Update: 2026-06-29 01:12:38

backend/auth/loginUsingCredentialsWithoutGooglePassenger.php

@@ -25,10 +25,6 @@ $allowedEmails = array_filter(array_map('trim', explode(',', $allowedTesterEmail
 
 $cleanEmail = strtolower(trim($email));
 $isTester = in_array($cleanEmail, $allowedEmails) || substr($cleanEmail, -13) === '@siromove.com';
-if (!$isTester) {
-    echo json_encode(["status" => "failure", "message" => "Access denied. Only tester accounts are allowed."]);
-    exit();
-}
 
 try {
     $con = Database::get('main');
@@ -37,19 +33,7 @@ try {
     $encryptedEmail = $encryptionHelper->encryptData($email);
 
     $sql = "SELECT
-                p.`id`,
-                p.`phone`,
-                p.`email`,
-                p.`gender`,
-                p.`status`,
-                p.`birthdate`,
-                p.`site`,
-                p.`first_name`,
-                p.`last_name`,
-                p.`sosPhone`,
-                p.`education`,
-                p.`employmentType`,
-                p.`maritalStatus`,
+                p.*,
                 phone_verification_passenger.verified,
                 invitesToPassengers.isInstall,
                 invitesToPassengers.inviteCode,
@@ -72,6 +56,12 @@ try {
     $count = $stmt->rowCount();
 
     if ($count > 0) {
+        // التحقق من أن الحساب معلم كحساب فحص في قاعدة البيانات أو البيئة
+        $isTestInDb = (isset($data['is_test']) && $data['is_test'] == 1) || (isset($data['isTest']) && $data['isTest'] == 1);
+        if (!$isTestInDb && !$isTester) {
+            jsonError("Access denied. Not a tester account.");
+            exit();
+        }
         // فك تشفير البيانات للرد
         if(isset($data['phone'])) $data['phone'] = $encryptionHelper->decryptData($data['phone']);
         if(isset($data['email'])) $data['email'] = $encryptionHelper->decryptData($data['email']);