Update: 2026-06-29 00:07:33

backend/auth/syria/uploadImage.php

@@ -72,7 +72,7 @@ $result['path'] = $simplePath;
 
 // --------- بناء الرابط العام ---------
 $protocol = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') ? 'https' : 'http';
-$host = getenv('APP_DOMAIN') ?: ($_SERVER['HTTP_HOST'] ?? 'api.siromove.com');
+$host = $_SERVER['HTTP_HOST'] ?? (getenv('APP_DOMAIN') ?: 'api.siromove.com');
 
 $basePath = rtrim(dirname(dirname(dirname($_SERVER['SCRIPT_NAME']))), '/');
 $url = "$protocol://$host{$basePath}/auth/uploads/{$country}/{$result['filename']}";

backend/connect.php

@@ -5,6 +5,21 @@
 // ============================================================
 
 require_once __DIR__ . '/core/bootstrap.php';
+
+// --------- تحقق من تطابق المنطقة (Region Mismatch Guard) ---------
+$requestHost = $_SERVER['HTTP_HOST'] ?? '';
+$appDomain = getenv('APP_DOMAIN') ?: '';
+if (!empty($appDomain) && !empty($requestHost) && strtolower($requestHost) !== strtolower($appDomain)) {
+    if ($requestHost !== 'localhost' && !preg_match('/^127\.0\.0\./', $requestHost)) {
+        http_response_code(400);
+        exit(json_encode([
+            'status' => 'failure',
+            'error_code' => 'REGION_MISMATCH',
+            'message' => "Region mismatch: Request host '$requestHost' does not match server domain '$appDomain'."
+        ]));
+    }
+}
+
 require_once __DIR__ . '/functions.php';
 
 // 1. Rate Limiting and JWT Authentication

backend/reset_driver.php

@@ -1,10 +0,0 @@
-<?php
-require_once __DIR__ . '/core/bootstrap.php';
-try {
-    $db = Database::get('main');
-    $stmt = $db->prepare("UPDATE drivers SET status = 'pending_review' WHERE driverID = 'TEST202606252141546122'");
-    $stmt->execute();
-    echo "Driver status updated to pending_review successfully!";
-} catch (Exception $e) {
-    echo "Error: " . $e->getMessage();
-}