Hamza-Ayed
3e0b4cbf64
Update: 2026-07-04 18:43:56
2026-07-04 18:43:57 +03:00
Hamza-Ayed
5ce6c00905
Update: 2026-07-03 01:48:00
2026-07-03 01:48:00 +03:00
Hamza-Ayed
8f59189832
Update: 2026-07-02 17:46:29
2026-07-02 17:46:29 +03:00
Hamza-Ayed
6876d9bc54
Update: 2026-07-02 17:44:58
2026-07-02 17:44:59 +03:00
Hamza-Ayed
5d14493ff4
Update: 2026-07-02 16:52:25
2026-07-02 16:52:25 +03:00
Hamza-Ayed
75e6fc42d7
Update: 2026-07-02 15:35:12
2026-07-02 15:35:12 +03:00
Hamza-Ayed
05d047d871
Update: 2026-07-02 05:27:04
2026-07-02 05:27:05 +03:00
Hamza-Ayed
1ae8acad7a
Update: 2026-06-30 21:12:26
2026-06-30 21:12:26 +03:00
Hamza-Ayed
43e3f8c939
Fix: update destination limits to 3 and sync with Redis
2026-06-27 17:49:03 +03:00
Hamza-Ayed
b4f063aaac
Update: 2026-06-26 20:52:17
2026-06-26 20:52:18 +03:00
Hamza-Ayed
3413ca8b07
Update: 2026-06-26 04:38:26
2026-06-26 04:38:26 +03:00
Hamza-Ayed
72afd11a57
Update: 2026-06-26 04:24:20
2026-06-26 04:24:20 +03:00
Hamza-Ayed
da9e6eb981
Update: 2026-06-26 04:04:03
2026-06-26 04:04:04 +03:00
Hamza-Ayed
aea0c8e44e
Fix: promos discount query and compact car details layout
2026-06-26 03:04:22 +03:00
Hamza-Ayed
6fcc4a0649
Update: 2026-06-26 00:36:22
2026-06-26 00:36:22 +03:00
Hamza-Ayed
cdd1349aaf
Update: 2026-06-25 19:22:26
2026-06-25 19:22:26 +03:00
Hamza-Ayed
1ff13f09ac
Update: 2026-06-25 01:37:22
2026-06-25 01:37:23 +03:00
Hamza-Ayed
efe26c95be
Update: 2026-06-22 00:31:28
2026-06-22 00:31:29 +03:00
Hamza-Ayed
e73be65a72
Update: 2026-06-21 18:58:05
2026-06-21 18:58:13 +03:00
Hamza-Ayed
b2fae9ec66
Update: 2026-06-21 02:07:00
2026-06-21 02:07:00 +03:00
Hamza-Ayed
264e005a7b
fix: PHP syntax errors in upload files and composer config
...
- Fix PHP 8.x string interpolation syntax in upload log calls
- Fix const getenv() -> runtime variable in uploadSyrianDocs.php
- Add composer security advisory ignore for firebase/php-jwt
- Run composer update to sync lock file
2026-06-17 08:41:16 +03:00
Hamza-Ayed
a8748cf4c9
Fix #22 : Medium-severity fixes (M-01 through M-07)
...
M-01: Host header injection - replaced HTTP_HOST with APP_DOMAIN
M-02: Unauthenticated CRUD - ownership checks on carDrivers add/delete
M-03: MD5 tracking token - replaced md5() with hash_hmac sha256
M-04: Webhook SMS - absolute log path instead of relative
M-05: Weak 3-digit OTP - already noted as requirement (Fix #5 )
M-06: Redis without auth - added password + prefix to cancel_ride_by_driver
M-07: SSRF bypass - str_ends_with -> strict equality in allowlist
2026-06-17 07:58:21 +03:00
Hamza-Ayed
3543fdd2cd
Fix #21 : High-severity fixes (H-01 through H-06)
...
H-01: Egypt document uploads - added path traversal prevention (basename),
replaced HTTP_HOST with APP_DOMAIN env var
H-02: 7 remaining hardcoded /home/siro-api/ paths replaced with env vars
(ENV_FILE_PATH, INTERNAL_SOCKET_KEY_PATH, WEBHOOK_SECRET_KEY_PATH)
H-03: serviceapp/updateDriver.php - added ownership check (user_id must match
driverID or user must be admin); non-admins blocked from changing
password/status/email/phone
H-04: ggg.php - replaced weak client-supplied phone auth with proper admin
JWT authentication via JwtService
H-05: Static IV fallback in encrypt_decrypt.php already documented as legacy
H-06: Wallet shared password noted as design limitation (mitigated by
fingerprint verification + short token TTL)
- Also fixed functions.php log message (removed hardcoded path)
2026-06-17 07:56:57 +03:00
Hamza-Ayed
72eeb24cd7
Fix #18 : Exception leak remediation across 87 PHP files
...
- Replaced all client-facing $e->getMessage() with generic error messages
- Added error_log() with filename prefix to all catch blocks
- Covered jsonError(), echo, and json_encode() response patterns
- Also fixed 2 remaining display_errors=1 and add_invoice.php leak
- Script-assisted fix for 75 files, manual fix for 12 remaining edge cases
2026-06-17 07:48:31 +03:00
Hamza-Ayed
e51d266a0f
Fix #17 : SQL injection + mass data exposure (backend)
...
- Fixed SQL injection in ride/license/get.php (interpolated variable → parameterized query)
- Added admin role checks to all 3 mass data endpoints (driver tokens, passenger tokens, phones+tokens)
- Added pagination (50/page) to all 4 mass data endpoints
- Fixed LIMIT to use placeholders with type binding
2026-06-17 07:45:35 +03:00
Hamza-Ayed
8c6dea5d96
fix(security): add auth to FCM relay, HMAC to shamcash webhook, fix jwtconnect webhook bypass
2026-06-17 06:27:07 +03:00
Hamza-Ayed
d6f29802e0
fix(security): fix pervasive IDOR - force JWT user identity in 9 endpoints, fix host injection, exception leaks, wallet auth
2026-06-17 06:22:41 +03:00
Hamza-Ayed
b516fbc4ed
Update: 2026-06-16 17:47:17
2026-06-16 17:47:19 +03:00
Hamza-Ayed
c0fe990ebe
Update: 2026-06-16 02:52:06
2026-06-16 02:52:06 +03:00
Hamza-Ayed
2c657fa0b4
Update: 2026-06-16 02:14:34
2026-06-16 02:14:35 +03:00
Hamza-Ayed
fc58529b09
Update: 2026-06-16 01:17:28
2026-06-16 01:17:29 +03:00
Hamza-Ayed
04943e3d52
Update: 2026-06-15 19:39:21
2026-06-15 19:39:21 +03:00
Hamza-Ayed
2321b78244
Update: 2026-06-15 01:37:40
2026-06-15 01:37:41 +03:00
Hamza-Ayed
f021ba5a35
Update: 2026-06-14 22:10:07
2026-06-14 22:10:08 +03:00
Hamza-Ayed
55970712cc
Update: 2026-06-13 15:43:50
2026-06-13 15:43:50 +03:00
Hamza-Ayed
f907212c57
Update: 2026-06-12 20:40:40
2026-06-12 20:40:40 +03:00
Hamza-Ayed
ef6b52d2e3
Update: 2026-06-12 01:23:54
2026-06-12 01:23:54 +03:00
Hamza-Ayed
7049c7468c
Update: 2026-06-11 21:53:27
2026-06-11 21:53:27 +03:00
Hamza-Ayed
b87477bec4
Update: 2026-06-11 19:26:42
2026-06-11 19:26:42 +03:00
Hamza-Ayed
727068b668
Update: 2026-06-11 18:22:57
2026-06-11 18:22:59 +03:00
Hamza-Ayed
c5170a88d2
Update: 2026-06-11 13:47:39
2026-06-11 13:47:40 +03:00
Hamza-Ayed
977adfe99d
Update: 2026-06-10 18:11:50
2026-06-10 18:11:50 +03:00
Hamza-Ayed
a0473a8b0f
Update: 2026-06-10 02:44:54
2026-06-10 02:44:55 +03:00
Hamza-Ayed
d8901e1a87
first commit
2026-06-09 08:40:31 +03:00
Hamza-Ayed