Hamza-Ayed
b18fd027b6
Update: 2026-07-10 03:04:06
2026-07-10 03:04:06 +03:00
Hamza-Ayed
a526dae042
Update: 2026-07-09 04:13:14
2026-07-09 04:13:14 +03:00
Hamza-Ayed
70718946f5
Update: 2026-07-09 03:41:48
2026-07-09 03:41:48 +03:00
Hamza-Ayed
7dff7b6973
Update: 2026-07-09 01:55:25
2026-07-09 01:55:25 +03:00
Hamza-Ayed
d452f9baa9
feat: integrate seasonal surge multipliers and grid-specific commission discounts into pricing logic
2026-07-08 23:23:44 +03:00
Hamza-Ayed
21877153eb
feat: harden backend security with HMAC verification, SSL validation, and documentation updates while removing legacy scripts.
2026-07-08 22:10:01 +03:00
Hamza-Ayed
628e169552
Update: 2026-07-07 04:57:50
2026-07-07 04:57:51 +03:00
Hamza-Ayed
d6ab09c19b
Update: 2026-07-06 18:23:46
2026-07-06 18:23:46 +03:00
Hamza-Ayed
9d7e2b412e
Update: 2026-07-06 02:55:17
2026-07-06 02:55:17 +03:00
Hamza-Ayed
8b5daf6566
Update: 2026-07-06 02:52:45
2026-07-06 02:52:46 +03:00
Hamza-Ayed
47a6fbb308
Update: 2026-07-06 02:43:48
2026-07-06 02:43:48 +03:00
Hamza-Ayed
035fa5c209
Update: 2026-07-06 02:40:45
2026-07-06 02:40:45 +03:00
Hamza-Ayed
785802221a
Update: 2026-07-06 02:37:04
2026-07-06 02:37:05 +03:00
Hamza-Ayed
61e7787d54
Update: 2026-07-06 02:31:40
2026-07-06 02:31:40 +03:00
Hamza-Ayed
775d6dd0f3
Update: 2026-07-06 02:24:21
2026-07-06 02:24:21 +03:00
Hamza-Ayed
7bcfed3ce1
Update: 2026-07-06 02:17:53
2026-07-06 02:17:53 +03:00
Hamza-Ayed
6dccb63178
Update: 2026-07-06 02:13:27
2026-07-06 02:13:28 +03:00
Hamza-Ayed
ac50598ee0
Update: 2026-07-06 02:07:30
2026-07-06 02:07:30 +03:00
Hamza-Ayed
8d9126bb45
Update: 2026-07-06 02:04:01
2026-07-06 02:04:01 +03:00
Hamza-Ayed
c24e921bac
Update: 2026-07-06 01:47:37
2026-07-06 01:47:37 +03:00
Hamza-Ayed
e7453cb6f9
Update: 2026-07-06 01:31:52
2026-07-06 01:31:53 +03:00
Hamza-Ayed
bec8f61d70
Update: 2026-07-06 01:28:23
2026-07-06 01:28:23 +03:00
Hamza-Ayed
d00502769a
Update: 2026-07-06 00:53:15
2026-07-06 00:53:15 +03:00
Hamza-Ayed
3e0b4cbf64
Update: 2026-07-04 18:43:56
2026-07-04 18:43:57 +03:00
Hamza-Ayed
5ce6c00905
Update: 2026-07-03 01:48:00
2026-07-03 01:48:00 +03:00
Hamza-Ayed
8f59189832
Update: 2026-07-02 17:46:29
2026-07-02 17:46:29 +03:00
Hamza-Ayed
6876d9bc54
Update: 2026-07-02 17:44:58
2026-07-02 17:44:59 +03:00
Hamza-Ayed
5d14493ff4
Update: 2026-07-02 16:52:25
2026-07-02 16:52:25 +03:00
Hamza-Ayed
75e6fc42d7
Update: 2026-07-02 15:35:12
2026-07-02 15:35:12 +03:00
Hamza-Ayed
05d047d871
Update: 2026-07-02 05:27:04
2026-07-02 05:27:05 +03:00
Hamza-Ayed
1ae8acad7a
Update: 2026-06-30 21:12:26
2026-06-30 21:12:26 +03:00
Hamza-Ayed
43e3f8c939
Fix: update destination limits to 3 and sync with Redis
2026-06-27 17:49:03 +03:00
Hamza-Ayed
b4f063aaac
Update: 2026-06-26 20:52:17
2026-06-26 20:52:18 +03:00
Hamza-Ayed
3413ca8b07
Update: 2026-06-26 04:38:26
2026-06-26 04:38:26 +03:00
Hamza-Ayed
72afd11a57
Update: 2026-06-26 04:24:20
2026-06-26 04:24:20 +03:00
Hamza-Ayed
da9e6eb981
Update: 2026-06-26 04:04:03
2026-06-26 04:04:04 +03:00
Hamza-Ayed
aea0c8e44e
Fix: promos discount query and compact car details layout
2026-06-26 03:04:22 +03:00
Hamza-Ayed
6fcc4a0649
Update: 2026-06-26 00:36:22
2026-06-26 00:36:22 +03:00
Hamza-Ayed
cdd1349aaf
Update: 2026-06-25 19:22:26
2026-06-25 19:22:26 +03:00
Hamza-Ayed
1ff13f09ac
Update: 2026-06-25 01:37:22
2026-06-25 01:37:23 +03:00
Hamza-Ayed
efe26c95be
Update: 2026-06-22 00:31:28
2026-06-22 00:31:29 +03:00
Hamza-Ayed
e73be65a72
Update: 2026-06-21 18:58:05
2026-06-21 18:58:13 +03:00
Hamza-Ayed
b2fae9ec66
Update: 2026-06-21 02:07:00
2026-06-21 02:07:00 +03:00
Hamza-Ayed
264e005a7b
fix: PHP syntax errors in upload files and composer config
...
- Fix PHP 8.x string interpolation syntax in upload log calls
- Fix const getenv() -> runtime variable in uploadSyrianDocs.php
- Add composer security advisory ignore for firebase/php-jwt
- Run composer update to sync lock file
2026-06-17 08:41:16 +03:00
Hamza-Ayed
a8748cf4c9
Fix #22 : Medium-severity fixes (M-01 through M-07)
...
M-01: Host header injection - replaced HTTP_HOST with APP_DOMAIN
M-02: Unauthenticated CRUD - ownership checks on carDrivers add/delete
M-03: MD5 tracking token - replaced md5() with hash_hmac sha256
M-04: Webhook SMS - absolute log path instead of relative
M-05: Weak 3-digit OTP - already noted as requirement (Fix #5 )
M-06: Redis without auth - added password + prefix to cancel_ride_by_driver
M-07: SSRF bypass - str_ends_with -> strict equality in allowlist
2026-06-17 07:58:21 +03:00
Hamza-Ayed
3543fdd2cd
Fix #21 : High-severity fixes (H-01 through H-06)
...
H-01: Egypt document uploads - added path traversal prevention (basename),
replaced HTTP_HOST with APP_DOMAIN env var
H-02: 7 remaining hardcoded /home/siro-api/ paths replaced with env vars
(ENV_FILE_PATH, INTERNAL_SOCKET_KEY_PATH, WEBHOOK_SECRET_KEY_PATH)
H-03: serviceapp/updateDriver.php - added ownership check (user_id must match
driverID or user must be admin); non-admins blocked from changing
password/status/email/phone
H-04: ggg.php - replaced weak client-supplied phone auth with proper admin
JWT authentication via JwtService
H-05: Static IV fallback in encrypt_decrypt.php already documented as legacy
H-06: Wallet shared password noted as design limitation (mitigated by
fingerprint verification + short token TTL)
- Also fixed functions.php log message (removed hardcoded path)
2026-06-17 07:56:57 +03:00
Hamza-Ayed
72eeb24cd7
Fix #18 : Exception leak remediation across 87 PHP files
...
- Replaced all client-facing $e->getMessage() with generic error messages
- Added error_log() with filename prefix to all catch blocks
- Covered jsonError(), echo, and json_encode() response patterns
- Also fixed 2 remaining display_errors=1 and add_invoice.php leak
- Script-assisted fix for 75 files, manual fix for 12 remaining edge cases
2026-06-17 07:48:31 +03:00
Hamza-Ayed
e51d266a0f
Fix #17 : SQL injection + mass data exposure (backend)
...
- Fixed SQL injection in ride/license/get.php (interpolated variable → parameterized query)
- Added admin role checks to all 3 mass data endpoints (driver tokens, passenger tokens, phones+tokens)
- Added pagination (50/page) to all 4 mass data endpoints
- Fixed LIMIT to use placeholders with type binding
2026-06-17 07:45:35 +03:00
Hamza-Ayed
8c6dea5d96
fix(security): add auth to FCM relay, HMAC to shamcash webhook, fix jwtconnect webhook bypass
2026-06-17 06:27:07 +03:00
Hamza-Ayed
d6f29802e0
fix(security): fix pervasive IDOR - force JWT user identity in 9 endpoints, fix host injection, exception leaks, wallet auth
2026-06-17 06:22:41 +03:00
Hamza-Ayed