Hamza-Ayed
63eea81039
Update: 2026-06-25 19:04:05
2026-06-25 19:04:05 +03:00
Hamza-Ayed
b57fd1cecb
Update: 2026-06-25 18:59:57
2026-06-25 18:59:57 +03:00
Hamza-Ayed
f3bafeb9e1
Update: 2026-06-25 18:57:58
2026-06-25 18:57:58 +03:00
Hamza-Ayed
7368feed11
Update: 2026-06-25 18:56:57
2026-06-25 18:56:57 +03:00
Hamza-Ayed
4a6b6d52a3
Update: 2026-06-25 18:53:08
2026-06-25 18:53:08 +03:00
Hamza-Ayed
85ff15cabe
Update: 2026-06-25 18:41:32
2026-06-25 18:41:33 +03:00
Hamza-Ayed
9b61bd50c8
Update: 2026-06-25 18:39:01
2026-06-25 18:39:01 +03:00
Hamza-Ayed
a4d9d8e74c
Update: 2026-06-25 18:05:26
2026-06-25 18:05:26 +03:00
Hamza-Ayed
1e24c3d0c8
add country-specific field config to review page, add warning snackbar, write AI extraction prompt
2026-06-25 17:40:09 +03:00
Hamza-Ayed
28b8558b6d
add 8-tab review page, review controller, updateDriverToActive handles new fields, drivers_cant_register navigates to review
2026-06-25 17:05:11 +03:00
Hamza-Ayed
d4db89f04e
add documents+ai_data to getDriverDetails, create rejectDriver endpoint, add rejected_reason column
2026-06-25 17:01:44 +03:00
Hamza-Ayed
0c5088fd6d
add ai_data + user_input to driver table, status=pending_review, save raw Gemini response
2026-06-25 16:54:21 +03:00
Hamza-Ayed
93bdaee388
increase reg token expiry to 3600s, remove backup URL
2026-06-25 15:55:04 +03:00
Hamza-Ayed
75e4524329
fix upload: parse nested message.url, backup retries=1, connect.php auth
2026-06-25 04:30:52 +03:00
Hamza-Ayed
0b9e5dfa03
remove random suffix from uploaded filenames: now {driverID}_{imageType}.{ext}
2026-06-25 04:21:58 +03:00
Hamza-Ayed
f5a5ffc10c
Update: 2026-06-25 03:58:15
2026-06-25 04:00:27 +03:00
Hamza-Ayed
5b5033b110
Update: 2026-06-25 03:56:11
2026-06-25 03:58:30 +03:00
Hamza-Ayed
4f4958defb
Update: 2026-06-25 03:51:57
2026-06-25 03:55:10 +03:00
Hamza-Ayed
6db2ece2ce
Update: 2026-06-25 03:43:29
2026-06-25 03:43:29 +03:00
Hamza-Ayed
89c1348f08
Update: 2026-06-25 03:28:59
2026-06-25 03:28:59 +03:00
Hamza-Ayed
85e85fe4d3
Update: 2026-06-25 02:55:24
2026-06-25 02:55:24 +03:00
Hamza-Ayed
98a8a2ae3d
Update: 2026-06-25 02:28:33
2026-06-25 02:28:33 +03:00
Hamza-Ayed
1ff13f09ac
Update: 2026-06-25 01:37:22
2026-06-25 01:37:23 +03:00
Hamza-Ayed
014b9a78da
Update: 2026-06-25 01:22:26
2026-06-25 01:22:26 +03:00
Hamza-Ayed
0c9f89fc60
Update: 2026-06-25 01:15:22
2026-06-25 01:15:22 +03:00
Hamza-Ayed
e157c8ec12
Update: 2026-06-25 01:03:54
2026-06-25 01:03:55 +03:00
Hamza-Ayed
eeb4e21f87
Update: 2026-06-25 00:50:19
2026-06-25 00:50:19 +03:00
Hamza-Ayed
0671388e15
Update: 2026-06-25 00:05:45
2026-06-25 00:05:45 +03:00
Hamza-Ayed
262d882bfe
Fix loginFromGooglePassenger to support passengerID request body fallback during first-time registration login flow
2026-06-25 00:02:38 +03:00
Hamza-Ayed
8839a500fc
Add diagnose_login.php for database query diagnostics
2026-06-25 00:00:37 +03:00
Hamza-Ayed
a56e318e20
Add check_server_code.php for server diagnostics
2026-06-24 23:59:51 +03:00
Hamza-Ayed
3c057dfbf8
Update: 2026-06-24 23:53:38
2026-06-24 23:53:38 +03:00
Hamza-Ayed
5f431b4f19
Fix loginFromGooglePassenger id mapping fallback to sub when user_id is new
2026-06-24 23:52:32 +03:00
Hamza-Ayed
aba42f0a7f
Update: 2026-06-24 23:51:26
2026-06-24 23:51:26 +03:00
Hamza-Ayed
c9d07f91fe
Fix loginFromGooglePassenger verification constraint
2026-06-24 23:51:06 +03:00
Hamza-Ayed
d7f5922a3b
Fix passenger registration auth bypass in JwtService
2026-06-24 23:47:41 +03:00
Hamza-Ayed
cca16053da
Fix OTP verification success response payload and restore deterministic encryptData
2026-06-24 23:24:41 +03:00
Hamza-Ayed
2ee3a14c6d
Fix OTP verification success response payload and restore deterministic encryptData
2026-06-24 23:11:24 +03:00
Hamza-Ayed
7b0283473e
Fix timezone bug in request.php using MySQL DATE_ADD and clean up EncryptionHelper
2026-06-24 23:03:45 +03:00
Hamza-Ayed
12dfb25629
Update: 2026-06-24 22:56:39
2026-06-24 22:56:39 +03:00
Hamza-Ayed
f75e456aac
Update: 2026-06-24 16:27:39
2026-06-24 16:27:41 +03:00
Hamza-Ayed
3fcc6e76fd
Update: 2026-06-24 16:19:03
2026-06-24 16:19:04 +03:00
Hamza-Ayed
2e4bf784ec
Update: 2026-06-24 16:18:03
2026-06-24 16:18:03 +03:00
Hamza-Ayed
dfeea2d95a
Update: 2026-06-24 16:15:00
2026-06-24 16:15:01 +03:00
Hamza-Ayed
6866e2171b
Update: 2026-06-24 16:12:30
2026-06-24 16:12:30 +03:00
Hamza-Ayed
89dca66892
Update: 2026-06-24 16:08:47
2026-06-24 16:08:47 +03:00
Hamza-Ayed
4894d566a0
Update: 2026-06-24 16:04:53
2026-06-24 16:04:53 +03:00
Hamza-Ayed
3b2c2a86c6
Update: 2026-06-23 18:44:45
2026-06-23 18:44:45 +03:00
Hamza-Ayed
ed6e34cc4b
Update: 2026-06-23 18:36:09
2026-06-23 18:36:09 +03:00
Hamza-Ayed
bb13eb74e8
Update: 2026-06-23 18:32:23
2026-06-23 18:32:23 +03:00
Hamza-Ayed
e4f86c5efd
Update: 2026-06-23 18:27:04
2026-06-23 18:27:04 +03:00
Hamza-Ayed
4043d939f2
Update: 2026-06-23 18:21:54
2026-06-23 18:21:54 +03:00
Hamza-Ayed
f25066140f
Update: 2026-06-23 18:19:33
2026-06-23 18:19:33 +03:00
Hamza-Ayed
c859b8006b
Update: 2026-06-23 18:18:30
2026-06-23 18:18:30 +03:00
Hamza-Ayed
a2f4f5d304
Update: 2026-06-23 18:14:22
2026-06-23 18:14:22 +03:00
Hamza-Ayed
342611a158
Update: 2026-06-23 18:12:45
2026-06-23 18:12:45 +03:00
Hamza-Ayed
2af9859ad8
Update: 2026-06-23 18:08:22
2026-06-23 18:08:22 +03:00
Hamza-Ayed
b60e06b890
Update: 2026-06-23 18:03:42
2026-06-23 18:03:42 +03:00
Hamza-Ayed
b110e03039
Update: 2026-06-23 17:58:46
2026-06-23 17:58:46 +03:00
Hamza-Ayed
eafc04a091
Update: 2026-06-23 17:57:07
2026-06-23 17:57:07 +03:00
Hamza-Ayed
6ad7aceee1
Update: 2026-06-23 17:46:32
2026-06-23 17:46:33 +03:00
Hamza-Ayed
52c4f96976
Update: 2026-06-23 17:42:09
2026-06-23 17:42:09 +03:00
Hamza-Ayed
148ca3af1d
Update: 2026-06-23 17:25:29
2026-06-23 17:25:29 +03:00
Hamza-Ayed
4e2f165d60
Update: 2026-06-23 16:25:59
2026-06-23 16:25:59 +03:00
Hamza-Ayed
c54a8f43fe
Update: 2026-06-23 16:17:20
2026-06-23 16:17:20 +03:00
Hamza-Ayed
bea94ed617
Update: 2026-06-23 15:35:14
2026-06-23 15:35:14 +03:00
Hamza-Ayed
b4d054a870
Update: 2026-06-23 15:21:45
2026-06-23 15:21:45 +03:00
Hamza-Ayed
efe26c95be
Update: 2026-06-22 00:31:28
2026-06-22 00:31:29 +03:00
Hamza-Ayed
e73be65a72
Update: 2026-06-21 18:58:05
2026-06-21 18:58:13 +03:00
Hamza-Ayed
b492b5076b
feat: implement accessibility-based scraper service and standalone worker backend with device registration UI
2026-06-21 15:21:16 +03:00
Hamza-Ayed
ce6f22dc71
Update: 2026-06-21 03:02:56
2026-06-21 03:02:56 +03:00
Hamza-Ayed
2ac086d1fd
Update: 2026-06-21 02:53:01
2026-06-21 02:53:02 +03:00
Hamza-Ayed
b2fae9ec66
Update: 2026-06-21 02:07:00
2026-06-21 02:07:00 +03:00
Hamza-Ayed
af3dcae5b7
Update: 2026-06-19 15:33:32
2026-06-19 15:33:32 +03:00
Hamza-Ayed
017bec86fa
Update: 2026-06-19 14:01:15
2026-06-19 14:01:15 +03:00
Hamza-Ayed
a0495147c4
Update: 2026-06-19 02:01:34
2026-06-19 02:01:34 +03:00
Hamza-Ayed
a003bf78c4
Update: 2026-06-19 01:47:48
2026-06-19 01:47:48 +03:00
Hamza-Ayed
f13faa8c31
Update: 2026-06-18 16:46:30
2026-06-18 16:46:30 +03:00
Hamza-Ayed
8b52d2f115
feat: add Nabeh integration with phone-to-user resolution and environment configuration support
2026-06-18 14:59:24 +03:00
Hamza-Ayed
72fa97477b
Update: 2026-06-17 18:22:52
2026-06-17 18:22:52 +03:00
Hamza-Ayed
b67417eb98
Add Nabeh integration: nabeh/ endpoints with NABEH_API_KEY auth
2026-06-17 18:22:45 +03:00
Hamza-Ayed
c2c4ed22e3
Fix: SSL pinning, root detection, network resilience, and compile errors
...
SSL pinning (all 4 apps): IOClient import, subdomain-safe domain matching
Root detection (all 4 apps): modern Magisk/KernelSU/APatch paths
Security checks (rider/driver/admin): PlatformException -> false
Rider crud: 60s timeout, 3 retries, exponential backoff, JWT pre-validation
Driver crud: exponential backoff for TimeoutException
RxInt compile (rider/driver): 10.obs -> RxInt(10)
Admin device_info: add missing imports, fix RxInt, add package_info_plus
2026-06-17 16:41:02 +03:00
Hamza-Ayed
264e005a7b
fix: PHP syntax errors in upload files and composer config
...
- Fix PHP 8.x string interpolation syntax in upload log calls
- Fix const getenv() -> runtime variable in uploadSyrianDocs.php
- Add composer security advisory ignore for firebase/php-jwt
- Run composer update to sync lock file
2026-06-17 08:41:16 +03:00
Hamza-Ayed
2c56d2f41e
Fix #24 : Flutter generated plugin files + pubspec.lock after crypto dependency addition
2026-06-17 08:19:09 +03:00
Hamza-Ayed
752bbf3a63
Fix #23 : JWT storage consistency across all Flutter apps
...
- siro_admin: added FlutterSecureStorage write alongside GetStorage
- siro_service: added FlutterSecureStorage write in login + guest JWT flows
- siro_rider: added FlutterSecureStorage write in guest + token-refresh flows
(full-credential login already wrote to both)
- siro_driver: already wrote to both (no change needed)
- All apps now write JWT to both GetStorage and FlutterSecureStorage
2026-06-17 08:03:19 +03:00
Hamza-Ayed
a8748cf4c9
Fix #22 : Medium-severity fixes (M-01 through M-07)
...
M-01: Host header injection - replaced HTTP_HOST with APP_DOMAIN
M-02: Unauthenticated CRUD - ownership checks on carDrivers add/delete
M-03: MD5 tracking token - replaced md5() with hash_hmac sha256
M-04: Webhook SMS - absolute log path instead of relative
M-05: Weak 3-digit OTP - already noted as requirement (Fix #5 )
M-06: Redis without auth - added password + prefix to cancel_ride_by_driver
M-07: SSRF bypass - str_ends_with -> strict equality in allowlist
2026-06-17 07:58:21 +03:00
Hamza-Ayed
3543fdd2cd
Fix #21 : High-severity fixes (H-01 through H-06)
...
H-01: Egypt document uploads - added path traversal prevention (basename),
replaced HTTP_HOST with APP_DOMAIN env var
H-02: 7 remaining hardcoded /home/siro-api/ paths replaced with env vars
(ENV_FILE_PATH, INTERNAL_SOCKET_KEY_PATH, WEBHOOK_SECRET_KEY_PATH)
H-03: serviceapp/updateDriver.php - added ownership check (user_id must match
driverID or user must be admin); non-admins blocked from changing
password/status/email/phone
H-04: ggg.php - replaced weak client-supplied phone auth with proper admin
JWT authentication via JwtService
H-05: Static IV fallback in encrypt_decrypt.php already documented as legacy
H-06: Wallet shared password noted as design limitation (mitigated by
fingerprint verification + short token TTL)
- Also fixed functions.php log message (removed hardcoded path)
2026-06-17 07:56:57 +03:00
Hamza-Ayed
50a5308f43
Fix #20 : DDL removal from register.php, CORS policy, secret leak
...
- Removed ALTER TABLE DDL statements from Admin/auth/register.php (belongs in migration scripts)
- Added validated CORS with configurable allowed origins via CORS_ALLOWED_ORIGINS env var
- Removed assignment in load_env.php (secrets no longer exposed in superglobal)
2026-06-17 07:51:01 +03:00
Hamza-Ayed
2d607d9e90
Fix #19 : Plaintext OTP hashing + hardcoded server paths
...
- Changed OTP storage in Admin/auth/login.php from plaintext to sha256 hash
- Updated Admin/auth/verify_login.php to hash user input before comparison
- Replaced hardcoded /home/siro-api/ paths with environment variables:
- ERROR_LOG_PATH, ENV_FILE_PATH, SECRET_KEY_PAY_PATH, SECRET_KEY_PATH
- Falls back to __DIR__-relative paths when env vars are unset
2026-06-17 07:49:46 +03:00
Hamza-Ayed
790d58aaa2
remove temp fix script
2026-06-17 07:48:34 +03:00
Hamza-Ayed
72eeb24cd7
Fix #18 : Exception leak remediation across 87 PHP files
...
- Replaced all client-facing $e->getMessage() with generic error messages
- Added error_log() with filename prefix to all catch blocks
- Covered jsonError(), echo, and json_encode() response patterns
- Also fixed 2 remaining display_errors=1 and add_invoice.php leak
- Script-assisted fix for 75 files, manual fix for 12 remaining edge cases
2026-06-17 07:48:31 +03:00
Hamza-Ayed
e51d266a0f
Fix #17 : SQL injection + mass data exposure (backend)
...
- Fixed SQL injection in ride/license/get.php (interpolated variable → parameterized query)
- Added admin role checks to all 3 mass data endpoints (driver tokens, passenger tokens, phones+tokens)
- Added pagination (50/page) to all 4 mass data endpoints
- Fixed LIMIT to use placeholders with type binding
2026-06-17 07:45:35 +03:00
Hamza-Ayed
f528e1d3c5
Fix #16 : SSL pinning in all 4 Flutter apps
...
- Created ssl_pinning.dart with SHA-256 DER hash pinning for intaleq.xyz and siromove.com
- Replaced http.post/http.get with pinned client in all CRUD classes
- Added crypto dependency to siro_admin and siro_driver pubspec
2026-06-17 07:40:43 +03:00
Hamza-Ayed
0e28814e7d
Fix #15 : PCI-DSS compliance - remove persistent CVV storage from Flutter apps
2026-06-17 07:26:27 +03:00
Hamza-Ayed
16331bd35d
Fix #14 : Remove unused privateKeyFCM (Firebase service account key) from Flutter apps
2026-06-17 07:21:18 +03:00
Hamza-Ayed
623d66a3d8
Fix #13 : Remove hardcoded PII from Flutter apps, enable root detection in siro_admin
2026-06-17 07:13:18 +03:00
Hamza-Ayed
1a9619f9f8
fix(security): fix login AND logic to OR, add signup input validation, separate OTP rate limit keys
2026-06-17 07:05:58 +03:00
Hamza-Ayed
70c06edd71
fix(security): fix host header injection in upload_audio, email header injection, add SSL verify to MTN curl
2026-06-17 06:57:56 +03:00
Hamza-Ayed
75aeb73f27
fix(security): fix openssl_sign key resource in MTN initiate, add google-services.json to gitignore
2026-06-17 06:55:36 +03:00
Hamza-Ayed
1d3ea597f4
fix(security): wallet balance check with FOR UPDATE, remove user-supplied ID in signup, hardcoded IP to env
2026-06-17 06:53:00 +03:00
Hamza-Ayed