Hamza-Ayed
e5bf70fddb
Update: 2026-07-23 02:14:58
2026-07-23 02:14:58 +03:00
Hamza-Ayed
8ec0ac2942
Update: 2026-07-22 01:35:37
2026-07-22 01:35:37 +03:00
Hamza-Ayed
540e77984b
Update: 2026-07-22 00:44:11
2026-07-22 00:44:11 +03:00
Hamza-Ayed
bec8089fd1
Update: 2026-07-22 00:42:09
2026-07-22 00:42:09 +03:00
Hamza-Ayed
16101927e1
Update: 2026-07-22 00:39:28
2026-07-22 00:39:28 +03:00
Hamza-Ayed
58222fbf81
Update: 2026-07-22 00:37:03
2026-07-22 00:37:03 +03:00
Hamza-Ayed
bcab0ea221
Update: 2026-07-22 00:36:04
2026-07-22 00:36:05 +03:00
Hamza-Ayed
b18fd027b6
Update: 2026-07-10 03:04:06
2026-07-10 03:04:06 +03:00
Hamza-Ayed
a526dae042
Update: 2026-07-09 04:13:14
2026-07-09 04:13:14 +03:00
Hamza-Ayed
70718946f5
Update: 2026-07-09 03:41:48
2026-07-09 03:41:48 +03:00
Hamza-Ayed
7dff7b6973
Update: 2026-07-09 01:55:25
2026-07-09 01:55:25 +03:00
Hamza-Ayed
628e169552
Update: 2026-07-07 04:57:50
2026-07-07 04:57:51 +03:00
Hamza-Ayed
d6ab09c19b
Update: 2026-07-06 18:23:46
2026-07-06 18:23:46 +03:00
Hamza-Ayed
3e0b4cbf64
Update: 2026-07-04 18:43:56
2026-07-04 18:43:57 +03:00
Hamza-Ayed
5ce6c00905
Update: 2026-07-03 01:48:00
2026-07-03 01:48:00 +03:00
Hamza-Ayed
8f59189832
Update: 2026-07-02 17:46:29
2026-07-02 17:46:29 +03:00
Hamza-Ayed
6876d9bc54
Update: 2026-07-02 17:44:58
2026-07-02 17:44:59 +03:00
Hamza-Ayed
5d14493ff4
Update: 2026-07-02 16:52:25
2026-07-02 16:52:25 +03:00
Hamza-Ayed
75e6fc42d7
Update: 2026-07-02 15:35:12
2026-07-02 15:35:12 +03:00
Hamza-Ayed
43e3f8c939
Fix: update destination limits to 3 and sync with Redis
2026-06-27 17:49:03 +03:00
Hamza-Ayed
72afd11a57
Update: 2026-06-26 04:24:20
2026-06-26 04:24:20 +03:00
Hamza-Ayed
da9e6eb981
Update: 2026-06-26 04:04:03
2026-06-26 04:04:04 +03:00
Hamza-Ayed
6fcc4a0649
Update: 2026-06-26 00:36:22
2026-06-26 00:36:22 +03:00
Hamza-Ayed
e73be65a72
Update: 2026-06-21 18:58:05
2026-06-21 18:58:13 +03:00
Hamza-Ayed
b2fae9ec66
Update: 2026-06-21 02:07:00
2026-06-21 02:07:00 +03:00
Hamza-Ayed
a8748cf4c9
Fix #22 : Medium-severity fixes (M-01 through M-07)
...
M-01: Host header injection - replaced HTTP_HOST with APP_DOMAIN
M-02: Unauthenticated CRUD - ownership checks on carDrivers add/delete
M-03: MD5 tracking token - replaced md5() with hash_hmac sha256
M-04: Webhook SMS - absolute log path instead of relative
M-05: Weak 3-digit OTP - already noted as requirement (Fix #5 )
M-06: Redis without auth - added password + prefix to cancel_ride_by_driver
M-07: SSRF bypass - str_ends_with -> strict equality in allowlist
2026-06-17 07:58:21 +03:00
Hamza-Ayed
3543fdd2cd
Fix #21 : High-severity fixes (H-01 through H-06)
...
H-01: Egypt document uploads - added path traversal prevention (basename),
replaced HTTP_HOST with APP_DOMAIN env var
H-02: 7 remaining hardcoded /home/siro-api/ paths replaced with env vars
(ENV_FILE_PATH, INTERNAL_SOCKET_KEY_PATH, WEBHOOK_SECRET_KEY_PATH)
H-03: serviceapp/updateDriver.php - added ownership check (user_id must match
driverID or user must be admin); non-admins blocked from changing
password/status/email/phone
H-04: ggg.php - replaced weak client-supplied phone auth with proper admin
JWT authentication via JwtService
H-05: Static IV fallback in encrypt_decrypt.php already documented as legacy
H-06: Wallet shared password noted as design limitation (mitigated by
fingerprint verification + short token TTL)
- Also fixed functions.php log message (removed hardcoded path)
2026-06-17 07:56:57 +03:00
Hamza-Ayed
72eeb24cd7
Fix #18 : Exception leak remediation across 87 PHP files
...
- Replaced all client-facing $e->getMessage() with generic error messages
- Added error_log() with filename prefix to all catch blocks
- Covered jsonError(), echo, and json_encode() response patterns
- Also fixed 2 remaining display_errors=1 and add_invoice.php leak
- Script-assisted fix for 75 files, manual fix for 12 remaining edge cases
2026-06-17 07:48:31 +03:00
Hamza-Ayed
d6f29802e0
fix(security): fix pervasive IDOR - force JWT user identity in 9 endpoints, fix host injection, exception leaks, wallet auth
2026-06-17 06:22:41 +03:00
Hamza-Ayed
b516fbc4ed
Update: 2026-06-16 17:47:17
2026-06-16 17:47:19 +03:00
Hamza-Ayed
c0fe990ebe
Update: 2026-06-16 02:52:06
2026-06-16 02:52:06 +03:00
Hamza-Ayed
2c657fa0b4
Update: 2026-06-16 02:14:34
2026-06-16 02:14:35 +03:00
Hamza-Ayed
fc58529b09
Update: 2026-06-16 01:17:28
2026-06-16 01:17:29 +03:00
Hamza-Ayed
04943e3d52
Update: 2026-06-15 19:39:21
2026-06-15 19:39:21 +03:00
Hamza-Ayed
2321b78244
Update: 2026-06-15 01:37:40
2026-06-15 01:37:41 +03:00
Hamza-Ayed
f021ba5a35
Update: 2026-06-14 22:10:07
2026-06-14 22:10:08 +03:00
Hamza-Ayed
f907212c57
Update: 2026-06-12 20:40:40
2026-06-12 20:40:40 +03:00
Hamza-Ayed
727068b668
Update: 2026-06-11 18:22:57
2026-06-11 18:22:59 +03:00
Hamza-Ayed
c5170a88d2
Update: 2026-06-11 13:47:39
2026-06-11 13:47:40 +03:00
Hamza-Ayed
977adfe99d
Update: 2026-06-10 18:11:50
2026-06-10 18:11:50 +03:00
Hamza-Ayed
d8901e1a87
first commit
2026-06-09 08:40:31 +03:00
Hamza-Ayed