Hamza-AyedandClaude Opus 5
6802026dbd
Searching encrypted columns currently works only because encryptData() is AES-CBC with a fixed IV, i.e. deterministic. That determinism is what leaks equality and shared prefixes, and it is why moving storage to AES-GCM would break every lookup. This separates the two concerns. - core/Security/BlindIndex.php: HMAC-SHA256 over a normalised value, keyed by a secret pepper. Phone numbers have a small keyspace, so a bare SHA-256 would be reversible by enumeration; the pepper lives in the environment, not the database. The scope string includes table and field so the same number does not produce a matching index across tables. Normalisation unifies local/international phone forms, lowercases emails and folds Arabic alef/ya/ta-marbuta and diacritics for names. - migrations/: nullable *_bidx columns plus indexes, and the missing adminUser.status/approved_by/approved_at columns that admin approvals need. - scripts/backfill_blind_index.php: restartable, batched, --dry-run capable, touches only index columns. - Admin lookups by phone/email now match the index, keeping the old ciphertext comparison in the same query so search keeps working until the backfill runs. bootstrap exposes $blindIndex as null when no pepper is configured. Also: AdminCaptain/getCaptainDetailsById.php selected driver.education, a column absent from this schema. The PDOException was uncaught, so the client received an empty body with HTTP 200 — the "non-JSON response" seen when opening a captain. It now omits the column, catches the error, reports it as JSON, and requires an admin role. Console: opening any sidebar section refetches its data instead of showing what was loaded when the console started. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
72 lines
2.2 KiB
PHP
72 lines
2.2 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../connect.php';
|
|
|
|
$phone = filterRequest("phone");
|
|
|
|
if (empty($phone)) {
|
|
jsonError("Phone number is required.");
|
|
exit;
|
|
}
|
|
|
|
try {
|
|
/**
|
|
* البحث عبر الفهرس الأعمى أولاً (phone_bidx): مطابقة تامة عبر فهرس مُهيأ
|
|
* ولا تعتمد على كون التشفير حتمياً، فتظل تعمل بعد النقل إلى AES-GCM.
|
|
*
|
|
* يُبقى المسار القديم (مقارنة النص المشفّر) كاحتياط حتى ينتهي تشغيل
|
|
* scripts/backfill_blind_index.php، وإلا لتوقّف البحث بين الترحيل والتعبئة.
|
|
*/
|
|
global $blindIndex;
|
|
$driver = null;
|
|
|
|
if ($blindIndex) {
|
|
$bidx = $blindIndex->index('driver.phone', $phone);
|
|
if ($bidx) {
|
|
$stmt = $con->prepare("SELECT * FROM driver WHERE phone_bidx = :bidx LIMIT 1");
|
|
$stmt->execute([':bidx' => $bidx]);
|
|
$driver = $stmt->fetch(PDO::FETCH_ASSOC) ?: null;
|
|
}
|
|
}
|
|
|
|
if (!$driver) {
|
|
$encPhone = $encryptionHelper->encryptData($phone);
|
|
$stmt = $con->prepare("SELECT * FROM driver WHERE phone = :phone LIMIT 1");
|
|
$stmt->execute([':phone' => $encPhone]);
|
|
}
|
|
|
|
if (!$driver) {
|
|
$driver = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
}
|
|
|
|
if ($driver) {
|
|
// ✅ الحقول المشفرة اللي لازم تنفك:
|
|
$encryptedFields = [
|
|
'phone',
|
|
'email',
|
|
'first_name',
|
|
'last_name',
|
|
'national_number',
|
|
'address','gender','site',
|
|
'birthdate',
|
|
'name_arabic',
|
|
];
|
|
|
|
foreach ($encryptedFields as $field) {
|
|
if (!empty($driver[$field])) {
|
|
$driver[$field] = $encryptionHelper->decryptData($driver[$field]);
|
|
}
|
|
}
|
|
|
|
// ❌ احذف كلمة المرور من النتيجة
|
|
unset($driver['password']);
|
|
|
|
jsonSuccess($driver);
|
|
|
|
} else {
|
|
jsonError("No driver found with this phone.");
|
|
}
|
|
|
|
} catch (PDOException $e) {
|
|
error_log("[find_driver_by_phone.php] " . $e->getMessage());
|
|
jsonError("An internal error occurred. Please try again later.");
|
|
} |