fix(security): fix pervasive IDOR - force JWT user identity in 9 endpoints, fix host injection, exception leaks, wallet auth

backend/ride/cancelRide/add.php

@@ -1,12 +1,19 @@
 <?php
 require_once __DIR__ . '/../../connect.php';
 
-// استقبال المتغيرات
-$driverID    = filterRequest("driverID");
-$passengerID = filterRequest("passengerID");
+// استقبال المتغيرات — force user IDs from JWT based on role
 $rideID      = filterRequest("rideID");
 $note        = filterRequest("note");
 
+// Force driverID/passengerID from JWT based on user role
+if ($role === 'driver') {
+    $driverID = $user_id;
+    $passengerID = filterRequest("passengerID");
+} else {
+    $passengerID = $user_id;
+    $driverID = filterRequest("driverID");
+}
+
 // تنفيذ الإدخال بطريقة آمنة
 $sql = "INSERT INTO `canecl` (`driverID`, `passengerID`, `rideID`, `note`) 
         VALUES (:driverID, :passengerID, :rideID, :note)";