Hamza-Ayed
24fb56f08f
Update: 2026-07-12 05:40:28
2026-07-12 05:40:28 +03:00
Hamza-Ayed
83f5bf516b
feat: add Nabeh payment verification proxy and update UI components
2026-07-11 22:14:37 +03:00
Hamza-Ayed
87dc925ea7
Refactor(Auth): Complete auth folder restructuring, security patches, and Flutter endpoint updates
2026-07-09 05:22:05 +03:00
Hamza-Ayed
a526dae042
Update: 2026-07-09 04:13:14
2026-07-09 04:13:14 +03:00
Hamza-Ayed
70718946f5
Update: 2026-07-09 03:41:48
2026-07-09 03:41:48 +03:00
Hamza-Ayed
21877153eb
feat: harden backend security with HMAC verification, SSL validation, and documentation updates while removing legacy scripts.
2026-07-08 22:10:01 +03:00
Hamza-Ayed
4d16fbda48
Update: 2026-07-06 01:20:19
2026-07-06 01:20:19 +03:00
Hamza-Ayed
ccf7dc99ee
Update: 2026-07-06 01:18:35
2026-07-06 01:18:36 +03:00
Hamza-Ayed
1b67c5e8fc
Update: 2026-07-06 01:01:29
2026-07-06 01:01:30 +03:00
Hamza-Ayed
d00502769a
Update: 2026-07-06 00:53:15
2026-07-06 00:53:15 +03:00
Hamza-Ayed
40ffcabc91
Update: 2026-07-05 18:46:09
2026-07-05 18:46:09 +03:00
Hamza-Ayed
9b0f0de1ce
Update: 2026-07-05 18:16:24
2026-07-05 18:16:24 +03:00
Hamza-Ayed
2a5cd2cfbc
Update: 2026-07-05 17:53:37
2026-07-05 17:53:37 +03:00
Hamza-Ayed
d7f723c735
Update: 2026-07-05 17:49:26
2026-07-05 17:49:26 +03:00
Hamza-Ayed
01652eed8b
Update: 2026-07-05 01:40:01
2026-07-05 01:40:02 +03:00
Hamza-Ayed
5cf809e0cb
Update: 2026-07-05 00:21:29
2026-07-05 00:21:29 +03:00
Hamza-Ayed
5f2aa84101
Update: 2026-07-04 21:58:03
2026-07-04 21:58:04 +03:00
Hamza-Ayed
90fbe0ade8
Update: 2026-07-04 21:56:02
2026-07-04 21:56:02 +03:00
Hamza-Ayed
ce7db27936
Update: 2026-07-04 21:38:44
2026-07-04 21:38:44 +03:00
Hamza-Ayed
8ae6a2e2da
Update: 2026-07-04 15:39:18
2026-07-04 15:39:18 +03:00
Hamza-Ayed
2adf195b36
Update: 2026-07-02 05:56:57
2026-07-02 05:56:57 +03:00
Hamza-Ayed
05d047d871
Update: 2026-07-02 05:27:04
2026-07-02 05:27:05 +03:00
Hamza-Ayed
d2ce4bdb16
Update: 2026-06-30 23:32:14
2026-06-30 23:32:15 +03:00
Hamza-Ayed
26ae0124c8
Update: 2026-06-30 22:43:38
2026-06-30 22:43:38 +03:00
Hamza-Ayed
1b5d6eae44
Simplify APNs payload for iOS visible notifications and fetch latest token
2026-06-30 22:13:45 +03:00
Hamza-Ayed
772f8b647d
Update: 2026-06-30 22:10:05
2026-06-30 22:10:05 +03:00
Hamza-Ayed
9a296742f1
Fix APNs push type for visible notifications on iOS
2026-06-30 22:09:27 +03:00
Hamza-Ayed
116e3fad22
Fix env variable name for service account file to fix 'No access token' error
2026-06-30 22:06:57 +03:00
Hamza-Ayed
ae723a75f6
Update: 2026-06-30 21:59:55
2026-06-30 21:59:55 +03:00
Hamza-Ayed
1dc5ccc11d
Restore legacy decrypt fallback for prepended random IV in EncryptionHelper
2026-06-30 21:54:31 +03:00
Hamza-Ayed
0af4eed1ce
Update: 2026-06-29 01:10:32
2026-06-29 01:10:32 +03:00
Hamza-Ayed
9ded734e38
Update: 2026-06-26 17:29:23
2026-06-26 17:29:23 +03:00
Hamza-Ayed
3002dbd517
Update: 2026-06-26 01:26:12
2026-06-26 01:26:12 +03:00
Hamza-Ayed
75e4524329
fix upload: parse nested message.url, backup retries=1, connect.php auth
2026-06-25 04:30:52 +03:00
Hamza-Ayed
d7f5922a3b
Fix passenger registration auth bypass in JwtService
2026-06-24 23:47:41 +03:00
Hamza-Ayed
2ee3a14c6d
Fix OTP verification success response payload and restore deterministic encryptData
2026-06-24 23:11:24 +03:00
Hamza-Ayed
7b0283473e
Fix timezone bug in request.php using MySQL DATE_ADD and clean up EncryptionHelper
2026-06-24 23:03:45 +03:00
Hamza-Ayed
12dfb25629
Update: 2026-06-24 22:56:39
2026-06-24 22:56:39 +03:00
Hamza-Ayed
89dca66892
Update: 2026-06-24 16:08:47
2026-06-24 16:08:47 +03:00
Hamza-Ayed
bb13eb74e8
Update: 2026-06-23 18:32:23
2026-06-23 18:32:23 +03:00
Hamza-Ayed
e4f86c5efd
Update: 2026-06-23 18:27:04
2026-06-23 18:27:04 +03:00
Hamza-Ayed
6ad7aceee1
Update: 2026-06-23 17:46:32
2026-06-23 17:46:33 +03:00
Hamza-Ayed
52c4f96976
Update: 2026-06-23 17:42:09
2026-06-23 17:42:09 +03:00
Hamza-Ayed
bea94ed617
Update: 2026-06-23 15:35:14
2026-06-23 15:35:14 +03:00
Hamza-Ayed
e73be65a72
Update: 2026-06-21 18:58:05
2026-06-21 18:58:13 +03:00
Hamza-Ayed
b2fae9ec66
Update: 2026-06-21 02:07:00
2026-06-21 02:07:00 +03:00
Hamza-Ayed
3543fdd2cd
Fix #21 : High-severity fixes (H-01 through H-06)
...
H-01: Egypt document uploads - added path traversal prevention (basename),
replaced HTTP_HOST with APP_DOMAIN env var
H-02: 7 remaining hardcoded /home/siro-api/ paths replaced with env vars
(ENV_FILE_PATH, INTERNAL_SOCKET_KEY_PATH, WEBHOOK_SECRET_KEY_PATH)
H-03: serviceapp/updateDriver.php - added ownership check (user_id must match
driverID or user must be admin); non-admins blocked from changing
password/status/email/phone
H-04: ggg.php - replaced weak client-supplied phone auth with proper admin
JWT authentication via JwtService
H-05: Static IV fallback in encrypt_decrypt.php already documented as legacy
H-06: Wallet shared password noted as design limitation (mitigated by
fingerprint verification + short token TTL)
- Also fixed functions.php log message (removed hardcoded path)
2026-06-17 07:56:57 +03:00
Hamza-Ayed
50a5308f43
Fix #20 : DDL removal from register.php, CORS policy, secret leak
...
- Removed ALTER TABLE DDL statements from Admin/auth/register.php (belongs in migration scripts)
- Added validated CORS with configurable allowed origins via CORS_ALLOWED_ORIGINS env var
- Removed assignment in load_env.php (secrets no longer exposed in superglobal)
2026-06-17 07:51:01 +03:00
Hamza-Ayed
2d607d9e90
Fix #19 : Plaintext OTP hashing + hardcoded server paths
...
- Changed OTP storage in Admin/auth/login.php from plaintext to sha256 hash
- Updated Admin/auth/verify_login.php to hash user input before comparison
- Replaced hardcoded /home/siro-api/ paths with environment variables:
- ERROR_LOG_PATH, ENV_FILE_PATH, SECRET_KEY_PAY_PATH, SECRET_KEY_PATH
- Falls back to __DIR__-relative paths when env vars are unset
2026-06-17 07:49:46 +03:00
Hamza-Ayed
0ceb67ee56
fix(security): fix SQL injection in updatePaymetToPaid, OTP random_int, static IV encryption, storage mismatch
2026-06-17 06:31:13 +03:00
Hamza-Ayed