Hamza-AyedandClaude Opus 5
db4ca7dd7a
Hotfix: a comment added to the dashboard SQL contained double quotes inside
the double-quoted PHP string, terminating it and making dashbord.php fail to
parse. Production was returning a parse error for every dashboard request.
Authorisation gaps closed — connect.php only proves a token is valid, it does
not check what the caller is allowed to do:
- Admin/ggg.php decrypts any database field and was authorised solely by an
admin phone number sent in the request body. Anyone who knew a listed
number could decrypt platform data without signing in. It now runs behind
connect.php, requires super_admin, keeps the phone list as a second factor,
and records every use.
- ride/kazan/update.php, kazan/add.php and ride/promo/{add,update,delete}.php
changed live pricing and discount codes with no role check at all, so any
valid token — including a driver's or passenger's — could rewrite the fare
table. All now require super_admin.
Staff/pending.php: adminUser has no `status` column in this deployment, so
the query failed with an opaque "unavailable". It now checks for the column
and reports the actual reason.
Console: Kazan tariff editor for super admins — sends only changed fields,
shows an old → new confirmation before saving, and stays read-only with an
explanatory notice for plain admins.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
52 lines
1.4 KiB
PHP
52 lines
1.4 KiB
PHP
<?php
|
|
require_once __DIR__ . '/../../connect.php';
|
|
|
|
// حارس الصلاحيات: هذه النقطة تعدّل التسعير/الأكواد الترويجية على الإنتاج.
|
|
// connect.php يتحقق من صحة التوكن فقط، لذا بدون هذا الفحص كان أي توكن صالح
|
|
// (سائق أو راكب) قادراً على تعديلها.
|
|
if ($role !== 'super_admin') {
|
|
http_response_code(403);
|
|
echo json_encode([
|
|
'status' => 'failure',
|
|
'message' => 'Forbidden. Super Admin access required.',
|
|
]);
|
|
exit;
|
|
}
|
|
|
|
$id = filterRequest("id");
|
|
if (empty($id)) {
|
|
jsonError("ID is required for update");
|
|
exit;
|
|
}
|
|
|
|
$allowedFields = [
|
|
"promo_code", "amount", "description", "passengerID",
|
|
"validity_start_date", "validity_end_date"
|
|
];
|
|
|
|
$setParts = [];
|
|
$params = [];
|
|
|
|
foreach ($allowedFields as $field) {
|
|
if (isset($_POST[$field])) {
|
|
$value = filterRequest($field);
|
|
$setParts[] = "`$field` = :$field";
|
|
$params[":$field"] = $value;
|
|
}
|
|
}
|
|
|
|
if (empty($setParts)) {
|
|
jsonError("No valid fields to update.");
|
|
exit;
|
|
}
|
|
|
|
$sql = "UPDATE `promos` SET " . implode(", ", $setParts) . " WHERE `id` = :id";
|
|
$params[":id"] = $id;
|
|
|
|
$stmt = $con->prepare($sql);
|
|
if ($stmt->execute($params)) {
|
|
jsonSuccess(null, "Promo updated successfully");
|
|
} else {
|
|
jsonError("Failed to update promo");
|
|
}
|
|
?>
|