Hamza-Ayed 2d607d9e90 Fix #19: Plaintext OTP hashing + hardcoded server paths ...

- Changed OTP storage in Admin/auth/login.php from plaintext to sha256 hash
- Updated Admin/auth/verify_login.php to hash user input before comparison
- Replaced hardcoded /home/siro-api/ paths with environment variables:
  - ERROR_LOG_PATH, ENV_FILE_PATH, SECRET_KEY_PAY_PATH, SECRET_KEY_PATH
  - Falls back to __DIR__-relative paths when env vars are unset

2026-06-17 07:49:46 +03:00

..

Admin

Fix #19: Plaintext OTP hashing + hardcoded server paths

2026-06-17 07:49:46 +03:00

auth

Fix #18: Exception leak remediation across 87 PHP files

2026-06-17 07:48:31 +03:00

card_image

first commit

2026-06-09 08:40:31 +03:00

core

Fix #19: Plaintext OTP hashing + hardcoded server paths

2026-06-17 07:49:46 +03:00

driver_assurance

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

EgyptDocuments

Update: 2026-06-16 17:47:17

2026-06-16 17:47:19 +03:00

email

Fix #18: Exception leak remediation across 87 PHP files

2026-06-17 07:48:31 +03:00

imageForUsingApp

first commit

2026-06-09 08:40:31 +03:00

instructions_web

first commit

2026-06-09 08:40:31 +03:00

migration

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

new_driver_car

first commit

2026-06-09 08:40:31 +03:00

ride

Fix #18: Exception leak remediation across 87 PHP files

2026-06-17 07:48:31 +03:00

serviceapp

Fix #18: Exception leak remediation across 87 PHP files

2026-06-17 07:48:31 +03:00

webhook_sms

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

.env.example

Update: 2026-06-16 17:47:17

2026-06-16 17:47:19 +03:00

.gitignore

Update: 2026-06-16 17:47:17

2026-06-16 17:47:19 +03:00

aggregate_files.py

Update: 2026-06-11 13:47:39

2026-06-11 13:47:40 +03:00

composer.json

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

composer.lock

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

connect.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

driver_socket.php

Update: 2026-06-11 13:47:39

2026-06-11 13:47:40 +03:00

encrypt_decrypt.php

Fix #19: Plaintext OTP hashing + hardcoded server paths

2026-06-17 07:49:46 +03:00

functions.php

fix(security): wallet balance check with FOR UPDATE, remove user-supplied ID in signup, hardcoded IP to env

2026-06-17 06:53:00 +03:00

get_connect.php

first commit

2026-06-09 08:40:31 +03:00

ggg.php

first commit

2026-06-09 08:40:31 +03:00

git_push.sh

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

intaleq_v1_secure_latest.md

Update: 2026-06-11 13:47:39

2026-06-11 13:47:40 +03:00

intaleq_v1.code-workspace

Update: 2026-06-11 13:47:39

2026-06-11 13:47:40 +03:00

invest_code.php

Update: 2026-06-11 13:47:39

2026-06-11 13:47:40 +03:00

load_env.php

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

login.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

loginAdmin.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

loginFirstTime.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

loginFirstTimeDriver.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

loginJwtDriver.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

loginJwtWalletDriver.php

Update: 2026-06-16 02:52:06

2026-06-16 02:52:06 +03:00

loginWallet.php

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

logout.php

Fix #18: Exception leak remediation across 87 PHP files

2026-06-17 07:48:31 +03:00

migrate_driver_passwords.php

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

migration_create_table.php

Fix #18: Exception leak remediation across 87 PHP files

2026-06-17 07:48:31 +03:00

migration_referral_system.sql

Update: 2026-06-10 02:44:54

2026-06-10 02:44:55 +03:00

passenger_socket.php

Update: 2026-06-16 17:47:17

2026-06-16 17:47:19 +03:00

privacy_policy1.php

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

privacy_policy.php

Update: 2026-06-12 20:40:40

2026-06-12 20:40:40 +03:00

schema_primary.sql

Update: 2026-06-16 01:17:28

2026-06-16 01:17:29 +03:00

schema_ride.sql

Update: 2026-06-15 01:37:40

2026-06-15 01:37:41 +03:00

schema_tracking.sql

Update: 2026-06-15 01:37:40

2026-06-15 01:37:41 +03:00

test_signed_pricing.php

Update: 2026-06-15 19:39:21

2026-06-15 19:39:21 +03:00

upload_audio.php

fix(security): fix host header injection in upload_audio, email header injection, add SSL verify to MTN curl

2026-06-17 06:57:56 +03:00

uploadImagePortrate.php

fix(security): fix pervasive IDOR - force JWT user identity in 9 endpoints, fix host injection, exception leaks, wallet auth

2026-06-17 06:22:41 +03:00