Hamza/Siro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: Hamza/Siro:4620e84d34ffda2e9d3c1c04ecd144dd3eb557cc
Branches Tags
Hamza/Siro:main Hamza/Siro:feature/food-delivery-module Hamza/Siro:youthful-wake
...
compare: Hamza/Siro:03a21aa95d23b9e97778df95f445e695c1fa180a
Branches Tags
Hamza/Siro:main Hamza/Siro:feature/food-delivery-module Hamza/Siro:youthful-wake
2 Commits
4620e84d34 ... 03a21aa95d
Author SHA1 Message Date
Hamza-AyedandClaude Opus 5 03a21aa95d Bump transitive dev dependencies in lockfiles 
matcher, test_api and related transitive packages, from pub get.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-02 18:19:55 +03:00
Hamza-AyedandClaude Opus 5 3b4b4639a6 Guard debug logs in release and remove device-check bypass 
Log.print used developer.log with no kDebugMode guard, so release
builds emitted wallet JWTs, the HMAC secret, phone numbers and full
API responses to os_log/logcat on the user's device. Both the rider
and driver apps were affected.

Also removes a hardcoded test-account condition in the rider login
flow that skipped the entire FCM-token/fingerprint comparison — and
therefore the device-change OTP — for one email address.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
 2026-08-02 18:19:50 +03:00
5 changed files with 55 additions and 41 deletions
Expand all files Collapse all files
siro_driver/lib/print.dart
+7
View File
@@ -1,9 +1,16 @@
import 'dart:developer' as developer; import 'dart:developer' as developer;
import 'package:flutter/foundation.dart' show kDebugMode;
class Log { class Log {
Log._(); Log._();
/// ⚠️ يُطبع في وضع التطوير فقط.
/// `developer.log` لا يُحذف في نسخة الإصدار — يذهب إلى os_log على iOS
/// و logcat على أندرويد، وكان يسرّب الـ JWT وسر الـ HMAC وأرقام الهواتف
/// وردود الـ API كاملة إلى سجلّ النظام على جهاز المستخدم.
static void print(String value, {StackTrace? stackTrace}) { static void print(String value, {StackTrace? stackTrace}) {
if (!kDebugMode) return;
developer.log(value, name: 'LOG', stackTrace: stackTrace); developer.log(value, name: 'LOG', stackTrace: stackTrace);
} }
siro_driver/pubspec.lock
+6 -6
View File
@@ -1521,10 +1521,10 @@ packages:
dependency: transitive dependency: transitive
description: description:
name: matcher name: matcher
sha256: "12956d0ad8390bbcc63ca2e1469c0619946ccb52809807067a7020d57e647aa6" sha256: dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861
url: "https://pub.dev" url: "https://pub.dev"
source: hosted source: hosted
version: "0.12.18" version: "0.12.19"
material_color_utilities: material_color_utilities:
dependency: transitive dependency: transitive
description: description:
@@ -1537,10 +1537,10 @@ packages:
dependency: transitive dependency: transitive
description: description:
name: meta name: meta
sha256: "23f08335362185a5ea2ad3a4e597f1375e78bce8a040df5c600c8d3552ef2394" sha256: "1741988757a65eb6b36abe716829688cf01910bbf91c34354ff7ec1c3de2b349"
url: "https://pub.dev" url: "https://pub.dev"
source: hosted source: hosted
version: "1.17.0" version: "1.18.0"
mime: mime:
dependency: transitive dependency: transitive
description: description:
@@ -2125,10 +2125,10 @@ packages:
dependency: transitive dependency: transitive
description: description:
name: test_api name: test_api
sha256: "93167629bfc610f71560ab9312acdda4959de4df6fac7492c89ff0d3886f6636" sha256: "949a932224383300f01be9221c39180316445ecb8e7547f70a41a35bf421fb9e"
url: "https://pub.dev" url: "https://pub.dev"
source: hosted source: hosted
version: "0.7.9" version: "0.7.11"
timezone: timezone:
dependency: transitive dependency: transitive
description: description:
siro_rider/lib/controller/auth/login_controller.dart
+29 -29
View File
@@ -418,39 +418,39 @@ class LoginController extends GetxController {
force: true); // Fetch access token after clearing firstTimeLoadKey force: true); // Fetch access token after clearing firstTimeLoadKey
// ── 5. المقارنة: FCM token + fingerprint ────────────────────── // ── 5. المقارنة: FCM token + fingerprint ──────────────────────
if (email != '962798583052@intaleqapp.com') { // ملاحظة: كان هنا استثناء لحساب اختبار بعينه يتخطى الفحص بالكامل.
if (serverFCM == null && // حُذف — لا استثناءات على التحقق من تغيّر الجهاز.
tokenResp != null && if (serverFCM == null &&
tokenResp != 'failure' && tokenResp != null &&
tokenResp != 'error' && tokenResp != 'failure' &&
tokenResp != 'token_expired') { tokenResp != 'error' &&
final tokenJson = tokenResp != 'token_expired') {
tokenResp is String ? jsonDecode(tokenResp) : tokenResp; final tokenJson =
final serverData = tokenJson['data'] ?? tokenJson['message']; tokenResp is String ? jsonDecode(tokenResp) : tokenResp;
if (serverData is Map) { final serverData = tokenJson['data'] ?? tokenJson['message'];
serverFCM = serverData['token']?.toString() ?? ''; if (serverData is Map) {
serverFP = serverData['fingerPrint']?.toString() ?? ''; serverFCM = serverData['token']?.toString() ?? '';
} serverFP = serverData['fingerPrint']?.toString() ?? '';
} }
}
if (serverFCM != null && serverFCM.isNotEmpty) { if (serverFCM != null && serverFCM.isNotEmpty) {
final localFCM = (box.read(BoxName.tokenFCM) ?? '').toString(); final localFCM = (box.read(BoxName.tokenFCM) ?? '').toString();
// ── اختلاف أي منهما = جهاز مختلف أو تثبيت جديد ───────── // ── اختلاف أي منهما = جهاز مختلف أو تثبيت جديد ─────────
final fcmChanged = serverFCM != localFCM; final fcmChanged = serverFCM != localFCM;
final fpChanged = final fpChanged =
serverFP != null && serverFP.isNotEmpty && serverFP != localFP; serverFP != null && serverFP.isNotEmpty && serverFP != localFP;
if (fcmChanged || fpChanged) { if (fcmChanged || fpChanged) {
mySnackbarInfo('Device Change Detected'.tr); mySnackbarInfo('Device Change Detected'.tr);
await Get.to(() => OtpVerificationPage( await Get.to(() => OtpVerificationPage(
phone: data['phone'].toString(), phone: data['phone'].toString(),
deviceToken: localFP, deviceToken: localFP,
token: tokenResp ?? '', token: tokenResp ?? '',
ptoken: serverFCM ?? '', // نمرر FCM القديم للـ OTP controller ptoken: serverFCM ?? '', // نمرر FCM القديم للـ OTP controller
)); ));
return; return;
}
} }
} }
siro_rider/lib/print.dart
+7
View File
@@ -1,9 +1,16 @@
import 'dart:developer' as developer; import 'dart:developer' as developer;
import 'package:flutter/foundation.dart' show kDebugMode;
class Log { class Log {
Log._(); Log._();
/// ⚠️ يُطبع في وضع التطوير فقط.
/// `developer.log` لا يُحذف في نسخة الإصدار — يذهب إلى os_log على iOS
/// و logcat على أندرويد، وكان يسرّب الـ JWT وسر الـ HMAC وأرقام الهواتف
/// وردود الـ API كاملة إلى سجلّ النظام على جهاز المستخدم.
static void print(String value, {StackTrace? stackTrace}) { static void print(String value, {StackTrace? stackTrace}) {
if (!kDebugMode) return;
developer.log(value, name: 'LOG', stackTrace: stackTrace); developer.log(value, name: 'LOG', stackTrace: stackTrace);
} }
siro_rider/pubspec.lock
+6 -6
View File
@@ -1297,10 +1297,10 @@ packages:
dependency: transitive dependency: transitive
description: description:
name: matcher name: matcher
sha256: "12956d0ad8390bbcc63ca2e1469c0619946ccb52809807067a7020d57e647aa6" sha256: dc0b7dc7651697ea4ff3e69ef44b0407ea32c487a39fff6a4004fa585e901861
url: "https://pub.dev" url: "https://pub.dev"
source: hosted source: hosted
version: "0.12.18" version: "0.12.19"
material_color_utilities: material_color_utilities:
dependency: transitive dependency: transitive
description: description:
@@ -1313,10 +1313,10 @@ packages:
dependency: transitive dependency: transitive
description: description:
name: meta name: meta
sha256: "23f08335362185a5ea2ad3a4e597f1375e78bce8a040df5c600c8d3552ef2394" sha256: "1741988757a65eb6b36abe716829688cf01910bbf91c34354ff7ec1c3de2b349"
url: "https://pub.dev" url: "https://pub.dev"
source: hosted source: hosted
version: "1.17.0" version: "1.18.0"
mime: mime:
dependency: "direct main" dependency: "direct main"
description: description:
@@ -1901,10 +1901,10 @@ packages:
dependency: transitive dependency: transitive
description: description:
name: test_api name: test_api
sha256: "93167629bfc610f71560ab9312acdda4959de4df6fac7492c89ff0d3886f6636" sha256: "949a932224383300f01be9221c39180316445ecb8e7547f70a41a35bf421fb9e"
url: "https://pub.dev" url: "https://pub.dev"
source: hosted source: hosted
version: "0.7.9" version: "0.7.11"
timezone: timezone:
dependency: transitive dependency: transitive
description: description: