Hamza-Ayed
75e4524329
fix upload: parse nested message.url, backup retries=1, connect.php auth
2026-06-25 04:30:52 +03:00
Hamza-Ayed
0b9e5dfa03
remove random suffix from uploaded filenames: now {driverID}_{imageType}.{ext}
2026-06-25 04:21:58 +03:00
Hamza-Ayed
f5a5ffc10c
Update: 2026-06-25 03:58:15
2026-06-25 04:00:27 +03:00
Hamza-Ayed
5b5033b110
Update: 2026-06-25 03:56:11
2026-06-25 03:58:30 +03:00
Hamza-Ayed
4f4958defb
Update: 2026-06-25 03:51:57
2026-06-25 03:55:10 +03:00
Hamza-Ayed
6db2ece2ce
Update: 2026-06-25 03:43:29
2026-06-25 03:43:29 +03:00
Hamza-Ayed
89c1348f08
Update: 2026-06-25 03:28:59
2026-06-25 03:28:59 +03:00
Hamza-Ayed
0671388e15
Update: 2026-06-25 00:05:45
2026-06-25 00:05:45 +03:00
Hamza-Ayed
262d882bfe
Fix loginFromGooglePassenger to support passengerID request body fallback during first-time registration login flow
2026-06-25 00:02:38 +03:00
Hamza-Ayed
5f431b4f19
Fix loginFromGooglePassenger id mapping fallback to sub when user_id is new
2026-06-24 23:52:32 +03:00
Hamza-Ayed
c9d07f91fe
Fix loginFromGooglePassenger verification constraint
2026-06-24 23:51:06 +03:00
Hamza-Ayed
cca16053da
Fix OTP verification success response payload and restore deterministic encryptData
2026-06-24 23:24:41 +03:00
Hamza-Ayed
2ee3a14c6d
Fix OTP verification success response payload and restore deterministic encryptData
2026-06-24 23:11:24 +03:00
Hamza-Ayed
7b0283473e
Fix timezone bug in request.php using MySQL DATE_ADD and clean up EncryptionHelper
2026-06-24 23:03:45 +03:00
Hamza-Ayed
12dfb25629
Update: 2026-06-24 22:56:39
2026-06-24 22:56:39 +03:00
Hamza-Ayed
f75e456aac
Update: 2026-06-24 16:27:39
2026-06-24 16:27:41 +03:00
Hamza-Ayed
2e4bf784ec
Update: 2026-06-24 16:18:03
2026-06-24 16:18:03 +03:00
Hamza-Ayed
dfeea2d95a
Update: 2026-06-24 16:15:00
2026-06-24 16:15:01 +03:00
Hamza-Ayed
4894d566a0
Update: 2026-06-24 16:04:53
2026-06-24 16:04:53 +03:00
Hamza-Ayed
3b2c2a86c6
Update: 2026-06-23 18:44:45
2026-06-23 18:44:45 +03:00
Hamza-Ayed
ed6e34cc4b
Update: 2026-06-23 18:36:09
2026-06-23 18:36:09 +03:00
Hamza-Ayed
bb13eb74e8
Update: 2026-06-23 18:32:23
2026-06-23 18:32:23 +03:00
Hamza-Ayed
4043d939f2
Update: 2026-06-23 18:21:54
2026-06-23 18:21:54 +03:00
Hamza-Ayed
f25066140f
Update: 2026-06-23 18:19:33
2026-06-23 18:19:33 +03:00
Hamza-Ayed
c859b8006b
Update: 2026-06-23 18:18:30
2026-06-23 18:18:30 +03:00
Hamza-Ayed
342611a158
Update: 2026-06-23 18:12:45
2026-06-23 18:12:45 +03:00
Hamza-Ayed
b110e03039
Update: 2026-06-23 17:58:46
2026-06-23 17:58:46 +03:00
Hamza-Ayed
52c4f96976
Update: 2026-06-23 17:42:09
2026-06-23 17:42:09 +03:00
Hamza-Ayed
148ca3af1d
Update: 2026-06-23 17:25:29
2026-06-23 17:25:29 +03:00
Hamza-Ayed
72fa97477b
Update: 2026-06-17 18:22:52
2026-06-17 18:22:52 +03:00
Hamza-Ayed
264e005a7b
fix: PHP syntax errors in upload files and composer config
...
- Fix PHP 8.x string interpolation syntax in upload log calls
- Fix const getenv() -> runtime variable in uploadSyrianDocs.php
- Add composer security advisory ignore for firebase/php-jwt
- Run composer update to sync lock file
2026-06-17 08:41:16 +03:00
Hamza-Ayed
a8748cf4c9
Fix #22 : Medium-severity fixes (M-01 through M-07)
...
M-01: Host header injection - replaced HTTP_HOST with APP_DOMAIN
M-02: Unauthenticated CRUD - ownership checks on carDrivers add/delete
M-03: MD5 tracking token - replaced md5() with hash_hmac sha256
M-04: Webhook SMS - absolute log path instead of relative
M-05: Weak 3-digit OTP - already noted as requirement (Fix #5 )
M-06: Redis without auth - added password + prefix to cancel_ride_by_driver
M-07: SSRF bypass - str_ends_with -> strict equality in allowlist
2026-06-17 07:58:21 +03:00
Hamza-Ayed
72eeb24cd7
Fix #18 : Exception leak remediation across 87 PHP files
...
- Replaced all client-facing $e->getMessage() with generic error messages
- Added error_log() with filename prefix to all catch blocks
- Covered jsonError(), echo, and json_encode() response patterns
- Also fixed 2 remaining display_errors=1 and add_invoice.php leak
- Script-assisted fix for 75 files, manual fix for 12 remaining edge cases
2026-06-17 07:48:31 +03:00
Hamza-Ayed
1a9619f9f8
fix(security): fix login AND logic to OR, add signup input validation, separate OTP rate limit keys
2026-06-17 07:05:58 +03:00
Hamza-Ayed
1d3ea597f4
fix(security): wallet balance check with FOR UPDATE, remove user-supplied ID in signup, hardcoded IP to env
2026-06-17 06:53:00 +03:00
Hamza-Ayed
3dad979eb5
fix(security): remove JWT role extraction without signature, add OTP replay protection, fix user enumeration
2026-06-17 06:45:53 +03:00
Hamza-Ayed
0ceb67ee56
fix(security): fix SQL injection in updatePaymetToPaid, OTP random_int, static IV encryption, storage mismatch
2026-06-17 06:31:13 +03:00
Hamza-Ayed
b516fbc4ed
Update: 2026-06-16 17:47:17
2026-06-16 17:47:19 +03:00
Hamza-Ayed
fc58529b09
Update: 2026-06-16 01:17:28
2026-06-16 01:17:29 +03:00
Hamza-Ayed
2321b78244
Update: 2026-06-15 01:37:40
2026-06-15 01:37:41 +03:00
Hamza-Ayed
0ae368dbc8
Update: 2026-06-12 22:40:40
2026-06-12 22:40:40 +03:00
Hamza-Ayed
f907212c57
Update: 2026-06-12 20:40:40
2026-06-12 20:40:40 +03:00
Hamza-Ayed
ef6b52d2e3
Update: 2026-06-12 01:23:54
2026-06-12 01:23:54 +03:00
Hamza-Ayed
c5170a88d2
Update: 2026-06-11 13:47:39
2026-06-11 13:47:40 +03:00
Hamza-Ayed
d8901e1a87
first commit
2026-06-09 08:40:31 +03:00
