Hamza-AyedandClaude Opus 5
2135edcf43
- Customer-service notes joined to the account by comparing encrypted phone columns. Both notes tables now carry phone_key, written when a note is saved, and the three joins match on it. - The email_verifications join was comparing a plaintext column against an encrypted one, so it never matched and `verified` was always NULL in both passenger and driver sign-in. It is now resolved in PHP against the decrypted address, which fixes a pre-existing bug rather than only preparing for GCM. - auth/sendVerifyEmail.php built all three of its statements by interpolating the request values into SQL. Any caller could inject through the email or token field. Now parameterised. - serviceapp/register.php duplicate detection consults the users indexes and writes them with the row. Sweep confirms no join or lookup compares two encrypted columns any more. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
93 lines
3.2 KiB
PHP
93 lines
3.2 KiB
PHP
<?php
|
|
|
|
require_once __DIR__ . '/../../connect.php';
|
|
|
|
$email = filterRequest('email');
|
|
$phone = filterRequest('phone');
|
|
$password = filterRequest('password');
|
|
|
|
// تشفير الحقول المطلوبة قبل الاستعلام
|
|
$email = $encryptionHelper->encryptData($email);
|
|
$phone = $encryptionHelper->encryptData($phone);
|
|
|
|
$sql = "SELECT
|
|
driver.id,
|
|
driver.phone,
|
|
driver.email,
|
|
driver.password,
|
|
driver.gender,
|
|
driver.birthdate,
|
|
driver.site,
|
|
driver.first_name,
|
|
driver.last_name,
|
|
driver.education,
|
|
driver.employmentType,
|
|
driver.maritalStatus,
|
|
driver.created_at,
|
|
driver.updated_at,
|
|
driver.email AS _email_enc
|
|
FROM
|
|
driver
|
|
WHERE
|
|
driver.phone = :phone AND driver.email = :email";
|
|
|
|
|
|
/**
|
|
* حالة توثيق البريد.
|
|
*
|
|
* كان الاستعلام يربط email_verifications.email بعمود البريد في الحساب، لكن
|
|
* الأول يُخزَّن نصاً صريحاً والثاني مشفّراً — فالربط لم يكن يطابق شيئاً أصلاً
|
|
* وكانت verified تعود NULL دائماً. نجلبها هنا بالبريد الأصلي.
|
|
*/
|
|
function fetchEmailVerified(PDO $con, ?string $plainEmail): ?int
|
|
{
|
|
if (!$plainEmail) return null;
|
|
try {
|
|
$st = $con->prepare("SELECT verified FROM email_verifications WHERE email = ? LIMIT 1");
|
|
$st->execute([$plainEmail]);
|
|
$v = $st->fetchColumn();
|
|
return $v === false ? null : (int) $v;
|
|
} catch (PDOException $e) {
|
|
error_log('[email_verifications] ' . $e->getMessage());
|
|
return null;
|
|
}
|
|
}
|
|
|
|
$stmt = $con->prepare($sql);
|
|
$stmt->bindParam(':email', $email);
|
|
$stmt->bindParam(':phone', $phone);
|
|
$stmt->execute();
|
|
$data = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
|
$count = $stmt->rowCount();
|
|
|
|
if ($count > 0) {
|
|
$plainEmail = $encryptionHelper->decryptData($data[0]['_email_enc'] ?? null) ?: null;
|
|
$data[0]['verified'] = fetchEmailVerified($con, $plainEmail);
|
|
unset($data[0]['_email_enc']);
|
|
}
|
|
|
|
if ($count > 0) {
|
|
$stored_password = $data[0]['password'];
|
|
if (password_verify($password, $stored_password)) {
|
|
|
|
// فك التشفير للحقول الحساسة
|
|
$data[0]['phone'] = $encryptionHelper->decryptData($data[0]['phone']);
|
|
$data[0]['email'] = $encryptionHelper->decryptData($data[0]['email']);
|
|
$data[0]['gender'] = $encryptionHelper->decryptData($data[0]['gender']);
|
|
$data[0]['birthdate'] = $encryptionHelper->decryptData($data[0]['birthdate']);
|
|
$data[0]['site'] = $encryptionHelper->decryptData($data[0]['site']);
|
|
$data[0]['first_name'] = $encryptionHelper->decryptData($data[0]['first_name']);
|
|
$data[0]['last_name'] = $encryptionHelper->decryptData($data[0]['last_name']);
|
|
$data[0]['education'] = $encryptionHelper->decryptData($data[0]['education']);
|
|
$data[0]['employmentType'] = $encryptionHelper->decryptData($data[0]['employmentType']);
|
|
$data[0]['maritalStatus'] = $encryptionHelper->decryptData($data[0]['maritalStatus']);
|
|
|
|
unset($data[0]['password']); // لا نرجّع الباسورد
|
|
jsonSuccess($data);
|
|
} else {
|
|
jsonError("Incorrect password.");
|
|
}
|
|
} else {
|
|
jsonError("User does not exist.");
|
|
}
|
|
?>
|