Hamza-AyedandClaude Opus 5
db4ca7dd7a
Hotfix: a comment added to the dashboard SQL contained double quotes inside
the double-quoted PHP string, terminating it and making dashbord.php fail to
parse. Production was returning a parse error for every dashboard request.
Authorisation gaps closed — connect.php only proves a token is valid, it does
not check what the caller is allowed to do:
- Admin/ggg.php decrypts any database field and was authorised solely by an
admin phone number sent in the request body. Anyone who knew a listed
number could decrypt platform data without signing in. It now runs behind
connect.php, requires super_admin, keeps the phone list as a second factor,
and records every use.
- ride/kazan/update.php, kazan/add.php and ride/promo/{add,update,delete}.php
changed live pricing and discount codes with no role check at all, so any
valid token — including a driver's or passenger's — could rewrite the fare
table. All now require super_admin.
Staff/pending.php: adminUser has no `status` column in this deployment, so
the query failed with an opaque "unavailable". It now checks for the column
and reports the actual reason.
Console: Kazan tariff editor for super admins — sends only changed fields,
shows an old → new confirmation before saving, and stays read-only with an
explanatory notice for plain admins.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
95 lines
4.0 KiB
PHP
95 lines
4.0 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../connect.php';
|
|
|
|
// حارس الصلاحيات: هذه النقطة تعدّل التسعير/الأكواد الترويجية على الإنتاج.
|
|
// connect.php يتحقق من صحة التوكن فقط، لذا بدون هذا الفحص كان أي توكن صالح
|
|
// (سائق أو راكب) قادراً على تعديلها.
|
|
if ($role !== 'super_admin') {
|
|
http_response_code(403);
|
|
echo json_encode([
|
|
'status' => 'failure',
|
|
'message' => 'Forbidden. Super Admin access required.',
|
|
]);
|
|
exit;
|
|
}
|
|
|
|
$kazanPercent = filterRequest("kazanPercent") ?: filterRequest("kazan");
|
|
$adminId = filterRequest("adminId");
|
|
$fuelPrice = filterRequest("fuelPrice");
|
|
$currency = filterRequest("currency") ?: 'SYP';
|
|
$speedPrice = filterRequest("speedPrice");
|
|
$comfortPrice = filterRequest("comfortPrice");
|
|
$ladyPrice = filterRequest("ladyPrice");
|
|
$electricPrice = filterRequest("electricPrice");
|
|
$vanPrice = filterRequest("vanPrice");
|
|
$deliveryPrice = filterRequest("deliveryPrice");
|
|
$mishwarVipPrice = filterRequest("mishwarVipPrice");
|
|
$fixedPrice = filterRequest("fixedPrice");
|
|
$awfarPrice = filterRequest("awfarPrice");
|
|
$normalMinPrice = filterRequest("normalMinPrice");
|
|
$peakMinPrice = filterRequest("peakMinPrice");
|
|
$lateMinPrice = filterRequest("lateMinPrice") ?: filterRequest("latePrice");
|
|
$naturePrice = filterRequest("naturePrice");
|
|
$heavyPrice = filterRequest("heavyPrice");
|
|
$freePrice = filterRequest("freePrice");
|
|
$country = filterRequest("country");
|
|
|
|
$sql = "INSERT INTO `kazan`
|
|
(`country`, `kazanPercent`, `fuelPrice`, `currency`,
|
|
`speedPrice`, `comfortPrice`, `ladyPrice`, `electricPrice`, `vanPrice`,
|
|
`deliveryPrice`, `mishwarVipPrice`, `fixedPrice`, `awfarPrice`,
|
|
`normalMinPrice`, `peakMinPrice`, `lateMinPrice`,
|
|
`adminId`)
|
|
VALUES
|
|
(:country, :kazanPercent, :fuelPrice, :currency,
|
|
:speedPrice, :comfortPrice, :ladyPrice, :electricPrice, :vanPrice,
|
|
:deliveryPrice, :mishwarVipPrice, :fixedPrice, :awfarPrice,
|
|
:normalMinPrice, :peakMinPrice, :lateMinPrice,
|
|
:adminId)
|
|
ON DUPLICATE KEY UPDATE
|
|
`kazanPercent` = VALUES(`kazanPercent`),
|
|
`fuelPrice` = VALUES(`fuelPrice`),
|
|
`currency` = VALUES(`currency`),
|
|
`speedPrice` = VALUES(`speedPrice`),
|
|
`comfortPrice` = VALUES(`comfortPrice`),
|
|
`ladyPrice` = VALUES(`ladyPrice`),
|
|
`electricPrice` = VALUES(`electricPrice`),
|
|
`vanPrice` = VALUES(`vanPrice`),
|
|
`deliveryPrice` = VALUES(`deliveryPrice`),
|
|
`mishwarVipPrice` = VALUES(`mishwarVipPrice`),
|
|
`fixedPrice` = VALUES(`fixedPrice`),
|
|
`awfarPrice` = VALUES(`awfarPrice`),
|
|
`normalMinPrice` = VALUES(`normalMinPrice`),
|
|
`peakMinPrice` = VALUES(`peakMinPrice`),
|
|
`lateMinPrice` = VALUES(`lateMinPrice`),
|
|
`adminId` = VALUES(`adminId`)";
|
|
|
|
$stmt = $con->prepare($sql);
|
|
|
|
$stmt->bindParam(':kazanPercent', $kazanPercent);
|
|
$stmt->bindParam(':adminId', $adminId);
|
|
$stmt->bindParam(':fuelPrice', $fuelPrice);
|
|
$stmt->bindParam(':currency', $currency);
|
|
$stmt->bindParam(':speedPrice', $speedPrice);
|
|
$stmt->bindParam(':comfortPrice', $comfortPrice);
|
|
$stmt->bindParam(':ladyPrice', $ladyPrice);
|
|
$stmt->bindParam(':electricPrice', $electricPrice);
|
|
$stmt->bindParam(':vanPrice', $vanPrice);
|
|
$stmt->bindParam(':deliveryPrice', $deliveryPrice);
|
|
$stmt->bindParam(':mishwarVipPrice', $mishwarVipPrice);
|
|
$stmt->bindParam(':fixedPrice', $fixedPrice);
|
|
$stmt->bindParam(':awfarPrice', $awfarPrice);
|
|
$stmt->bindParam(':normalMinPrice', $normalMinPrice);
|
|
$stmt->bindParam(':peakMinPrice', $peakMinPrice);
|
|
$stmt->bindParam(':lateMinPrice', $lateMinPrice);
|
|
$stmt->bindParam(':country', $country);
|
|
|
|
if ($stmt->execute()) {
|
|
jsonSuccess(null, "Kazan saved successfully");
|
|
} else {
|
|
jsonError("Failed to save Kazan");
|
|
}
|
|
|
|
$stmt->close();
|
|
?>
|