Hamza/Siro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update: 2026-06-26 04:04:03

Browse Source
This commit is contained in:
Hamza-Ayed
2026-06-26 04:04:04 +03:00
parent aea0c8e44e
commit da9e6eb981
10 changed files with 325 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
backend/ride/pricing/get.php
View File

@@ -373,6 +373,7 @@ function calculateDynamicPrice($country, $minFare, $distance, $duration, $kazanR
// 2. Validate Promo Code
$discount = 0;
$promo_applied = false;
if (!empty($promo_code)) {
$sqlPromo = "SELECT amount FROM `promos`
WHERE promo_code = :promo_code
@@ -384,10 +385,31 @@ if (!empty($promo_code)) {
':promo_code' => $promo_code,
':passenger_id' => $passenger_id
]);
if ($stmtPromo->rowCount() > 0) {
$promoData = $stmtPromo->fetch(PDO::FETCH_ASSOC);
$discount = (float) $promoData['amount'];
// ✅ FIX P4: إذا لم يُوجد الكود أو كان منتهي الصلاحية → failure فوراً
if ($stmtPromo->rowCount() === 0) {
echo json_encode([
'status' => 'failure',
'message' => 'Promo code not found or has expired',
'applied_discount' => 0,
]);
exit;
}
$promoData = $stmtPromo->fetch(PDO::FETCH_ASSOC);
$discount = (float) $promoData['amount'];
// ✅ FIX P4: إذا كان الخصم صفر → failure مع رسالة واضحة
if ($discount <= 0) {
echo json_encode([
'status' => 'failure',
'message' => 'This promo code has no discount value',
'applied_discount' => 0,
]);
exit;
}
$promo_applied = true;
}
// 3. Fetch Passenger Wallet (Negative Balance / Debt)

16
backend/ride/rides/add_ride.php
View File

@@ -139,18 +139,10 @@ if (!isset($tokenData['prices'][$carType])) {
exit;
}
// ✅ FIX H-05: التحقق من distance و duration في الـ token أيضاً
if (isset($tokenData['distance']) && $tokenData['distance'] != $distance) {
error_log("[add_ride] Security failed — distance mismatch.");
printFailure("Tampered ride data (distance mismatch)");
exit;
}
if (isset($tokenData['duration']) && $tokenData['duration'] != $duration_text) {
error_log("[add_ride] Security failed — duration mismatch.");
printFailure("Tampered ride data (duration mismatch)");
exit;
}
// ✅ FIX P2: تم حذف التحقق من distance و duration
// السبب: token['distance'] هو الإحداثيات بينما $distance هو المسافة بالكيلومتر (0.x)
// وtoken['duration'] هو الثواني بينما $duration_text هو الدقائق — mismatch دائم يكسر جميع الرحلات
// الإحداثيات كافية للتحقق من سلامة الطلب عبر coordsMatch() أعلاه
// Securely override pricing from the cryptographically signed token
$price = $tokenData['prices'][$carType]['price'];