Hamza/Siro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
114 Commits 2 Branches 0 Tags
0c9f89fc60ea6d7a5119b81ddb917ec8c2dfa843
Commit Graph

78 Commits

Author SHA1 Message Date
Hamza-Ayed
0c9f89fc60 Update: 2026-06-25 01:15:22 2026-06-25 01:15:22 +03:00
Hamza-Ayed
e157c8ec12 Update: 2026-06-25 01:03:54 2026-06-25 01:03:55 +03:00
Hamza-Ayed
eeb4e21f87 Update: 2026-06-25 00:50:19 2026-06-25 00:50:19 +03:00
Hamza-Ayed
0671388e15 Update: 2026-06-25 00:05:45 2026-06-25 00:05:45 +03:00
Hamza-Ayed
262d882bfe Fix loginFromGooglePassenger to support passengerID request body fallback during first-time registration login flow 2026-06-25 00:02:38 +03:00
Hamza-Ayed
8839a500fc Add diagnose_login.php for database query diagnostics 2026-06-25 00:00:37 +03:00
Hamza-Ayed
a56e318e20 Add check_server_code.php for server diagnostics 2026-06-24 23:59:51 +03:00
Hamza-Ayed
3c057dfbf8 Update: 2026-06-24 23:53:38 2026-06-24 23:53:38 +03:00
Hamza-Ayed
5f431b4f19 Fix loginFromGooglePassenger id mapping fallback to sub when user_id is new 2026-06-24 23:52:32 +03:00
Hamza-Ayed
aba42f0a7f Update: 2026-06-24 23:51:26 2026-06-24 23:51:26 +03:00
Hamza-Ayed
c9d07f91fe Fix loginFromGooglePassenger verification constraint 2026-06-24 23:51:06 +03:00
Hamza-Ayed
d7f5922a3b Fix passenger registration auth bypass in JwtService 2026-06-24 23:47:41 +03:00
Hamza-Ayed
cca16053da Fix OTP verification success response payload and restore deterministic encryptData 2026-06-24 23:24:41 +03:00
Hamza-Ayed
2ee3a14c6d Fix OTP verification success response payload and restore deterministic encryptData 2026-06-24 23:11:24 +03:00
Hamza-Ayed
7b0283473e Fix timezone bug in request.php using MySQL DATE_ADD and clean up EncryptionHelper 2026-06-24 23:03:45 +03:00
Hamza-Ayed
12dfb25629 Update: 2026-06-24 22:56:39 2026-06-24 22:56:39 +03:00
Hamza-Ayed
f75e456aac Update: 2026-06-24 16:27:39 2026-06-24 16:27:41 +03:00
Hamza-Ayed
2e4bf784ec Update: 2026-06-24 16:18:03 2026-06-24 16:18:03 +03:00
Hamza-Ayed
dfeea2d95a Update: 2026-06-24 16:15:00 2026-06-24 16:15:01 +03:00
Hamza-Ayed
6866e2171b Update: 2026-06-24 16:12:30 2026-06-24 16:12:30 +03:00
Hamza-Ayed
89dca66892 Update: 2026-06-24 16:08:47 2026-06-24 16:08:47 +03:00
Hamza-Ayed
4894d566a0 Update: 2026-06-24 16:04:53 2026-06-24 16:04:53 +03:00
Hamza-Ayed
3b2c2a86c6 Update: 2026-06-23 18:44:45 2026-06-23 18:44:45 +03:00
Hamza-Ayed
ed6e34cc4b Update: 2026-06-23 18:36:09 2026-06-23 18:36:09 +03:00
Hamza-Ayed
bb13eb74e8 Update: 2026-06-23 18:32:23 2026-06-23 18:32:23 +03:00
Hamza-Ayed
e4f86c5efd Update: 2026-06-23 18:27:04 2026-06-23 18:27:04 +03:00
Hamza-Ayed
4043d939f2 Update: 2026-06-23 18:21:54 2026-06-23 18:21:54 +03:00
Hamza-Ayed
f25066140f Update: 2026-06-23 18:19:33 2026-06-23 18:19:33 +03:00
Hamza-Ayed
c859b8006b Update: 2026-06-23 18:18:30 2026-06-23 18:18:30 +03:00
Hamza-Ayed
342611a158 Update: 2026-06-23 18:12:45 2026-06-23 18:12:45 +03:00
Hamza-Ayed
b110e03039 Update: 2026-06-23 17:58:46 2026-06-23 17:58:46 +03:00
Hamza-Ayed
6ad7aceee1 Update: 2026-06-23 17:46:32 2026-06-23 17:46:33 +03:00
Hamza-Ayed
52c4f96976 Update: 2026-06-23 17:42:09 2026-06-23 17:42:09 +03:00
Hamza-Ayed
148ca3af1d Update: 2026-06-23 17:25:29 2026-06-23 17:25:29 +03:00
Hamza-Ayed
bea94ed617 Update: 2026-06-23 15:35:14 2026-06-23 15:35:14 +03:00
Hamza-Ayed
efe26c95be Update: 2026-06-22 00:31:28 2026-06-22 00:31:29 +03:00
Hamza-Ayed
e73be65a72 Update: 2026-06-21 18:58:05 2026-06-21 18:58:13 +03:00
Hamza-Ayed
b492b5076b feat: implement accessibility-based scraper service and standalone worker backend with device registration UI 2026-06-21 15:21:16 +03:00
Hamza-Ayed
2ac086d1fd Update: 2026-06-21 02:53:01 2026-06-21 02:53:02 +03:00
Hamza-Ayed
b2fae9ec66 Update: 2026-06-21 02:07:00 2026-06-21 02:07:00 +03:00
Hamza-Ayed
f13faa8c31 Update: 2026-06-18 16:46:30 2026-06-18 16:46:30 +03:00
Hamza-Ayed
8b52d2f115 feat: add Nabeh integration with phone-to-user resolution and environment configuration support 2026-06-18 14:59:24 +03:00
Hamza-Ayed
72fa97477b Update: 2026-06-17 18:22:52 2026-06-17 18:22:52 +03:00
Hamza-Ayed
b67417eb98 Add Nabeh integration: nabeh/ endpoints with NABEH_API_KEY auth 2026-06-17 18:22:45 +03:00
Hamza-Ayed
264e005a7b fix: PHP syntax errors in upload files and composer config 
- Fix PHP 8.x string interpolation syntax in upload log calls
- Fix const getenv() -> runtime variable in uploadSyrianDocs.php
- Add composer security advisory ignore for firebase/php-jwt
- Run composer update to sync lock file
 2026-06-17 08:41:16 +03:00
Hamza-Ayed
a8748cf4c9 Fix #22: Medium-severity fixes (M-01 through M-07) 
M-01: Host header injection - replaced HTTP_HOST with APP_DOMAIN
M-02: Unauthenticated CRUD - ownership checks on carDrivers add/delete
M-03: MD5 tracking token - replaced md5() with hash_hmac sha256
M-04: Webhook SMS - absolute log path instead of relative
M-05: Weak 3-digit OTP - already noted as requirement (Fix #5)
M-06: Redis without auth - added password + prefix to cancel_ride_by_driver
M-07: SSRF bypass - str_ends_with -> strict equality in allowlist
 2026-06-17 07:58:21 +03:00
Hamza-Ayed
3543fdd2cd Fix #21: High-severity fixes (H-01 through H-06) 
H-01: Egypt document uploads - added path traversal prevention (basename),
       replaced HTTP_HOST with APP_DOMAIN env var
H-02: 7 remaining hardcoded /home/siro-api/ paths replaced with env vars
       (ENV_FILE_PATH, INTERNAL_SOCKET_KEY_PATH, WEBHOOK_SECRET_KEY_PATH)
H-03: serviceapp/updateDriver.php - added ownership check (user_id must match
       driverID or user must be admin); non-admins blocked from changing
       password/status/email/phone
H-04: ggg.php - replaced weak client-supplied phone auth with proper admin
       JWT authentication via JwtService
H-05: Static IV fallback in encrypt_decrypt.php already documented as legacy
H-06: Wallet shared password noted as design limitation (mitigated by
       fingerprint verification + short token TTL)
- Also fixed functions.php log message (removed hardcoded path)
 2026-06-17 07:56:57 +03:00
Hamza-Ayed
50a5308f43 Fix #20: DDL removal from register.php, CORS policy, secret leak 
- Removed ALTER TABLE DDL statements from Admin/auth/register.php (belongs in migration scripts)
- Added validated CORS with configurable allowed origins via CORS_ALLOWED_ORIGINS env var
- Removed  assignment in load_env.php (secrets no longer exposed in superglobal)
 2026-06-17 07:51:01 +03:00
Hamza-Ayed
2d607d9e90 Fix #19: Plaintext OTP hashing + hardcoded server paths 
- Changed OTP storage in Admin/auth/login.php from plaintext to sha256 hash
- Updated Admin/auth/verify_login.php to hash user input before comparison
- Replaced hardcoded /home/siro-api/ paths with environment variables:
  - ERROR_LOG_PATH, ENV_FILE_PATH, SECRET_KEY_PAY_PATH, SECRET_KEY_PATH
  - Falls back to __DIR__-relative paths when env vars are unset
 2026-06-17 07:49:46 +03:00
Hamza-Ayed
72eeb24cd7 Fix #18: Exception leak remediation across 87 PHP files 
- Replaced all client-facing $e->getMessage() with generic error messages
- Added error_log() with filename prefix to all catch blocks
- Covered jsonError(), echo, and json_encode() response patterns
- Also fixed 2 remaining display_errors=1 and add_invoice.php leak
- Script-assisted fix for 75 files, manual fix for 12 remaining edge cases
 2026-06-17 07:48:31 +03:00