVkjw5GAhH4XnEpveIjqDhzQIDAQAB
|
||||
AoGBALRcAvqJT8nHN7y+8QNFHNZ+XwIpc4egmJY1Ny0iJvPtZWaYHVG5PRE4Qu4+
|
||||
29+3oX5dYDx146tu4L5mQvLS3ULBsvxaUZt2lT/vxkQzI9pNfXw584WvIrbtxQod
|
||||
ILvBcnamwQa9hEOIFZVyZ/hzkzUcMO6cAXqvsfqqPgJhm7PBAkEA+xgE9CUOLDFl
|
||||
vLePQKGcHIUOsPLr16qNEgGhTW7Km3OMMqoB2f7t67xOHGqK6tnANRM4Sk6IModI
|
||||
wbZuVh4jMQJBANKOVmIdDLNffZVHp90SDRG7/YdK2R5ob361CIkcUzjh927Wfs5W
|
||||
A/WroB7eJ7pWiq2BMaj/xq65nYaCOldvaV0CQQDm12c+eY61DFjnDa6ykaEvCxi9
|
||||
jydJp+93vW3o/VFhZvJeZbO8EcX0MrNxJnY+gSBW6yuWDOrj4UH/bVO08pIRAkEA
|
||||
lH3TiBAqo9nlTEEjrnILi4VD0IVFx/8pGnf71A6I1qXuBVn6RfQ9iKWIIBzWccCU
|
||||
vrZNWn1AFntLD9CJ6p3k9QJBAMbSQ9CoXWlOLJRduV15ER1ZyE/inVd4jIvtjAgz
|
||||
b7QaM62Ecxl3D8EI/LTSZV9Oa8D/62cJeMsflVa7gpavL70=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -1,6 +0,0 @@
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqBQZEJXWCQwPsPzBM70M3TjyU
|
||||
5vwCZWoEtUomR9Qu+dEQaa0Hniz6JY8+goCxfMYuZQw6+kimctA2KqzT2pCsJufN
|
||||
b92pSAMZgb0RSTl2y62oJkJd2WY7dj36AvPEyw6DxCFItvFOu7HGl3LlHQBriiw3
|
||||
jwtuS6DO7gbmAJPU8wIDAQAB
|
||||
-----END PUBLIC KEY-----
|
||||
@@ -1,15 +0,0 @@
|
||||
-----BEGIN RSA PRIVATE KEY-----
|
||||
MIICXwIBAAKBgQDOhVAdUyxFpVNSyjRndMWEPAN9vJEetMzLbjF9DTn2lPVuRj/M
|
||||
kwq9wCNhy+tdeX2lIn4K3EkONBvYJubBhxnYOoQuMchPW5vG7VnmpLjZ7TkpM2n9
|
||||
fcMu8u1GkLatLblDI4LTfvn3851+nhpnYlUVkjw5GAhH4XnEpveIjqDhzQIDAQAB
|
||||
AoGBALRcAvqJT8nHN7y+8QNFHNZ+XwIpc4egmJY1Ny0iJvPtZWaYHVG5PRE4Qu4+
|
||||
29+3oX5dYDx146tu4L5mQvLS3ULBsvxaUZt2lT/vxkQzI9pNfXw584WvIrbtxQod
|
||||
ILvBcnamwQa9hEOIFZVyZ/hzkzUcMO6cAXqvsfqqPgJhm7PBAkEA+xgE9CUOLDFl
|
||||
vLePQKGcHIUOsPLr16qNEgGhTW7Km3OMMqoB2f7t67xOHGqK6tnANRM4Sk6IModI
|
||||
wbZuVh4jMQJBANKOVmIdDLNffZVHp90SDRG7/YdK2R5ob361CIkcUzjh927Wfs5W
|
||||
A/WroB7eJ7pWiq2BMaj/xq65nYaCOldvaV0CQQDm12c+eY61DFjnDa6ykaEvCxi9
|
||||
jydJp+93vW3o/VFhZvJeZbO8EcX0MrNxJnY+gSBW6yuWDOrj4UH/bVO08pIRAkEA
|
||||
lH3TiBAqo9nlTEEjrnILi4VD0IVFx/8pGnf71A6I1qXuBVn6RfQ9iKWIIBzWccCU
|
||||
vrZNWn1AFntLD9CJ6p3k9QJBAMbSQ9CoXWlOLJRduV15ER1ZyE/inVd4jIvtjAgz
|
||||
b7QaM62Ecxl3D8EI/LTSZV9Oa8D/62cJeMsflVa7gpavL70=
|
||||
-----END RSA PRIVATE KEY-----
|
||||
@@ -1,6 +0,0 @@
|
||||
-----BEGIN PUBLIC KEY-----
|
||||
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDqBQZEJXWCQwPsPzBM70M3TjyU
|
||||
5vwCZWoEtUomR9Qu+dEQaa0Hniz6JY8+goCxfMYuZQw6+kimctA2KqzT2pCsJufN
|
||||
b92pSAMZgb0RSTl2y62oJkJd2WY7dj36AvPEyw6DxCFItvFOu7HGl3LlHQBriiw3
|
||||
jwtuS6DO7gbmAJPU8wIDAQAB
|
||||
-----END PUBLIC KEY-----
|
||||
Reference in New Issue
Block a user