 Hamza-Ayed
|
0cb1ab0ea3
|
Update: 2026-08-07 01:06:09
|
2026-08-07 01:06:09 +03:00 |
|
|
Hamza-Ayed
|
a1104a4695
|
Update: 2026-08-07 00:57:03
|
2026-08-07 00:57:03 +03:00 |
|
|
Hamza-Ayed
|
6e451e8b71
|
Update: 2026-08-07 00:36:27
|
2026-08-07 00:36:27 +03:00 |
|
|
Hamza-Ayed
|
b18fd027b6
|
Update: 2026-07-10 03:04:06
|
2026-07-10 03:04:06 +03:00 |
|
|
Hamza-Ayed
|
3e0b4cbf64
|
Update: 2026-07-04 18:43:56
|
2026-07-04 18:43:57 +03:00 |
|
|
Hamza-Ayed
|
75e6fc42d7
|
Update: 2026-07-02 15:35:12
|
2026-07-02 15:35:12 +03:00 |
|
|
Hamza-Ayed
|
b2fae9ec66
|
Update: 2026-06-21 02:07:00
|
2026-06-21 02:07:00 +03:00 |
|
|
Hamza-Ayed
|
a8748cf4c9
|
Fix #22: Medium-severity fixes (M-01 through M-07)
M-01: Host header injection - replaced HTTP_HOST with APP_DOMAIN
M-02: Unauthenticated CRUD - ownership checks on carDrivers add/delete
M-03: MD5 tracking token - replaced md5() with hash_hmac sha256
M-04: Webhook SMS - absolute log path instead of relative
M-05: Weak 3-digit OTP - already noted as requirement (Fix #5)
M-06: Redis without auth - added password + prefix to cancel_ride_by_driver
M-07: SSRF bypass - str_ends_with -> strict equality in allowlist
|
2026-06-17 07:58:21 +03:00 |
|
|
Hamza-Ayed
|
b516fbc4ed
|
Update: 2026-06-16 17:47:17
|
2026-06-16 17:47:19 +03:00 |
|
|
Hamza-Ayed
|
2321b78244
|
Update: 2026-06-15 01:37:40
|
2026-06-15 01:37:41 +03:00 |
|
|
Hamza-Ayed
|
f907212c57
|
Update: 2026-06-12 20:40:40
|
2026-06-12 20:40:40 +03:00 |
|
|
Hamza-Ayed
|
727068b668
|
Update: 2026-06-11 18:22:57
|
2026-06-11 18:22:59 +03:00 |
|
|
Hamza-Ayed
|
d8901e1a87
|
first commit
|
2026-06-09 08:40:31 +03:00 |
|