5 Commits

Author	SHA1	Message	Date
Hamza-Ayed	a8748cf4c9	Fix #22: Medium-severity fixes (M-01 through M-07) ... M-01: Host header injection - replaced HTTP_HOST with APP_DOMAIN M-02: Unauthenticated CRUD - ownership checks on carDrivers add/delete M-03: MD5 tracking token - replaced md5() with hash_hmac sha256 M-04: Webhook SMS - absolute log path instead of relative M-05: Weak 3-digit OTP - already noted as requirement (Fix #5) M-06: Redis without auth - added password + prefix to cancel_ride_by_driver M-07: SSRF bypass - str_ends_with -> strict equality in allowlist	2026-06-17 07:58:21 +03:00
Hamza-Ayed	3543fdd2cd	Fix #21: High-severity fixes (H-01 through H-06) ... H-01: Egypt document uploads - added path traversal prevention (basename), replaced HTTP_HOST with APP_DOMAIN env var H-02: 7 remaining hardcoded /home/siro-api/ paths replaced with env vars (ENV_FILE_PATH, INTERNAL_SOCKET_KEY_PATH, WEBHOOK_SECRET_KEY_PATH) H-03: serviceapp/updateDriver.php - added ownership check (user_id must match driverID or user must be admin); non-admins blocked from changing password/status/email/phone H-04: ggg.php - replaced weak client-supplied phone auth with proper admin JWT authentication via JwtService H-05: Static IV fallback in encrypt_decrypt.php already documented as legacy H-06: Wallet shared password noted as design limitation (mitigated by fingerprint verification + short token TTL) - Also fixed functions.php log message (removed hardcoded path)	2026-06-17 07:56:57 +03:00
Hamza-Ayed	f907212c57	Update: 2026-06-12 20:40:40	2026-06-12 20:40:40 +03:00
Hamza-Ayed	c5170a88d2	Update: 2026-06-11 13:47:39	2026-06-11 13:47:40 +03:00
Hamza-Ayed	d8901e1a87	first commit	2026-06-09 08:40:31 +03:00